Privacy Policy

1. Who we are

QRush.delivery provides a website builder and digital ordering tools for hotels and hospitality businesses. QRush.delivery is operated by Sole Proprietor Andrey Anatolyevich Kulachenko, registered in the Russian Federation under registration numbers 770765074793 / 309774608600785, with registered address at 6 Pokrovskaya Street, Khotkovo, Sergiev Posad, Moscow Region, 141370, Russian Federation.

Where applicable, QRush.delivery processes personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

Important: QRush is the Data Controller for hotel representatives and staff, for guests using the guest app, and for website visitors who send a request. QRush is registered in the Roskomnadzor register of personal data operators, No. 77-26-574250.

2. Data we process as Controller

We may collect and process personal data of hotel representatives and platform users, such as:

• Name, email address, and company name
• Account credentials and account-related information (e.g., role/permissions within the hotel account)
• Billing and payment details (where applicable)
• IP address, device identifiers, browser information, and log data
• Support communications and system messages

We use this data to provide and operate the Service, manage accounts, process billing, prevent fraud and abuse, maintain security, and provide customer support.

Website requests. When a visitor of qrush.delivery sends a request for a demo or for the pilot programme, we process the data entered in the form: name, contact (email, phone or messenger username), property details (name, type, number of rooms, country, role, comment), and the date, time and page of the request. The IP address is stored only as an irreversible hash to protect the form from mass submissions. The purpose is to review the request and contact the visitor about it.

3. Hotel guest data

QRush processes guest data so that guests can use the Service: send orders and requests to the hotel, follow their status and receive notifications. The hotel where the guest stays receives the guest data needed to fulfil the orders and handles it as an independent controller for its own purposes, as described in the Guest Data Transfer Agreement.

Guest data may include (depending on whether the guest creates an account):

• Guest name and last name
• Email address and account password (stored in hashed form), if the guest registers an account
• Profile photo, if the guest uploads one so hotel staff can recognise them when delivering services
• Room number and delivery point within hotel premises
• Order details (food, beverages, shop items, services, tours)
• Stay dates (check-in/check-out), if the hotel chooses to store them
• Technical data such as device information and log data, used to operate and secure the app

The profile photo is used only so hotel staff can visually recognise the guest; it is not used for automated facial recognition or biometric identification.

Guests send requests about their personal data to QRush at privacy@qrush.delivery; questions about orders and the stay go to the hotel.

4. Legal bases

For hotel representatives, administrators, and platform users, QRush processes personal data based on:

• performance of a contract (providing access to and operation of the Service);
• compliance with legal obligations;
• legitimate interests (such as security, fraud prevention, and service improvement).

Guest data is processed to perform the contract with the guest (the guest app terms) and, for security of the Service, on the basis of legitimate interest.

Website requests are processed on the basis of the visitor's consent, given as a separate document (Consent to personal data processing) by ticking the consent box in the form.

5. Sharing & subprocessors

We do not sell personal data. We use the following subprocessors; each receives only the data needed for its function:

Subprocessors are bound by contracts or terms that require confidentiality and data protection.

Push notification text may contain the order number and type, room number and delivery point. Names, phone numbers and email addresses are not included.

6. Security

We use technical and organizational measures designed to protect data, such as encryption in transit, access control, and monitoring. No method of transmission or storage is 100% secure.

Hotels are responsible for securing their accounts and the guest data they receive.

7. Retention

We keep personal data only as long as necessary for the purposes described in this Privacy Policy or as required by law. Guest data is kept during the stay and for the period set by the hotel in its guest documents (12 months after check-out by default), unless the guest deletes the account earlier. Website request data is kept until its purpose is achieved, but no longer than three years from the request, or until consent is withdrawn.

8. Cross-Border Data Transfers

Personal data processed in the Service is recorded, systematised, accumulated and stored in a database on a server located in the Russian Federation. To deliver push notifications, QRush transfers the device identifier and notification text to Apple Inc. and Google LLC, whose servers are in the USA. QRush has notified Roskomnadzor of this cross-border transfer (notification No. 100451287) and assessed the safeguards applied by the recipients.

Notifications can be turned off in the phone settings; the Service keeps working.

9. Your rights

Depending on your location, you may have rights to access, rectify, delete, restrict processing of, or object to the processing of your personal data, as well as the right to data portability.

Send requests to privacy@qrush.delivery. We reply within 10 business days.

10. Contact

Privacy inquiries: privacy@qrush.delivery

Support: support@qrush.delivery