Personal Data Processing Policy

1. General provisions

1.1. This Policy of ALGO-PRIME Limited Liability Company (hereinafter — ALGO-PRIME, the Operator) regarding the processing of personal data has been developed in accordance with the Law of the Republic of Uzbekistan "On Personal Data" No. ZRU-547 of 02.07.2019 (hereinafter — the Personal Data Law) with a view to protecting human rights and freedoms in the processing of personal data, including the right to privacy of personal life.

1.2. This Policy applies to all personal data processed by the Operator and extends to relations arising both before and after its approval.

1.3. This Policy is published for free access on the Operator's website at algo-prime.me.

1.4. Key terms used in this Policy:

personal data

any information relating to a directly or indirectly determined or determinable natural person (a data subject);

personal data operator

ALGO-PRIME, which, independently or jointly with other persons, organises and (or) carries out the processing of personal data and also determines the purposes of processing, the composition of the data and the actions performed with it;

processing of personal data

any action or set of actions with personal data performed with or without the use of automation tools: collection, recording, systematisation, accumulation, storage, updating, extraction, use, transfer, anonymisation, blocking, deletion, destruction;

anonymisation

actions as a result of which it becomes impossible, without the use of additional information, to determine that personal data belongs to a particular data subject;

blocking

temporary suspension of the processing of personal data, except where processing is necessary in order to update it;

destruction

actions as a result of which it becomes impossible to restore the content of personal data in an information system and (or) as a result of which the material carriers of personal data are destroyed.

2. Rights and obligations of the Operator

2.1. The Operator has the right:

• to determine independently the composition and list of measures necessary to fulfil the obligations provided for by personal data legislation;
• to entrust the processing of personal data to another person with the data subject's consent, unless otherwise provided by law, on the basis of a contract obliging that person to observe confidentiality and data protection requirements;
• to continue processing personal data without the data subject's consent where grounds expressly set out in legislation are present.

2.2. The Operator is obliged:

• to organise the processing of personal data in accordance with legislation;
• to respond to communications and requests from data subjects and their representatives within the time limits established by legislation;
• to provide the authorised state body for personal data with information at its request within the time limits established by legislation;
• to ensure the confidentiality of personal data and to take measures to protect it against unlawful access.

3. Rights of the data subject

3.1. A data subject has the right:

• to receive information concerning the processing of their personal data, except in the cases provided for by legislation;
• to demand that their personal data be updated, blocked or destroyed if the data is incomplete, out of date, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing;
• to withdraw consent to the processing of personal data;
• to appeal against the acts or omissions of the Operator to the authorised state body or through the courts.

3.2. Compliance with the requirements of this Policy is monitored by the person responsible for organising the processing of personal data at the Operator.

4. Principles of processing

• processing is carried out on a lawful and fair basis;
• processing is limited to the achievement of specific, predetermined and lawful purposes; processing incompatible with the purposes of collection is not permitted;
• it is not permitted to combine databases the processing of which is carried out for purposes incompatible with one another;
• only such data as corresponds to the purposes of processing is processed, and its volume is not excessive;
• the accuracy and currency of personal data is ensured; incomplete or inaccurate data is deleted or updated;
• storage is carried out in a form permitting identification of the data subject for no longer than the purposes of processing require;
• upon achievement of the purposes of processing, the data is destroyed or anonymised, unless otherwise provided by legislation or by contract;
• processing is carried out in a manner guaranteeing the security of the data, including protection against unauthorised access, loss, alteration and destruction.

5. Purposes of processing

5.1. The Operator processes personal data for the following purposes:

• carrying out its statutory activities: preparation, conclusion and performance of contracts for software development, technical audit, consulting and support;
• handling and responding to communications received through the forms on the website;
• recruitment: consideration of applications for vacancies, assessment of candidates, maintenance of a talent pool;
• compliance with labour legislation within employment relations and relations directly connected with them;
• maintenance of personnel and accounting records, fulfilment of the obligations of a tax agent and of other obligations provided for by the legislation of the Republic of Uzbekistan;
• ensuring the operation of the website and its security, and analysing the quality of the user experience.

6. Legal grounds

6.1. The legal ground for the processing of personal data is the body of regulatory legal acts in accordance with which the Operator carries out processing, including:

• the Constitution of the Republic of Uzbekistan;
• the Civil Code of the Republic of Uzbekistan;
• the Labour Code of the Republic of Uzbekistan;
• the Tax Code of the Republic of Uzbekistan;
• the Law of the Republic of Uzbekistan "On Personal Data" No. ZRU-547 of 02.07.2019;
• the Law of the Republic of Uzbekistan "On Informatisation";
• other regulatory legal acts governing relations connected with the Operator's activities.

6.2. The legal grounds for processing also include: the charter of ALGO-PRIME; contracts concluded between the Operator and data subjects; the consent of data subjects to the processing of their personal data.

7. Categories of data subjects and composition of data

7.1. Website visitors and persons who have made contact through the forms

Purpose — responding to the communication, preparing a commercial proposal, assessing a project:

• name;
• email address;
• the content of the communication and the links attached to it;
• cookies and other technical data generated when visiting the website;
• IP address and approximate location of the device.

7.2. Candidates for vacancies

Purpose — consideration of the application and taking a decision on employment:

• surname, first name, patronymic;
• contact details (telephone number, email address);
• links to a CV, professional network profiles and code repositories;
• information on education, work experience and qualifications;
• other personal data that the candidate voluntarily provides about themselves in their CV and covering letter.

7.3. Employees and former employees

Purpose — compliance with labour legislation, maintenance of personnel and accounting records, fulfilment of tax obligations:

• surname, first name, patronymic; sex; citizenship; date and place of birth;
• passport details, address of registration and of actual residence;
• contact details;
• taxpayer identification number;
• information on education, qualifications and professional development;
• information on employment history, position and income;
• other data provided by employees in accordance with the requirements of labour legislation.

7.4. Clients and counterparties who are natural persons, and representatives of counterparties

Purpose — conclusion and performance of contracts:

• surname, first name, patronymic; position;
• contact details (telephone number, email address);
• the details necessary for the conclusion and performance of the contract and for making settlements.

7.5. The Operator does not process biometric personal data and does not process special categories of personal data concerning racial and ethnic origin, political views, religious beliefs, state of health and intimate life.

8. Procedure and conditions of processing

8.1. Processing is carried out with the consent of the data subject, and also without such consent in the cases expressly provided for by the legislation of the Republic of Uzbekistan.

8.2. Processing is carried out by a mixed method — with and without the use of automation tools, with the transfer of data over the Operator's internal network and over the Internet.

8.3. Only those employees of the Operator whose job duties include the processing of personal data and who have been familiarised with the requirements of legislation and with the Operator's internal documents are admitted to processing.

8.4. Personal data may be transferred to contractors and subcontractors engaged by the Operator to the extent necessary for the provision of services, on the basis of a contract obliging them to observe confidentiality. More detailed information about the third parties involved in processing is provided to the data subject upon request.

8.5. The dissemination of personal data without the data subject's consent is not permitted, unless otherwise provided by legislation.

8.6. The transfer of personal data to state bodies is carried out in the cases and in the manner provided for by the legislation of the Republic of Uzbekistan.

8.7. The Operator takes legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking and dissemination, including:

• identifying current security threats and measures to neutralise them;
• adopting internal documents governing the processing and protection of personal data;
• appointing persons responsible for ensuring the security of personal data;
• restricting employees' access to documents and databases containing personal data;
• organising records of personal data carriers and storing them in conditions that preclude unlawful access;
• carrying out internal monitoring of the compliance of processing with the requirements of legislation.

9. Storage periods

9.1. Personal data is stored for no longer than the purpose of its processing requires, unless a different period is established by legislation or by contract.

9.2. Communications received through the forms on the website are stored until the purpose of processing is achieved — but for no more than 12 months from the moment of the last interaction, if no contract has been concluded between the parties.

9.3. Candidates' data is stored for up to 12 months from the moment the application is received — so that another vacancy may be offered. A candidate has the right at any time to demand the deletion of their data.

9.4. Data of employees and counterparties is stored for the periods established by the labour, tax and archival legislation of the Republic of Uzbekistan.

9.5. The Operator ceases the processing of personal data upon achievement of the purpose of processing, upon withdrawal of the data subject's consent, upon detection of unlawful processing, and also upon termination of the Operator's activities.

10. Requests from data subjects

10.1. A data subject has the right to send the Operator a request for confirmation of the fact that their personal data is being processed, for the legal grounds and purposes of processing, and for other information provided for by the Personal Data Law. The Operator provides a response within the time limits established by legislation.

10.2. The request must contain information confirming the identity of the data subject or of their representative, and information confirming the data subject's participation in relations with the Operator, or otherwise confirming the fact that their data is processed by the Operator.

10.3. The request is to be sent to the email address hello@algo-prime.uz or by registered letter to the Operator's address.

10.4. Where inaccurate personal data is identified, the Operator blocks it for the period of verification and updates it within the time limits established by legislation, after which it lifts the blocking.

10.5. A data subject has the right to withdraw consent to the processing of personal data at any time by sending a written notification to the Operator's address or to the email address hello@algo-prime.uz.

11. Cookies

11.1. The website uses cookies. The types of files, the purposes of their use and the ways of refusing them are described in the Cookie Policy.

12. Amendments to the Policy

12.1. The Operator has the right to make amendments to this Policy. The current version is published on this page and takes effect from the moment of publication.

13. Contact details of the Operator

Date of publication of the current version: 23 August 2026.