PRIVACY AND PERSONAL DATA PROCESSING POLICY

This document establishes the rules for processing and protecting the personal data of
visitors to dubanya.uz and users of its booking forms.

Effective date: July 31, 2026
Operator: JV LLC "DUBANYA SILK ROAD"


1. General Provisions

1.1. This Privacy and Personal Data Processing Policy (the "Policy") establishes the procedure for
collecting, using, storing, transferring, and protecting the personal data of visitors to
https://dubanya.uz/.

1.2. This Policy has been prepared in accordance with Law of the Republic of Uzbekistan No. ZRU-547
dated July 2, 2019, "On Personal Data", and other applicable laws of the Republic of Uzbekistan.

1.3. This Policy applies to information received through the Website, booking and contact forms, as well
as when a user contacts the Operator by telephone, email, or messenger.

1.4. By submitting a request through the Website and selecting the consent checkbox, the user
confirms that they have read this Policy and consents to the processing of the personal data provided.


2. Operator Details

Joint Venture in the form of a Limited Liability Company "DUBANYA SILK ROAD"
Short name: JV LLC "DUBANYA SILK ROAD"
Tax Identification Number: 312498537
Registered address: Republic of Uzbekistan, Samarkand Region, Samarkand District, Konigil MFY,
Samarqand darvozasi Street, 49
Website: https://dubanya.uz/
Email: info@dubanya.uz
Telephone: +998 90 456 56 56
Hereinafter referred to as the "Operator".


3. Personal Data Processed

3.1. The Operator may receive the following personal data provided directly by the user:
• name;
• telephone number;
• email address, when the user contacts the Operator by email;
• the contents of a comment, message, or request;
• preferred date, time, and format of the visit;
• other information voluntarily provided by the user to process a request or provide services.

3.2. When the Website is visited, the following technical data may be processed automatically:
• IP address;
• device type, browser, and operating system;
• date and time of the visit;
• pages viewed and actions performed on the Website;
• referral source;
• cookies and similar identifiers;
• approximate location determined from the IP address;
• other technical information required for the operation and security of the Website.

3.3. The Operator does not intentionally collect biometric, genetic, or other special categories of
personal data through the Website.

Users should not include information about their health, diagnoses, religious or political views, or other
sensitive information in the Comment field. If such information is required for the safe provision of a specific service, it must be processed on the basis of separate consent.


4. Purposes and Legal Grounds for Processing

4.1. Personal data is processed for the following purposes:
• receiving and processing booking requests;
• contacting the user to confirm the date, time, number of guests, and format of the visit;
• entering into and performing a service agreement;
• providing information about services, prices, and visiting rules;
• sending booking-related notifications;
• reviewing requests, proposals, and complaints;
• ensuring the security and proper operation of the Website;
• analysing Website traffic and improving the Website and services;
• complying with legal obligations;
• protecting the rights and legitimate interests of the Operator and users.

4.2. The legal grounds for processing are:
• the user's consent;
• the need to take steps at the user's request before entering into an agreement;
• the conclusion and performance of an agreement;
• compliance with legal requirements;
• the legitimate interests of the Operator, provided that the user's rights and legitimate interests are
not infringed.

4.3. Advertising and marketing communications are sent only with the user's separate voluntary
consent. The user may withdraw such consent at any time.

4.4. If the purposes of processing change and the new purpose is incompatible with the original
purpose, the Operator will obtain new consent from the user.


5. Processing Procedure and Retention Periods

5.1. Processing may be carried out by automated and non-automated means.

5.2. The Operator may perform the following actions with personal data:
• collection, recording, systematisation, accumulation, and storage;
• clarification, updating, and use;
• granting access to authorised persons;
• transfer in the cases provided for by this Policy;
• anonymisation and temporary suspension of processing;
• deletion and destruction.

5.3. Data relating to requests that do not result in an agreement is retained for no longer than 12
months after the last interaction with the user, unless longer retention is required to review a request
or protect the legitimate interests of the parties.

5.4. Data relating to the provision of services and payments is retained for the duration of the
contractual relationship and thereafter for the periods required by the laws of the Republic of
Uzbekistan.

5.5. Data used for advertising communications is processed until the relevant consent is withdrawn.

5.6. Technical and analytics data is retained within the periods configured in the relevant services and
only to the extent necessary for analytics, security, and improvement of the Website.

5.7. Personal data is deleted or destroyed upon:
• achievement of the processing purposes;
• withdrawal of consent, where no other lawful basis for processing exists;
• expiry of the established processing period;
• identification of unlawful processing;
• a final and binding court decision;
• other grounds provided for by law.


6. Cookies and Analytics Services

6.1. The Website may use:
• essential cookies required for the technical operation of the Website and its forms;
• functional cookies that store settings selected by the user;
• analytics cookies that help assess Website traffic and use.

6.2. The Website is built using the Tilda platform, which may process technical data and information
submitted through Website forms.

6.3. Google Analytics may be used to analyse Website traffic. It may receive technical information
about Website use, including an IP address, device and browser data, and actions performed on pages.

6.4. Non-essential analytics cookies must be used only after the user's consent has been obtained. The
user may accept or reject them through the cookie notice and may also change browser settings.

6.5. Disabling essential cookies may cause certain Website functions to operate incorrectly.


7. Disclosure of Data to Third Parties

7.1. The Operator does not sell personal data or disclose it to third parties for their independent
advertising purposes.

7.2. To the extent necessary for the stated purposes, access to personal data may be granted to:
• Operator employees who handle bookings and enquiries;
• hosting and technical support providers;
• the Tilda platform and connected form-processing services;
• providers of CRM, email, telephony, and messenger services;
• analytics providers, including Google Analytics;
• government authorities in the cases and manner provided for by law.

7.3. Persons who receive access to data on the Operator's instructions must maintain confidentiality
and use the data only to perform the functions assigned to them.


8. Cross-Border Data Transfer

8.1. As foreign technology services may be used to operate the Website, certain technical and personal
data may be processed outside the Republic of Uzbekistan.

8.2. Cross-border transfers are carried out only where a legal basis exists, including the user's consent,
adequate protection by the recipient, or appropriate contractual and organisational safeguards.

8.3. By submitting a form and confirming consent, the user agrees to the possible cross-border transfer
of data to service providers required to process the request, operate the Website, and provide analytics, within the purposes of this Policy.


9. Personal Data Security

9.1. The Operator takes the legal, organisational, and technical measures necessary to protect
personal data against:
• unauthorised or accidental access;
• loss, destruction, or alteration;
• copying, disclosure, or dissemination without a legal basis;
• other unlawful actions.

9.2. Access to personal data is granted only to employees and contractors who require it to perform
their employment or contractual duties.

9.3. Despite the measures taken, the transmission of information over the internet cannot be
completely secure. Users should also take reasonable precautions when transmitting information.


10. User Rights

The user has the right to:
• know whether the Operator holds their personal data and what data is held;
• receive information about the purposes, legal grounds, methods, and periods of processing;
• request clarification, amendment, or supplementation of data;
• request temporary suspension of processing where the data is inaccurate, outdated, unlawfully
obtained, or excessive;
• withdraw previously given consent;
• request deletion or destruction of data where lawful grounds exist;
• opt out of advertising communications;
• receive information about actual or intended cross-border transfers;
• apply to the authorised government body or a court to protect their rights.
Data is amended or supplemented following a verified user request within the periods prescribed by
law, including no later than three days after receipt of the relevant request.


11. Submitting Requests

11.1. Requests concerning the processing of personal data may be submitted:
• by email to info@dubanya.uz;
• to the Operator's registered address;
• by another available means that allows the sender and contents of the request to be identified.

11.2. A request should preferably state:
• the user's name;
• telephone number or other contact method;
• the substance of the request;
• information enabling the Operator to identify which data relates to the applicant.

11.3. To prevent unauthorised access, the Operator may request information necessary to verify the
applicant's identity.

11.4. Withdrawal of consent does not affect the lawfulness of processing carried out before the
withdrawal was received. Following withdrawal, the Operator may continue processing only where
another lawful basis exists.


12. Data Relating to Minors

If a user provides personal data relating to a minor, the user confirms that they are authorised to act as
the minor's parent, guardian, custodian, or other legal representative.
The Operator may delete a minor's data if it determines that the data was provided without the
required consent of a legal representative.


13. Links to Third-Party Resources

The Website may contain links to Instagram, Telegram, WhatsApp, maps, and other third-party
resources. After a user follows such a link, data is processed by the relevant third party under its own
privacy rules.

The Operator is not responsible for the processing of data on third-party websites or in third-party
applications.


14. Changes to this Policy

14.1. The Operator may amend this Policy if the law, Website functionality, or data-processing
practices change.

14.2. A new version takes effect on the date it is published on the Website, unless another effective
date is specified.

14.3. The current version is available at: https://dubanya.uz/policy_en.

JV LLC "DUBANYA SILK ROAD"
Version date: July 31, 2026