PRIVACY POLICY

1. General provisions and terms

1.1. This Privacy Policy (hereinafter — the “Policy”) determines the procedure for the processing and protection of the personal data of the users of the Ustav.uz platform hosted on the Internet at ustav.uz (hereinafter — the “Website”, the “Platform”).

1.2. The Policy has been developed in accordance with the Law of the Republic of Uzbekistan of 2 July 2019 No. ZRU-547 “On Personal Data”, the Model Procedure for the Processing of Personal Data (approved by order of the Minister of Justice of the Republic of Uzbekistan, registered on 15 November 2023, reg. No. 3478), the Regulation on the Procedure for Determining the Level of Protection of Personal Data during Their Processing (approved by Resolution of the Cabinet of Ministers of the Republic of Uzbekistan of 5 October 2022 No. 570) and other regulatory legal acts of the Republic of Uzbekistan in the field of personal data.

1.3. By using the Website and providing personal data, the user confirms agreement with the terms of this Policy. If the user does not agree with the Policy, the user must refrain from using the Platform.

1.4. The following terms are used in this Policy. The terms “personal data”, “personal data subject”, “processing of personal data”, “personal data database”, “operator of a personal data database”, “owner of a personal data database” and “third party” are given in the meaning of Article 4 of Law No. ZRU-547; “cross-border transfer of personal data” — in the meaning of Article 15 of the Law. The term “consent of the subject” is given in an explanatory meaning, since it is not separately defined in the Law.

personal data — information recorded on an electronic, paper and (or) other tangible medium that relates to a specific individual or makes it possible to identify such individual;

personal data subject (the subject) — an individual to whom personal data relate;

processing of personal data — the performance of one action or of a combination of actions involving the collection, systematization, storage, modification, supplementation, use, provision, dissemination, transfer, depersonalization and destruction of personal data;

personal data database — a database in the form of an information system containing personal data;

operator of a personal data database (the operator) — a state body, an individual and (or) a legal entity that processes personal data; with respect to the Platform, the operator is the person specified in Section 2;

owner of a personal data database (the owner) — a state body, an individual and (or) a legal entity holding the right to possess, use and dispose of a personal data database; with respect to the Platform, the Operator is at the same time the owner of the personal data database;

third party — any person that is not the subject, the owner and (or) the operator, but that is connected with them by circumstances or by relations concerning the processing of personal data;

cross-border transfer of personal data — the transfer of personal data by the owner and (or) the operator outside the territory of the Republic of Uzbekistan;

consent of the subject (explanatory) — a freely given, specific and informed expression of will by which the subject permits the processing of the subject’s personal data.

2. The personal data Operator

2.1. The personal data operator is:

Name: “C7 CYBERSECURITY” LLC, a resident of the Technological Park of Software Products and Information Technologies “IT Park” of the Republic of Uzbekistan;

TIN: 310 734 480;

Legal address: Tashkent, Mirabad district, Buyuk Turon Street, 73/96;

E-mail address: [email protected];

Telephone: +998 90 816 89 30.

2.2. The Operator is at the same time the owner of the personal data database (holds the right to possess, use and dispose of the database) within the meaning of Article 4 of Law No. ZRU-547.

2.3. In accordance with Article 31 of Law No. ZRU-547 and clauses 27 and 30 of Model Procedure No. 3478, the Operator appoints a structural unit or an official responsible for organizing the processing and protection of personal data: Director Akhmedkhodjaev I.I. The Operator approves internal documents determining the policy for the processing and protection of personal data (including the regulation on the processing of personal data and the relevant orders).

3. List of the personal data processed

3.1. In order to generate the charter and render the Service, the Operator processes the following personal data provided by the user:

3.1.1. surname, first name, patronymic;

3.1.2. data of the identity document (series and number of the passport / ID card);

3.1.3. personal identification number of an individual (PINFL / JShShIR);

3.1.4. address (of the place of residence, of registration and (or) the address of the company);

3.1.5. information on the participants, on the director (chief executive) and on the company being established (or the existing company) that is necessary for generating the charter;

3.1.6. payment information (to the extent received from the payment aggregator; payment card details are not collected or stored by the Operator).

3.2. The Operator does not process biometric or genetic personal data, or special categories of personal data. The user should not enter into the form any information that is not requested by the Platform.

3.3. The Operator processes only those data that are necessary to achieve the purposes specified in Section 4 (clause 5 of Model Procedure No. 3478), and the scope and nature of the data processed correspond to the purposes and methods of their processing.

4. Purposes of the processing of personal data

4.1. Personal data are processed for the following purposes:

4.1.1. generating the finished document (the charter of an MChJ) on the basis of the data entered by the user;

4.1.2. making payment for the Service through the payment aggregator and confirming the payment;

4.1.3. providing customer (technical) support and communicating with the user on matters relating to the rendering of the Service;

4.1.4. complying with the requirements of the legislation of the Republic of Uzbekistan (including in the field of accounting and tax records).

4.2. The processing of personal data for other purposes incompatible with those specified is not carried out without obtaining separate consent from the subject.

5. Legal grounds for the processing

5.1. The legal ground for the processing of personal data is the consent of the personal data subject, given when filling in the form on the Website and ticking the consent box. In accordance with clause 9 of Model Procedure No. 3478, acceptance (confirmation) of a public offer that clearly states the purposes of the processing of personal data is recognized as the subject’s consent to the processing.

5.2. Separate legal grounds may be: the necessity to perform a contract to which the subject is a party (the rendering of the Service), as well as the performance of the Operator’s obligations imposed by legislation (Article 18 of Law No. ZRU-547).

5.3. Consent is given freely and is specific and informed. The subject has the right to withdraw the consent in the manner provided for in Section 8.

5.4. In accordance with clause 11 of Model Procedure No. 3478, the consent of the subject obtained on the Website contains: the name and TIN of the Operator; the surname, first name and patronymic of the subject and the data of the identity document; the purposes of the processing of personal data; the list of the personal data to the processing of which the consent is given; the term (period) during which the consent is valid; consent to the transfer of personal data to third parties and (or) to their cross-border transfer; consent to the dissemination of personal data in publicly available sources (if any); and other necessary information.

6. Procedure and methods of processing; storage periods

6.1. The processing of personal data is carried out using automation tools (automated processing) and (or) without their use (mixed processing).

6.2. The processing includes the collection, systematization, storage, use, transfer (in the cases specified in Section 7), depersonalization and destruction of personal data.

6.3. Personal data are stored no longer than required by the purposes of their processing. At the same time: the personal data entered by the user into the form for generating the charter (the order data) are available to the user for repeated downloading of the generated document for 48 (forty-eight) hours from the moment of payment, after which they are depersonalized (removed from the order); documents and information confirming the conclusion and performance of the contract (the record of acceptance, confirmation of payment, the electronic receipt) are stored for the period established by legislation for similar documents, but for no less than five years (including for the purposes of tax and accounting records); other personal data are stored until the purposes of their processing are achieved.

6.4. Personal data are subject to destruction or depersonalization: upon achievement of the purposes of the processing, upon expiry of the term of the consent or upon the entry into legal force of a court decision — within 3 (three) days (clause 23 of Model Procedure No. 3478); upon withdrawal of the subject’s consent — no later than the business day following the day on which the relevant application is received (clause 10 of Model Procedure No. 3478), in the absence of other lawful grounds for continuing the processing; where the processing is carried out in violation of legislation (at the request of the subject or of the subject’s legal representative, by a decision of a court or of another authorized body) — within 1 (one) business day (clause 24 of Model Procedure No. 3478). Data subject to storage by virtue of law (including for tax and accounting records) are retained for the relevant period on an independent legal ground.

7. Transfer to third parties, localization and cross-border transfer

7.1. The Operator has the right to transfer personal data to third parties solely to the extent necessary to achieve the purposes of the processing and provided that such persons ensure the confidentiality and security of the data:

7.1.1. to the payment aggregator — for the purpose of making payment for the Service;

7.1.2. to the hosting provider and (or) the cloud infrastructure provider — for the purposes of the technical hosting and operation of the Platform;

7.1.3. to other persons — in the cases directly provided for by the legislation of the Republic of Uzbekistan (upon the lawful request of authorized bodies).

7.2. Data are not transferred to third parties for marketing or advertising purposes without separate consent from the subject.

7.3. The biometric and genetic data of individuals, as well as the data of individuals who are users of the services of telecommunications operators, are subject to mandatory storage exclusively in the territory of the Republic of Uzbekistan; such data are not subject to cross-border transfer (Article 27-1 of Law No. ZRU-547). Since the Platform does not process the said data, the requirement of their mandatory localization does not in practice apply to the Operator.

7.4. Other personal data may be stored and processed both in the territory of the Republic of Uzbekistan and outside it (including where the Website is hosted on servers outside the Republic of Uzbekistan), subject to compliance with one of the conditions for cross-border transfer established by Articles 15 and 27-1 of Law No. ZRU-547: the transfer is carried out to the territory of a state that ensures adequate (comparable) protection of personal data — in accordance with the list approved by the Cabinet of Ministers of the Republic of Uzbekistan; or the Operator adopts and complies with standard contractual clauses or binding corporate rules meeting the requirements approved by the authorized state body; or the Operator complies with international standards in the field of the management and storage of personal data, the list of which is approved by the authorized state body. Biometric and genetic data are not processed by the Operator.

7.5. In accordance with Article 20 of Law No. ZRU-547 (as currently in force), state registration in the State Register of Personal Data Databases is required for those personal data databases which, by virtue of part two of Article 27-1 of the Law, are subject to mandatory storage in the territory of the Republic of Uzbekistan (biometric and genetic data, as well as the data of users of the services of telecommunications operators). Since the Platform does not process such data (clause 7.3 of this Policy), the obligation to register the Operator’s personal data database in the State Register does not apply to the Operator.

8. Rights of the personal data subject and the procedure for exercising them

8.1. The personal data subject has the right to:

8.1.1. receive information concerning the processing of the subject’s personal data (the right of access);

8.1.2. demand the clarification, modification and supplementation of the subject’s personal data where they are incomplete or inaccurate;

8.1.3. demand the blocking (temporary suspension of the processing) of the subject’s personal data;

8.1.4. demand the destruction (deletion) of the subject’s personal data that are processed in violation of legislation or upon achievement of the purposes of the processing;

8.1.5. withdraw the consent previously given to the processing of personal data;

8.1.6. appeal against the actions (inaction) of the Operator to the authorized state body in the field of personal data (the Personalization State Centre) and (or) to a court.

8.2. To exercise these rights, the subject shall send a request to the Operator to the e-mail address [email protected] or to the address Tashkent, Mirabad district, Buyuk Turon Street, 73/96. The Operator shall consider the request within the shortest possible time in compliance with the periods established by legislation: the modification and supplementation of personal data are carried out no later than 3 (three) days from the moment of the request (Article 11 of Law No. ZRU-547, clause 15 of Model Procedure No. 3478); a notice of refusal to provide the requested information is sent within 10 (ten) days (Article 22 of Law No. ZRU-547).

8.3. The consent is withdrawn by sending a relevant request to the Operator. After the withdrawal of the consent, the Operator shall cease the processing and ensure the destruction of the personal data no later than the business day following the day on which the application is received (clause 10 of Model Procedure No. 3478), except for data subject to storage by virtue of law (including for tax and accounting records).

9. Personal data protection measures

9.1. The Operator takes the necessary legal, organizational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying and dissemination, as well as against other unlawful actions (Article 27 of Law No. ZRU-547, clauses 29–31 of Model Procedure No. 3478).

9.2. Such measures include, in particular: restricting and differentiating access to personal data; determining the list of persons having access to personal data; the identification and authentication of the users of the information system; maintaining an event log (a log of user actions); the use of integrity control tools; the use of cryptographic information protection tools and secure data transmission channels (the HTTPS protocol); backup copying; determining the required level of protection of personal data in accordance with the Regulation approved by Resolution of the Cabinet of Ministers of the Republic of Uzbekistan of 5 October 2022 No. 570; ensuring information security on the basis of the state standards of the Republic of Uzbekistan; concluding confidentiality agreements with third parties; and approving internal documents determining the policy for the processing and protection of personal data.

9.3. Employees and engaged persons who obtain access to personal data undertake to maintain their confidentiality and to use the data solely in accordance with their official (employment) duties.

9.4. The Operator’s obligations to protect personal data arise from the moment of their collection and remain in effect until the moment of their destruction or depersonalization.

10. Use of cookies and web analytics systems

10.1. The Website uses only strictly necessary (technical) cookies that ensure the operation of the Website and the retention of the user’s service settings. Such cookies are not used to collect statistics, for profiling or for advertising (marketing) purposes.

10.2. Strictly necessary cookies are processed without separate consent from the user, since the Website cannot operate without them.

10.3. Web analytics systems and advertising (marketing) cookies are not used on the Website. Should they be introduced in the future, the Operator will make the appropriate amendments to this Policy and will ensure that the user’s consent is obtained in the established manner.

10.4. The user has the right to restrict or disable the processing of cookies in the settings of the user’s browser; if strictly necessary cookies are disabled, certain functions of the Website may not operate correctly.

11. Procedure for amending the Policy and contact details of the Operator

11.1. The Operator has the right to make amendments to this Policy. A new version comes into force from the moment it is posted on the Website, unless otherwise provided by the new version.

11.2. The current version of the Policy is permanently available on the Website at https://ustav.uz/en/politika. The user is advised to review the text of the Policy periodically.

11.3. On all matters relating to the processing of personal data, the user may contact the Operator: e-mail address [email protected]; telephone: +998 90 816 89 30; postal address: Tashkent, Mirabad district, Buyuk Turon Street, 73/96.