1. GENERAL PROVISIONS

1.1. This Privacy Policy (hereinafter – “Policy”) defines the procedure for processing and protecting personal data of users of the mobile application “Yo'ldosh” (hereinafter – “Application”, “Platform”).

1.2. The personal data operator is LLC "MILLIY YOLDOSH" (hereinafter – “Operator”, “We”), registered in accordance with the legislation of the Republic of Uzbekistan.

1.3. This Policy is developed in accordance with:

• The Law of the Republic of Uzbekistan “On Personal Data” dated 02.07.2019 No. ZRU-547;
• The Resolution of the Cabinet of Ministers of the Republic of Uzbekistan “On measures to improve the procedure for processing personal data” dated 10.02.2020 No. 82;
• other regulatory legal acts of the Republic of Uzbekistan.

1.4. Use of the Application means the User's unconditional agreement with this Policy and the conditions for processing his personal data specified therein. In case of disagreement with the terms of the Policy, the User must stop using the Application.

1.5. This Policy applies only to the Yo'ldosh Application. We do not control and are not responsible for third-party sites and services to which the User can navigate via links available in the Application.

1.6. The Operator checks the relevance of personal data and, if inaccuracies are identified, takes measures to update or delete them, unless otherwise provided by the legislation of the Republic of Uzbekistan.

2. TERMS AND DEFINITIONS

2.1. This Policy uses the following terms:

• Personal data – any information relating to a directly or indirectly identified or identifiable natural person (personal data subject).
• Personal data processing – any action or set of actions performed with personal data, including collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.
• Personal data confidentiality – a mandatory requirement for the Operator or other person who has gained access to personal data not to allow their dissemination without the consent of the personal data subject or other legal grounds.
• User – a person who has access to the Application via the Internet and uses the Application.
• Passenger – a User who uses the Application to search and book trips.
• Driver – a User who has passed verification and uses the Application to publish trip information.
• Cookies – small files that are saved on the User's device and contain information about previous visits and actions in the Application.

3. WHAT PERSONAL DATA WE COLLECT

3.1. Data collected from all Users during registration:

• Mobile phone number
• First name
• Last name

3.2. Additional data collected from Drivers during verification:

Copy of driver's license, including:

• Driver's license photo
• Series and number of driver's license
• Driver's license category
• Issue date and expiration date
• PINFL (personal identification number of an individual)
• Date of birth
• Place of document issuance

Copy of vehicle technical passport, including:

• Technical passport photo
• Vehicle state registration number
• Make, model, year of manufacture of the vehicle
• VIN number (vehicle identification number)
• Data about the vehicle owner

3.3. Data collected automatically when using the Application:

• Trip information (route, date, start and end time of the trip, cost)
• Booking history
• Geolocation data (when using navigation and location determination functions)
• History of messages in the built-in chat
• IP address
• Device type, operating system, Application version
• Unique device identifier
• Data on interaction with the Application (viewed pages, usage time, clicks)
• Information about the Driver's balance and transaction history (commission deduction)
• Cookies and similar tracking technologies

3.4. Data provided by Users voluntarily:

• Profile photo (optional)
• Additional contact information (optional)
• Reviews and ratings of other Users
• Appeals to support service

4. PURPOSES OF PERSONAL DATA PROCESSING

4.1. We collect and process Users' personal data for the following purposes:

4.2. Providing access to the Platform:

• Registration and identification of Users
• Creation and management of user account
• Ensuring the functioning of the Application

4.3. Driver verification:

• Verification of document authenticity (driver's license, technical passport)
• Confirmation of the right to operate the vehicle
• Ensuring Passenger safety
• Compliance with transportation legislation

4.4. Trip organization:

• Publication of trip information
• Search and booking of trips
• Ensuring communication between Drivers and Passengers through the built-in chat
• Notification of trip status

4.5. Financial operations:

• Calculation and deduction of Service commission from Drivers
• Accounting of transactions and management of Drivers' balance
• Formation of financial reporting

4.6. Ensuring security:

• Prevention of fraud and abuse
• Detection of violations of the Public Offer
• Resolution of disputes between Users
• Investigation of incidents

4.7. Improving service quality:

• Analysis of Application usage
• Development of new features and services
• Personalization of user experience
• Optimization of routes and search algorithms

4.8. Communication with Users:

• Sending trip notifications
• Informing about changes in the Application
• Technical support
• Sending news and special offers (with User consent)

4.9. Compliance with legislation:

• Fulfillment of tax and accounting requirements
• Provision of information to state authorities upon request
• Protection of the Operator's rights and legitimate interests

5. LEGAL GROUNDS FOR PERSONAL DATA PROCESSING

5.1. The legal grounds for processing personal data are:

• 5.2. Consent of the personal data subject to the processing of his personal data, provided by accepting this Policy during registration in the Application.
• 5.3. Necessity for the performance of a contract to which the personal data subject is a party (Public Offer for the provision of services for access to the Platform).
• 5.4. Necessity for the exercise of the rights and legitimate interests of the Operator or third parties (ensuring security, fraud prevention).
• 5.5. Necessity for the fulfillment of obligations provided by the legislation of the Republic of Uzbekistan (financial reporting, requirements of state authorities).

6. METHODS AND TERMS OF PERSONAL DATA PROCESSING

6.1. Personal data processing is carried out using automation tools and without using automation tools.

6.2. We process personal data for the period necessary to achieve the processing purposes specified in section 4 of this Policy, unless otherwise provided by legislation.

6.3. Personal data storage periods:

• Data of active Users (name, surname, phone number) are stored until the User deletes the account or the Operator blocks the account.
• Drivers' documents (driver's license, technical passport) are stored for the entire period of the Driver's use of the Application and for 3 (three) years after deletion or blocking of the account.
• Trip history and financial transactions are stored for 5 (five) years for accounting and tax compliance purposes.
• Messages in the built-in chat are stored for 1 (one) year from the date of sending or until the User deletes the account.
• Geolocation data are stored for 90 (ninety) days from the completion of the trip.
• Technical information (IP address, device data, cookies) is stored for 6 (six) months.

6.4. Upon expiration of storage periods, personal data are subject to deletion or depersonalization, unless otherwise provided by the legislation of the Republic of Uzbekistan.

6.5. In case of deletion of the account by the User, his personal data are deleted within 30 (thirty) calendar days, except for data that must be stored in accordance with legislative requirements (financial transactions, accounting documents).

7. TRANSFER OF PERSONAL DATA TO THIRD PARTIES

7.1. We do not sell, exchange or transfer Users' personal data to third parties without the User's consent, except in cases provided by this Policy and the legislation of the Republic of Uzbekistan.

7.2. Personal data may be transferred to third parties in the following cases:

To other Application Users:

• Passengers are shown information about the Driver (name, surname, profile photo, rating, car make and model, state number) when viewing the trip.
• Drivers are shown information about Passengers (name, surname, profile photo, rating) after booking the trip.
• Transfer is carried out only to the extent necessary for organizing the trip.

To service providers and contractors:

We may transfer personal data to organizations that provide services on our behalf:

• Hosting providers for data placement on servers
• Payment systems for processing financial operations
• SMS mailing providers for sending OTP codes and notifications
• Analytics services for analyzing Application usage
• Technical support services
• All such third parties are obliged to ensure the confidentiality and security of personal data in accordance with agreements concluded with the Operator.

To state authorities and law enforcement agencies:

In accordance with the legislation of the Republic of Uzbekistan based on an official request from competent authorities (court, prosecutor's office, police, tax authorities, etc.).

In case of reorganization or sale of business:

In case of merger, acquisition, reorganization or sale of the Operator's assets, personal data may be transferred to the successor or acquirer subject to their compliance with this Policy.

7.3. We do not carry out cross-border transfer of personal data without complying with the requirements of the legislation of the Republic of Uzbekistan on personal data.

7.4. When expanding activities to the territory of other states, the Operator will comply with the requirements of the legislation on personal data protection of the respective countries.

8. PROTECTION OF PERSONAL DATA

8.1. The Operator takes necessary legal, organizational and technical measures to protect personal data from unauthorized or accidental access, destruction, alteration, blocking, copying, provision, distribution, as well as from other unlawful actions.

8.2. Technical protection measures:

• Encryption of personal data during transmission (SSL/TLS)
• Encryption of personal data during storage in databases
• Use of secure servers with limited access
• Regular data backup
• Protection against unauthorized access (firewalls, intrusion detection systems)
• Antivirus protection
• Multi-level authentication for administrative access

8.3. Organizational protection measures:

• Appointment of a person responsible for organizing personal data processing
• Differentiation of employee access rights to personal data
• Training of employees on rules for processing and protecting personal data
• Conclusion of confidentiality agreements with employees
• Control over compliance with personal data legislation requirements
• Conducting internal audits of the personal data protection system

8.4. Access to personal data is available only to authorized employees of the Operator and contractors who need this information to perform their duties.

8.5. Despite the application of all necessary security measures, we cannot guarantee absolute protection of personal data from all possible threats, taking into account the technical limitations of the Internet.

8.6. The User is responsible for maintaining the confidentiality of his account data (phone number, OTP code). Any actions performed using the User's account are considered performed by the User himself.

8.7. In case of detection of an incident related to a personal data security breach, the Operator undertakes to notify the affected Users and the authorized state body within the time limits established by legislation.

9. RIGHTS OF PERSONAL DATA SUBJECTS

9.1. In accordance with the legislation of the Republic of Uzbekistan, Users have the following rights regarding their personal data:

• 1) Right of access: The User has the right to obtain information on whether his personal data is being processed and to access such personal data.
• 2) Right to rectification: The User has the right to demand correction of inaccurate or incomplete personal data.
• 3) Right to erasure: The User has the right to demand deletion of his personal data in cases where:
  • personal data is no longer necessary for the purposes for which it was collected;
  • the User withdraws consent to personal data processing;
  • personal data was processed unlawfully;
  • deletion is necessary to comply with legislative requirements.
• 4) Right to restriction of processing: The User has the right to demand restriction of personal data processing in cases where:
  • the accuracy of personal data is contested;
  • processing is unlawful, but the User does not want data deletion;
  • personal data is no longer needed by the Operator, but is needed by the User to protect his rights.
• 5) Right to withdraw consent: The User has the right to withdraw his consent to personal data processing at any time by deleting the account in the Application.
• 6) Right to lodge a complaint: The User has the right to lodge a complaint with the authorized state body for the protection of personal data subjects' rights.

9.2. To exercise their rights, the User can:

• Use account settings in the Application to update or delete information.
• Contact support service through the Application functionality or via contacts specified in section 14 of this Policy.

9.3. The Operator undertakes to consider the User's request and provide a response within 30 (thirty) calendar days from the date of receipt of the request.

9.4. The Operator has the right to refuse deletion of personal data if their storage is provided by the legislation of the Republic of Uzbekistan (for example, financial transactions for accounting purposes).

10. COOKIES AND TRACKING TECHNOLOGIES

10.1. The Yo'ldosh Application uses cookies and similar tracking technologies to improve user experience and analyze Application usage.

10.2. Cookies are small text files that are saved on the User's device and allow the Application to remember information about the User's actions and preferences.

10.3. We use the following types of cookies:

• 1) Essential cookies: Provide basic Application functionality (authorization, security). These cookies are necessary for the Application's operation and cannot be disabled.
• 2) Functional cookies: Allow the Application to remember the User's choices (interface language, display settings).
• 3) Analytical cookies: Collect information on how Users use the Application, which allows us to improve its operation (Google Analytics, Firebase Analytics and others).
• 4) Advertising cookies: Used to display relevant advertising and evaluate the effectiveness of advertising campaigns (currently not used, but may be implemented in the future).

10.4. The User can manage cookies through their device or browser settings. However, disabling essential cookies may affect the Application's functionality.

10.5. In addition to cookies, we use the following technologies:

• Tracking pixels for analyzing the effectiveness of email mailings (if applicable).
• Third-party SDKs for analytics and error tracking (Firebase, Crashlytics, etc.).
• Unique device identifiers for identifying Users across different sessions.

11. SPECIAL FEATURES OF PROCESSING DATA OF MINORS

11.1. The Yo'ldosh Application is intended for persons who have reached 18 (eighteen) years of age.

11.2. We do not intentionally collect personal data of persons under 18 years of age.

11.3. If the Operator becomes aware that personal data has been collected from a person under 18 years of age without the consent of parents or legal representatives, such data will be immediately deleted.

11.4. If you believe that we may have received personal data from a person under 18 years of age, please contact us via the contacts specified in section 14 of this Policy.

12. CHANGES TO THE PRIVACY POLICY

12.1. The Operator reserves the right to make changes to this Policy at any time.

12.2. The new version of the Policy comes into force from the moment of its placement in the Application, unless otherwise provided by the new version of the Policy.

12.3. Users will be notified of significant changes in the Policy (changes in processing purposes, transfer of data to new third parties, changes in storage periods) through the Application (push notification, message in the Application) at least 7 (seven) calendar days before the changes come into force.

12.4. The current version of the Policy is always available in the Application in the settings section and at the address: [specify website if available].

12.5. Continued use of the Application after the new version of the Policy comes into force means the User's agreement with the changes made.

12.6. The date of the last Policy update is indicated at the beginning of the document.

13. APPLICABLE LAW

13.1. This Policy and all related issues are governed by the legislation of the Republic of Uzbekistan.

13.2. All disputes arising in connection with personal data processing are resolved in accordance with the legislation of the Republic of Uzbekistan.

13.3. Compliance with the pre-trial procedure is mandatory before going to court. The period for considering a claim is 10 (ten) calendar days.

14. CONTACT INFORMATION

14.1. If you have questions, comments or requests regarding this Policy or the processing of your personal data, you can contact us in the following ways:

14.2. We undertake to respond to your request within 10 (ten) calendar days from the date of its receipt.

14.3. To protect your privacy when processing requests, we may ask you for additional information to verify your identity.

15. FINAL PROVISIONS

15.1. This Policy is an integral part of the Public Offer for the provision of services for access to the Yo'ldosh Platform.

15.2. If any provision of this Policy is declared invalid, this does not entail the invalidity of the remaining provisions.

15.3. This Policy is drawn up in Russian and Uzbek languages. In case of discrepancies, the Uzbek version has priority.

15.4. By accepting the terms of this Policy, the User confirms that:

• he has read the text of the Policy in full;
• understands his rights and obligations;
• gives consent to the processing of his personal data for the purposes and under the conditions defined by this Policy;
• undertakes to maintain the confidentiality of his account credentials.