PERSONAL DATA PROCESSING POLICY

1. General Provisions
This Personal Data Processing Policy (the “Policy”) describes how Colvir Software Solutions CA LLC (CSS CA LLC), registered in the Republic of Uzbekistan as “CSS CA” MCHJ XK, with its registered address at 34 Istiqbol Street, Movarounnahr MFY, Mirabad District, Tashkent, Republic of Uzbekistan (the “Company”, “we”, “us” or “Operator”), processes personal data collected through https://cssca.uz/ (the “Website”).
The Company processes personal data in accordance with the applicable legislation of the Republic of Uzbekistan, including the Law of the Republic of Uzbekistan No. ZRU-547 dated 2 July 2019 “On Personal Data”, as amended from time to time, and applicable subordinate legislation governing the processing and protection of personal data.
This Policy applies to personal data collected through the Website, including personal data submitted by individuals through the “Contact Us” / “Request a consultation” form.

2. Personal Data Operator
For the purposes of applicable personal data legislation, the Company acts as the operator of the relevant personal data databases and is responsible for the processing and protection of personal data within the scope described in this Policy.
Operator:
Colvir Software Solutions CA LLC (CSS CA LLC)
Registered in the Republic of Uzbekistan as “CSS CA” MCHJ XK
TIN: 312325957
Registered address: 34 Istiqbol Street, Movarounnahr MFY, Mirabad District, Tashkent, Republic of Uzbekistan
Email: sales@colvir.com
The Company has appointed a person responsible for matters related to the processing and protection of personal data.

3. Personal Data We Process
Depending on the purpose of your interaction with the Website, we may process the following categories of personal data:

• name;
• company name;
• business email address;
• telephone number; and
• information contained in your message.

The exact list of personal data collected through a particular form is determined by the fields included in that form.
We do not intentionally collect special categories of personal data through the Website unless such processing is expressly permitted by applicable law and the necessary consent or other legal basis has been obtained.
Users are requested not to submit special personal data or other unnecessary personal information through the Website.

4. Sources of Personal Data
We collect personal data directly from you when you voluntarily provide it to us, including when you:

• submit an enquiry through the “Contact Us” / “Request a consultation” form;
• communicate with us by email or through other contact details provided on the Website; or
• otherwise voluntarily provide personal data to us in connection with your interaction with the Website.

We may also receive personal data from other sources where such collection is permitted by applicable legislation.

5. Purposes of Processing
We process personal data only for specific and predetermined purposes and only to the extent necessary to achieve those purposes.
Personal data collected through the “Contact Us” / “Request a consultation” form may be processed for the following purposes:

• receiving and responding to enquiries and requests;
• communicating with you regarding your enquiry;
• providing information about the Company’s products, services or activities where this is related to your request; and
• entering into and performing agreements, where applicable.

We will not process personal data for purposes incompatible with the purposes for which the data were collected, unless such processing is permitted by applicable legislation and the relevant legal basis has been established.
If the purpose of processing is changed, the Company will take the measures required by applicable legislation, including obtaining additional consent where required.

6. Legal Grounds for Processing
Depending on the particular processing activity, the Company may process personal data on one or more of the following grounds permitted by the legislation of the Republic of Uzbekistan:

• your consent to the processing of your personal data;
• the necessity to process personal data for the performance of a contract to which you are a party or for taking measures at your request prior to entering into a contract;
• the necessity to comply with legal obligations applicable to the Company;
• protection of the legitimate rights and interests of you or another person;
• exercise of the rights and legitimate interests of the Company or a third party, provided that the rights and legitimate interests of the personal data subject are not violated;
• processing for statistical or other research purposes, subject to mandatory depersonalisation where required by law; or
• other grounds expressly provided for by the legislation of the Republic of Uzbekistan.

Where processing is based on your consent, the consent may be withdrawn in accordance with applicable legislation and the procedure described in this Policy.

7. Consent to Processing
Where your consent is required, the Company obtains your consent in a form that allows the fact of obtaining such consent to be confirmed.
By submitting personal data through a Website form accompanied by an appropriate consent mechanism, you confirm that you have been informed about the relevant processing of your personal data and consent to such processing to the extent specified in the applicable consent.
The consent may specify:

• the identity of the Operator;
• the personal data subject;
• the purposes of processing;
• the categories or specific types of personal data processed;
• the period or term for which the consent is valid;
• whether personal data may be provided to third parties;
• whether cross-border transfer of personal data is envisaged;
• whether the personal data may be distributed through publicly available sources; and
• other information required by applicable legislation.

You may withdraw your consent in the form in which it was provided or in another form permitted by applicable legislation.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Where the Company has another lawful basis for continued processing, the withdrawal of consent will not necessarily require the Company to cease all processing of the relevant personal data.

8. Use of the Website, Cookies and Statistics
The Website does not use third-party web analytics tools, advertising trackers or advertising pixels.
The Website is hosted on Tilda. Tilda’s built-in statistics operates in simplified mode and may record page views without using analytics cookies. Tilda may use strictly necessary cookies or similar technologies required for the security and correct operation of the Website.
The Company does not use information collected through such technologies for behavioural advertising or profiling.
If the Website’s use of cookies or analytics technologies changes, the Company will update this Policy and, where required by applicable legislation, obtain the necessary consent or provide the required information before introducing such processing.

9. Provision of Personal Data to Third Parties
We may provide access to personal data to third parties where this is necessary for the purposes described in this Policy and is permitted by applicable legislation.
Such third parties may include:

• service providers supporting the operation of the Website;
• hosting and IT infrastructure providers;
• providers of email and communication services;
• professional advisers and contractors;
• government authorities and other persons where disclosure is required by law; and
• other persons where you have provided the required consent.

Where personal data are processed by a third party on behalf of the Company, the Company takes appropriate contractual, organisational and technical measures to ensure that such processing is carried out in accordance with applicable personal data protection requirements.

10. Cross-Border Transfers
Personal data may be transferred or made accessible outside the Republic of Uzbekistan only where such transfer or access is permitted under applicable legislation of the Republic of Uzbekistan.
Where cross-border transfer of personal data is required, the Company will assess the applicable legal requirements, including requirements concerning the level of protection in the recipient country and any applicable consent or contractual safeguards.
Where the law requires your consent to a cross-border transfer, such consent will be obtained in the manner prescribed by applicable legislation.

11. Storage of Personal Data
The Company stores personal data in a form that permits identification of the personal data subject for no longer than is necessary to achieve the purposes for which the personal data were collected, unless a longer retention period is required or permitted by law or by an applicable agreement.
The retention period may depend on:

• the purpose for which the personal data were collected;
• the nature of the relationship between you and the Company;
• applicable legal, regulatory, accounting or reporting requirements;
• the existence of legal claims or disputes; and
• the withdrawal of consent, where processing is based on consent.

Upon achievement of the purposes of processing, expiry of the applicable retention period, withdrawal of consent where no other lawful basis for processing exists, or in other cases required by law, personal data will be deleted, destroyed or depersonalised as required by applicable legislation.

12. Protection of Personal Data
The Company takes necessary legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, disclosure, copying, use or other unlawful processing.
Such measures may include, where appropriate:

• access controls and role-based access;
• confidentiality obligations applicable to persons authorised to access personal data;
• technical security measures;
• measures designed to preserve the integrity and availability of personal data;
• procedures for identifying and responding to personal data security incidents; and
• other measures required by applicable legislation.

The specific security measures applied by the Company may vary depending on the nature and risks associated with the relevant processing.

13. Confidentiality
Persons who have access to personal data in connection with their professional, employment or contractual duties are required to maintain the confidentiality of such data, except where disclosure is permitted or required by applicable legislation.
Personal data will not be publicly disclosed or distributed for purposes other than those specified at the time of collection unless such disclosure or distribution is permitted by law and the required consent has been obtained.

14. Your Rights
Under the applicable legislation of the Republic of Uzbekistan, you may have the right to:

• know whether the Company processes your personal data and obtain information about such processing;
• obtain information about the purposes, grounds and methods of processing;
• obtain information about the Company and persons having access to your personal data where required by law;
• request correction or supplementation of inaccurate or incomplete personal data;
• withdraw your consent to processing, where processing is based on consent;
• request temporary suspension of processing in cases provided by law, including where personal data are incomplete, outdated, inaccurate, unlawfully obtained or no longer necessary for the relevant processing purposes;
• request deletion or destruction of personal data where required by applicable legislation;
• provide or refuse consent to the distribution of personal data through publicly available sources; and
• apply to the competent state authority or a court for protection of your rights and legitimate interests concerning your personal data.

These rights are subject to limitations and conditions established by the legislation of the Republic of Uzbekistan.

15. How to Exercise Your Rights
To exercise your rights or obtain information concerning the processing of your personal data, you may contact the Company at:
Email: sales@colvir.com
Postal address: 34 Istiqbol Street, Movarounnahr MFY, Mirabad District, Tashkent, Republic of Uzbekistan.
Your request should contain sufficient information to allow the Company to identify the relevant personal data and process your request.
Where reasonably necessary to protect personal data against unauthorised disclosure, the Company may request additional information necessary to verify the identity or authority of the requester, to the extent permitted by law.
The Company will consider requests concerning personal data in accordance with the time limits and procedures established by applicable legislation.

16. Requests and Complaints
If you believe that your personal data have been processed unlawfully or that your rights have otherwise been violated, you may first contact the Company using the contact details specified in this Policy.
You also have the right to apply to the competent state authority of the Republic of Uzbekistan or to a court in accordance with applicable legislation.

17. Personal Data of Minors
The Website is not intended to collect personal data from minors unless such collection is permitted by applicable legislation and the required consent of a parent, guardian or other lawful representative has been obtained.
If we become aware that personal data of a minor have been provided to us without the required legal basis or consent, we will take appropriate measures in accordance with applicable legislation.

18. Changes to this Policy
The Company may amend this Policy from time to time to reflect changes in applicable legislation, the Company’s activities, the Website or the way personal data are processed.
The updated version of the Policy will be published on the Website with the relevant effective date.
Where required by applicable legislation, the Company will take additional measures to inform personal data subjects about material changes and/or obtain the required consent.

19. Contact Information
For questions regarding this Policy or the processing and protection of personal data, please contact the Company using the following details:
Email: sales@colvir.com
Postal address: 34 Istiqbol Street, Movarounnahr MFY, Mirabad District, Tashkent, Republic of Uzbekistan.