Version 1.0 (draft)
Date: 30.07.2026
1.1. This Policy sets out the procedure for the collection, processing, storage, transfer and protection of personal data of users of the Zakaz Pro platform (hereinafter — the "Platform").
1.2. The operator of personal data is AKACORP GLOBAL TECH LLC (hereinafter — the "Operator"), TIN 312414442, registered address: Farg'ona viloyati, Farg'ona shahri, Mash'al MFY, Mustaqillik shoh ko'chasi, 3S-uy.
1.3. This Policy has been developed in accordance with the Law of the Republic of Uzbekistan "On Personal Data" No. LRU-547 of 02.07.2019, the Law of the Republic of Uzbekistan "On Electronic Commerce" No. LRU-792 of 29.09.2022 and the Law of the Republic of Uzbekistan "On Protection of Consumer Rights" No. 221-I of 26.04.1996.
1.4. This Policy applies to all Platform products: the customer mobile application, the cashier application (POS), the business web panel (Dashboard), the website and the administrative panel.
1.5. By using the Platform, you confirm that you have read this Policy. Consent to the processing of data is given separately and may be withdrawn (section 12).
On the Platform, customer data is processed by two independent parties.
| Party | Role | Area of responsibility |
|---|---|---|
| Platform | Operator | Account, authentication, catalogue, order placement, loyalty calculation, notifications, security |
| Business (merchant) | Independent operator in respect of its own customers | Order fulfilment, service, its own marketing communications, the terms of its own loyalty programme |
2.1. A Business is granted access only to the data of those customers who have placed orders with that Business, and only to the extent necessary to fulfil the order and to operate the loyalty programme.
2.2. The Platform does not disclose to a Business any data about a customer's orders placed with other Businesses.
3.1. The sole identifier of a customer on the Platform is a verified mobile telephone number. The Platform does not assign public identifiers to customers and does not display internal technical identifiers either to customers or to Business staff.
3.2. The customer's QR code does not contain personal data. It is a technical link that passes the customer's telephone number to the cashier in order to avoid dictating the number and input errors.
3.3. The QR code of a Business, a point of sale or a table does not contain any personal data of the customer.
3.4. The Platform supports three statuses of a customer account:
| Status | How it is created | Restrictions |
|---|---|---|
| Verified | The customer has confirmed the number with a code (OTP) | Full access, including loyalty and history |
| Unverified | The cashier registered the customer using the number stated, without verification | Limited access; certain loyalty functions are unavailable until the number is verified |
| Guest (without identification) | The order was placed without providing a telephone number | Personal data is not collected. Loyalty is not applied. The order history is not linked to a customer |
3.5. A single telephone number may be used for several roles (customer, business owner, manager, cashier, administrator). The data associated with the roles is logically segregated.
3.6. A customer may request the transfer of the account to a new telephone number or the unlinking of the account from a number. Transfer and unlinking are carried out following verification of the customer's identity in the manner established by the Operator.
Date of birth, gender, marital status, significant dates, the Telegram username and the WhatsApp mark are entered by the customer only of their own accord in their profile, may be changed or removed at any time, and deleting the account erases them together with the photograph. The Platform uses them solely for personal offers from the Businesses the customer orders from (for example, a birthday or anniversary greeting) and does not pass them to third parties beyond those Businesses.
The Platform does not store full bank card numbers, CVV codes or credentials for access to payment applications. Online payment is carried out on the side of licensed payment organisations.
The Platform does not collect biometric data, health data, data on religious or political views or other special categories of data. The Platform does not request access to the customer's contacts, gallery or microphone, save where this is necessary for a specific action initiated by the customer (for example, attaching a photograph).
For staff (owner, manager, cashier) the following is additionally processed: role and access rights, assignment to a point of sale, shift history, history of operations in the POS. The operator of this data is the employing Business.
Name, legal form, TIN, registered address, contact details of the head of the organisation, bank details, licences and permits, scanned copies of documents. The procedure is governed by the internal KYC regulations.
| Purpose | Basis |
|---|---|
| Registration and authentication (including the sending of verification codes) | Performance of the contract |
| Placement, transmission and processing of an order | Performance of the contract |
| Operation of the loyalty programme, calculation of points and discounts | Performance of the contract / consent |
| Generation and transmission of the fiscal receipt | Statutory requirement |
| Informing about order status | Performance of the contract |
| User support and resolution of disputed situations | Legitimate interest |
| Security, prevention of fraud and abuse of the loyalty programme | Legitimate interest |
| Analytics and service improvement (in anonymised form) | Legitimate interest |
| Marketing mailings and personal offers | Only with consent |
| Compliance with the requirements of tax and other authorised bodies | Statutory requirement |
6.1. The Platform automatically calculates points, discounts and the loyalty level according to the rules set by the Business. This constitutes automated processing, but it does not give rise to legal consequences and does not restrict the customer's rights — the customer is entitled not to participate in the loyalty programme.
6.2. The Platform may automatically generate personal offers based on purchase history — only where consent to marketing has been given.
The Platform does not sell personal data. Disclosure is possible only in the following cases:
| Recipient | What is disclosed | Purpose |
|---|---|---|
| Business (merchant) and its staff | Telephone number, name, composition and status of the order, loyalty data of that Business | Order fulfilment, loyalty programme |
| Fiscal Data Operator (FDO) / online cash register | Fiscal data of the transaction | Statutory requirement |
| Messaging service provider (SMS aggregator / Telegram / WhatsApp / Viber) | Telephone number, text of the notification | Sending verification codes and notifications |
| Payment organisations | Amount and transaction identifier | Processing of online payment |
| Delivery service / courier | Name, telephone number, delivery address | Delivery of the order (where delivery is used) |
| Cloud infrastructure provider | Data to the extent stored and processed | Hosting in compliance with localisation requirements |
| Authorised state bodies | Upon an official request in the established manner | Statutory requirement |
7.1. Agreements are concluded with all processors obliging them to observe confidentiality and the requirements of the legislation of Uzbekistan.
8.1. Personal data is processed and stored on servers (in databases) physically located within the territory of the Republic of Uzbekistan.
8.2. The personal data database is registered in the state register of personal data databases in the cases and in the manner provided for by the Law "On Personal Data".
8.3. Categories of personal data for which the Law "On Personal Data" establishes a requirement of mandatory storage within the territory of the Republic of Uzbekistan are not transferred outside that territory. The transfer of other data outside the Republic of Uzbekistan is permitted only where the grounds provided for by legislation exist, including where the recipient ensures an adequate level of data protection.
8.4. Retention periods:
| Category of data | Retention period |
|---|---|
| Account data | For the period the account remains in existence |
| Order and loyalty data | The period the account remains in existence + 3 years for the resolution of disputes |
| Fiscal and accounting documents | The period established by tax legislation — not less than 5 years |
| Technical logs | 12 months |
| Data of guest (unidentified) orders | Personal data is not collected; the fiscal data of the transaction is retained as an accounting document |
| Records of support enquiries | 24 months |
8.5. Deletion. Where an account is deleted at the customer's request, the data is deleted or anonymised within 30 calendar days, with the exception of data which the Platform is obliged to retain by law (primarily fiscal and accounting documents).
9.1. The following measures are applied: encryption of transmission channels (TLS), role-based segregation of access rights, logging of access to personal data, backup, password policies and the storage of secrets outside the code.
9.2. Access by Platform staff to personal data is granted on the principle of the minimum necessary scope.
9.3. Upon detection of an incident involving personal data, the Operator shall notify the authorised body and the affected customers within the shortest possible time from the moment the incident is established.
10.1. The website and the web panel use: technically necessary cookies (session, security), functional cookies (language, settings) and analytical cookies.
10.2. Analytical and marketing cookies are set only with the user's consent. Settings are available in the consent banner and may be changed at any time.
11.1. Service notifications (verification codes, order statuses, changes to the contract) are always sent — they are necessary for the operation of the service and do not require separate marketing consent.
11.2. Marketing messages are sent only with the customer's consent and subject to frequency limits. The applicable mailing limits are set out in the Platform rules; a customer may opt out of marketing at any time without losing access to the service.
11.3. Opting out of marketing does not entail disconnection from the loyalty programme.
12.1. A customer has the right to:
12.2. How to exercise these rights: via the "Profile" section in the application or by contacting akacorpglobaltech@gmail.com. The period for reviewing an enquiry is 15 working days.
12.3. The withdrawal of consent does not extend to data which the Platform is obliged to retain by law.
13.1. The Platform is not intended for independent use by persons under 18 years of age. The Platform does not deliberately collect data of minors.
13.2. Where such an account is identified, the data is deleted, and in the case of the sale of age-restricted goods (alcohol, tobacco) separate restrictions apply in accordance with legislation.
14.1. The Platform may amend this Policy. The current version is published on the website and in the application, indicating the date of entry into force.
14.2. Customers are notified of material amendments in advance — not less than 10 calendar days beforehand — via the application or by message.
Operator: AKACORP GLOBAL TECH LLC
Full name: «AKACORP GLOBAL TECH» mas'uliyati cheklangan jamiyati
Name in English: "AKACORP GLOBAL TECH" Limited Liability Company
TIN: 312414442
Date of state registration: 08.09.2025
Registered address: Farg'ona viloyati, Farg'ona shahri, Mash'al MFY, Mustaqillik shoh ko'chasi, 3S-uy
Telephone: +998 50 744 41 31
E-mail for personal data enquiries: akacorpglobaltech@gmail.com
Person responsible for the processing of personal data: the Personal Data Protection Officer of AKACORP GLOBAL TECH LLC (enquiries — akacorpglobaltech@gmail.com)