1. GENERAL PROVISIONS

1.1. This Privacy and Personal Data Processing Policy (hereinafter the “Policy”) sets out the procedure for collecting, processing, using, storing, transferring and protecting personal data and other confidential information when using the “Azma Finance” software.
1.2. The personal data controller/operator is AZMA ACCOUNTING LLC, TIN 310677164, registered in accordance with the laws of the Republic of Uzbekistan, registered address: Republic of Uzbekistan, Tashkent, 70 Kichik Beshagach St. (hereinafter “AZMA” or the “Operator”).
1.3. This Policy applies when using:
a) the informational website www.azma.uz (hereinafter the “Website”);
b) the “Azma Finance” software available, in particular, at app.azma.uz, including the Personal Account, related software modules, integrations and other interfaces (hereinafter the “Platform”);
c) AZMA’s support service and other channels of interaction with Users.
1.4. This Policy applies to the personal data of:
a) natural persons registering and acting on the Platform on behalf of legal entities and individual entrepreneurs;
b) individual entrepreneurs;
c) directors, founders, employees and other representatives of Users;
d) natural persons who are counterparties of Users and representatives of such counterparties;
e) employees and other natural persons whose information the User uploads to the Platform when using accounting, tax, HR and other functionality;
f) natural persons contacting the support service or otherwise interacting with AZMA;
g) visitors to the Website and the Platform with respect to automatically collected technical data.
1.5. For the purposes of this Policy, “User” means a legal entity, individual entrepreneur or other business entity using the Platform on the basis of AZMA’s public offer, and “Data Subject” (“Subject”) means the natural person to whom the relevant personal data relate.
1.6. Personal data are processed in accordance with the laws of the Republic of Uzbekistan, including the Law of the Republic of Uzbekistan “On Personal Data” and legislation on informatization, electronic commerce, electronic digital signature and cybersecurity.
1.7. By an internal instrument, AZMA designates an employee or structural unit responsible for organizing the processing and protection of personal data.
1.8. Personal data databases subject to mandatory state registration under the law are registered by AZMA in the established manner. Changes to information subject to reflection in the relevant state register are entered within the periods prescribed by law.

2. LEGAL BASES FOR PROCESSING PERSONAL DATA

2.1. AZMA processes personal data where one or more legal bases provided for by law exist, including:
a) consent of the Data Subject;
b) necessity of processing to enter into or perform an agreement with the Data Subject;
c) necessity of fulfilling AZMA’s obligations established by law;
d) necessity of protecting the rights and legitimate interests of the Data Subject or another person;
e) exercise of the rights and legitimate interests of AZMA or a third party, provided that such processing does not violate the rights and legitimate interests of the Data Subject;
f) processing of anonymized data for statistical, analytical and research purposes;
g) processing of information lawfully obtained from publicly available sources;
h) other grounds provided for by the laws of the Republic of Uzbekistan.
2.2. When registering on the Platform, a natural person confirms having read this Policy and, where processing is based on consent, grants such consent by an action that reliably confirms receipt of that consent.
2.3. Obtaining general consent to this Policy does not replace separate consent where the law requires a special form of consent for the relevant category of data or method of processing.
2.4. For the processing of special categories of personal data, AZMA ensures the availability of written consent, including in electronic form, or another legal basis provided for by law.
2.5. Where the User provides AZMA with the personal data of its employees, representatives, founders, counterparties or other natural persons, the User must, prior to such transfer, ensure the existence of a legal basis provided for by law for processing and transferring the relevant data to AZMA.
The User is responsible for the lawfulness of obtaining and providing such data to AZMA and, upon AZMA’s request, must confirm the existence of the relevant legal basis.
2.6. AZMA processes third-party personal data transferred by the User solely to the extent necessary to provide the User with the functionality contemplated by the Platform and to comply with applicable legal requirements.

3. CATEGORIES OF PROCESSED INFORMATION

3.1. Registration and Account Data
When registering for and using the Personal Account, the following may be processed:
a) surname, first name and patronymic;
b) mobile telephone number;
c) email address;
d) job title and information on authority;
e) identifier or username in the communication channels used;
f) information about the User on whose behalf the natural person acts;
g) data necessary for authentication and access management.
3.2. Data on the User and Its Representatives
Depending on the functionality used, the following may be processed:
a) name and details of the User;
b) TIN (INN) and PINFL, if applicable;
c) information on the director and founders;
d) addresses;
e) bank details;
f) information on the tax regime;
g) information on the authority of representatives;
h) other information necessary to identify the User and perform the agreement.
Information about a legal entity that does not in itself relate to an identified or identifiable natural person does not constitute personal data, but may be protected by AZMA as confidential information.
3.3. Accounting, Tax and HR Data
When using the relevant Platform functionality, AZMA may process the following containing personal data:
a) primary accounting documents;
b) contracts, invoices, acceptance acts and electronic tax invoices;
c) bank statements and settlement information;
d) information on wages, accruals and deductions;
e) information on employees, hiring, transfers, dismissal, leave and other HR events;
f) information necessary to calculate taxes, social and other mandatory payments;
g) documents and information necessary to prepare accounting, tax, statistical and other reports;
h) data of representatives and natural persons who are counterparties of the User;
i) other information directly contained in documents uploaded to or generated through the Platform.
3.4. Biometric and Genetic Data
The standard functionality of Azma Finance is not intended for the targeted collection and processing of genetic data or biometric data for the purpose of identifying a person.
The User must not upload such data without objective necessity and a legal basis provided for by law.
Where such data are processed by virtue of a separate lawful function, AZMA applies to them the special processing and storage regime established by the laws of the Republic of Uzbekistan.
3.5 EDS and Authentication Data
Depending on the functionality used, AZMA may process:
a) EDS certificate details;
b) data on the certificate holder;
c) validity period and status of the certificate;
d) identifiers of operations performed with the EDS;
e) technical logs of EDS usage;
f) private key, password or other technical access data—only where the relevant Platform architecture provides for their connection and processing in order to execute the User’s mandate.
Data enabling an action to be performed using an EDS are treated by AZMA as restricted-access information and are used strictly within the scope of the mandate granted by the User.
3.6. Payment Information
When a payment is made, AZMA may receive from a bank or Payment Service:
a) payment amount and currency;
b) transaction date and status;
c) payment identifier;
d) information necessary to identify the payer;
e) limited information on the payment instrument to the extent transmitted by the Payment Service;
f) information on refunds and Recurring Payments.
Processing of bank cards and other payment credentials is also carried out by the relevant bank or Payment Service in accordance with its rules.
3.7. Technical Data
When visiting the Website and using the Platform, the following may be recorded automatically:
a) IP address;
b) connection date and time;
c) browser type and version;
d) operating system and device type;
e) session identifiers;
f) user actions in the interface;
g) information on errors and technical events;
h) login, authorization and operation logs;
i) cookies and other similar technical identifiers.
3.8. Support Inquiries
AZMA processes the content of inquiries from the User and the Data Subject, attached documents, sender information, date, time and interaction history to the extent necessary to review the inquiry, ensure service quality and resolve disputes.
3.8.1. Interaction via Telegram and Other Electronic Channels
When the User interacts with AZMA via Telegram, SMS and other electronic communication channels used by the Parties, AZMA may process the content of messages, attached documents and files, contact details, date and time of dispatch, correspondence history and other information contained in such messages solely for the purposes of performing the agreement, identifying the User, processing inquiries, providing Platform functionality, creating tasks, monitoring service quality and confirming interaction between the Parties.
Processing of such messages may be carried out both by authorized AZMA employees and by automated tools of the Platform, including tools for classification, analysis and information extraction, to the extent necessary for the stated purposes.
By providing third-party personal data through the said channels, the User confirms that it has lawful grounds to transfer them to AZMA.

4. PURPOSES OF PROCESSING

4.1. Personal data are processed solely for specific and legitimate purposes, including:
a) registering and identifying the User and its representatives;
b) creating and administering the Personal Account;
c) granting access to Azma Finance functionality;
d) automating accounting, tax, HR and other processes provided for by the Platform;
e) processing source data and generating documents;
f) using the EDS within the scope of the mandate granted by the User;
g) interacting with government information systems, electronic document interchange operators and other systems necessary for the operation of the relevant functionality;
h) accepting payments and managing subscriptions, Recurring Payments and refunds;
i) generating primary documents, acceptance acts, electronic invoices and other mandatory documents;
j) providing technical and user support;
k) sending service, legally significant, payment and technical notifications, including via the Platform, Telegram, SMS and other communication channels specified by the User;
l) ensuring the security of accounts and the Platform;
m) preventing and detecting fraud, unauthorized access and other violations;
n) complying with legal requirements and requirements of government authorities and courts;
o) maintaining AZMA’s accounting and tax records;
p) establishing, exercising and defending the rights of AZMA and the User, including dispute resolution;
q) analyzing performance, fixing errors and improving the Platform;
r) preparing anonymized statistics and analytics.
4.2. Personal data are not used by AZMA for a purpose incompatible with the purpose declared at the time of their collection.
4.3. If AZMA intends to use personal data for a new purpose requiring the Data Subject’s consent, such processing begins only after the relevant consent is obtained.
4.4. Advertising and marketing communications not directly related to performance of the agreement or operation of the Platform are sent to a natural person only where there is a legal basis provided for by law and, where required, separate consent.
Opting out of advertising communications does not preclude the sending of messages regarding security, payments, changes to terms, technical operation of the Platform and other notifications necessary to perform the agreement.

5. PROCESSING AND ACCESS PROCEDURE

5.1. Processing is carried out by automated means and, where necessary to provide the relevant functionality, with the involvement of authorized AZMA employees.
5.2. Access by AZMA employees is granted on a need-to-know basis and to the extent necessary to perform their duties.
5.3. Employees and engaged persons who have access to personal data and other confidential information must comply with confidentiality and information-security requirements.
5.4. AZMA takes reasonable measures to keep personal data accurate and up to date. At the same time, the User must promptly update information under its control.
5.5. AZMA may cross-check provided information against data from government information systems and other lawful sources where such verification is necessary for the operation of the relevant Platform function.
5.6. Where a decision is made solely on the basis of automated processing of personal data that directly produces legal effects for the Data Subject or affects the Data Subject’s rights and legitimate interests, such processing is carried out only where a legal basis provided for by law exists.
In cases provided for by law, the Data Subject is given the opportunity to obtain information on the procedure for such decision and to lodge an objection.

6. TRANSFER TO THIRD PARTIES

6.1. AZMA does not sell Users’ personal data or confidential information to third parties.
6.2. To the extent necessary for the purposes of this Policy, data may be disclosed to:
a) providers of server, cloud and other IT infrastructure;
b) developers and technical contractors supporting operation of the Platform;
c) banks, payment organizations and payment system operators;
d) electronic document interchange operators, including Didox;
e) communications and electronic notification delivery service providers;
f) government information systems and government authorities—when the User uses the relevant functionality;
g) AZMA’s auditors, legal counsel and other professional advisers to the extent necessary to protect rights and fulfill obligations;
h) other persons where the transfer is necessary to perform the agreement, is carried out with the Data Subject’s consent or is expressly permitted by law.
6.3. A person processing data on behalf of AZMA is provided only with the scope of information necessary to perform the relevant function.
AZMA requires such persons to comply with confidentiality, the established purposes of processing and the necessary information-protection measures.
6.4. Disclosure to a government authority is made only where a lawful basis exists and to the extent necessary to comply with the relevant requirement or authority of the government body.
6.5. When transferring personal data to a third party, AZMA notifies the Data Subject as required by law, including by sending a written or electronic notice within the prescribed period, except where such notice is not required by law.
6.6. The User agrees that, in order to perform functions that the User independently enables on the Platform, the relevant data may be transmitted to a specific government information system, electronic document interchange operator, bank or other technology participant directly necessary to execute the selected operation.

7. CROSS-BORDER TRANSFER AND DATA STORAGE LOCATION

7.1. AZMA organizes the storage and processing of personal data taking into account the special requirements of the laws of the Republic of Uzbekistan regarding the location of their storage.
7.2. Categories of personal data for which mandatory storage within the territory of the Republic of Uzbekistan is established by law are placed and stored within the territory of the Republic of Uzbekistan in the manner prescribed by law.
7.3. Other personal data may be stored or processed outside the Republic of Uzbekistan only where the conditions and safeguards provided for by law are in place.
Before using a foreign provider, AZMA must determine the existence of a legal basis for such storage or processing and ensure applicable contractual, organizational and technical protection measures.
7.4. Cross-border transfer is carried out to states providing the level of protection required by law or where another legal basis expressly provided for by law exists.
Where separate consent of the Data Subject is required for the transfer, the transfer is carried out only after such consent is obtained.
7.5. AZMA does not carry out cross-border transfers where the relevant category of data is subject to mandatory storage exclusively within the Republic of Uzbekistan or where such transfer is prohibited or restricted by law.
7.6. The Data Subject has the right to request information from AZMA regarding completed or intended cross-border transfers of his or her personal data.

8. RETENTION PERIODS, DELETION AND ANONYMIZATION

8.1. AZMA retains personal data no longer than necessary for the relevant purpose of processing, unless a longer period is provided for by law or another valid legal basis.
8.2. Data necessary for the operation of an account and performance of the agreement are processed during the term of the agreement.
8.3. After termination of the agreement, the User may be granted a period provided for by the Platform’s terms of use to export data belonging to the User.
Upon expiry of that period, data are deleted, anonymized or transferred to archival storage unless further retention is required on a lawful basis.
8.4. An EDS private key, password and other technical data enabling new actions to be performed with the EDS, where stored by means of the Platform, are blocked and deleted in the manner and within the periods provided for by the agreement with the User and internal information-security requirements.
Termination of the ability to use the EDS does not entail deletion of previously signed documents and logs of completed operations where their retention is required by law or to confirm completed actions.
8.5. Electronic document interchange documents, electronic tax invoices, payment records, primary accounting documents and other documents for which a mandatory retention period is established by law are retained until expiry of the relevant period.
8.6. Information-security and technical operation logs are retained for the period necessary to:
a) ensure the security of the Platform;
b) detect and investigate incidents;
c) confirm actions performed by users and systems;
d) protect the rights of AZMA and Users;
e) comply with mandatory legal requirements.
8.7. Upon withdrawal of consent, data that were processed solely on the basis of that consent are subject to cessation of processing and destruction or anonymization.
Where, after withdrawal of consent, AZMA retains another legal basis provided for by law to process specific information, such information may be processed only within the scope of that legal basis.
8.8. Once the purpose of processing has been achieved and in the absence of another lawful basis, personal data are subject to destruction or irreversible anonymization.
8.9. Information deleted from active information systems may temporarily remain in backup copies until the end of the relevant backup retention cycle. Until final deletion, such information is not used for ordinary operational processing and is accessible only for system recovery, security assurance or compliance with a mandatory legal requirement.
8.10. Anonymized statistical and analytical data that do not allow identification of a specific natural person may be retained after processing of the underlying personal data has ceased.

9. RIGHTS OF THE DATA SUBJECT

9.1. The Data Subject has the right to:
a) know whether AZMA holds personal data relating to him or her and the composition of such data;
b) receive information on the purposes, legal bases and methods of their processing;
c) receive information on the sources from which the data were obtained;
d) receive information on the persons to whom the data have been or may be disclosed;
e) receive information on processing and retention periods;
f) receive information on cross-border transfers;
g) request rectification or completion of inaccurate or incomplete data;
h) withdraw previously granted consent;
i) request temporary suspension of the processing of data that are incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the declared purpose;
j) request destruction of personal data where a legal basis provided for by law exists;
k) lodge an objection to an automated decision provided for by law;
l) apply to an authorized government body or a court for protection of his or her rights.
9.2. A request may be submitted:
a) through the designated function in the Personal Account;
b) through AZMA’s support service;
c) by written notice sent to AZMA’s registered address;
d) by another method that makes it possible to reliably establish the sender and the content of the request.
9.3. Before fulfilling a request, AZMA may request information necessary to identify the applicant and confirm his or her authority.
The scope of information requested for identification must not be excessive in relation to the purpose of verification.
9.4. AZMA reviews the request within the period prescribed by law. Where no special period is established, AZMA endeavors to provide a response no later than 10 (ten) Business Days from receipt of information sufficient to review the request.
9.5. Refusal to satisfy a request is permitted only where a lawful basis exists and is communicated to the Data Subject with the relevant reason in cases provided for by law.
9.6. Deletion of data or withdrawal of consent may result in the inability to use certain functions or the entire Platform where the relevant data are objectively necessary to provide them.

10. CONFIDENTIAL INFORMATION OF THE USER

10.1. In addition to personal data, AZMA ensures the confidentiality of other restricted-access information obtained in connection with use of the Platform, including:
a) accounting and tax data;
b) financial indicators;
c) bank statements;
d) contracts and primary documents;
e) information on employees and wages;
f) information on business transactions and counterparties;
g) the User’s trade secrets;
h) account credentials and access tools;
i) data related to the use of an EDS;
j) other information that by its nature is manifestly not intended for public dissemination.
10.2. AZMA uses such information solely:
a) to provide the functionality contemplated for the User;
b) for technical support and security assurance;
c) to comply with legal requirements;
d) to protect the rights of AZMA and the User.
10.3. Access to confidential information is granted only to employees and engaged persons who require such access to perform the relevant function.
10.4. Disclosure of confidential information to contractors is permitted strictly to the extent necessary and subject to obligations to ensure its confidentiality and security.
10.5. AZMA does not disclose confidential information to the public at large and does not use the User’s accounting, tax or HR documents for advertising or other purposes unrelated to providing the Platform.

11. INFORMATION SECURITY AND CYBERSECURITY

11.1. AZMA takes legal, organizational and technical measures aimed at preventing:
a) unauthorized access to information;
b) unlawful copying, modification, transfer or destruction of data;
c) loss and breach of integrity of information;
d) unlawful use of credentials and EDS;
e) other information-security and cybersecurity incidents.
11.2. Depending on the nature of the information, system architecture and current risks, the set of measures includes:
a) segregation of access rights and roles;
b) authentication of users and administrators;
c) restriction of administrative privileges;
d) logging and recording of critical actions;
e) control over employee access to production data;
f) use of secure data transmission channels;
g) application of cryptographic protection tools where provided for by the architecture and legal requirements;
h) backup and recovery procedures;
i) control over software updates and remediation of identified vulnerabilities;
j) monitoring of events and signs of unauthorized access;
k) organization of incident response;
l) preservation of records and digital evidence necessary to analyze and investigate an incident;
m) restriction of access to keys and authentication tools;
n) establishment of information-security requirements for contractors with access to data.
11.3. In this Policy, AZMA does not disclose specific configurations of security controls, keys, network infrastructure parameters or other information whose disclosure could create an additional security risk.
11.4. Upon detecting an incident, AZMA:
a) takes measures to contain its spread;
b) identifies affected systems and information;
c) blocks or restricts compromised access tools where necessary;
d) takes measures to restore the integrity and availability of information;
e) preserves necessary logs and digital evidence;
f) takes measures to eliminate the cause of the incident and prevent recurrence;
g) notifies authorized government bodies and Data Subjects in the cases and manner required by law.
11.5. The User must ensure the security of its access tools and immediately notify AZMA of:
a) compromise of a password or EDS;
b) suspicious login activity;
c) loss of a device or authentication tool;
d) other circumstances creating a risk of unauthorized access.

12. COOKIES AND TECHNICAL ANALYTICS

12.1. The Website and the Platform may use cookies and similar technologies to support authorization, session persistence, security and proper operation of the interface.
12.2. Strictly necessary technical cookies are used to the extent required to provide the function requested by the user and to ensure security.
12.3. When analytical or other non-essential cookies are used, AZMA processes the information obtained through them to analyze interface performance, detect errors and improve the Platform.
Where separate consent is required by law for the relevant category of cookies, it is activated only after such consent is obtained.
12.4. Advertising identifiers and similar technologies for personalized advertising must not be used without an appropriate lawful basis.
12.5. The User may restrict the use of cookies through browser settings or available Platform settings. Disabling strictly necessary technical cookies may make it impossible to use certain functions.

13. AMENDMENTS TO THIS POLICY AND CONTACTS

13.1. AZMA may update this Policy upon changes in legislation, Platform functionality, categories of processed information, infrastructure used or internal processes.
13.2. The current version of the Policy is published on the Website at: https://azmafinance.com/privacy-policy.
13.3. Material changes affecting the scope of processed data, the procedure for transferring them or the rights of the Data Subject are brought to the User’s attention by a notification on the Platform.
13.4. An amendment to this Policy does not in itself entitle AZMA to use previously collected personal data for a new purpose where the law requires new consent of the Data Subject for that purpose.
13.5. Inquiries regarding the processing and protection of personal data may be directed to:
13.6. When handling an inquiry regarding personal data, AZMA may request information necessary to identify the Data Subject and prevent unlawful disclosure of information to an unauthorized person.
13.7. This Policy takes effect on the date of its publication and applies until replaced by a new version.