Personal Data Processing Policy

Last updated: 09.06.2026

1. General provisions

This Personal Data Processing Policy (hereinafter referred to as the “Policy”) has been developed in compliance with the requirements of the Law of the Republic of Uzbekistan dated 07/02/2019 No. ZRU-547 “On Personal Data” (hereinafter referred to as the “Personal Data Law”) in order to ensure the protection of human and civil rights and freedoms when processing personal data, including protection of the rights to privacy, personal and family secrets.

This Policy applies to the following categories of personal data subjects that are processed by the Operator (hereinafter referred to as “Personal Data Subjects”):

  • Contractors of the Operator (individuals).
  • Representatives (employees) of the Operator's counterparties (legal entities and individual entrepreneurs).
  • The Operator's clients.
  • Users of the Operator's Website.

Basic concepts used in the Policy

The operator of personal data is CARSTONE AMUSEMENT LLC, TIN: 303 146 764, legal address: TOSHKENT SHAHRI, YANGIHAYOT TUMANI, AL FARG'ONIY MFY, SPUTNIK 6 DAHASI, independently or jointly with other persons organizing and (or) processing personal data, as well as determining the purposes of personal data processing, the composition of personal data, and actions (operations) performed with the personal data to be processed.

Personal data processing is any action (operation) or set of actions (operations) with personal data performed with or without automation tools. The processing of personal data includes, but is not limited to: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction.

Automated personal data processing is the processing of personal data using computer technology.

Dissemination of personal data — actions aimed at disclosing personal data to an unspecified group of people.

Providing personal data is an action aimed at disclosing personal data to a specific person or a specific group of people.

Blocking of personal data is the temporary termination of the processing of personal data (except in cases where the processing is necessary to clarify personal data).

Destruction of personal data — actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which the material carriers of personal data are destroyed.

Depersonalization of personal data — actions as a result of which it becomes impossible to determine the identity of personal data to a specific personal data subject without using additional information.

The personal data information system is a set of personal data contained in databases and the information technologies and technical means that ensure their processing.

Cross-border transfer of personal data is the transfer of personal data to the territory of a foreign state, to an authority of a foreign state, a foreign individual or a foreign legal entity.

Website is a set of programs for electronic computers and other information contained in an information system, which is accessed via the Internet information and telecommunications network and located at: https://magicsafari.uz.

Website Services (Services) — Website functions that allow Personal Data Subjects to receive Operator services.

The purpose of personal data processing is to provide access to the Services, information and/or materials contained on the Site, to enable Personal Data Subjects to use all the functions of the Site developed for the provision of services, to inform Personal Data Subjects by sending emails, and to fulfill obligations under civil-law relations between the Operator and Personal Data Subjects during the use of the Services.

By registering on the Website, the Personal Data Subject provides their consent to the processing of their personal data in accordance with these Regulations.

2. Basic rights and obligations of the Operator

The operator has the right to:

  • independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of obligations stipulated by the Law on Personal Data and regulatory legal acts adopted in accordance with it, unless otherwise provided by the Law on Personal Data or other laws;
  • entrust the processing of personal data to another person with the consent of the personal data subject, unless otherwise provided by law, on the basis of a contract concluded with this person. The person who processes personal data on behalf of the Operator is obliged to comply with the principles and rules of personal data processing provided for by the Law on Personal Data;
  • if the personal data subject withdraws consent to the processing of personal data, continue processing personal data without the consent of the personal data subject, provided there are grounds specified in the Personal Data Act.

The operator must:

  • organize the processing of personal data in accordance with the requirements of the Law on Personal Data;
  • respond to enquiries and requests from personal data subjects and their legal representatives in accordance with the requirements of the Personal Data Act;
  • inform the authorized body for the protection of the rights of personal data subjects (hereinafter referred to as the “State Personalization Center” or “Center”), upon request of this body, of the necessary information within 10 working days from the date of receipt of such request.

3. The basic rights of Personal Data Subjects

The personal data subject has the right to:

  • receive information regarding the processing of their personal data, except in cases provided for by law. The information is provided to the Personal Data Subject by the Operator in an accessible form, and it should not contain personal data related to other Personal Data Subjects, except in cases where there are legitimate grounds for the disclosure of such personal data. The list of information and the procedure for obtaining it are established by the Law on Personal Data;
  • require the Operator to clarify their personal data, or block or destroy it, if the personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing, as well as to take legal measures to protect their rights;
  • appeal to the Center or in court against illegal actions or omissions of the Operator during the processing of their personal data.

A personal data subject may exercise the rights to receive information regarding the processing of their personal data, as well as the rights to clarify, block or destroy their personal data, by contacting the Operator with an appropriate request by e-mail: Mahmud.usmanov@gmail.com. In both cases, the request must be executed in compliance with the requirements of Article 6.1 of this Policy.

Control over the fulfillment of the requirements of this Policy is carried out by an authorized person responsible for organizing the processing of personal data by the Operator. Responsibility for violation of the requirements of the legislation of the Republic of Uzbekistan and the Operator's local acts in the field of personal data processing and protection is determined in accordance with the legislation of the Republic of Uzbekistan.

4. Legal grounds for personal data processing

The legal basis for the processing of personal data is a set of regulatory legal acts, in compliance with which and in accordance with which the Operator processes personal data, including:

  • the Constitution of the Republic of Uzbekistan;
  • the Civil Code of the Republic of Uzbekistan;
  • the Tax Code of the Republic of Uzbekistan;
  • Law No. ZRU-404 dated April 13, 2016 “On Accounting”;
  • other regulatory legal acts regulating relations related to the Operator's activities.

The legal basis for the processing of personal data is also:

  • the Operator's Charter;
  • contracts concluded with the Personal Data Subject;
  • consent of the Personal Data Subject to the processing of personal data.

5. Purposes, scope and procedure of personal data processing

The processing of personal data is limited to the achievement of specific, predetermined and legitimate purposes. Processing of personal data incompatible with the purposes of personal data collection is not allowed. The content and scope of the personal data being processed must comply with the stated purposes of processing provided for in this section, and must not be redundant in relation to those purposes.

5.1. The Operator's counterparties (individuals)

Purposes of processing: conclusion and execution of contracts; carrying out activities in accordance with the constituent documents.

Categories of personal data processed: last name, first name, patronymic; contact phone number; email address.

The Operator does not process biometric or special categories of personal data of counterparties (individuals). The Operator performs automated processing. List of actions: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, blocking, deletion, destruction. Disclosure and dissemination of personal data to third parties is prohibited without the consent of the counterparty, unless otherwise provided by law. No cross-border transfer is carried out.

5.2. Representatives (employees) of the Operator's counterparties (legal entities and individual entrepreneurs)

Purposes of processing: execution of contracts with counterparties; preparation of commercial proposals; carrying out activities in accordance with the constituent documents.

Categories of personal data processed: last name, first name, patronymic; contact phone number; email address.

The Operator does not process biometric or special categories of personal data of representatives (employees) of counterparties. The Operator performs automated processing. List of actions: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, blocking, deletion, destruction. Disclosure and dissemination of personal data to third parties is prohibited without the consent of the representative, unless otherwise provided by law. No cross-border transfer is carried out.

5.3. The Operator's clients

Purposes of processing: conclusion and execution of contracts; organization of participation in the loyalty program; sending advertising and informational messages about goods and services; carrying out activities in accordance with the constituent documents.

Categories of personal data processed: last name, first name, patronymic; passport data; contact phone number; email address; gender; credentials for logging into the personal account (username and password).

The Operator does not process biometric or special categories of personal data of clients. The Operator performs automated processing. List of actions: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, blocking, deletion, destruction. Disclosure and dissemination of personal data to third parties is prohibited without the client's consent, unless otherwise provided by law. No cross-border transfer is carried out.

5.4. Users of the Operator's Website

Purposes of processing: processing requests and enquiries submitted via the Website; sending advertising and informational messages about goods and services; preparation of commercial proposals; ensuring the uninterrupted operation of the Website; improving the user experience; keeping Website visit statistics; building the Personal Data Subject's profile; targeting goods and services according to the Personal Data Subject's interests; carrying out activities in accordance with the constituent documents.

Categories of personal data processed: last name, first name, patronymic; contact phone number; email address; credentials for logging into the personal account (username and password); date and time of the visit to the Website; cookies; data collected via website-visitor statistics aggregators.

The Operator does not process biometric or special categories of personal data of users. The Operator performs automated processing. List of actions: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, blocking, deletion, destruction. Disclosure and dissemination of personal data to third parties is prohibited without the user's consent, unless otherwise provided by law. No cross-border transfer is carried out.

6. Principles and conditions of processing

The processing of personal data is carried out by the Operator in accordance with the requirements of the legislation of the Republic of Uzbekistan and on the basis of the following principles:

  • legality and fair basis;
  • limiting the processing of personal data to the achievement of specific, predetermined and legitimate goals;
  • preventing the processing of personal data incompatible with the purposes of personal data collection;
  • preventing the consolidation of databases containing personal data processed for purposes incompatible with each other;
  • processing only those personal data that meet the purposes of their processing;
  • compliance of the content and volume of the processed personal data with the stated purposes of processing;
  • preventing the processing of excessive personal data in relation to the stated purposes;
  • ensuring the accuracy, sufficiency and relevance of personal data in relation to the purposes of processing;
  • destruction or depersonalization of personal data upon achievement of the purposes of their processing or in case of loss of the need to achieve these goals, unless otherwise provided by law.

The processing of personal data is carried out with the consent of the Personal Data Subject, as well as without it in cases provided for by the legislation of the Republic of Uzbekistan. Only the Operator's employees whose job responsibilities include processing personal data are allowed to process it.

The Operator takes the necessary legal, organizational and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, distribution and other unauthorized actions.

The Operator stores personal data in a form that allows determining the subject of personal data for no more than 1 year. When collecting personal data, including via the Internet, the Operator ensures the recording, systematization, accumulation, storage, clarification (updating, modification) and extraction of personal data of citizens of the Republic of Uzbekistan using databases located on the territory of the Republic of Uzbekistan.

6.1. Cookies

An information banner that appears on the Site informs the Site visitor about the processing of cookies and user data. The above-mentioned personal data is processed by the Operator in order to ensure the stable operation of the Site, improve the user experience, improve the ways and methods of presenting information on the Site, maintain statistics on Site visits and identify the most visited pages, create a profile, and target the product in accordance with the interests of the Site visitor.

The Site visitor has the choice to provide consent to the processing of the above-mentioned personal data by continuing to use the Site, or to refuse by disabling the processing of cookies and the collection of user data in the browser settings, or by leaving the Site. A visitor can delete cookies from their device at any time; however, if cookies are not accepted, some Site functions may be lost.

7. Updating, correcting, deleting and destroying personal data; responding to subjects' requests

Confirmation of the fact of personal data processing by the Operator, the legal grounds and purposes of processing, as well as other information specified in the Law on Personal Data, are provided by the Operator to the personal data subject or their representative within 10 (ten) business days from the date of receipt of the enquiry or request. The information provided does not include personal data related to other Personal Data Subjects, except in cases where there are legitimate grounds for the disclosure of such data.

The request must contain:

  • the number of the main identity document of the Personal Data Subject or their representative, information on the date of issue of the specified document and the issuing authority;
  • information confirming the Personal Data Subject's participation in the relationship with the Operator (contract number, date of conclusion of the contract and (or) other information), or information otherwise confirming the fact of personal data processing by the Operator;
  • the signature of the Personal Data Subject or their representative.

The request can be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Republic of Uzbekistan, as well as by e-mail at Mahmud.usmanov@gmail.com.

In case of detection of inaccurate personal data, the Operator blocks it for the verification period and clarifies the personal data within seven working days from the date of submission of supporting information, after which the blocking is removed. Upon achieving the purposes of processing, as well as in the case of revocation of consent, personal data is subject to destruction unless otherwise provided by a contract or by law.

8. Final provisions

The operator has the right to send advertising and informational messages to the Personal Data Subject via e-mail, SMS and push notifications only subject to prior consent to receive advertising in accordance with the Law of the Republic of Uzbekistan dated 06/07/2022 No. ZRU-776 “On Advertising”. Consent is provided in writing or electronically by checking the appropriate box on the Website.

The personal data subject has the right to refuse to receive advertising messages by clicking on the appropriate link in the emails received from the Operator, or by contacting the Operator with a corresponding request by e-mail at Mahmud.usmanov@gmail.com.

In compliance with the requirements of Article 18 of the Law on Personal Data, this Policy is published (and regularly updated) in free access on the Internet on the Website at: https://magicsafari.uz/en/privacy.