Data controller
The controller of personal data processing and the operator of the LOKACIA platform is Private Company Arvo Labs Limited, BIN 260640900744, Republic of Kazakhstan, Astana, Yesil district, Al-Farabi Avenue, 21/1, apt. 5, postal code Z05T2K5. Contact: hello@lokacia.kz.
1. What data we collect
When you use LOKACIA.KZ, we may collect the following data:
- •Personal data: name, email, phone number, avatar
- •Host business verification data: BIN, legal name and entity type; payout details and a bank account certificate (shared with the payment partner PayLink)
- •Booking data: dates, amounts, interaction history
- •Company data: BIN, name, registered address (for B2B invoices)
- •Technical data: IP address, browser type, cookies
- •Correspondence: messages between hosts and renters via the built-in chat
2. How we use data
The collected data is used for:
- •Providing platform services: registration, booking, payment
- •Checking hosts' business registration by BIN and ensuring security
- •Notifications: booking confirmations, new messages, status changes
- •Improving the service: analytics, optimisation, bug fixing
- •Generating PDF invoices and acts for B2B clients
- •Resolving disputes between platform participants
3. Data storage
The main user database is hosted on our own (self-hosted) server located in the Republic of Kazakhstan; the personal data of the main database is stored in Kazakhstan. Access to the database is restricted. Data in transit is protected by encryption (TLS), data at rest by server-level encryption. Verification documents are kept in secure storage with restricted access. Data is stored for the entire lifetime of the account and for 12 months after its deletion (for accounting and dispute resolution purposes). Backups are created regularly and stored securely.
4. Cookies
We use cookies for authentication (Supabase session cookies), remembering language preferences and collecting analytics. You can disable cookies in your browser settings, but this may limit the functionality of the service (for example, you may need to sign in again on every visit).
5. Sharing data with third parties
We do not sell or share your personal data with third parties, except in the following cases:
- •Payment providers — to process transactions
- •Hosts/renters — contact details after a booking is confirmed
- •Government authorities — upon request in accordance with the laws of the Republic of Kazakhstan
- •Email provider (Resend, USA) — to deliver emails and notifications
Cross-border data transfer
The main database is located in Kazakhstan, but certain technical vendors that keep the service running may be located outside the Republic of Kazakhstan. In particular, the email service Resend (USA) receives your email address and the content of the email being sent (for example, a registration or booking confirmation) solely to deliver that email. Only the minimum necessary data is transferred; Resend does not use this data for its own purposes. Such a transfer is made on the basis of your separate, non-pre-ticked consent, which is requested at registration via a separate checkbox.
- •Data categories: email address and the content of the service email
- •Purpose: delivery of service email notifications
- •Vendor category: foreign technology vendors (email delivery)
- •Minimisation: only the minimum necessary data is transferred
- •Right to withdraw: consent can be withdrawn in the account settings ("Consents") or via support
- •Consequences of withdrawal: some service email notifications may become unavailable; the account is not deleted or blocked
Operator: Private Company Arvo Labs Limited. The contact for enquiries is given above in the "Data controller" section.
The specific country of processing is not asserted until a confirmed legal source is available.
6. Your rights
You have the right to:
- •Request a copy of all your data stored on the Platform
- •Request correction of inaccurate data
- •Request deletion of your account and all related data
- •Withdraw consent to data processing (this will terminate the account)
- •File a complaint with the authorised personal data protection body of the Republic of Kazakhstan
7. Security
We take reasonable technical and organisational measures to protect your data: encryption in transit and at rest, restricted employee access, regular security audits, two-factor authentication for administrative access.
8. Changes to the policy
We may update this Policy. You will be notified of material changes by email. The current version is always available on this page.