Privacy Policy

At Kerpak, we believe shopping should be simple, convenient, and private.

We collect only the personal information necessary to provide and improve our services. We do not sell personal data, collect information from third-party data brokers, or require unnecessary personal details.

This Privacy Policy explains what information we collect, how we use it, and how we protect your privacy when you use Kerpak's mobile applications, web applications, and smart retail solutions.

1. Who We Are

Kerpak is a technology platform that enables self-service shopping through smart fridges, vending machines, micromarkets, and other unattended retail solutions.

The Kerpak platform is operated by SRT International Ltd., a company registered in Cyprus (registration no. HE416588), trading as Kerpak.

Kerpak provides the technology that enables customers to access products, complete transactions, and manage their shopping experience.

Products are sold by independent merchants and retail operators. These merchants are responsible for the products they sell and may have their own privacy policies.

Kerpak is the data controller for the processing described in this Privacy Policy, including camera and video processing at Kerpak-powered locations. This means Kerpak decides how and why this information is used and is responsible for it. Merchants receive the transaction information they need to sell products, issue refunds and keep accounting records, and they are responsible for their own use of that information.

2. Information We Collect

We follow a simple principle: collect only what is needed to provide the service.

Mobile Application

When you register for the Kerpak mobile application, we ask for:

• Mobile phone number (required): Used to create and authenticate your account and provide essential service communications.
• Email address (optional): Used for receipts, notifications, or communications you choose to receive. You can unsubscribe from optional communications at any time.
• Name and address (optional): Used only when you choose to provide them for features or services that require this information.

You can use the mobile application without providing optional information.

Device Permissions

The app asks for device permissions only when a feature needs them. You can turn optional permissions off at any time in your device settings:

• Camera: Used to scan the QR code on a kiosk or micromarket and barcodes of the products.
• Location (optional): Used to show Kerpak locations near you.
• Bluetooth (optional): Used to connect to a kiosk near you if the kiosk has no connection.
• Push notifications (optional): Used to send service notifications. If you enable them, we store a device token that allows us to deliver notifications to your device.

Web Application

Our web-based shopping service does not require account registration. We process only the information necessary to manage your shopping session, complete your transaction, and provide requested services.

Shopping and Transaction Information

When you make a purchase, we may process limited transaction information, including:

• products purchased and transaction amounts;
• transaction date, time, and kiosk location;
• transaction status and payment confirmation;
• payment tokens and transaction identifiers; and
• information needed to provide receipts, customer support, or resolve transaction issues.

We do not collect personal information about customers from third-party data brokers or use external sources to enrich customer profiles.

Technical and Performance Information

Our website and mobile applications may collect limited technical, analytics, and performance information necessary to monitor product stability, diagnose problems, understand technical performance, and improve the reliability of our services. We do not use this information to build advertising profiles.

Support Communications

If you contact us, we process the information you provide, such as your contact details, the content of your message, and related transaction details, to respond to you and resolve the issue.

3. Payments

Kerpak does not collect or store your full payment card details, such as your complete card number or card security code.

Sensitive payment information is collected and processed by independent, PCI DSS-compliant payment service providers, such as Stripe.

Kerpak may retain a payment token supplied by the payment provider. A payment token is a technical reference that allows Kerpak to initiate or manage authorized transactions without storing the underlying card details.

Kerpak may also receive information necessary to confirm and manage transactions, such as payment status, transaction identifiers, amounts, and limited payment-related information supplied by the payment provider.

Payment providers may independently process additional information to comply with payment regulations, prevent fraud, and provide their services. Their processing is governed by their own privacy policies and applicable law.

4. Cameras and Computer Vision

Some Kerpak-powered retail locations use cameras and computer vision technology to identify products selected by customers, verify transactions, and detect transaction anomalies.

Live Video Processing

Cameras capture video only during an active shopping session. Outside a session, the camera view is blocked and no video is recorded. During a session, video is processed automatically to:

• identify products and determine the contents of the transaction;
• detect possible transaction anomalies; and
• blur faces and other identifying details that are not needed to verify the transaction.

Kerpak does not use facial recognition or biometric identification to identify individual shoppers.

Temporary Transaction Recordings

A video recording of the shopping transaction, with faces blurred, may be temporarily retained for transaction verification, resolving discrepancies, customer support, and improving the accuracy and reliability of product recognition. Because the recording is linked to a specific transaction, it is still treated as personal information and protected accordingly.

The standard retention period for transaction videos is 30 days, after which recordings are deleted unless a particular recording needs to be retained for longer to investigate or resolve a transaction dispute, security incident, or legal requirement.

Access to retained transaction recordings is restricted to authorized personnel and service providers who require access for these purposes.

How Your Purchase Is Determined

Our system automatically determines which products you took and the amount you are charged. If you believe a charge is wrong, contact us at support@kerpaktech.com or through the app. A member of our team will review the transaction, including the recording where available, and correct any error. Please raise disputes within 30 days, while the recording is still retained.

De-Identified Footage for Model Enhancement

To enhance the precision of our product identification systems, selected footage may be retained beyond the standard 30-day window within a training dataset dedicated to our computer vision algorithms. Prior to inclusion in this dataset, video files undergo complete de-identification: all connections to transaction records, user accounts, mobile numbers, and payment details are permanently severed. We refrain from attempting to re-identify any individual in this footage, and these materials are never utilized to make individual-level determinations. Access remains strictly restricted to authorized development personnel and specialized technical providers operating under our direction. We store this footage for a maximum duration of 3 years, performing periodic evaluations to purge files that are no longer required.

This processing relies on our legitimate interest in advancing the precision, dependability, and overall quality of our smart retail services. Because these video records are fully disassociated from your account details, locating specific footage upon request to fulfill privacy rights may not be feasible without explicit contextual references provided by you. You retain the right to object to this processing at any time through the procedures outlined in Section 8.

5. How We Use Information

We use personal information only for legitimate service-related purposes, including:

• Providing our services: Creating accounts, authenticating users, enabling shopping sessions, and managing transactions.
• Customer support: Responding to questions and resolving transaction issues.
• Security and reliability: Preventing misuse, investigating errors or transaction anomalies, and maintaining the platform.
• Service improvement: Improving product recognition, transaction accuracy, stability, and platform performance.
• Legal compliance: Meeting applicable legal, accounting, and regulatory obligations.

Under the GDPR, we rely on the following legal bases:

• Performance of our contract with you: Creating and managing your account, enabling shopping sessions, using cameras to determine the contents of your purchase, processing payments, issuing receipts, and handling support requests about your transactions.
• Our legitimate interests: Detecting transaction anomalies and preventing fraud and loss; using transaction recordings, within the 30-day retention period, to improve the accuracy of product recognition; keeping our services secure and stable through crash and performance monitoring; and establishing or defending legal claims. We have weighed these interests against your rights, and you can object as described in Section 8.
• Legal obligations: Keeping tax and accounting records and responding to lawful requests from public authorities.
• Consent: Analytics, optional marketing communications, and optional device permissions (location, Bluetooth, and push notifications). You may withdraw your consent at any time, without affecting processing that took place before.

We do not sell customer information or use it to create advertising profiles.

6. Sharing Information

We share information only when necessary to provide our services or meet applicable legal requirements. This may include:

• Retail merchants: Information required to manage purchases, provide customer support, resolve transactions, and keep their own sales and accounting records.
• Payment service providers: Information necessary to initiate, authorize, verify, and manage payments.
• Technology service providers: Limited information required for hosting, authentication, communications, analytics, technical support, and maintaining the stability and performance of our services. These include Google (Firebase), Twilio, AWS, TopMessage.
• Public authorities: Information that we are legally required to disclose.

Service providers processing personal data on our behalf are bound by contractual and security obligations that require them to protect it to at least the standard described in this Privacy Policy. We do not sell or rent personal information.

7. Data Storage, Retention and Security

We take appropriate technical and organizational measures to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. These measures include access controls, secure communications, and limiting access to authorized personnel and service providers.

We retain personal information only for as long as necessary to provide our services, meet legal requirements, resolve disputes, or protect legitimate interests.

Account information is normally retained while your account remains active, subject to applicable legal requirements. When you delete your account, we delete or anonymize your account information within 30 days, except for transaction records we are required to keep by law.

Transaction information is retained for the period required by the accounting, tax, and payment laws of the country where the transaction took place.

Transaction video recordings are retained for 30 days, as described in Section 4.

Technical and analytics information is retained only for as long as reasonably necessary for product stability, performance monitoring, troubleshooting, and service improvement.

Information that is no longer required is deleted or anonymized.

Our platform is hosted primarily in EU/Germany. Some service providers, including Google (Firebase) and Stripe, may process personal information outside the European Economic Area, including in the United States. Where this happens, we rely on a European Commission adequacy decision (such as the EU–US Data Privacy Framework, where the recipient is certified under it) or on Standard Contractual Clauses approved by the European Commission. You can request a copy of the relevant safeguards by contacting us.

8. Your Privacy Rights

Under applicable data protection laws, including the GDPR, you may have the right to:

• access the personal information we hold about you;
• correct inaccurate information;
• request deletion of your personal information;
• restrict certain processing activities;
• receive your personal information in a portable format, where applicable;
• withdraw consent where processing is based on consent; and
• request human review of a charge determined automatically, as described in Section 4.

To exercise your privacy rights or ask a privacy-related question, contact us at support@kerpaktech.com. We will respond within the time limits required by applicable law.

Your Right to Object

Where we process your personal information based on our legitimate interests, such as detecting transaction anomalies or using transaction recordings to improve product recognition, you have the right to object at any time on grounds relating to your particular situation. If you object, we will stop unless we have compelling legitimate grounds for the processing or need it to establish, exercise, or defend legal claims. You can object to direct marketing at any time, and we will then stop it.

Deleting Your Account

You can delete your account at any time in the app under More > Account Details > Delete account, or by emailing support@kerpaktech.com. Section 7 explains what we keep after deletion and for how long.

Armenia

If you use Kerpak in Armenia, the Law of the Republic of Armenia on Protection of Personal Data also applies. Where that law requires your consent, for example for certain transfers of personal information outside Armenia, we will ask for it. You may lodge a complaint with the Personal Data Protection Agency of the Republic of Armenia.

Gulf Cooperation Council (GCC) Countries

If you use Kerpak in a GCC country, local data protection laws also apply, such as the Personal Data Protection Law of the Kingdom of Saudi Arabia and UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. You can exercise the rights those laws give you, including the rights to be informed, to access, to correct, and to request deletion of your personal information, using the contact details in Section 12. Where local law restricts transfers of personal information outside the country, we transfer it only as that law permits. You may also complain to the competent local authority, such as the Saudi Data & AI Authority (SDAIA) in Saudi Arabia.

Other Countries

Wherever you use Kerpak, we apply this Privacy Policy and respect the rights that your local data protection law gives you.

9. Analytics and Application Services

We use Google Firebase to provide and support certain technical functions of our web and mobile applications, including application performance monitoring, crash reporting, analytics, notifications, security, and other functionality required for the reliable operation and improvement of our services.

Depending on the services used, Firebase may process limited technical information such as device and application information, technical identifiers, crash and diagnostic data, application performance information, and information about how the application is used. Twilio, AWS and TopMessage also processes your mobile phone number to send you a one-time verification code.

We use this information to operate our applications, maintain security, diagnose technical problems, understand product performance, and improve the reliability and usability of our services. We do not use Firebase for third-party behavioral advertising or to create advertising profiles.

Firebase is provided by Google. Google processes information on Kerpak's behalf under data protection agreements with Kerpak and, where information is transferred to the United States, the safeguards described in Section 7.

In the EU, and wherever else the law requires it, we collect analytics data (information about how you use our website or app) only after you consent, through the cookie banner on our website or the consent prompt in the app. Crash reports and performance data are collected without consent where the law allows, based on our legitimate interest in keeping our services secure and working. You can change your analytics choice at any time through Cookie settings on the website.

10. Changes to This Policy

We may update this Privacy Policy to reflect changes in our services, technology, or legal requirements. The latest version will always be available on our website. Where required by law, we will provide additional notice of material changes.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact: