Personal data processing policy
The «EzguSavdo» service — EZGUPRO LLC, Tashkent, Republic of Uzbekistan
history_edu Redaction 5 of 23 October 2026.
This is a translation provided for convenience. The legally binding redaction is the Russian one, published at ezgusavdo.uz/ru/legal/privacy. In case of any discrepancy, the Russian text prevails.
Apps for third-party marketplaces. Data processing in the «EzguSavdo: orders from chat to CRM» app for Bitrix24 is governed by a separate document — the Bitrix24 app privacy policy. Data processing in the Shopify app is governed by the connector app privacy policy. This Policy applies to them in the part they do not govern.
1. General provisions
1.1. This Policy sets out how personal data is processed when the «EzguSavdo» software (the Platform) is used, and forms an integral part of the Public Offer, published at ezgusavdo.uz/en/legal/offer.
1.2. Personal data is processed in accordance with the Law of the Republic of Uzbekistan «On personal data» No. ZRU-547 of 02.07.2019 (the Personal Data Law) as amended by Law No. ZRU-1125 of 26.03.2026, and other legal acts of the Republic of Uzbekistan.
1.3. The terms «personal data», «operator», «processing» and «cross-border transfer» are used as defined in the Personal Data Law.
2. Allocation of roles
2.1. The Platform is provided to legal entities and individual entrepreneurs (the Client) to automate communication with their customers.
2.2. In respect of the personal data of end customers, the Client acts as the operator: it determines the purposes and scope of processing, builds the catalog and the AI seller’s settings, interacts with data subjects and is responsible for having lawful grounds for processing.
2.3. In respect of the same data, EZGUPRO LLC acts as the person carrying out the processing of personal data on the operator’s instructions. The Company processes data solely to the extent and for the purposes necessary for the operation of the Platform, and does not itself determine the purposes of such processing.
2.4. In respect of the personal data of the Client’s representatives (contact persons, users of the Personal Cabinet), EZGUPRO LLC acts as the operator and processes that data for the purposes of concluding and performing the agreement, issuing invoices and providing technical support.
3. Data categories and purposes of processing
| Category | Composition | Purpose | Legal basis |
|---|---|---|---|
| End customer data | User identifier in the communication channel, display name, content of dialog messages, voice messages and their transcripts, images sent by the customer | Generating the AI seller’s reply, product selection, keeping the dialog history | Operator’s (Client’s) instructions; the subject’s consent obtained by the Client |
| Contact details provided by the customer | Name, phone number, delivery address — if the customer provided them in the dialog | Transfer to the Client for placing and fulfilling the order | Operator’s (Client’s) instructions |
| Data of the Client’s representatives | Full name, position, work phone, email address | Concluding and performing the agreement, invoices and acts, technical support | Performance of the agreement |
| Technical data | IP address, session data, logs of requests to the Platform | Ensuring the operability and security of the Platform, investigating incidents | Legitimate interest of the operator |
| Advertising referral and visit data | Cookie and ad-click identifiers, campaign tags, IP address, browser information | Measuring the effectiveness of the Platform’s advertising, statistics of visits to the website and the Personal Cabinet | Consent of the subject; legitimate interest of the operator |
3.1. The Company does not collect or request biometric or genetic personal data, the personal data of users of telecommunications services, or special categories of personal data.
3.2. The Client is prohibited from placing in the Platform and transferring to the Company biometric and genetic personal data, as well as the personal data of users of telecommunications services. Such data is subject to mandatory localisation in the territory of the Republic of Uzbekistan under article 27-1 of the Personal Data Law.
4. Localisation and cross-border transfer
4.1. Under article 27-1 of the Personal Data Law as amended by Law No. ZRU-1125 of 26.03.2026, only biometric and genetic personal data and the personal data of users of telecommunications services are subject to mandatory placement on technical means physically located in the territory of the Republic of Uzbekistan. Personal data of other categories may be processed outside the Republic of Uzbekistan where one of the grounds set out in part three of that article is present.
4.2. Part of the processed data is placed on technical means located in the territory of the Republic of Uzbekistan. Processing on those means does not constitute cross-border transfer.
4.3. For the remainder, the operation of the Platform involves cross-border transfer of personal data to the persons listed in section 5. Transfer takes place to the minimum extent necessary to generate the AI seller’s reply and to operate the Platform.
4.4. The Company takes measures to minimise the volume of personal data transferred and does not transfer to the persons in section 5 any data that is not required for the relevant operation.
4.5. The Client, as the operator, ensures that a lawful ground for cross-border transfer exists and that the necessary consents of end customers have been obtained.
5. Persons engaged in processing
| Category | Purpose of processing | Categories of data transferred | Place of processing |
|---|---|---|---|
| Cloud infrastructure providers | Hosting the Platform, databases, files and backups | All categories in section 3 | Member States of the European Union |
| Artificial intelligence model providers | Generating the AI seller’s replies, speech and image recognition, catalog search | Content of dialog messages, voice messages and images sent by the customer; the store’s catalog and knowledge base data | USA, Member States of the European Union, countries of Asia — depending on the provider’s processing regions |
| Message delivery services | Sign-in and registration codes, messages to the Client’s representatives, service notifications of the Platform team | Contact details of the Client’s representative (e-mail address, phone number, messenger identifier); service information required for support and incident investigation | United Arab Emirates, Russian Federation |
| Payment operators | Payment for the Platform’s services | Phone number of the Client’s representative, payment amount and purpose; when a bank card is linked — its details, which are transferred to the operator and are not stored by the Company | Republic of Uzbekistan |
| Advertising and analytics platforms | Measuring the effectiveness of the Platform’s advertising, statistics of visits to the website and the Personal Cabinet | Advertising referral and visit data (section 3) | Ireland, USA, Russian Federation |
| Authentication services | Signing in to the Personal Cabinet with an external account | E-mail address and name of the Client’s representative received from the service | USA |
| The Company’s own technical means | Storage and processing of Platform data | All categories in section 3 | Republic of Uzbekistan |
5.1. The Company may choose and replace persons within the categories in the table based on availability, quality and cost of processing, provided that the basic functionality of the Platform is preserved. Each person receives only the categories of data stated for its category and required for the relevant operation. The list of the specific persons engaged in processing (the List of persons engaged in processing) is provided to the Client on request sent to i@ezgusavdo.uz.
5.2. The Company notifies Clients of changes to the List of persons engaged in processing in the Personal Cabinet no later than 15 calendar days before the changes take effect. If the Client disagrees, it is entitled to terminate the agreement before that date without measures of liability being applied to it.
5.3. Platforms and services that the Client connects to the Platform at its own discretion — channels of communication with customers (messengers, social networks), CRM and accounting systems, voice assistants — are not persons engaged by the Company in processing. Processing of data in those services is governed by their own terms, accepted by the Client and the end customer independently; the Company transfers to them only the data required for the function the Client has enabled.
5.4. AI assistants connected by the Client. The Client may, at its own discretion, connect to the Platform an AI assistant of a third-party provider through a connector for AI assistants. The provider of such an assistant is not a person engaged by the Company in processing: it is chosen and connected by the Client itself, and processing of data by the provider is governed by terms the Client accepts independently. Clause 5.1 does not apply to these operations.
5.5. After a representative of the Client has signed in to the Personal Cabinet and expressly approved the connection, the AI assistant, on the Client’s instructions, receives and changes only the data of the Client’s store: the store name, information about the plan and use of limits, the product catalog (names, prices, stock, categories, brands, SKUs, descriptions), and the content of price lists that the Client itself uploads for import. The following are not transferred through the connector: end customer data, dialog content, orders, payment data, the e-mail address and other account identifiers, minimum prices and discount limits. Changes made through the connector are recorded in the store’s action log, stating the connector.
6. Retention and deletion
6.1. The personal data of end customers is retained for the term of the agreement with the Client.
6.2. Upon termination of the agreement, data processed on the Client’s instructions is deleted within 30 calendar days, except for data whose retention is mandatory under legislation. Upon the Client’s written request submitted before the expiry of that period, the data is exported in a machine-readable format.
6.3. Data of the Client’s representatives and documents relating to the performance of the agreement are retained for the periods established by the legislation on accounting and archives.
6.4. Anonymised dialog data may be used by the Company to improve the quality of the Platform without a time limit and does not constitute personal data.
6.5. Records of access granted to AI assistants (clause 5.4) are kept for as long as the access is valid and are deleted after it expires or is revoked. A price list uploaded through the connector is not stored as a file; the result of parsing it is deleted automatically within two days at the latest. Action log entries are retained for the term of the agreement.
7. Protection measures
7.1. The Company applies organisational and technical measures to protect personal data, including: isolation of each Client’s data at the level of the store identifier; segregation of employee access rights on a least-privilege basis; encryption of data in transit; access logging; backups.
7.2. Access by the Company’s employees to the content of dialogs is granted only to the extent necessary to provide technical support and investigate incidents.
8. Incidents
8.1. The Company notifies the Client of any incident that becomes known to it affecting personal data processed on the Client’s instructions, within 72 hours of the detection of the incident.
8.2. The notification states the nature of the incident, the presumed categories and volume of affected data, and the measures taken and planned.
8.3. Notification of the authorised state body and of data subjects, where required by legislation, is carried out by the Client as the operator; the Company provides the Client with the necessary assistance.
9. Rights of data subjects
9.1. A data subject is entitled to obtain information about the processing of their data, to require its correction, blocking or destruction, and to withdraw consent to processing.
9.2. Since the Client is the operator in respect of end customer data, subject requests are addressed to the Client. The Company, as the processor, assists the Client in fulfilling such requests within a period not exceeding 10 business days from the date the Client’s request is received.
9.3. Requests concerning the data of the Client’s representatives are addressed directly to the Company at i@ezgusavdo.uz and are considered within the periods established by the Personal Data Law.
9.4. The Client may revoke an AI assistant’s access at any time in the Personal Cabinet (Settings → Integrations → AI assistants, «Disconnect»). Revocation takes effect immediately: the assistant’s next request to the Platform is refused.
10. Registration of the personal data database
10.1. The procedure for, and the necessity of, registering a personal data database in the State Register of Personal Data Databases are determined by the legislation of the Republic of Uzbekistan. The Company performs the relevant obligations in the established manner.
11. Changes to the Policy
11.1. The Company is entitled to amend this Policy. The new redaction is published at ezgusavdo.uz/ru/legal/privacy stating the date of the redaction.
11.2. Clients are notified of material changes, including changes to the List of persons engaged in processing (section 5), in the Personal Cabinet no later than 15 calendar days in advance.
11.3. An archive of previous redactions is available on request at i@ezgusavdo.uz.
12. Company details
| Name | EZGUPRO Limited Liability Company |
| Taxpayer ID (INN) | 313189635 |
| Address | 100121, Republic of Uzbekistan, Tashkent, Yakkasaray district, MFY Meros, Bogiboston street, 186/188 |
| Contact for personal data matters | i@ezgusavdo.uz |
| Phone | +998 93 933 90 90 |
Annex. Special terms for data received from Meta platforms
This Annex is not part of sections 1–12 of the Policy and is published in addition to them. It sets out the commitments undertaken by the Company under the Meta Platform Terms and Developer Policies in respect of the Instagram Direct and WhatsApp channels, and does not amend or limit sections 1–12. Clause 5.3 of the Policy remains in force: channel owners are not persons engaged by the Company in processing.
A.1. When the Client connects the Instagram Direct and/or WhatsApp channels, the Platform receives data from the Meta Platforms, Inc. platforms («Meta Platform Data»): messages from the Client’s customers, identifiers and profile data necessary to receive and handle enquiries and to conduct correspondence on the Client’s behalf.
A.2. The Company uses Meta Platform Data solely to provide the service to the Client to whom that data belongs: receiving incoming messages, replying to customers, advising them, helping to select a product and place an order, and transferring the order to the Client’s business system.
A.3. The Company does not use Meta Platform Data for its own purposes. In particular, the Company does not sell or transfer it to third parties for advertising or targeting purposes, does not use it to build advertising profiles, does not combine the data of different Clients, and does not apply it for purposes unrelated to providing the service to the relevant Client.
A.4. Meta Platform Data is retained no longer than is necessary to provide the service to the Client and is deleted at the Client’s request or upon termination of the service, except for information subject to retention by law. The deletion procedure is described in the Data Deletion Policy.
A.5. Meta Platform Data is processed in accordance with the applicable Meta platform terms and the legislation of the Republic of Uzbekistan, including the requirements on localisation and on the grounds for cross-border transfer set out in sections 3 and 4 of this Policy.