Consent to Personal Data Processing

QRush.delivery · Last updated: October 26, 2026

1. Who gives consent and to whom

By ticking the consent box when signing up for the QRush website and mobile app (the "Service"), I freely and for my own benefit consent to the processing of my personal data on the terms below.

The data controller receiving this consent is QRush.delivery (Sole Proprietor Andrei Kulachenko, Russian Federation, registered with the Russian data protection authority under No. 77-26-574250).

This consent is a separate document and is not part of the Privacy Notice or the Terms of Service.

2. Purposes

• creating and maintaining my account and signing in;
• for guests: linking the account to my hotel stay, passing my orders and requests to the hotel, order status notifications, reviews and ratings;
• for hotel staff: working in the hotel workspace - receiving and completing guest orders, order notifications;
• answering my requests and keeping the Service secure.

3. Data

• name, email address, password (stored only as a hash);
• profile photo, if I upload one, so that staff or guests can recognise me; it is not used for identification;
• for guests: room number and dates of stay, orders and requests, delivery place, comments, ratings and tips;
• for staff: hotel, position, completed orders and ratings;
• technical data: device information, push notification identifier, activity log, IP address.

No special categories of data and no biometric data are processed.

4. What is done with the data

Collection, recording, organisation, storage, updating, retrieval, use, transfer (provision, access), blocking, deletion and destruction, with and without automated means. The data is stored on a server in the Russian Federation.

5. Who receives the data

• the hotel where I stay or work, to the extent needed to fulfil orders and for work; the hotel processes it as an independent controller;
• if the hotel is located outside the Russian Federation, the data needed for my orders is transferred to the hotel's country;
• push notifications are delivered via Apple Push Notification service (Apple Inc.) and Firebase Cloud Messaging (Google LLC), whose servers are in the USA; they receive the device identifier and the notification text, without my name, phone or email.

I consent to these transfers, including cross-border transfers. The data is not sold or shared for advertising.

6. Duration and withdrawal

This consent is valid from sign-up until the account is deleted or consent is withdrawn, but no longer than three years after my last sign-in.

I can withdraw consent at any time by deleting the account in the app (Profile → "Delete account") or by writing to privacy@qrush.delivery. The data is then destroyed within 10 business days unless the law requires keeping it longer.

7. Rights

My rights and the details of processing are described in the Privacy Notice.