Privacy Policy

1. General Provisions

This Privacy Policy and Personal Data Processing Notice (the "Policy") defines how personal data of users of the Taler mobile application, web services, and other Taler services (collectively, the "Service") is processed and protected.

Personal data controller:

• Vavavasa LLC;
• UNP: 791440344;
• Address: office 104, 4a Tani Karpinskoy st, Mogilev 212030, Republic of Belarus;
• Email for personal data matters: support@taler.discount;
• Support email: support@taler.discount;
• Website: https://талер.бел.

The Policy is drafted with due regard to applicable legislation of the Republic of Belarus and Apple App Store / Google Play requirements for disclosing data processing practices.

2. Key Terms

Personal Data means information relating to an identified or identifiable natural person.

Administrator / Personal Data Controller means Vavavasa LLC, the owner of the Taler Platform (Service) and the personal data controller.

Platform / Service means the Taler software and infrastructure and related functionality.

App means the Taler mobile and/or web application used to access the Service.

User means any person using the Service, including a Client and a Store.

Client (CLIENT) means a User purchasing goods or services via the Service.

Store / Seller / VENDOR means an entity using the Service to publish and sell offers.

Regulatory Documents means this Policy, the Terms, policies, rules, and other Taler documents governing use of the Service, including the Privacy Policy and Personal Data Processing Notice.

3. Data We Process

3.1. Account and Contact Data

• user identifier;
• first and last name (if provided by the user);
• email address (if provided by the user);
• phone number (if provided by the user);
• date of birth (if provided by the user);
• country and city (if provided by the user);
• profile photo (if provided by the user);
• account role and status;
• account creation date.

3.2. Store Data (for VENDOR)

• legal entity name;
• registration/tax details;
• licenses and permits;
• store name and description;
• address, city, country;
• contact phone number;
• bank details;
• photos and logo (if provided by the user);
• coordinates and opening hours;
• goods/offer details;
• data required for verification and moderation.

3.3. Order and Transaction Data

• order identifier;
• goods/service details;
• store reference;
• price, discount, and status;
• order date/time;
• offer validity period;
• QR-code issuance and redemption details;
• refund/cancellation details.

3.4. Payment Data

Payments are processed through Alfa-Bank infrastructure.

Taler does not receive or store full bank card numbers or CVV codes.

We may receive from the payment provider: amount, status, transaction identifier, and technical payment metadata.

3.5. User Content

• reviews, ratings, comments;
• photos (including profile photos);
• messages sent with gifts;
• support requests.

3.6. Social Features Data

• user subscriptions/follows;
• favorite stores;
• personal subscription QR code;
• profile visibility settings and (if enabled) purchase history data.

3.7. Geolocation

The application may request geolocation access to:

• show nearby stores;
• find offers nearby;
• display objects on a map.

A user's current geolocation is not intended for persistent server-side storage. Store coordinates may be stored.

3.8. Technical Data, Analytics, and Diagnostics

• device and OS data;
• application version;
• technical identifiers;
• feature usage events;
• error, crash, and performance data.

4. Processing Purposes

• registration, identification, and authentication;
• order fulfillment and payment processing;
• displaying stores, offers, and maps;
• operating social features;
• content moderation and abuse prevention;
• user support and error diagnostics;
• analytics and service improvement;
• compliance with legal requirements;
• generation of anonymized statistics.

We limit personal data processing to the stated purposes and do not sell users' personal data.

5. Legal Bases

Personal data is processed on the basis of:

• user consent (where required);
• necessity to perform a contract/user agreement;
• fulfillment of legal obligations;
• controller's legitimate interest, subject to data subject rights.

Consent may be provided through Service interfaces (including separate checkboxes for marketing communications) and may be withdrawn at any time via profile settings, the "Unsubscribe" link, device push settings, and/or email. Withdrawal applies prospectively and does not affect the lawfulness of processing performed before withdrawal.

6. Apple ATT, IDFA and Tracking

For iOS, Taler follows App Tracking Transparency (ATT) requirements.

• If scenarios falling under Apple's tracking definition are enabled, the app requests ATT permission.
• Without user permission, we do not use IDFA for cross-service/cross-app tracking.
• Declining ATT does not block core Service functionality.
• Users can change their decision in iOS settings.

If tracking is not used in a release version, corresponding App Store Connect fields are set to "No".

7. App Store Connect Data Categories (Linked / Not Linked)

For App Store Connect disclosure purposes:

• account, contact, order, content, and geolocation data are generally considered Linked to User;
• some analytics and diagnostics may be processed in aggregated or anonymized form (Not Linked) where user identification is not required;
• data use for tracking is declared separately and only when such scenarios are actually used.

8. Google Play User Data and Data Safety Requirements

Taler complies with Google Play requirements regarding collection, use, transfer, and protection of user data.

For Google Play publication, the Data safety section declares:

• which data categories are collected;
• whether data is shared with third parties;
• whether data is used for analytics, app functionality, personalization, fraud prevention, and/or advertising;
• whether security measures are applied (for example, encryption in transit);
• whether account and data deletion is available.

We:

1. collect only data necessary for declared Service features;
2. disclose actually collected data categories in this Policy;
3. do not use data for incompatible purposes;
4. do not sell users' personal data;
5. limit data access on a need-to-know basis;
6. require contractors to apply comparable data protection measures.

Taler keeps Data safety information up to date and commits to updating it if functionality or data processing practices change.

9. Android Permissions and Device Data Disclosure

The app may request only permissions necessary for specific user scenarios.

For each sensitive permission, the purpose is disclosed:

• Geolocation — finding nearby stores and showing them on a map;
• Camera/photos (if applicable) — uploading profile photos, reviews, and other user content;
• Notifications (if applicable) — informing users about order statuses, gifts, and other events;
• Phone/contacts/SMS (if applicable) — only where explicitly required by a feature and to the extent needed for its operation.

If a user denies permission, the corresponding feature may be limited, while core Service functionality remains available to the maximum extent possible.

10. Sensitive Data and Consent

If the Service processes sensitive categories of data (including precise geolocation, financial information, user photos/content, and other data subject to platform requirements), such processing is performed:

1. on a valid legal basis;
2. with transparent notice of processing purposes;
3. only to the extent required for a specific feature;
4. with safeguards proportionate to processing risks.

Where platform rules or law require it, separate user consent is requested before processing starts.

11. Third-Party Providers and Processors

The Service may use:

• Firebase Authentication;
• Firebase Analytics;
• Firebase Crashlytics;
• Firebase Storage;
• Firebase Performance Monitoring;
• AppsFlyer (marketing attribution/analytics, where required consents are in place);
• Alfa-Bank (payment acquiring);
• MTS Belarus (SMS verification);
• mapping service providers (including OSM tiles and/or other providers);
• infrastructure, email, and support providers.

Taler does not sell personal data.

Data transfer is possible only as necessary for:

• order and payment processing;
• mapping and communication features;
• analytics, diagnostics, and technical support;
• legal compliance and protection of controller/user rights.

Third parties act:

• either as independent controllers within their responsibility;
• or as processors acting on behalf of Taler.

Taler concludes required contractual arrangements and applies oversight measures regarding contractors' data processing.

12. Cross-Border Data Transfer

When international providers are used, data may be processed outside the Republic of Belarus.

In such cases, legal safeguards and contractual guarantees provided by applicable law are applied.

13. Data Retention

Data is retained no longer than necessary for processing purposes and/or periods established by law.

Retention categories and periods:

• account data: until deletion + 1 month;
• orders/payments/accounting data: as required by law;
• analytics and diagnostics: 3 years;
• backups and logs: 1 year.

Upon expiry of retention periods, data is deleted or irreversibly anonymized.

14. Account Deletion

Users can initiate account deletion in the App: Profile → Delete account.

Users can request deletion of the account and related personal data directly in the App and via support contact channels (if applicable).

After a request:

1. the account is moved to deletion status;
2. restoration is possible within 30 (thirty) calendar days — to restore, sign in to the app and confirm your intention to recover the account (if provided by functionality);
3. after the 30-day restoration window expires, recovery is no longer possible: data is deleted or anonymized, and the Firebase Authentication record is also permanently deleted;
4. certain financial/legal accounting data may be retained to the extent required by law.

Deletion request fulfillment period: 30 days.

Deletion request channel: in-app path (Profile → Delete account) and/or email: support@taler.discount.

15. User Rights

Users are entitled to:

• receive information about their data and processing;
• request correction of inaccurate/incomplete data;
• withdraw consent (where processing is consent-based);
• request deletion/restriction of processing where permitted by law;
• request a copy of data in a structured format (if applicable);
• lodge a complaint with a competent authority.
• Data portability: request an export of their personal data in a machine-readable format (JSON or CSV) to the extent technically available at the time of the request.

Requests are submitted to: support@taler.discount.

To process a request, the Controller may reasonably ask for information necessary to verify the applicant's identity. A response is generally provided within 15 calendar days from receipt, unless another period is required by law; where objectively necessary, this period may be extended with user notification.

Supervisory authority / Dispute resolution. Users who believe that the processing of their personal data infringes applicable law have the right to lodge a complaint with the competent personal data supervisory authority. In the Republic of Belarus, supervisory functions in this area are performed by the National Centre for Personal Data Protection (NCPDP): address and contact details — 220004, Minsk, K. Tsetkin st. 24-3, phone +375 (17) 367-07-90. If a user resides in an EEA or EU member state, they may also contact the competent supervisory authority in their country of residence.

Before filing with a supervisory authority, a user may contact the Controller for pre-trial resolution. This does not limit the user's right to file a complaint with a supervisory authority or to seek judicial protection.

16. Public Content and User Interactions

Users independently control certain visibility settings in social features.

Default profile visibility. New accounts are set to private by default. Purchase history is not visible to other users until the user actively enables public sharing in their profile settings.

Users are advised not to publish data they do not want disclosed. Taler may limit or remove content that violates law, third-party rights, or Service rules.

17. Data Security

Taler applies technical and organizational safeguards, including:

• access controls;
• encryption in transit (HTTPS/TLS);
• encryption at rest where technically applicable and supported by the underlying infrastructure;
• incident logging and monitoring;
• security incident monitoring and response;
• security incident response procedures;
• internal staff access control procedures;
• regular review of protection practices.

Despite implemented measures, absolute security of Internet data transmission cannot be guaranteed.

18. Minors

The Service is intended for users aged 16+.

If a minor's data has been provided without proper legal basis, please contact us: support@taler.discount.

19. Policy Updates

Taler may update this Policy due to changes in law, functionality, or technologies.

The current version is published at: https://талер.бел/privacy-policy. In case of material changes, users may also be notified through the app and/or other channels.

20. Contacts

Vavavasa LLC

UNP: 791440344

Address: office 104, 4a Tani Karpinskoy st, Mogilev 212030

Email for personal data matters: support@taler.discount

Support email: support@taler.discount

Website: https://талер.бел

21. Third-Party Provider Privacy Policies

You can review our providers' privacy policies at:

• Google / Firebase — policies.google.com/privacy.
• AppsFlyer — appsflyer.com/legal/services-privacy-policy.
• OpenStreetMap Foundation — osmfoundation.org/wiki/Privacy_Policy.
• Alfa-Bank (payment acquiring) — data processing rules are available on the bank's website and in the acquiring agreement.
• MTS Belarus (SMS verification) — data processing rules are available on the operator's website and in the telecom service agreement.

22. Cookies and Tracking Technologies

The web version of the Service and the SDKs used in the mobile app may employ cookies and similar technologies.

22.1. Essential cookies

Required for Service operation: authentication session storage, CSRF protection, load balancing. Disabling essential cookies is not possible without losing core functionality.

22.2. Analytics cookies and SDKs

• Firebase Analytics — collects aggregated statistics on app feature usage.
• AppsFlyer — install and marketing campaign attribution (used where required consents and/or ATT permission on iOS are in place).

Analytics cookies are not used to serve personalised advertising without a separate user consent.

22.3. Managing preferences and opting out

• In a web browser: use your browser settings to restrict or delete cookies. Instructions are available in your browser's help documentation.
• In the iOS app: change ATT permission under Settings → Privacy & Security → Tracking.
• In the Android app: use the ad personalisation settings in Google Settings on your device.
• Opting out of analytics cookies does not affect access to core Service features.

Note: essential cookies cannot be disabled because they are required for the secure operation of the Service.

23. Marketing and Push Notifications

Taler does not send marketing messages without prior user consent.

• Opt-in: consent to receive marketing emails and/or push notifications is requested separately at registration or in profile settings.
• Transactional notifications (order confirmation, payment status, offer expiry reminder) may be sent without separate marketing consent as they are necessary for contract performance.
• Unsubscribing from marketing emails: click the "Unsubscribe" link at the bottom of any marketing email, or update notification preferences in the app profile settings.
• Disabling push notifications: on iOS — Settings → Notifications → Taler; on Android — Settings → Apps → Taler → Notifications. Disabling push does not affect in-app notifications.

Withdrawing consent to marketing communications is not a basis for restricting access to the Service.

After receiving an opt-out request, Taler stops the respective marketing messages within a reasonable period, usually no later than 10 business days, except for mandatory service notifications.

24. Referral and Gift Feature Data

Taler provides referral programme and gift-sending features.

24.1. Referral codes

• A user's referral code is generated automatically and linked to their account.
• When a referral code is used, the event is recorded and retained as part of the account's transaction history.

24.2. Gift tokens and recipient contact data

• When sending a gift to another user, the sender may provide the recipient's phone number or email address solely to deliver the gift token.
• The recipient's contact data is used only for the one-time gift delivery and is not added to marketing lists without the recipient's separate consent.
• If the recipient is not a registered Taler user, their contact data is stored only for the duration of the gift token's validity period.

24.3. Unclaimed gifts

• If a gift token is not activated by the recipient within its validity period, the token is cancelled.
• The recipient's contact data is deleted upon expiry of the token's validity period, unless further retention is required for dispute resolution or legal compliance.
• The sender may be notified when an unclaimed gift token expires.