Personal data processing policy
The «EzguSavdo» service — EZGUPRO LLC, Tashkent, Republic of Uzbekistan
history_edu Redaction 1 of 15 September 2026.
This is a translation provided for convenience. The legally binding redaction is the Russian one, published at ezgusavdo.uz/ru/legal/privacy. In case of any discrepancy, the Russian text prevails.
Apps for third-party marketplaces. Data processing in the «EzguSavdo: orders from chat to CRM» app for Bitrix24 is governed by a separate document — the Bitrix24 app privacy policy. Data processing in the Shopify app is governed by the connector app privacy policy. This Policy applies to them in the part they do not govern.
1. General provisions
1.1. This Policy sets out how personal data is processed when the «EzguSavdo» software (the Platform) is used, and forms an integral part of the Public Offer, published at ezgusavdo.uz/en/legal/offer.
1.2. Personal data is processed in accordance with the Law of the Republic of Uzbekistan «On personal data» No. ZRU-547 of 02.07.2019 (the Personal Data Law) as amended by Law No. ZRU-1125 of 26.03.2026, and other legal acts of the Republic of Uzbekistan.
1.3. The terms «personal data», «operator», «processing» and «cross-border transfer» are used as defined in the Personal Data Law.
2. Allocation of roles
2.1. The Platform is provided to legal entities and individual entrepreneurs (the Client) to automate communication with their customers.
2.2. In respect of the personal data of end customers, the Client acts as the operator: it determines the purposes and scope of processing, builds the catalog and the AI seller’s settings, interacts with data subjects and is responsible for having lawful grounds for processing.
2.3. In respect of the same data, EZGUPRO LLC acts as the person carrying out the processing of personal data on the operator’s instructions. The Company processes data solely to the extent and for the purposes necessary for the operation of the Platform, and does not itself determine the purposes of such processing.
2.4. In respect of the personal data of the Client’s representatives (contact persons, users of the Personal Cabinet), EZGUPRO LLC acts as the operator and processes that data for the purposes of concluding and performing the agreement, issuing invoices and providing technical support.
3. Data categories and purposes of processing
| Category | Composition | Purpose | Legal basis |
|---|---|---|---|
| End customer data | User identifier in the communication channel, display name, content of dialog messages, voice messages and their transcripts, images sent by the customer | Generating the AI seller’s reply, product selection, keeping the dialog history | Operator’s (Client’s) instructions; the subject’s consent obtained by the Client |
| Contact details provided by the customer | Name, phone number, delivery address — if the customer provided them in the dialog | Transfer to the Client for placing and fulfilling the order | Operator’s (Client’s) instructions |
| Data of the Client’s representatives | Full name, position, work phone, email address | Concluding and performing the agreement, invoices and acts, technical support | Performance of the agreement |
| Technical data | IP address, session data, logs of requests to the Platform | Ensuring the operability and security of the Platform, investigating incidents | Legitimate interest of the operator |
3.1. The Company does not collect or request biometric or genetic personal data, the personal data of users of telecommunications services, or special categories of personal data.
3.2. The Client is prohibited from placing in the Platform and transferring to the Company biometric and genetic personal data, as well as the personal data of users of telecommunications services. Such data is subject to mandatory localisation in the territory of the Republic of Uzbekistan under article 27-1 of the Personal Data Law.
4. Localisation and cross-border transfer
4.1. Under article 27-1 of the Personal Data Law as amended by Law No. ZRU-1125 of 26.03.2026, only biometric and genetic personal data and the personal data of users of telecommunications services are subject to mandatory placement on technical means physically located in the territory of the Republic of Uzbekistan. Personal data of other categories may be processed outside the Republic of Uzbekistan where one of the grounds set out in part three of that article is present.
4.2. Part of the processed data is placed on technical means located in the territory of the Republic of Uzbekistan. Processing on those means does not constitute cross-border transfer.
4.3. For the remainder, the operation of the Platform involves cross-border transfer of personal data to the persons listed in section 5. Transfer takes place to the minimum extent necessary to generate the AI seller’s reply and to operate the Platform.
4.4. The Company takes measures to minimise the volume of personal data transferred and does not transfer to the persons in section 5 any data that is not required for the relevant operation.
4.5. The Client, as the operator, ensures that a lawful ground for cross-border transfer exists and that the necessary consents of end customers have been obtained.
5. List of persons engaged in processing
| No. | Person | Purpose of processing | Categories of data transferred | Jurisdiction |
|---|---|---|---|---|
| 1 | Google Cloud EMEA Limited | Computing infrastructure, storage of databases and backups | All categories in section 3 | Ireland |
| 2 | Google LLC | Generating the AI seller’s replies, speech recognition | Content of dialog messages, voice messages | USA |
| 3 | OpenAI, L.L.C. | Generating the AI seller’s replies, speech recognition | Content of dialog messages, voice messages | USA |
| 4 | Anthropic PBC | Generating the AI seller’s replies | Content of dialog messages | USA |
| 5 | EZGUPRO LLC, own infrastructure | Storage and processing of Platform data | All categories in section 3 | Republic of Uzbekistan |
5.1. The Company uses several providers of computing capacity and of large language models and is entitled to choose between them for individual operations based on availability, quality and cost of processing, provided that the basic functionality of the Platform is preserved. Large language model providers process only the content of dialog messages and voice messages and receive no other categories of data.
5.2. The Company notifies Clients of changes to this list in the Personal Cabinet no later than 15 calendar days before the changes take effect. If the Client disagrees, it is entitled to terminate the agreement before that date without measures of liability being applied to it.
5.3. The platforms through which communication with customers takes place (the communication channels connected by the Client) are not persons engaged by the Company in processing. Processing of data in those services is governed by their own terms, accepted by the Client and the end customer independently.
6. Retention and deletion
6.1. The personal data of end customers is retained for the term of the agreement with the Client.
6.2. Upon termination of the agreement, data processed on the Client’s instructions is deleted within 30 calendar days, except for data whose retention is mandatory under legislation. Upon the Client’s written request submitted before the expiry of that period, the data is exported in a machine-readable format.
6.3. Data of the Client’s representatives and documents relating to the performance of the agreement are retained for the periods established by the legislation on accounting and archives.
6.4. Anonymised dialog data may be used by the Company to improve the quality of the Platform without a time limit and does not constitute personal data.
7. Protection measures
7.1. The Company applies organisational and technical measures to protect personal data, including: isolation of each Client’s data at the level of the store identifier; segregation of employee access rights on a least-privilege basis; encryption of data in transit; access logging; backups.
7.2. Access by the Company’s employees to the content of dialogs is granted only to the extent necessary to provide technical support and investigate incidents.
8. Incidents
8.1. The Company notifies the Client of any incident that becomes known to it affecting personal data processed on the Client’s instructions, within 72 hours of the detection of the incident.
8.2. The notification states the nature of the incident, the presumed categories and volume of affected data, and the measures taken and planned.
8.3. Notification of the authorised state body and of data subjects, where required by legislation, is carried out by the Client as the operator; the Company provides the Client with the necessary assistance.
9. Rights of data subjects
9.1. A data subject is entitled to obtain information about the processing of their data, to require its correction, blocking or destruction, and to withdraw consent to processing.
9.2. Since the Client is the operator in respect of end customer data, subject requests are addressed to the Client. The Company, as the processor, assists the Client in fulfilling such requests within a period not exceeding 10 business days from the date the Client’s request is received.
9.3. Requests concerning the data of the Client’s representatives are addressed directly to the Company at i@ezgusavdo.uz and are considered within the periods established by the Personal Data Law.
10. Registration of the personal data database
10.1. The procedure for, and the necessity of, registering a personal data database in the State Register of Personal Data Databases are determined by the legislation of the Republic of Uzbekistan. The Company performs the relevant obligations in the established manner.
11. Changes to the Policy
11.1. The Company is entitled to amend this Policy. The new redaction is published at ezgusavdo.uz/ru/legal/privacy stating the date of the redaction.
11.2. Clients are notified of material changes, including changes to the list in section 5, in the Personal Cabinet no later than 15 calendar days in advance.
11.3. An archive of previous redactions is available on request at i@ezgusavdo.uz.
12. Company details
| Name | EZGUPRO Limited Liability Company |
| Taxpayer ID (INN) | 313189635 |
| Address | 100121, Republic of Uzbekistan, Tashkent, Yakkasaray district, MFY Meros, Bogiboston street, 186/188 |
| Contact for personal data matters | i@ezgusavdo.uz |
| Phone | +998 93 933 90 90 |
Annex. Special terms for data received from Meta platforms
This Annex is not part of sections 1–12 of the Policy and is published in addition to them. It sets out the commitments undertaken by the Company under the Meta Platform Terms and Developer Policies in respect of the Instagram Direct and WhatsApp channels, and does not amend or limit sections 1–12. Clause 5.3 of the Policy remains in force: channel owners are not persons engaged by the Company in processing.
A.1. When the Client connects the Instagram Direct and/or WhatsApp channels, the Platform receives data from the Meta Platforms, Inc. platforms («Meta Platform Data»): messages from the Client’s customers, identifiers and profile data necessary to receive and handle enquiries and to conduct correspondence on the Client’s behalf.
A.2. The Company uses Meta Platform Data solely to provide the service to the Client to whom that data belongs: receiving incoming messages, replying to customers, advising them, helping to select a product and place an order, and transferring the order to the Client’s business system.
A.3. The Company does not use Meta Platform Data for its own purposes. In particular, the Company does not sell or transfer it to third parties for advertising or targeting purposes, does not use it to build advertising profiles, does not combine the data of different Clients, and does not apply it for purposes unrelated to providing the service to the relevant Client.
A.4. Meta Platform Data is retained no longer than is necessary to provide the service to the Client and is deleted at the Client’s request or upon termination of the service, except for information subject to retention by law. The deletion procedure is described in the Data Deletion Policy.
A.5. Meta Platform Data is processed in accordance with the applicable Meta platform terms and the legislation of the Republic of Uzbekistan, including the requirements on localisation and on the grounds for cross-border transfer set out in sections 3 and 4 of this Policy.