Privacy and Personal Data Processing Pol

PRIVACY AND PERSONAL DATA PROCESSING POLICY

Last updated: July 30, 2026

This Privacy and Personal Data Processing Policy (hereinafter, the "Policy") sets out the procedures for the collection, storage, use, transfer, and other processing of personal data of users of digital goods and services.

For the purposes of this Policy, ORIONIX Limited Liability Company (TIN: 312 945 770, registered address: TASHKENT CITY, UCHTEPA DISTRICT, FARHOD MFY, 23 MAVZESI, HOUSE 47, APARTMENT 29), hereinafter referred to as the "Company", processes personal data in accordance with Law of the Republic of Uzbekistan No. ZRU-547 "On Personal Data" dated July 2, 2019, as well as other regulatory legal acts of the Republic of Uzbekistan.

BY USING THE COMPANY'S DIGITAL GOODS AND SERVICES, THE USER CONFIRMS THAT THEY HAVE READ THIS POLICY AND CONSENTS TO THE PROCESSING OF THEIR PERSONAL DATA IN CASES WHERE SUCH CONSENT IS REQUIRED BY THE LEGISLATION OF THE REPUBLIC OF UZBEKISTAN.

1. Personal Data Subject to Processing

The Company processes only the personal data necessary to provide the User with digital goods and services.

Depending on the nature of the services provided, the Company may process the following categories of personal data:

1.1. Identification Data

surname;
first name;
patronymic (if applicable).

1.2. Contact Data

telephone number;
email address;
other means of communication provided by the User.

1.3. Telegram Account Data

For the purpose of providing purchased digital goods, the Company may process information relating to the User's Telegram account, including:

Telegram ID;
username;
other identifiers necessary to deliver the purchased digital goods.

1.4. Payment Data

When digital goods are paid for, information about the completed payment may be processed, including:

the last digits of the bank card number;
payment transaction identifier;
payment account information;
other payment identifiers.

The Company does not store full bank card details (PAN), CVV/CVC codes, or PIN codes. Payment information is processed by payment organizations and banks in accordance with applicable legal requirements and security standards.

1.5. Order and Service Usage Data

The Company may process information regarding:

purchased digital goods and services;
the time the order was placed;
the order value;
the order fulfillment status;
the provision of digital goods;
the User's actions directly related to the use of purchased digital goods (for example, activation of Telegram Premium, Telegram Stars, and other digital services).

1.6. Processing of Special Categories of Personal Data

The Company does not intentionally collect or process special categories of personal data unless such processing is provided for by the legislation of the Republic of Uzbekistan.

Users are advised not to provide information concerning:

racial or ethnic origin;
political views;
religious or philosophical beliefs;
health status;
biometric data;
other special categories of personal data.

If such information is received accidentally, the Company takes reasonable measures to cease its processing and delete such data, unless otherwise provided for by the legislation of the Republic of Uzbekistan.

2. Purposes of Personal Data Processing

The Company processes personal data exclusively for lawful purposes and only to the extent necessary to achieve such purposes.

Personal data may be used for:

2.1. Provision of Digital Goods and Services

registering an order;
performing the User Agreement;
providing purchased digital goods;
performing the End User License Agreement;
providing technical support.

2.2. Performance of Financial Obligations

Personal data is used for:

processing payments;
confirming payment;
issuing refunds;
preventing fraud;
reviewing disputed payments.

2.3. Communications with the User

The Company may send the User:

order confirmations;
service provision notifications;
order status messages;
account security notifications;
responses to User inquiries

Marketing or advertising messages are sent only with the User's consent where obtaining such consent is required by the legislation of the Republic of Uzbekistan.

2.4. Compliance with Legal Requirements

Personal data may be used for:

compliance with the legislation of the Republic of Uzbekistan;
compliance with tax legislation;
maintaining accounting records;
compliance with lawful requests of government authorities;
compliance with legislation on combating the legalization (laundering) of proceeds from criminal activity, the financing of terrorism, and the financing of the proliferation of weapons of mass destruction.

2.5. Protection of the Company's Legitimate Interests

The Company may use personal data for the purposes of:

protecting its rights and legitimate interests;
preventing fraudulent activities;
ensuring information security;
investigating security incidents;
resolving disputes.

The Company does not process personal data for purposes incompatible with those specified above.

Where personal data must be processed for other purposes, the Company obtains the User's consent or carries out such processing on another basis provided for by the legislation of the Republic of Uzbekistan.

3. Legal Bases for Personal Data Processing

The Company processes personal data where one or more grounds provided for by the legislation of the Republic of Uzbekistan apply, including:

the consent of the personal data subject, where obtaining such consent is required by law;
the necessity to perform a contract to which the User is a party or to enter into a contract at the User's initiative;
the performance of obligations imposed by the legislation of the Republic of Uzbekistan on the Company;
the exercise and protection of the Company's lawful rights and interests, provided that such processing does not violate the rights and legitimate interests of the personal data subject;
other grounds, provided for by the legislation of the Republic of Uzbekistan.

The User's consent to the processing of personal data may be provided in writing, in the form of an electronic document, or by actions that unambiguously indicate the User's intention, where such a method is permitted by the legislation of the Republic of Uzbekistan.

3.1 Legal Bases for Personal Data Processing

The Company processes personal data where one or more grounds provided for by the legislation of the Republic of Uzbekistan apply, including:

Entering into and performing a contract with the User. Personal data is processed to the extent necessary to enter into, perform, amend, and terminate the User Agreement, the End User License Agreement, and other contracts to which the User is a party.
Consent of the personal data subject. Where, under the legislation of the Republic of Uzbekistan, personal data may be processed only with the consent of the personal data subject, the Company obtains such consent before the relevant processing begins. Consent may be expressed in writing, in the form of an electronic document, or by actions that unambiguously indicate the User's intention, including selecting the relevant checkbox when placing an order or taking other actions confirming consent to the processing of personal data.
Compliance with the legislation of the Republic of Uzbekistan. The Company may process personal data where such processing is necessary to perform obligations imposed on the Company by the legislation of the Republic of Uzbekistan, including requirements relating to accounting, taxation, combating the legalization (laundering) of proceeds from criminal activity, the financing of terrorism, and the financing of the proliferation of weapons of mass destruction.
Protection of the Company's rights and legitimate interests. The Company may process personal data in cases provided for by the legislation of the Republic of Uzbekistan where such processing is necessary to protect its rights and legitimate interests or the rights of third parties and does not violate the rights and legitimate interests of the personal data subject.

The Company does not process personal data for the distribution of advertising information or the promotion of goods and services without obtaining the User's consent where such consent is required by the legislation of the Republic of Uzbekistan.

When processing personal data, the Company is guided by the principles of lawfulness, fairness, proportionality, confidentiality, and processing personal data exclusively for predetermined and lawful purposes.

4. Transfer of Personal Data to Third Parties

The Company may transfer personal data to third parties only to the extent necessary to achieve the purposes of personal data processing set out in this Policy and in compliance with the requirements of the legislation of the Republic of Uzbekistan.

Personal data may be transferred to the following categories of recipients:

4.1. Payment Service Providers

For payment processing, settlements, and refunds, the Company may transfer personal data to banks, payment organizations, payment systems, and other payment service providers.

The information transferred is limited to the amount objectively necessary to process the relevant payment transaction and may include information about the User, the payment transaction, and payment identifiers

4.2. Telegram Service

For the purpose of providing purchased digital goods, the Company may transfer to Telegram the information necessary for their activation, including the User's Telegram account identifier and information about the purchased digital good.

Such transfer is carried out exclusively through official means of interaction with the Telegram platform (Telegram API) and only to the extent necessary to provide the relevant service.

The Company is not responsible for personal data processing performed independently by Telegram in accordance with its own privacy policy.

4.3. Identification, Compliance, and Fraud Prevention Service Providers

For the purpose of complying with the legislation of the Republic of Uzbekistan and the laws of other countries applicable to the Company's activities, as well as requirements relating to combating the legalization (laundering) of proceeds from criminal activity, the financing of terrorism, sanctions compliance, fraud prevention, payment security, and risk management, the Company may transfer personal data to specialized organizations that provide:

identity identification and verification (KYC);
sanctions screening;
customer due diligence;
transaction monitoring;
fraud prevention;
risk assessment;
information security.

The transfer is carried out exclusively to the extent necessary to perform the relevant checks and comply with legal requirements.

4.4. Government Authorities and Other Authorized Persons

The Company may provide personal data to government authorities, courts, law enforcement agencies, and other persons in the cases and in the manner provided for by the legislation of the Republic of Uzbekistan or by mandatory requirements of legislation applicable to the Company's activities.

All persons receiving personal data from the Company must ensure its confidentiality and security in accordance with the legislation of the Republic of Uzbekistan, the terms of concluded agreements, and applicable information protection requirements.

4.5. Cross-Border Transfer of Personal Data

The Company may carry out cross-border transfers of personal data in cases provided for by the legislation of the Republic of Uzbekistan where such transfer is necessary to perform a contract with the User, provide purchased digital goods and services, process payments, comply with legal requirements, or obtain services from providers engaged by the Company.

Where the legislation of the Republic of Uzbekistan establishes requirements for the localization of personal data of citizens of the Republic of Uzbekistan, the Company ensures the collection, systematization, and storage of such personal data using personal data databases located in the territory of the Republic of Uzbekistan, unless otherwise permitted by the legislation of the Republic of Uzbekistan.

Any subsequent cross-border transfer of personal data is carried out only where grounds provided for by the legislation of the Republic of Uzbekistan exist and provided that the Company has adopted the necessary organizational, technical, and legal measures aimed at protecting personal data during its transfer and further processing.

Due to the international nature of the Company's activities, personal data may be transferred to and processed in foreign countries, including the United Kingdom, the Hong Kong Special Administrative Region of the People's Republic of China, and other jurisdictions, to the extent necessary to provide the User with digital goods and services and perform the Company's obligations, subject to compliance with the personal data protection requirements of the legislation of the Republic of Uzbekistan.

5. Rights of the Personal Data Subject

The Company ensures that personal data subjects can exercise their rights in accordance with the legislation of the Republic of Uzbekistan.

The personal data subject has the right to:

Receive information about personal data processing. Request from the Company information on whether their personal data is being processed, the categories of personal data processed, the purposes and legal bases of processing, the methods of processing, the retention periods, and other information provided for by the legislation of the Republic of Uzbekistan.
Request clarification, amendment, supplementation, blocking, or destruction of personal data. The User may request the amendment, supplementation, blocking, or destruction of their personal data where such data is incomplete, outdated, inaccurate, obtained in violation of the legislation of the Republic of Uzbekistan, or no longer necessary for the stated purposes of processing. The Company reviews the relevant requests and takes measures in the manner and within the time limits provided for by the legislation of the Republic of Uzbekistan.
Withdraw consent to personal data processing. Where personal data is processed on the basis of the User's consent, the User may withdraw such consent by submitting the relevant request to the Company. Withdrawal of consent does not affect the lawfulness of personal data processing carried out before the Company receives the withdrawal and does not terminate personal data processing where it is carried out on other grounds provided for by the legislation of the Republic of Uzbekistan.
Appeal the Company's actions or omissions. The User may appeal the Company's actions or omissions relating to the processing of their personal data to the authorized government body of the Republic of Uzbekistan or to a court in accordance with the procedure established by the legislation of the Republic of Uzbekistan.
Exercise other rights provided for by the legislation of the Republic of Uzbekistan in the field of personal data protection.

The Company reviews requests from personal data subjects in the manner and within the time limits established by the legislation of the Republic of Uzbekistan.

6. Personal Data Retention Period

The Company retains personal data no longer than required for the purposes of its processing, unless a longer retention period is established by the legislation of the Republic of Uzbekistan.

Personal data is retained for the following periods:

Identification and contact data, as well as information relating to the User's account, is retained for the duration of the contractual relationship between the User and the Company and thereafter for the period necessary to perform mutual obligations, review inquiries, settle claims, resolve disputes, and comply with the requirements of the legislation of the Republic of Uzbekistan.
Information on orders, payments, and settlements is retained for the period necessary to perform contractual obligations, maintain accounting and tax records, comply with legislation on combating the legalization (laundering) of proceeds from criminal activity, the financing of terrorism, and the financing of the proliferation of weapons of mass destruction, as well as other mandatory legal requirements.
Technical information, event logs, information on support requests, and other data related to the use of the Company's services is retained for the period necessary to ensure the security of information systems, review User requests, prevent fraud, investigate information security incidents, and protect the rights and legitimate interests of the Company and Users.

Once the purposes of processing have been achieved or where there are no lawful grounds for further processing, personal data is subject to destruction, anonymization, or blocking in the manner established by the legislation of the Republic of Uzbekistan, unless otherwise provided for by the legislation of the Republic of Uzbekistan or required for the Company to perform obligations imposed on it by law.

7. Withdrawal of Consent to Personal Data Processing

Where personal data is processed on the basis of the consent of the personal data subject, the User may withdraw previously given consent at any time by submitting the relevant request to the Company using the contact details specified on the Company's official website.

After receiving the request, the Company ceases personal data processing carried out exclusively on the basis of the User's consent, unless there are other grounds for processing provided for by the legislation of the Republic of Uzbekistan.

Where personal data processing is necessary to perform a contract with the User, fulfill obligations imposed on the Company by the legislation of the Republic of Uzbekistan, or is carried out on other grounds provided for by the legislation of the Republic of Uzbekistan, the Company may continue processing the relevant personal data to the extent necessary to achieve the specified purposes.

Withdrawal of consent does not affect the lawfulness of personal data processing carried out before the Company receives the relevant request.

If, as a result of the withdrawal of consent, it becomes impossible to provide certain digital goods or services that require processing of the relevant personal data, the Company may discontinue the provision of such goods or services after notifying the User.

The User may submit a request to the Company to cease processing, block, or destroy personal data in cases provided for by the legislation of the Republic of Uzbekistan, and may also appeal the Company's actions or omissions to the authorized government body of the Republic of Uzbekistan or to a court.

8. Amendments to the Policy

The Company may amend this Policy in the event of changes to the legislation of the Republic of Uzbekistan, changes in the nature of the services provided, the introduction of new personal data processing technologies, changes in the Company's organizational structure, or on other grounds related to the Company's activities.

The current version of the Policy is posted on the Company's official website. The date of the Policy's latest update is stated at the beginning of the Policy or indicated in another clearly visible manner.

Amendments take effect upon their publication on the Company's official website, unless a different effective date is specified in the new version of the Policy.

The Company recommends that Users regularly review the current version of the Policy.

Continued use of digital goods and services after amendments take effect means that the User has reviewed the new version of the Policy. Where the amendments require the User's consent under the legislation of the Republic of Uzbekistan, the Company obtains such consent before the relevant personal data processing begins.

This Policy is governed by and shall be interpreted in accordance with the legislation of the Republic of Uzbekistan.

The Policy is publicly available on the Company's official website and may be reviewed by all Users.

For questions relating to personal data processing, the exercise of the rights of personal data subjects, or the application of this Policy, the User may contact the Company using the contact details specified on the official website.