Privacy Policy

This Privacy Policy (hereinafter, the Policy) sets out the procedure and conditions for processing personal data within the TunkaForm service (hereinafter, the Service).

The Policy has been prepared in accordance with the Law of the Republic of Uzbekistan "On Personal Data" (No. ZRU-547 of 2 July 2019) and other legislation.

The Policy is an integral part of the Terms of Use. By registering with or using the Service, you confirm that you have read the Policy and consent to the processing of your data on the terms set out in it.

Operator - "ShahNur Software" LLC (TIN 311 915 358), the entity that organises and carries out the processing of personal data.

Personal data - any information relating to a specific individual or allowing that individual to be identified.

Data subject - an individual whose personal data is being processed.

Processing - any action involving the collection, systematisation, storage, modification, use, transfer, anonymisation or destruction of personal data.

Customer, User, Account and Customer Data - have the meanings given to them in the Terms of Use.

For Account data, applications submitted through the Website and technical data, the Operator is the data owner and operator.

For data that the Customer enters into the Service about its own customers, employees and counterparties, the Customer is the data owner. The Operator processes such data only on the Customer's instructions and for the purpose of providing the Service.

The Customer must have a legal basis and the data subjects' consent to enter such data into the Service.

Account data - name, phone number, organisation name, User role; passwords are stored only in hashed form; when signing in via Telegram - Telegram ID and username; when signing in via Google or Apple - email address or Apple ID.

Customer Data - data entered by the Customer about its customers, orders, measurements, inventory, cash desk, debts, employees and payroll.

Applications submitted through the Website - phone number, name if provided, and the page and source from which the application was submitted.

Payment data - payment amount, date, method and status. Bank card details are processed by the Payme and Click payment systems and are not shared with the Operator.

Technical data - IP address, device and browser type, server logs, error reports.

Usage analytics - pages viewed, clicks, feature usage and session recordings (see section 6).

The Service does not collect or process biometric data (facial images, fingerprints and the like).

Data is processed for the following purposes:

1. providing the Service and maintaining the Account;
2. performing order, cash desk and payroll calculations;
3. sending notifications via Telegram;
4. providing technical support and handling enquiries;
5. recording payments;
6. ensuring security and preventing fraud;
7. detecting errors and improving the Service;
8. contacting people who have submitted an application through the Website.

Processing is carried out on the following grounds:

1. the data subject's consent;
2. performance of a contract to which the data subject is a party;
3. compliance with obligations established by law.

Data is not processed for purposes incompatible with the stated purposes.

The Website and the dashboard use cookies and browser storage (local storage) to keep sign-in sessions. These are necessary for the Service to work.

PostHog is used for usage analytics, and Google Analytics for Website statistics.

In session recordings, all data in input fields is masked, and in the dashboard on-screen text is masked as well. As a result, personal data and business figures are not recorded.

On the Website, you can give or withdraw consent to analytics at any time via the notice at the bottom of the page or the "Privacy settings" link. Declining analytics does not affect how the Website works.

Data is shared only with the following parties and only to the extent necessary for them to perform their function:

1. data centre provider - server hosting;
2. PostHog - usage analytics;
3. Sentry - error tracking;
4. Telegram - bot, notifications and sign-in;
5. Google and Apple - where the user chooses to sign in this way; Google also for Website statistics;
6. Payme and Click - payment acceptance.

The Operator does not sell personal data or share it with third parties for advertising purposes.

Data is provided to government authorities only in the cases and manner established by the legislation of the Republic of Uzbekistan.

Account data and Customer Data are stored on servers in a secure data centre used by the Operator.

The servers of some service providers (PostHog, Sentry, Google, Telegram) are located outside Uzbekistan. Only the data necessary for the purposes set out in section 7 is transferred to them, and the Operator ensures data protection in accordance with legal requirements.

Telegram notifications are delivered through Telegram's servers and contain the content of the notifications the Customer has enabled.

The Operator takes legal, organisational and technical measures to protect data from unauthorised access, modification, disclosure and destruction, including:

1. data is encrypted with TLS when transmitted over the network;
2. passwords are stored in hashed form;
3. access to data is restricted to authorised staff;
4. encrypted backups are made daily and kept for 14 days.

No method of protection offers an absolute guarantee. If a data security breach is detected, the Operator will notify the affected Customers in the manner established by law.

Data is kept for the following periods:

1. Account data and Customer Data - for as long as the Account is active;
2. after the Account is closed or a deletion request is received - deleted within 30 days, except for data that the law requires to be kept longer (for example, payment records);
3. backups - deleted automatically within 14 days;
4. analytics and error data - a limited period set in the settings of the respective services.

Data subjects have the right to:

1. be informed that their data is being processed, of the purposes of processing and of the parties to whom the data is transferred;
2. access their data and export it;
3. have inaccurate or outdated data corrected;
4. request deletion of their data or restriction of its processing;
5. withdraw consent to processing;
6. object to processing for analytics purposes;
7. file a complaint about the Operator's actions with the competent government authority or a court.

Requests are sent to [email protected] or via the @tunkaformrobot Telegram bot. The Operator responds to a request within 10 business days.

Subjects of Customer Data (the Customer's own customers and employees) should first address their requests to the Customer; the Operator assists the Customer in fulfilling such requests.

The Service is intended for business use and is not meant to be used by persons under 18. The Operator does not knowingly collect data from minors.

The Operator may change the Policy. The new version is published on this page with its revision date.

Significant changes are announced through the dashboard, and you will be asked to accept the new version.

The Policy is published in several languages. In the event of any discrepancy between the texts, the Uzbek (Latin script) version prevails.