Xonsaroy Pay

PRIVACY POLICY JSC "Xonsaroy Payments"

Version effective as of "30" July 2025 Tashkent city

This Personal Information Privacy Policy (hereinafter referred to as the Policy) applies to the information that JSC "Xonsaroy Pay" (hereinafter — Xonsaroy Pay) may obtain about the User during their use of the Xonsaroy Pay payment service in the form of a mobile application, web application, Telegram bot, as well as any other software solutions, products, and services provided by Xonsaroy Pay (hereinafter — the Xonsaroy Pay Services).

This Policy applies solely to the Xonsaroy Pay Services. Xonsaroy Pay does not control and is not responsible for the websites, services, or applications of third parties that the User may access via links available within the Xonsaroy Pay Services, as well as for the processing of personal information by such third parties.

All terms and definitions not disclosed in this Policy shall be interpreted in accordance with other agreements, public offers, and contracts governing the provision and use of the Xonsaroy Pay Services by the User.

By using the Xonsaroy Pay Services, the User unconditionally agrees to this Policy and the terms of processing their personal information. If the User disagrees with the provisions of this Policy, they must refrain from using any of the Xonsaroy Pay Services.

1. Personal data of Users received and processed by JSC "Xonsaroy Payments"

1.1. Within this Policy, User's personal information shall include:

1.1.1. Personal information that the User voluntarily provides when registering in any of the Xonsaroy Pay Services, or during their use, including personal data transferred during the execution of any agreements between Xonsaroy Pay and the User. Note: some services may only be available if certain personal data is provided.

1.1.2. Data automatically transmitted to Xonsaroy Pay during the use of its Services via software installed on the User's device, including: IP address, information from cookies (text files stored in the User's browser), browser details (or other software used to access the Services), access time, and the address of the requested page.

1.1.2.1. During the use of the mobile app, web version, or Telegram bot, Xonsaroy Pay may automatically collect the following:

• type of user interaction (click, hover, etc.);
• date and time of the interaction;
• URL of the visited page;
• previous page address (Referer);
• IP (without IP statistics processing);
• User-Agent (browser and OS info);
• ClientID (browser ID via cookies);
• screen resolution;
• HTML element class clicked;
• search queries;
• full payment details, enabled/disabled functions;
• geolocation;
• email address;
• phone contacts;
• content viewed within the Xonsaroy Pay interfaces;
• information from form submissions, including errors in completion.

1.1.2.2. By using any service provided by Xonsaroy Pay, the User agrees that Xonsaroy Pay may collect and use statistics and cookies, process them via automated systems, and transfer them to third parties for research, task execution, or service provision purposes. The User may manage cookie settings via their browser. Blocking cookies may limit access to some features of the Xonsaroy Pay payment service.

1.1.3. Xonsaroy Pay may obtain publicly available information posted by the User on third-party platforms (e.g., chats, forms, social media), including reviews and comments. This information is used to improve service quality.

1.1.4. Xonsaroy Pay may process specific data (e.g., IP address, device ID) to detect or prevent actions that violate this Policy or applicable law.

1.1.5. Xonsaroy Pay may receive information about the User from its counterparties or partners. For example, a counterparty may transfer data allowing transaction identification related to a specific User.

1.1.6. To ensure the security of online payments made with bank cards, Xonsaroy Pay may collect additional information. The list of such data is defined in Clause 3.3.2.1 of this Policy.

2. Purposes of Collecting and Processing Clients' Personal Information

2.1. Xonsaroy Pay collects and stores only the personal data necessary to provide the Xonsaroy Pay Services or to fulfill agreements with the User, except in cases where the legislation requires mandatory collection and storage of certain personal data.

Personal information is stored only for as long as it is required for the processing purposes, unless a longer retention period is established by the legislation of the Republic of Uzbekistan or by the Xonsaroy Pay Service Usage Policy.

2.2. The User's personal data may be used for the following purposes:

2.2.1. Identifying the User, registering them, and providing access to all features of the Xonsaroy Pay Services (including payments, transfers, transaction history, etc.);

2.2.2. Communicating with the User — sending notifications, messages, technical information, and responses to support requests;

2.2.3. Improving the quality of the app and web service, developing new features, personalizing the interface and content;

2.2.4. Conducting internal analytics, statistics, and technical monitoring based on anonymized data;

2.2.5. Participating in marketing activities (subject to the User's consent), including promotions, bonuses, newsletters, and advertising offers from Xonsaroy Pay and its partners;

2.2.6. Ensuring information security, fraud prevention, and compliance with legal requirements (including AML/CFT and data protection regulations).

3. Terms of Processing User's Personal Data and its Transfer to Third Parties

3.1. Xonsaroy Pay processes the User's personal data in accordance with this Policy, the terms of the Services, and the Company's internal regulations.

3.2. Xonsaroy Pay ensures the confidentiality of the User's personal data and takes necessary legal, organizational, and technical measures to protect it.

3.3. The transfer of personal data to third parties is allowed in the following cases:

3.3.1. If the User has given their consent to such transfer;

3.3.2. If the transfer is necessary for the use of a specific Xonsaroy Payments service or partner service, including for executing the User's instructions. In particular, personal data may be transferred to the following categories of third parties:

3.3.2.1. Credit institutions and other entities involved in executing transfers. For example, to ensure a proper level of online payment security using bank cards, Xonsaroy Payments may transfer information (as defined by payment system security protocols) to acquiring/issuing banks and payment systems. Such transfer may be mandatory (e.g., data about user's device: IP address, OS, geolocation, device ID/type, channel: browser/app, payment authorization, identification/verification) or optional (e.g., address match indicators, account information with the service provider, email address, mobile phone number, payment amount, risk level set by the provider).

3.3.3. If the information is published by the User (e.g., in chats or public posts on forums), it becomes public, and the User is responsible for the consequences of such publication.

3.3.4. In the event of transfer of control over Xonsaroy Pay (e.g., sale or reorganization), all obligations related to the protection of personal data pass to the successor.

3.3.5. If the transfer is required by the legislation of the Republic of Uzbekistan or needed to comply with legal obligations.

3.3.6. If Xonsaroy Pay has reasonable grounds to believe the User is violating agreements or legal requirements, and the transfer is necessary to protect the rights and interests of the Company or third parties.

3.4. Xonsaroy Pay may provide anonymized and aggregated data to partners, which does not allow identifying a specific User, for analytics, statistics, development of new features, and service improvement purposes.

3.5. The processing of personal data is carried out in accordance with the Law of the Republic of Uzbekistan "On Personal Data" and other applicable regulatory legal acts.

4. User's Modification and Deletion of Personal Data and Access to It

4.1. The User has the ability to modify (update, supplement) or delete previously provided personal information using the functionality of the Xonsaroy Pay Services (via the mobile app, Telegram bot, or web version, where such settings are available).

4.1.1. The User may withdraw their consent for the processing of personal data by submitting a written request to the email address: office@xonpay.uz.

4.1.2. Within the limits established by law, Xonsaroy Pay notifies third parties to whom the User's personal information has been disclosed about its modification or deletion, except where this is impossible or requires disproportionate effort.

4.2. In certain cases provided by the legislation of the Republic of Uzbekistan, Xonsaroy Pay may be obliged to retain the User's personal data even after account deletion or withdrawal of consent. Such storage and processing will strictly comply with the law.

4.3. Charges for paid services within Xonsaroy Pay are only initiated if the User's bank card has a sufficient balance. No deductions are made if the balance is insufficient to cover the cost.

4.3.1. According to applicable law, the User has the right to request from Xonsaroy Pay information regarding:

(a) the purposes of processing;
(b) categories of data being processed;
(c) categories of recipients who have received or will receive the data;
(d) data retention period or criteria for determining it;
(e) other information provided by law.

4.3.1.1. If the corresponding functionality is not available in the Service interface (app, bot, or website), Xonsaroy Pay may provide this information in writing or by another method suitable for identifying the User.

4.3.1.2. If there are doubts about the applicant's identity, Xonsaroy Pay may request additional data to confirm the User's identity.

4.3.1.3. The request will be processed within 30 calendar days from receipt. If necessary, this period may be extended by another 60 days with prior notification of the reasons for the delay.

4.3.1.4. If the request is deemed excessive or unfounded, Xonsaroy Pay may charge a reasonable administrative fee or refuse to provide the information.

4.3.1.5. The User has the right to transfer the personal data obtained from Xonsaroy Pay to a third party (another controller), where allowed by law.

4.4. Right to Object

4.4.1. The User may withdraw previously given consent or object to the processing of personal data, if allowed by law. Withdrawal of consent may result in the unavailability of certain Xonsaroy Pay Services or features.

4.4.2. The User has the right to file a complaint with the authorized government body for the protection of personal data if they believe their rights have been violated.

5. Measures for Protecting Clients' Personal Information

5.1. Xonsaroy Pay takes necessary legal, organizational, and technical measures to ensure the security of Users' personal data, preventing unauthorized or accidental access, destruction, modification, blocking, copying, distribution, and other unlawful actions by third parties.

5.2. The processing and protection of personal data are carried out in accordance with the Law of the Republic of Uzbekistan "On Personal Data" (ZRU-547 dated July 4, 2025), as well as other applicable legal and regulatory acts in the field of information security.

5.3. Xonsaroy Pay establishes a confidentiality regime for all processed personal data and monitors compliance with this regime. Internal standards and procedures are also implemented to provide additional protection, including in accordance with legal requirements and internal regulatory documents of Xonsaroy Pay.

6. Changes to the Privacy Policy. Applicable Law

6.1. Xonsaroy Pay reserves the right to unilaterally amend or supplement this Policy. The updated version shall be published on the official website https://xonsaroypay.uz and shall take effect from the moment of publication unless otherwise stated in the new version. Continued use of the Service by the User after such changes constitutes acceptance of the new version of the Policy.

6.2. This Policy and the relationships arising from its application are governed by the legislation of the Republic of Uzbekistan, including regulatory acts in the field of personal data protection.

7. Interaction with Users Regarding Personal Data Processing

7.1. All questions, suggestions, and inquiries regarding the processing of personal data may be submitted via email to: office@xonpay.uz.

7.2. Xonsaroy Pay reserves the right not to respond to requests that are not related to the provisions of this Policy. However, the User has the right to submit other inquiries to the address specified in the "Contacts" section of the Xonsaroy Pay website.

Privacy Policy