This English version is a translation provided for convenience. In case of any discrepancy between the English and Russian versions, the Russian version shall prevail.

1. In accordance with the legislation governing relations connected with the Collection and Processing of Personal Data, upon the User's Acceptance in the manner set out in the Public Offer Agreement, the User gives the Contractor and Third Parties unconditional consent to the Collection, Processing and cross-border transfer (if necessary) of the User's Personal Data, by means not contrary to the law, for the purposes set out in the Public Offer Agreement, and in sources, including publicly available ones, at the Contractor's discretion, in connection with any existing or future civil-law and (or) other legal relations with the Contractor.

2. The Parties define the User's Personal Data as the following information relating to the User, as well as any future changes and (or) additions to it, recorded on electronic, paper and (or) other tangible media, including but not limited to: surname, first name, patronymic (if any), IIN, date of birth, citizenship, gender, place of work and position, postal address (residential address, registration address), home, work and mobile telephone numbers, email address(es), user identifiers in social networks, chats, messengers and forums.

3. The Contractor collects, processes and (if necessary) transfers the User's Personal Data across borders for the following purposes, including but not limited to:

3.1. proper performance of the Public Offer Agreement and of the rights and obligations imposed on the Contractor by law;

3.2. the Contractor's internal control and accounting;

3.3. judicial and out-of-court protection of the Contractor's rights: in the event of a breach of obligations under the relevant transactions; in the event of disputes, including disputes with third parties;

3.4. research aimed at improving the quality of the Services;

3.5. marketing programmes, statistical research and promotion of the Services through direct contact with the User by various means of communication, including but not limited to: post, email, telephone and (or) fax, the Internet, etc.

4. By transmitting Personal Data to the Contractor via open communication channels, the User is aware of and accepts the risk of unauthorised access to such data by other persons and the associated consequences. The Contractor is not liable for unauthorised access to Personal Data by other persons during their transmission via open communication channels.

5. The User's consent to the Collection, Processing and cross-border transfer (if necessary) of Personal Data governed by this section may be withdrawn in the cases provided for by the legislation of the Republic of Kazakhstan, on the basis of a written application delivered to the Contractor no less than ten days before the date of withdrawal of this consent. The User acknowledges that this consent cannot be withdrawn if such withdrawal would contradict the law or if the User has outstanding obligations to the Contractor.

6. AI assistants (ChatGPT, Claude and other MCP clients)

6.1. The User may connect X2 POS to a third-party artificial intelligence assistant of the User's choice (for example, ChatGPT by OpenAI or Claude by Anthropic) via the Model Context Protocol (MCP). Only the User can establish the connection: the User signs in to X2 POS and grants access on the consent screen, choosing whether the assistant may only read data or may also record operations.

6.2. When the User makes a request in the AI assistant, X2 POS transmits to the assistant only the data needed to answer that request, and only within the permissions of the connected employee and the features of the company's subscription plan: products, prices and stock; sales, goods receipts and other stock documents; customers and suppliers (name, company name, phone number, email address, address, balance, bonuses and discounts); payments, financial accounts and balances; reports, forecasts, plans and trade rules; company settings. Individual and business identification numbers (IIN/BIN) and dates of birth are never transmitted.

6.3. X2 POS does not transmit data to the AI assistant on its own initiative. Operations that change data (sales, payments, goods receipts, prices and others) are performed only after the User has reviewed a preview and confirmed the operation in the assistant. Each change made through an AI assistant is recorded in the company's event log with a mark that it was made through the assistant.

6.4. The data transmitted to the AI assistant are processed by the provider of that assistant (OpenAI, Anthropic or another provider chosen by the User) in accordance with that provider's own privacy policy and terms. The Contractor is not responsible for the processing of data by the provider of the AI assistant.

6.5. X2 POS stores only cryptographic hashes (SHA-256) of the access tokens issued to the AI assistant, not the tokens themselves. An access token is valid for 1 hour; a refresh token is valid for 30 days.

6.6. The User may revoke the AI assistant's access at any time on the "Connected apps" page (https://x2pos.com/connected_apps) or by disconnecting X2 POS in the assistant itself. Once access is revoked, the assistant can no longer obtain data from X2 POS.

6.7. The Contractor does not use data received or transmitted through AI assistants to train artificial intelligence models and does not sell such data to third parties.

6.8. Questions about data processing may be sent to hello@x2pos.com.