RankUp Uzbekistan Privacy Policy (draft)
DRAFT — Prepared under the Law of the Republic of Uzbekistan "On Personal Data" (No. O'RQ-547 of 2 July 2019, as amended on 26 March 2026). Do not use it as an official document until a lawyer has reviewed it. Fill in the
[square brackets]with the Operator's real details. Items marked [Legal review needed] must be checked separately. Reference translation. The Uzbek text is the official version and prevails if the two differ.
1. General provisions
- This policy sets out how the personal data of users of the RankUp Uzbekistan website (the "Service") is processed.
- Owner and operator of the personal database: [individual entrepreneur's full name or LLC name] (the "Operator"), taxpayer ID (STIR): [000 000 000], address: [postal address], e-mail: [address], phone: [+998 00 000-00-00].
- When signing up, users read this policy and consent to the processing of their personal data by ticking a separate box (Articles 18 and 21 of the Law).
2. Data we process
| Category | Data | When we get it |
|---|---|---|
| Sign-up (required) | E-mail address, password (stored only as a one-way hash), name or contact person's name, confirmation of being 18 or older, date and time of consent to the terms and this policy | At sign-up |
| Sign-up (optional) | Consent to receive Service news by e-mail | At sign-up |
| Company account | Brand name, description, website, logo URL, headquarters location, taxpayer ID (STIR) | When a brand is added |
| Use of the Service | IP address, browser details (User-Agent), log-in date and time, records of bids, payments and actions | Automatically, during use |
| Payment | Order number, amount, status, the payment system's transaction ID (the Operator does not store bank card details) | At payment |
The Service does not process biometric, genetic or special categories of personal data.
3. Purposes
- identifying users, creating and deleting accounts, preventing abuse;
- reviewing brands, running ranking auctions (accepting bids, determining winners) and showing ads;
- taking ad payments, issuing refunds, preparing accounting and tax documents;
- resolving disputes, keeping audit logs, investigating security incidents;
- (with optional consent) sending Service news.
4. Legal grounds
- the data subject's consent (Articles 18 and 21 of the Law);
- performance of the contract concluded under the Terms of Service (public offer);
- the Operator's statutory obligations (keeping tax, accounting and advertising records).
5. Retention
When an account is deleted or the purpose of processing has been achieved, the data is destroyed or anonymized (Articles 16 and 17 of the Law). Records the law requires us to keep are stored separately for the following periods. [Legal review needed: confirm the periods]
- payment, accounting and tax documents — for the period set by tax and accounting law [period];
- advertising materials and related documents — for the period set by Article 15 of the Law on Advertising [period];
- access logs — [90 days];
- bid records and the audit log — in tamper-proof form, to prove the auctions were fair [period]; anonymized when the period ends.
6. Disclosure to third parties
The Operator does not disclose personal data to third parties, except with the data subject's consent or where the law provides for it (for example, a lawful request from a court or an authorized state body).
The following organizations process data on the Operator's behalf to run the Service:
| Organization | Task | Location |
|---|---|---|
| Render Services, Inc. | API server and database (hosting) | Singapore |
| Vercel Inc. | Website (hosting, request routing) | USA; servers in Singapore and other regions |
| [E-mail delivery service] | Verification and password reset e-mails | [country] |
| [Payment system, e.g. Click or Payme] | Taking payments — not connected yet; payments run in test (sandbox) mode | Uzbekistan |
7. Where data is stored and cross-border transfer
- The database is hosted on servers in Singapore; the website runs through a provider registered in the USA.
- Since the amendments of 26 March 2026, the obligation to store data in Uzbekistan (Article 27-1 of the Law) applies to biometric and genetic data and to data of users of local telecommunications services. The Service does not process such data. [Legal review needed]
- Cross-border transfer takes place under Article 15 of the Law. Singapore and the USA are on the list of states that adequately protect personal data, approved by a Cabinet of Ministers resolution of 29 July 2026. [Legal review needed: the list and the conditions of the simplified procedure] In addition, users give separate consent at sign-up to their data being stored on servers abroad.
8. Registration of the database
Under Article 20 of the Law, the personal database is registered in the State Register of Personal Databases: [register number and date]. [Legal review needed: registration procedure and deadline]
9. Your rights
Under Article 30 of the Law, users have the right to:
- receive information about the processing of their data, including its purposes, methods and recipients;
- demand that their data be clarified, changed or completed;
- demand that their data be destroyed;
- withdraw consent (Article 21 of the Law);
- appeal against the Operator's actions to the authorized state body or a court.
Requests are accepted at [e-mail] and handled within the period set by law. You can change your account details and delete your account yourself on the Account settings page. The required consent is withdrawn by deleting the account; use of the Service then ends.
10. Account deletion
- The e-mail address, name and password are deleted right away or replaced with values that can't identify you.
- Brands added by a company account are hidden, and their taxpayer ID (STIR) is deleted.
- Bid, payment and audit records are kept for the periods in section 5, linked only to a member number, to prove the auctions were fair and to meet legal requirements.
- If an ad is awaiting payment or there is a bid in an unfinished auction, the account can be deleted once settlement is complete.
E-mail verification and password reset links work once and expire (verification after 24 hours, reset after 30 minutes). The Operator stores only an irreversible hash of each link, not the link itself.
11. Security measures
- one-way password hashing (Argon2id);
- encryption in transit (HTTPS);
- least-privilege access, with administrator actions recorded in the audit log;
- protection of bid and audit records against changes (hash chain, updates and deletions blocked in the database).
If a data breach occurs, the Operator notifies the authorized state body and the affected users in the manner and within the time limits set by law. [Legal review needed: notification deadlines]
12. Cookies
Only necessary cookies are used: a session cookie to keep you logged in, a security (CSRF) token, and rk_locale, which remembers the language you chose. No advertising-tracking or analytics cookies are used.
13. People under 18
Only people aged 18 or older can sign up. If we find that someone under 18 has signed up, the account is deleted.
14. Responsible person and contact
- Person responsible for personal data protection: [full name], [position]
- Contact: [e-mail], [phone]
15. Changes to this policy
Changes are published on the Service before they take effect; registered users are also told about material changes by e-mail.
Effective date: [DD Month YYYY]