Privacy Policy

Version 1.0

Effective date: 1 June 2026

1. Definitions

“Operator” — Gap Technologies Ltd., a private company registered in the Astana International Financial Centre (AIFC), Republic of Kazakhstan, under business identification number 251240900919.

“Service” — the ADAT digital platform, including the website adat.uz (including адат.uz), the Telegram bot and the Telegram Mini App, as well as any related web interfaces and technical components provided by the Operator.

“User” — a natural person who has reached 18 years of age, has accepted the Service’s Public Offer, and uses the Service.

“Event” — a unit of content in the Service created by a User: an event, meeting, trip, or other activity with the ability to limit the number of participants, record participation status, and record financial arrangements.

“Personal data” — any information relating to an identified or identifiable natural person, including identifiers, contact details, information about behavior in the Service, and other data that directly or indirectly allow the data subject to be identified.

“Public Offer” — the Operator’s public offer for the use of the Service, of which this Policy forms an integral part.

“Telegram” — an instant messaging platform provided by Telegram Messenger Inc. and its affiliates; it is a platform independent of the Operator, and the relationship between the User and Telegram is governed by Telegram’s terms of service.

2. General Provisions

2.1. This Privacy Policy (hereinafter — the “Policy”) establishes the procedure and conditions for processing the personal data of Users whose data is processed by the Operator in connection with the functioning of the Service.

2.2. The Operator processes personal data in accordance with the Law of the Republic of Uzbekistan “On Personal Data” of 2 July 2019 No. LRU-547 (as amended on 27 March 2026, including the amendments introduced by the Law of 26 March 2026 No. LRU-1125), the Law of the Republic of Uzbekistan “On Protection of Consumer Rights”, as well as other applicable regulatory legal acts of the Republic of Uzbekistan.

2.3. This Policy applies to the processing of personal data carried out through all components of the Service: the website adat.uz (including адат.uz), the Telegram bot, and the Telegram Mini App — regardless of the technical means by which the User interacts with the Service.

2.4. By using the Service, the User confirms that they have read this Policy, understand its content, and have accepted it in the manner and on the terms provided for in this Policy.

2.5. If the User does not agree with the terms of this Policy, they must refrain from using the Service.

3. Categories of Personal Data Processed

3.1. Data received automatically from the Telegram platform

When a User interacts with the Telegram bot or the Telegram Mini App, the Operator automatically receives from the Telegram platform the User’s profile data (identifier, display name and Telegram username, profile photo, interface language, Premium subscription status — to the extent provided by the platform) and technical launch parameters necessary to verify the authenticity of the Telegram session and to protect against unauthorized requests.

Some of the technical launch parameters are processed before the consent screen is displayed — for the purpose of verifying that the launch was performed from Telegram and ensuring security.

The Operator does not request from Telegram any data about the User other than that listed. The Service’s Telegram bot does not collect personal data independently until the User opens the Telegram Mini App.

3.2. Data generated in the course of using the Service

Within the functioning of the Service, the Operator records the following data about the User’s actions: role and participation status in a group; the status of performance of financial arrangements and the corresponding amounts entered by the User independently; data about meetings created and reports on them, including participation marks.

In the course of using the Service, the User may voluntarily provide the following personal data:

  • mobile phone number;
  • region and locality of residence or location;
  • date of birth;
  • gender;
  • preferred interface language.

The User also creates user content in the Service: groups and their settings, meetings and information about the venue, as well as photographs uploaded to design a group.

The provision of the above data is entirely voluntary. Refusal to provide it does not prevent the use of the Service’s main functionality, except for functions for the technical operation of which the relevant data is necessary.

3.3. Technical data and data on the use of the Service

The Operator automatically collects the following technical data for the purposes of ensuring security, troubleshooting, analytics, and developing the Service:

  • data on actions in the Service (usage events, navigation between screens, interaction with interface elements);
  • technical session identifiers;
  • information about errors and exceptions occurring during use of the Service;
  • the device’s IP address at the time of login (used solely to protect against unauthorized access; not used for profiling or analytics);
  • the type of device, browser, or Telegram client and their versions.

The Service uses external reference services to display information about holidays and events; Users’ personal data is not transferred in doing so.

3.4. Cookies and analytics technologies (website adat.uz)

On the website adat.uz, the Operator uses cookies and similar tracking technologies. Depending on their purpose, cookies are divided into the following categories:

  • technical (strictly necessary): ensure the correct operation of the site, session persistence, and protection against unauthorized requests; cannot be disabled without impairing the functionality of the site;
  • functional: remember language preferences and site display settings; operate during the current session or a fixed period;
  • analytical: collect anonymized data on site traffic and behavior, including: a conditional session identifier, the source of referral to the site, pages viewed and visit duration, device and browser type, and the browser’s country and language. This data is used solely in aggregated form to analyze traffic and improve the Service.

The User has the right to restrict or prohibit the use of cookies through their browser settings. Disabling analytical cookies does not affect access to the site’s functionality.

4. Purposes and Legal Bases of Processing

4.1. The Operator processes personal data solely for predetermined, explicitly specified, and lawful purposes. The use of personal data for purposes not provided for in this Policy is not permitted without obtaining the data subject’s new consent.

The Operator processes personal data for the following purposes:

  • identifying the User and providing access to the Service;
  • ensuring the functioning of the Service: creating Events, managing groups, recording participation status;
  • displaying the User’s profile to other Users within a specific Event;
  • ensuring security and preventing abuse;
  • analytics and development of the Service;
  • compliance with the requirements of applicable law.

4.2. The Operator does not use personal data to make automated decisions that have legal or other significant consequences for the data subject.

5. Consent to the Processing of Personal Data

5.1. The User’s consent to the processing of personal data is expressed by accepting this Policy and the Public Offer in the Telegram Mini App upon first use of the Service.

5.2. Consent is voluntary, specific, informed, and unambiguous within the meaning of Article 21 of the Law of the Republic of Uzbekistan “On Personal Data”. The User may withdraw previously given consent at any time by sending a corresponding request by email or through the Service interface (where the relevant function is available).

5.3. Withdrawal of consent results in the cessation of processing of personal data carried out solely on the basis of such consent. Withdrawal of consent is not a ground for ceasing processing carried out on another lawful basis (performance of a contract, requirement of law). Withdrawal of consent may result in the inability to use certain functions of the Service.

6. Transfer of Personal Data to Third Parties

6.1. The Operator has the right to transfer personal data to the following categories of recipients:

  • Cloud providers and infrastructure services — for the purposes of hosting, data storage, and ensuring the operation of the Service.
  • Analytics providers — for processing anonymized data on traffic and use of the Service.
  • Contractors and technical partners — persons providing the Operator with technical support and development services, subject to confidentiality obligations.
  • Government and authorized bodies — solely in the cases and to the extent provided for by applicable law.

6.2. The Operator does not sell personal data to third parties and does not transfer it for advertising purposes without the data subject’s separate consent.

7. Cross-Border Transfer of Personal Data

7.1. In connection with the use of cloud infrastructure, Users’ personal data may be processed and stored outside the Republic of Uzbekistan.

7.2. Cross-border transfer of personal data is carried out by the Operator in accordance with Article 27¹ of the Law of the Republic of Uzbekistan “On Personal Data” in the version effective from 27 March 2026.

7.3. The Operator takes reasonable technical and organizational measures to ensure that, in the course of cross-border transfer, Users’ personal data is protected at a level equivalent to the protection standards established by the legislation of the Republic of Uzbekistan.

8. Retention and Deletion Periods for Personal Data

8.1. The Operator retains personal data for the duration of the User’s use of the Service, as well as for a reasonable period after the cessation of use necessary to fulfil the Operator’s obligations and to comply with the requirements of applicable law. Upon achievement of the processing purposes or upon expiry of the established periods, personal data is deleted or anonymized.

Data for which applicable legislation of the Republic of Uzbekistan establishes mandatory retention periods is retained for such periods regardless of the User’s cessation of use of the Service.

8.2. Upon expiry of the established retention periods, or upon receipt of a confirmed request from the data subject for deletion, the Operator deletes or anonymizes personal data in a manner that precludes the possibility of its restoration, except for data the mandatory retention of which is provided for by applicable law.

9. Rights of Personal Data Subjects

9.1. In accordance with the legislation of the Republic of Uzbekistan, a personal data subject has the right to:

  • obtain confirmation of the fact of processing of their personal data by the Operator, as well as a copy of the data being processed;
  • demand the correction of inaccurate, incomplete, or outdated personal data;
  • demand the deletion of personal data (“right to be forgotten”) where there are grounds provided for by law;
  • withdraw previously given consent to the processing of personal data, with the consequences provided for in clause 5.3 of this Policy;
  • obtain from the Operator information about the purposes of processing, the composition of the data being processed, the recipients of personal data, and their retention periods;
  • obtain information about instances of cross-border transfer of their personal data;
  • appeal against the actions (inaction) of the Operator to the authorized body for the protection of personal data of the Republic of Uzbekistan.

9.2. To exercise the rights listed above, the personal data subject sends a request by email. The request must contain: the subject’s surname and first name or another identifying attribute (Telegram identifier), a description of the requested action, and the method of receiving a response.

9.3. The Operator considers subjects’ requests within the periods established by the legislation of the Republic of Uzbekistan, and in the absence of such periods — within a reasonable period not exceeding 30 (thirty) calendar days from receipt of the request, provided that the information is sufficient to identify the subject.

10. Measures for the Protection of Personal Data

10.1. The Operator implements the technical and organizational measures necessary to protect personal data against unauthorized access, destruction, alteration, blocking, copying, and distribution, as well as against other unlawful actions of third parties.

10.2. The measures applied correspond to the nature of the data being processed and the current level of technological development.

10.3. Upon detection of an information security incident affecting Users’ personal data, the Operator immediately takes measures to localize and eliminate its consequences and, where necessary, informs the authorized bodies in the manner established by applicable law.

11. Amendments to this Policy

11.1. The Operator has the right to make amendments to this Policy. Each new version is formalized as a numbered version with an indication of its effective date and is kept in the Operator’s archive.

11.2. The Operator notifies Users of amendments by publishing the updated version of the Policy on the website adat.uz and/or through the Service interface. The new version comes into force from the moment of its publication, unless a different period is specified in the text of the new version.

11.3. If the amendments introduced entail the need to obtain the data subject’s new consent (in particular, where the purposes of processing change or the categories of data processed are expanded), the Operator ensures that the User again completes the consent procedure before processing begins within the new purposes or new categories of data.

12. Final Provisions and Contact Information

12.1. The official versions of this Policy are drawn up in Russian and Uzbek and constitute the versions applicable to the processing of personal data from its effective date. This English version is provided for information purposes only and has no independent legal force; in the event of any discrepancy, the Russian and Uzbek versions shall prevail.

12.2. This Policy is governed by the legislation of the Republic of Uzbekistan.

12.3. On all matters related to the processing of personal data, the personal data subject has the right to contact the Operator:

Operator Details:

  • Gap Technologies Ltd.
  • AIFC “Astana”, Republic of Kazakhstan
  • BIN: 251240900919
  • Email: info@gaptech.io
  • Website: adat.uz