Personal Data Processing Policy

This page is a translation of the Personal Data Processing Policy; the original text is available in the main version of the website.

1. General provisions

1.1. This Policy sets out the procedure and conditions for processing personal data on the website b2blistuz.com (the “Website”) and the measures for protecting it. It has been developed in accordance with Law of the Republic of Uzbekistan No. ZRU-547 of July 2, 2019 “On Personal Data” (the “Law”) and is freely available on the Website before personal data processing begins.

1.2. The owner and operator of the database containing personal data is the owner of the Website b2blistuz.com (the “Operator”). For all matters related to personal data, the Operator can be contacted by email at [email protected].

1.3. Terms are used in the meanings established by the Law. The terms “Account”, “Database”, “Export”, “Sample”, “Reveal” and “Order” have the meanings given in the Terms of Use.

2. Processing principles

2.1. The Operator processes personal data on the principles established by the Law — legality, respect for the rights of personal data subjects, confidentiality and security of personal data; it collects and processes only the personal data that is necessary and sufficient for predetermined lawful purposes and stores it for no longer than these purposes require.

3. Purposes, data, legal grounds and retention periods

3.1. The Operator processes personal data for the following purposes.

3.2. Registration and maintenance of the Account, logging in to the Website

• Subjects: registered users.
• Data: email address, name (if provided), password in the form of a cryptographic hash (the Operator does not store the password itself), date and time of registration, the fact and time of acceptance of the Terms of Use, IP address, date and time of logins.
• Legal ground: the consent of the personal data subject, which they give at registration by accepting the Terms of Use and this Policy; the Terms of Use — an agreement with the subject.
• Retention period: until the Account is deleted; login log — 12 months; information on acceptance of the Terms — 3 years after the Account is deleted.

3.3. Revealing contacts in Samples and enforcing the limit

• Subjects: registered users.
• Data: Account identifier, the revealed organization, date and time of the Reveal, IP address.
• Legal ground: the subject’s consent given at registration; the Terms of Use.
• Retention period: 12 months.

3.4. Placing and fulfilling Orders, settlements and accounting

• Subjects: buyers, representatives and contact persons of buyers that are organizations and sole proprietors.
• Data: name, email address, phone number (if provided), name of the organization or sole proprietor, invoice details, comment to the Order, payment method, contents and amount of the Order, payment information, IP address, the fact, date and time of consent to the terms of the Order. Bank card details are entered on the side of the bank or payment service; the Operator does not receive them.
• Legal grounds: the subject’s consent given when placing an Order; an agreement with the subject; fulfilment of obligations established by the legislation of the Republic of Uzbekistan on accounting and taxation.
• Retention period: for the document retention periods established by accounting legislation; unpaid Orders — 1 year.

3.5. Feedback and requests for custom data

• Subjects: persons who have sent a message or a request.
• Data: name, email address, phone number (if provided), subject and text of the message, address of the page from which the form was sent, IP address.
• Legal ground: the consent of the personal data subject, given by ticking a checkbox in the form on the Website; if the request is aimed at concluding an agreement — also an agreement with the subject.
• Retention period: until the request has been answered and the correspondence completed, but no more than 3 years, or until consent is withdrawn.

3.6. Ensuring the operation and security of the Website

• Subjects: visitors of the Website.
• Data: IP address, information about the browser and device (user agent), date and time of the request, address of the requested page and of the referring page, cookie identifiers (Section 6).
• Legal ground: fulfilment of the Operator’s obligation to protect personal data established by the Law, and the Terms of Use as regards protecting the Website against automated data collection and attacks.
• Retention period: server logs — no more than 12 months; in the event of an incident investigation — until it is completed.

3.7. The Operator does not process biometric or other special categories of personal data, does not make decisions producing legal consequences for the subject solely on the basis of automated processing, and does not send advertising messages without separate prior consent.

4. Information about organizations in the Database

4.1. The Database contains information about organizations: name, business address, coordinates, phones, websites, email addresses, links to social media pages, chain affiliation and categories. This is mainly information about legal entities and their separate subdivisions, which is not personal data.

4.2. Some records may relate to sole proprietors, artisans, independent professionals and other individuals engaged in business. If the information makes it possible to identify such a person, it is their personal data. The Operator includes in the Database only information related to the person’s business or professional activity (name, business address, work contacts) and does not collect information about their private life.

4.3. The source of the information is publicly available sources: organization listings in map services and directories, organizations’ websites and their social media pages.

4.4. The purpose is maintaining the reference Database and providing Samples and Exports to users of the Website for business purposes. The legal ground is the processing of publicly available personal data placed in publicly available sources until the personal data subject demands their removal from the Database.

4.5. Removal from the Database on request. If the Database contains your personal data and you do not want it to be processed, send an application to [email protected] (Section 9), specifying a phone number, email address or other information by which the record can be found (preferably with a link to the organization on the Website). Within the periods established by the Law, the Operator stops processing this information — showing it on the Website and including it in Exports — deletes it from the Database and notifies you of this. So that the information is not collected from the sources again, the Operator keeps only a minimal identifier (for example, a phone number or email address) in the exclusion list.

4.6. Exports provided to buyers before the application was received remain with the buyers, who process the data as independent operators. At the subject’s request, the Operator informs them to whom and which of their personal data has been provided.

4.7. Representatives of organizations may also ask to correct or delete information about an organization — at the same address.

5. Actions with personal data

5.1. The Operator collects, accumulates, stores, modifies, supplements, uses, depersonalizes, blocks and destroys personal data, and also provides it in the cases specified in Section 7. Processing is carried out both with and without the use of automation tools.

5.2. When the processing purposes have been achieved, consent has been withdrawn or the agreement has been terminated (if there are no other grounds for processing), the Operator stops processing and destroys the personal data, unless otherwise required by the legislation of the Republic of Uzbekistan.

6. Cookies and browser local storage

6.1. The Website uses only strictly necessary cookies: a session cookie — for logging in to the Account and for forms to work, and a cookie protecting forms against cross-site request forgery (CSRF). Without them, logging in, placing an Order and submitting forms are impossible. The Website does not use advertising cookies or third-party web analytics systems.

6.2. The contents of the cart are stored in the browser’s local storage (localStorage) on the user’s device and are sent to the server only when an Order is placed. They can be deleted by clearing the website data in the browser settings.

6.3. The user can block cookies in the browser settings; in this case, some features of the Website will be unavailable.

6.4. Additional cookies — for remembering settings, analytics and marketing — are set by the Website only with the consent of the user, which they give in the cookie window on their first visit. Consent can be changed or withdrawn at any time via the “Cookie settings” link at the bottom of every page.

7. Disclosure of personal data to third parties

7.1. The Operator does not sell the personal data of users and buyers and does not provide it to third parties, except where necessary for the purposes of Section 3:

• to the hosting and data center provider — for storing the Website’s data;
• to the bank and the payment service — for accepting payment;
• to the email delivery service — for delivering emails with invoices, links to files and replies to requests;
• to government authorities — in cases provided for by legislative acts.

7.2. If processing is entrusted to a third party, the Operator concludes an agreement with them that sets out the purposes and the list of actions with personal data and that party’s obligations to protect it and keep it confidential.

7.3. Cross-border transfer of personal data is carried out only in the cases and on the conditions permitted by the Law.

8. Rights of personal data subjects

8.1. The personal data subject has the right to:

• know whether the Operator has their personal data and receive information about its processing, including the purposes, methods and sources of collection;
• demand that their personal data be changed and supplemented if there are grounds confirmed by documents;
• demand that their personal data be blocked if there is information about a violation of the conditions of its collection and processing;
• demand the destruction of their personal data collected and processed in violation of the legislation of the Republic of Uzbekistan, and in other cases established by the Law, including the removal of their data from the Database (clause 4.5);
• withdraw consent to the processing of personal data in the manner and in the cases established by the Law;
• protect their rights and legitimate interests, including by applying to the authorized body for personal data protection and to a court.

9. How to submit an application

9.1. To exercise the rights specified in Section 8, the subject sends the Operator an application in writing or in the form of an electronic document to [email protected]. The application states the subject’s surname, first name (and patronymic, if any), information allowing their data to be found (email address, phone number, link to the organization on the Website) and the substance of the demand.

9.2. Consent given by ticking a checkbox on the Website can also be withdrawn in the same form in which it was obtained — for example, by an email to [email protected] from the address specified in the Account, the Order or the request.

9.3. The Operator considers applications and replies to them within the periods established by the Law. The reply is sent in a form corresponding to the form in which the application was submitted, unless the application itself specifies otherwise.

10. Protection of personal data

10.1. The Operator takes legal, organizational and technical measures to protect personal data against unauthorized or accidental access, modification, blocking, copying, dissemination, provision, deletion, and other unlawful actions: it determines and restricts the procedure for access to personal data; stores passwords only as a hash; uses encryption for data transmission (HTTPS); keeps event logs; and ensures unrestricted access to this Policy.

10.2. The Operator notifies the authorized body for personal data protection of a personal data leak in the manner and within the periods established by the legislation of the Republic of Uzbekistan.

11. Miscellaneous

11.1. The Website is intended for organizations and professional users and is not intended for persons under 18.

11.2. The Operator may change the Policy. A new version takes effect upon publication on this page unless it specifies otherwise.

11.3. The Operator’s contacts: website b2blistuz.com, email [email protected]. The terms of using the Website are set out in the Terms of Use.