1. GENERAL PROVISIONS

Personal Data Processing Policy (hereinafter referred to as the 'Policy') was developed according to the Law of the Republic of Uzbekistan dated July 2, 2019 No. ZRU-547 on Personal Data (hereinafter referred to as the 'Law').

This Policy establishes the procedure for processing personal data and measures to ensure the security of personal data ___ LLC (Certificate, TIN, postal address:, Branch of _____, PO box) focuses at the protection of the rights and liberties of humans and citizens when processing personal data, including the protection of privacy, personal and family secrets.

The following basic concepts are used in the Policy:

automated processing of personal data means the processing of personal data using computer equipment;

blocking of personal data means the interruption of personal data processing (except for cases where the processing is required to clarify personal data);

personal data information system means a set of personal data in databases and information technologies and hardware components for their processing;

depersonalisation of personal data means measures that prevent identification of ownership of personal data by a specific subject of personal data without additional information;

personal data processing means any action (operation) or a set of actions (operations) performed for personal data with or without automation tools, including collection, record, systematization, accumulation, storage, clarification (update, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data;

operator means a legal entity, which independently or jointly with other entities organizes and (or) processes personal data, as well as determines the purposes of processing of personal data, content of personal data to be processed, actions (operations) performed with personal data;

personal data means any information that directly or indirectly relates to a specific or designated individual (personal data subject);

provision of personal data means actions aimed at disclosure of personal data to a specific person or scope of persons;

distribution of personal data means actions aimed at disclosure of personal data to an indefinite scope of persons (transfer of personal data) or familiarization of unlimited scope of persons with personal data, including the publication of personal data in the media, information, and telecommunications networks or provision of access to personal data in any other way;

cross-border transfer of personal data means the transfer of personal data to a foreign country, authority of a foreign country, foreign individual or a foreign legal entity.

destruction of personal data means the actions which result in impossibility to restore the content of personal data in the personal data information system and (or) which result in the destruction of personal data storage media.

 

2. PRINCIPLES, PURPOSE, CONTENT AND CONDITIONS OF PERSONAL DATA PROCESSING

2.1. Personal data processing principles

The Operator processes personal data according to the following principles:

- legitimacy and fairness;

- personal data processing restriction through specific, predetermined and legitimate purposes;

- prevention of personal data processing incompatible with the purposes of personal data collection;

- prevention of the consolidation of databases containing personal data, which are processed in purposes incompatible with each other;

- processing of personal data that meet the purposes of their processing;

- compliance of the content and scope of the processed personal data with the purposes specified for the processing;

- prevention of processing of personal data that is excessive against the stated purposes of their processing;

- accuracy, sufficiency and relevance of personal data against the purposes of their processing;

- destruction or depersonalization of personal data upon the achievement of their processing purposes or if there is no further need to achieve these purposes, if it is impossible for the Operator to eliminate breaches in personal data unless otherwise provided by the Law.

2.2. Personal data is collected and further processed for the following purposes:

- use of the User's personal data in order to send him/ her/ it the Operator's offers, informational and advertising messages about the Operator's services via postal mailing, SMS, by the phone and e-mail to the User's address;

- User's provision with information related to the conrtact between the User and _______ LLC via SMS and email to the User's address, as well as by the phone.

- storage and processing in various databases and information systems, their inclusion in analytical and statistical reports;

- use of Piece of Works (scientific articles) for publishing on the platform; 

- other purposes for the compliance with the Offer published on the platform.

2.3. Conditions for personal data processing

The Operator processes personal data if there is at least one of the following conditions:

- personal data are processed upon the consent of the subject of personal data;

- personal data processing is required to achieve purposes stipulated by an international treaty of the Republic of Uzbekistan or the Law, to implement and fulfill the functions, powers and duties assigned by the legislation of the Republic of Uzbekistan to the Operator;

- personal data processing is required to deliver justice, execute court orders, orders of other authority or official subject to execution according to the Laws of the Republic of Uzbekistan on enforcement proceedings;

- personal data processing is required to execute an agreement to which the personal data subject is a party or beneficiary or guarantor, as well as to conclude an agreement on the initiative of the personal data subject or an agreement under which the personal data subject will be the beneficiary or guarantor;

- personal data processing is required to exercise the rights and legitimate interests of the operator or third parties or to achieve socially significant goals provided that the rights and liberties of the subject of personal data are not breached;

- the processing involves personal data to which the subject of personal data provides the access to an unlimited scope of persons or requests thereof (hereinafter referred to as the 'Publicly Available Personal Data');

- the processing involves personal data subject to publication or mandatory disclosure according to the Law.

2.4. Confidentiality of personal data

The Operator and other persons who received access to personal data should not disclose personal data to third parties with no consent of the subject of personal data, unless otherwise provided by the Law, the consent to personal data processing, or the Contract (Offer) concluded between ______ LLC and the subject of personal data.

2.5. Publicly Available Personal Data Sources

The Operator may create publicly available sources of personal data of subjects, including directories for informational support. In particular, the Operator may use the personal data of the subject when publishing the Pieces of Works (scientific article) on the platform;

Upon the written consent of the subject, the Publicly Available Personal Data Sources may include surname, first name, patronymic; information about the academic degree; employment, and position, as well as other information provided by the subject of personal data (in the case of the execution of contractual relations between the operator and the subject.

Information about the subject should be excluded from the publicly available personal data sources upon the request of the subject or by the decision of the court or other authorized state bodies.

2.6. Special categories of personal data

It is permitted for the Operator to process special categories of personal data related to race, nationality, political views, religious or philosophical beliefs, health status, intimate life, if:

- the subject of personal data has agreed in writing to the processing of his/ her personal data;

- the subject of personal data made them publicly available;

- personal data is processed according to state social assistance laws, labour laws, laws of the Republic of Uzbekistan on state pension provision or occupational pension;

- the processing of personal data is required to protect the life, health or other vital interests of the subject of personal data or the life, health or other vital interests of other persons and it is impossible to receive the consent of the subject of personal data;

- personal data is processed for medical and preventive purposes, to establish a medical diagnosis, provide medical and social services, provided that the personal data is processed by a person professionally engaged in medical activities who should keep medical secrecy according to the Laws of the Republic of Uzbekistan;

- the processing of personal data is required to establish or exercise the rights of the subject of personal data or third parties, as well as for the administration of justice;

- personal data is processed according to the laws on the mandatory types of insurance, insurance laws.

It is required to stop processing of special categories of personal data immediately if the reasons for which they were processed have been eliminated, unless otherwise provided by the Law.

The Operator can process personal data on a criminal record only in cases and in the manner determined by the Laws.

2.7. Biometric personal data

Information that describes physiological and biological characteristics of a person, which can be used to establish his/ her identity (biometric personal data) may be processed by the Operator only upon the written consent of the subject, including in the form of an electronic document.

2.8. Personal data processing entrusting to another person

The Operator is entitled to entrust the processing of personal data to another person upon the consent of the subject of personal data, unless otherwise provided by the Law based on the concluded agreement. A person who processes personal data on behalf of the Operator should comply with the principles and rules for personal data processing provided for by the Law.

2.9. Cross-border transfer of personal data

The Operator should make sure that the foreign country where the personal data is supposed to be transfered provides adequate protection of the rights of personal data subjects prior to the start of such transfer.

It is permitted to transfer personal data to the foreign countries that do not provide adequate protection of the rights of personal data subjects in the following cases:

- the subject of personal data agrees to the cross-border transfer of his/ her personal data, including in the form of an electronic document;

- execution of the contract to which the subject of personal data is a party.

- other cases provided by the Law.

 

3. RIGHTS OF THE SUBJECT OF PERSONAL DATA

3.1. Consent of the subject of personal data to their processing

The subject of personal data decides on the provision of his/ her personal data and consents to their processing on free basis, voluntarily and on his/ her behalf. The subject of personal data or his/ her representative can provide the consent to the processing of personal data in any form that confirms the fact of its receipt unless otherwise provided be the Law.

The obligation to provide evidence of consent of the personal data subject to the processing of his/ her personal data or the evidence of the grounds specified in the Law is assigned to the Operator.

3.2. Rights of the subject of personal data

The subject of personal data is entitled to receive information from the Operator on the processing of his/ her personal data, if such right is not limited by the Law. The subject of personal data is entitled to demand the Operator to clarify his/ her personal data, their blocking or destruction if the personal data is incomplete, outdated, inaccurate, illegally obtained, or not required for the stated purpose of processing, as well as to take measures provided by the Laws to protect his/ her rights.

It is permitted to process personal data to promote goods, works, services on the market through direct contacts with a potential consumer using means of communication only subject to prior consent of the subject of personal data. The specified processing of personal data is recognized as being carried out with no prior consent of the subject of personal data, unless the Operator proves that such consent has been obtained.

The Operator should immediately stop processing of personal data upon the request of the subject of this personal data for the above purposes.

It is prohibited to take decisions based solely on automated processing of personal data that generate legal consequences for the subject of personal data or otherwise affecting his/ her rights and legitimate interests, except for cases provided for by the Law or with the written consent of the subject of personal data. 

If the subject of personal data believes that the Operator processes his/ her personal data while breaching the Law or otherwise breaches his/ her rights and liberties, the subject of personal data is entitled to appeal against the actions or inaction of the Operator to the Authorized Body for the protection of the rights of subjects of personal data or in court if the dispute will not be settled within 30 days through a complaint procedure.

 

4. PERSONAL DATA SECURITY

The personal data processed by the Operator is secured by legal, organizational, and technical measures required to ensure compliance with the Laws on the protection of personal data.

To prevent unauthorized access to personal data, the Operator provides the following technical and organizational measures:

- appointment of officials responsible for the processing and protection of personal data;

- limitation of a number of persons accessing the personal data;

- organization of accounting, storage and circulation of information storage media;

- verification of the availability and effectiveness of the use of information security tools;

- use of anti-virus tools and means for personal data protection system restoring;

 

5. FINAL PROVISIONS

Other rights and obligations of the Operator, as an operator of personal data, are determined by the Laws of the Republic of Uzbekistan on personal data.