Bulka privacy policy

Data we use

To register customers and service orders, Bulka processes the customer’s name, phone number, optional profile and email information, delivery addresses, the geolocation of a selected point, order history, payment contents and amounts, refunds, bonus transactions, selected language and technical push-notification identifiers.

For card payments, Bulka may receive the operation result, payment network, last four card digits, expiry month and year, authorisation code and transaction identifier. If the customer expressly agrees to save the card, Bulka also receives a ForteBank token, encrypts it and links it to the profile for future purchases. The full card number and CVC/CVV are not received or stored by Bulka.

Why the data is needed

Data is used for authorisation, placing and paying for orders, issuing and delivering merchant receipts, refunds, courier delivery, the bonus programme, order-status notifications, customer support, fraud prevention and service improvement. We do not sell personal data.

Recipients of data

Disclosure is limited to what is required for the selected function:

• Kaspi Pay — creating and verifying payments and issuing refunds through the original payment channel;
• ForteBank JSC — processing card payments, Google Pay, 3‑D Secure, saved-card tokenisation and card refunds;
• Yandex Delivery — the name, phone number, address, route and order information required by the courier;
• Firebase — delivery of push notifications;
• WhatsApp/Meta — delivery of messages, one-time codes and notifications when the customer selects this channel;
• mapping and geocoding services — finding an address selected by the user and checking the delivery area;
• iiko — order contents, branch and loyalty-programme operations;
• AI providers Google Gemini, Alibaba Cloud/Qwen and DeepSeek — processing text that a user or employee deliberately submits to an AI feature. Bulka limits the data sent and removes direct identifiers where practicable.

Do not submit payment credentials, passwords, medical information or other sensitive data to AI features. Processing by WhatsApp/Meta and AI providers may involve cross-border transfers under their terms and privacy policies.

Retention and security

The profile and operational data are retained while the account is active or as required to provide service. Documents concerning orders, payments, refunds and merchant receipts may be retained for at least five years for accounting, performance of the bank agreement, claims and legal requirements, including after account deletion; the profile is anonymised where permitted.

Administrator access is logged, connections use HTTPS and card details are entered only in the bank’s protected widget. A saved-card token is encrypted with a separate key and does not reveal the full card number or CVC/CVV.