Receipt.uz — Personal Data Privacy Policy

Personal Data Privacy Policy

Effective as of September 1, 2026.

This Personal Data Privacy Policy (hereinafter referred to as the "Policy") has been developed in accordance with the requirements of the legislation of the Republic of Uzbekistan on personal data protection, electronic commerce, informatization, telecommunications, and other relevant legal acts.

This Policy defines the procedure for collecting, using, storing, transferring, and processing in other ways data related to the User by O'O'BQ "OTABEK HASANOV", address: Surxondaryo Region, Jarqo'rg'on District (hereinafter referred to as "Receipt", "Operator", or "We") during the process of using the Receipt.uz website, mobile or web applications, software interfaces, technical integrations, and other services provided by Receipt.

This Policy applies to individuals using Receipt services, individual entrepreneurs, representatives of legal entities, and other persons whose personal data may be processed during the use of Receipt services.

Receipt may act as a technical intermediary in carrying out payments. Upon the User's instruction, Receipt sends a technical request to the relevant payment infrastructure to initiate payment using a token, identifier, or other technical data.

Payment authorization, deduction of funds, processing, transfer, rejection, cancellation, refund, chargeback, and other financial processes related to payment are carried out by the relevant bank, payment organization, payment system, processing organization, acquiring organization, or payment recipient.

By using Receipt services, the User confirms that they have read and familiarized themselves with this Policy. If the User does not agree with the terms of personal data processing provided for in this Policy, they must stop using Receipt services.

Personal Data Processed by Receipt

Receipt may process data necessary for providing services to the User, technical maintenance, ensuring security, considering applications, providing technical integration with payment infrastructures, and for other purposes specified by law.

The scope of processed data may vary depending on the type of service used by the User, their interaction with Receipt, the type of technical integration, and the requirements of the relevant payment infrastructure.

The following data may be processed by Receipt:

Full Name — surname, first name, and patronymic;

phone number;

email address;

residential or delivery address, if required for the relevant service;

data related to the User's Receipt account;

user identifier, account ID, or other internal identifiers;

tokens and technical identifiers necessary for initiating payment;

technical data related to an order, invoice, check, or payment;

transaction metadata such as payment amount, currency, time, status, and technical operation identifier;

data related to the payment recipient or service provider;

IP address;

device identifier and technical specifications of the device;

operating system, browser type, and version;

model and manufacturer of the device used;

date and time of accessing the Receipt service;

data about pages, features, and services used;

data obtained through cookie files and similar technologies;

technical errors, system logs, and diagnostic data;

requests, applications, and messages sent by the User to the support service;

other data obtained in accordance with legislation or based on the User's consent.

Sources of Obtaining Data

Receipt may obtain data about the User from several sources. Such sources include the following:

data provided directly by the User in the process of using Receipt services;

technical data automatically generated during the use of the Receipt website and applications;

data obtained from the User's device, browser, or operating system;

technical data obtained from the relevant payment infrastructure to initiate payment or determine its status;

data obtained from partners and service organizations integrated with Receipt;

data obtained through User inquiries and technical support channels;

data obtained from public sources permitted by legislation;

other sources provided for by legislation.

Receipt strives to obtain data only from sources that are lawful and justified for providing the service.

Purposes of Processing Personal Data

Receipt may process the User's personal data for the following purposes:

providing Receipt services and ensuring their operation;

creating, maintaining, and managing the User's account;

identifying and authenticating the User;

sending a technical request to the relevant payment infrastructure to initiate payment based on the User's instruction;

determining the technical status of the payment and providing information to the User regarding this status;

generating and providing orders, accounts, electronic receipts, or other service-related documents;

receiving, considering, and responding to User requests;

ensuring operational security and stability of Receipt services;

preventing fraud, unauthorized access, illegal transactions, and other abuses;

detecting, investigating, and resolving information security incidents;

improving the technical quality of Receipt services and developing new features;

enhancing user experience and adapting the service interface;

conducting statistical and analytical research;

identifying and resolving technical errors;

fulfilling legal requirements and lawful requests of authorized state bodies;

protecting Receipt's legal rights and interests;

fulfilling contractual obligations;

sending service notifications, technical messages, and other important information to the User;

sending advertising, marketing, and informational messages in cases where the User's separate consent is available.

Processing of Payment-Related Data

When the User chooses to make a payment while using Receipt services, Receipt may send a technical request to the relevant payment infrastructure.

Such a request may use a token, transaction ID, merchant ID, order ID, session ID, or other technical identifiers.

The scope of technical data sent by Receipt depends on the technical requirements established by the relevant payment organization, bank, payment system, processing organization, or other infrastructure.

Processes such as entering payment card details, authorizing the card, confirming payment, deducting funds, transferring funds, rejecting payment, refunding, canceling, or chargeback are not independently carried out by Receipt.

These processes are carried out within the authority and responsibility of the relevant bank, payment organization, payment system, processing organization, acquiring organization, or payment recipient.

For this reason, regarding issues related to the final result of the payment transaction, its authorization, rejection, refund, or chargeback, the User may contact the organization providing the relevant payment service.

Cookies and Automatically Collected Data

Receipt may use cookie files and similar technologies to ensure proper operation of the website and services, improve security, obtain usage statistics, and enhance User experience.

IP address;

browser type and version;

operating system;

device type, model, and manufacturer;

time and date of accessing the Receipt service;

pages and features used;

referral source link;

cookie identifiers;

technical errors and diagnostic data;

technical data related to session and security.

The User may restrict or block cookies through browser settings. However, blocking cookies may cause some features of Receipt services to function partially or not at all.

Disclosure of Personal Data to Third Parties

Receipt keeps the User's personal data confidential. However, to provide services, perform technical integrations, ensure security, or fulfill legal requirements, certain data may be transferred to third parties.

Data may be transferred to the following categories of persons:

banks and other credit organizations;

payment organizations;

payment systems;

processing and acquiring organizations;

merchants accepting payment or service providers;

service partners technically integrated with Receipt;

organizations providing hosting, server, cloud infrastructure, and data storage services;

organizations providing information security and fraud detection services;

organizations providing analytics and technical monitoring services;

organizations providing legal, audit, accounting, and consulting services;

authorized state bodies;

other authorized persons in accordance with legislation.

When transferring data to third parties, Receipt strives to provide only the part of the relevant data that is necessary for rendering the service or achieving a lawful purpose.

If a third party processes data on behalf of Receipt, such person must use the data only for the purposes specified by Receipt and take appropriate measures to protect them.

Cross-Border Transfer of Personal Data

Certain technical services, hosting, cloud infrastructure, security, analytics, or other technological services used by Receipt may be provided through servers or service organizations located outside the territory of the Republic of Uzbekistan.

Therefore, certain personal data of the User may be transferred to or processed in the territory of another state, subject to compliance with the requirements and guarantees established by legislation.

When performing such a transfer, Receipt strives to take appropriate organizational and technical measures to protect data, ensure confidentiality, and comply with legislative requirements.

Retention Period of Personal Data

Receipt stores personal data for the period necessary to achieve the purposes of their processing.

If the retention period of data is established by legislation, contract, or other mandatory requirement, Receipt shall comply with this period.

After the necessity to store data no longer exists, Receipt may take measures to delete, destroy, or, in cases permitted by law, anonymize them.

Certain technical logs, security records, and transaction metadata may be retained for a certain period due to requirements of legislation, security, or the need to resolve disputes.

User Rights

The User has the right to exercise their rights regarding their personal data in accordance with the procedure provided for by the current legislation of the Republic of Uzbekistan.

Specifically, in cases provided for by law, the User has the right to:

obtain information about whether their personal data is being processed;

obtain information on the purposes and legal grounds for processing;

obtain information on the composition of the processed data;

obtain information on the source of personal data;

obtain information on the data processing period;

demand correction of inaccurate or outdated data in cases provided for by law;

demand deletion or destruction of personal data in cases provided for by law;

revoke consent given for the processing of personal data in the manner prescribed by law;

apply to authorized state bodies or to a court if they believe their rights have been violated.

To exercise these rights, the User may contact info@receipt.uz via email in written or electronic form.

Receipt reserves the right to request additional information necessary to identify the person submitting the request.

Modification and Deletion of Personal Data

If the User believes that there is an error in their data being processed by Receipt, they may submit a request seeking clarification or updating of the data.

Requests to delete personal data are considered taking into account legislation, contractual obligations, and mandatory data retention requirements.

If data retention is required by law or other mandatory requirements, Receipt may not be able to fully satisfy the deletion request. In such cases, Receipt may inform the User of the relevant legal basis.

Withdrawal of Consent

The User has the right to withdraw their consent to the processing of personal data in accordance with the procedure established by law.

To withdraw consent, the User may send an appropriate request to info@receipt.uz.

Withdrawal of consent may limit or discontinue the operation of certain Receipt services if processing the relevant data is objectively necessary to provide such services.

Withdrawal of consent does not affect the lawfulness of data processing carried out on a legal basis prior to the withdrawal of consent.

Protection of Personal Data

Receipt takes necessary organizational and technical measures to protect the User's personal data from unauthorized or accidental access, destruction, modification, blocking, copying, distribution, and other unlawful actions.

Such measures may include technical infrastructure protection, access right restrictions, authentication, monitoring, backups, maintaining security logs, and other information security mechanisms.

Receipt employees, contractors, and other persons with access to personal data must maintain data confidentiality and use them solely within the scope of performing their duties.

At the same time, data transmission via the Internet or the use of electronic systems cannot be guaranteed to be absolutely secure. The User must not disclose their account details, passwords, confirmation codes, and other confidential data to third parties.

Prevention of Fraud and Information Security

Receipt may process certain technical data to prevent unauthorized use of services, fraud, unauthorized access, automated malicious requests, account hacking attempts, and other security threats.

In particular, IP addresses, device identifiers, session data, browser details, and technical metadata of actions and operations may be processed for security monitoring and incident investigation.

Receipt may temporarily restrict access to the relevant account or functions if actions contrary to legislation or service terms are detected.

Data of Minors

Receipt services are intended for use by adults, unless otherwise specified in separate terms of service.

Personal data of a minor may be processed based on the requirements of legislation and the consent of the relevant legal representative.

If Receipt discovers that a minor's data has been provided without a legal basis, it may take measures to delete such data or stop processing them in accordance with legislation.

Third-Party Websites and Services

The Receipt website or services may contain links to third-party websites, payment services, or other external services.

The privacy policies, security measures, and personal data processing procedures of such third-party services may not be controlled by Receipt.

The User should review the relevant privacy policy and terms of use of a third-party service before using it.

Marketing and Informational Messages

Receipt may send technical and important service-related messages to the User. Such messages may include account, security, service changes, payment technical status, and other necessary notifications.

Marketing, advertising, promotional, and commercial offers will be sent to the User if grounds provided by legislation exist.

The User may opt out of receiving advertising and marketing messages, but the ability to receive technical or security messages necessary for rendering the service may be retained.

Anonymized and Statistical Data

In certain cases, Receipt may use anonymized or aggregated data that does not allow directly or indirectly identifying the User's identity.

Such data may be used to analyze service efficiency, improve technical metrics, study user experience, prepare statistical reports, and develop new products.

Anonymized data may be provided to third parties in a form that does not permit identification of individuals.

Amendments to the Privacy Policy

Receipt may make amendments and additions to this Policy from time to time.

The new version of the Policy will be published on the Receipt.uz website. Amendments shall take effect from the date of publication or another date specified in the new version.

The User may be additionally notified of significant changes to the Policy in the manner prescribed by law or determined by Receipt.

The User is recommended to regularly review the current version of the Policy.

Applicable Law

Current legislation of the Republic of Uzbekistan, including legal acts in the field of personal data protection, shall apply to this Policy and the relations between Receipt and the User regarding the processing of personal data.

Receipt complies with the principles of purpose, legality, confidentiality, security, and other principles established by law when processing personal data.

Interaction with Users Regarding Inquiries

Questions and inquiries regarding this Policy, the processing of personal data, accessing, modifying, deleting them, or withdrawing consent may be sent using the following contact details:

In the inquiry, the User must state their request as clearly as possible, as well as provide the information necessary for reviewing the inquiry.

Receipt may request additional information to identify the person submitting the inquiry.

Final Provisions

This Policy establishes the main principles and conditions for personal data processing by Receipt.

Receipt strives to use the User's personal data only for lawful purposes, where a relevant legal basis exists, and within the scope specified in this Policy.

The use of Receipt services implies that the User has read and accepted this Policy. In cases where separate consent is required for processing personal data, such consent shall be obtained in the manner prescribed by law.

The current version of this Policy is published on the Receipt.uz website.