This Policy describes what personal data Yashil Inno LLC (the "Operator") collects, why it does so, how long it keeps the data, to whom it transfers the data, and how the User can manage their data. The Policy applies to all services of the Agroimkon ecosystem (the "Platform"): the agroimkon.uz website, the app.agroimkon.uz platform (including the Telegram Mini App and the mobile apps for Android and iOS), the shop.agroimkon.uz classifieds board ("Agroimkon Eʼlonlar") and the Telegram bot @agroimkon_bot.
The Policy has been prepared in accordance with the Law of the Republic of Uzbekistan 'On Personal Data' No. ZRU-547 of 2 July 2019 and other legislative acts. Terms have the meanings given to them in that Law and in the User Agreement.
1. Operator and contacts
1.1. The owner and operator of the Platform's personal data databases is Yashil Inno LLC, TIN (INN) 310143710, address: 11 Islam Karimov Street, Bekhishtiyon MCG, Bukhara, Bukhara Region, Uzbekistan.
1.2. For questions about the processing of personal data, please contact us:
- email: info@agroimkon.uz;
- phone: +998 98 999 96 64.
The Operator is responsible for organising the processing of personal data. Please send requests to info@agroimkon.uz or call +998 98 999 96 64.
2. What data we process
2.1. Account data:
- mobile phone number;
- name (full name), profile photo, interface language;
- when signing in via Telegram: Telegram ID, username (@username), first and last name from Telegram;
- dates of registration and sign-ins, account status (active, blocked);
- information on the acceptance of documents: versions, date and time, IP address.
2.2. Profile data.
Individual or farmer:
- full name, date of birth;
- passport details (series and number, date of issue, expiry date, issuing authority), if the User provides them for profile verification;
- address, region and district, phone number, email.
Company:
- name, TIN (INN), year of establishment;
- full name and phone number of the head of the company, email;
- legal and actual address, region and district.
We also process the profile type, the verification status and the company card: description, services, routes, storage facilities, capacities.
2.3. Plots and products:
- name, type and area of the plot, region and district;
- plot coordinates that the User marks on the map;
- number of workers, year of planting, photos;
- crop, variety, expected volume, ripening time;
- terms of sale: price, minimum order, period;
- photos attached for verification.
2.4. Marketplace:
- Listings and offers;
- Requests (deals), their statuses and history;
- chat messages, reviews;
- complaints: text, reason, IP address;
- contact display settings and consent to display;
- contact reveal log: who, whose contact, when, from which section, IP address, browser or app information (user agent);
- blocks between profiles.
2.5. Payment:
- Plan and Subscription, invoices: payer details, amounts, currency, VAT;
- payment status.
When the User pays by card through a payment service, the Operator receives the payment ID and status. The card number is processed by the payment service; the Operator does not store it.
2.6. Documents: contracts and documents uploaded to the Platform, and electronic signatures on them (with the IP address and device information at the time of signing).
2.7. Classifieds board shop.agroimkon.uz:
- name, phone number, WhatsApp and Telegram given in the profile or listing;
- region and district, account type;
- listings and their photos, favourites, reviews, complaints;
- sign-in code requests: phone number, IP address.
2.8. Website agroimkon.uz: the name, phone number and message text that the User sends through the enquiry and application forms.
2.9. Technical data:
- IP address, browser or app information, time and URL of the request, in server logs and security logs;
- platform and app version (web, Telegram, Android, iOS) and dates of use, for version support and statistics;
- push notification token, when push notifications are enabled in the mobile app;
- data in cookies and in the browser's local storage (section 9).
2.10. One-time sign-in codes are stored until used, but for no longer than 5 minutes.
2.11. The Operator does not collect special categories of personal data, such as data on racial or ethnic origin, political views, religious beliefs or health, or biometric data. The device location is not determined automatically. The User enters plot coordinates themselves.
3. Purposes of processing
3.1. Personal data is processed for the following purposes:
- registration, sign-in and Account protection;
- operation of the Platform: catalogues, Listings, Requests, chats, contact reveals, reviews and complaints;
- verification (moderation) of profiles, plots, products and Listings;
- activation of Plans, invoicing, recording of payments, accounting and tax records;
- preventing fraud, spam and data harvesting, and ensuring security;
- User support and responding to enquiries;
- service notifications: sign-in codes, statuses, Requests, payments, changes to documents;
- informational messages about Platform features (the User may opt out of them);
- anonymised statistics and improvement of the Platform;
- publishing information about verified plots and products on the agroimkon.uz website and in the Telegram bot, without the name of an individual, a phone number or exact coordinates;
- compliance with legal requirements and lawful requests from state bodies.
3.2. The Operator does not make decisions that produce legal consequences for the User based solely on automated processing. Automatic rate limits (for example, the limit on contact reveals per hour) can be challenged through support.
4. Legal grounds
4.1. Personal data is processed:
- with the consent of the personal data subject, given at registration or sign-in (Consent to the Processing of Personal Data);
- to conclude and perform the User Agreement to which the User is a party;
- to fulfil obligations imposed on the Operator by law (accounting and tax records, responses to requests from authorised bodies);
- to protect the legitimate interests of the Operator and Users (Platform security, prevention of fraud and data harvesting) where permitted by law;
- in other cases provided for by the laws of the Republic of Uzbekistan.
5. Who sees the User's data
5.1. Other Users see the public part of the profile: company name or type of farm, region, Listings, information about plots and products, rating and reviews. Until a contact is revealed, plot coordinates are rounded to approximately 1 km. The name of an individual farmer is not shown until a contact is revealed.
5.2. Contact details (name or company name, phone number, and Telegram if the User has allowed it to be shown) are visible to another Participant:
- after a Request is accepted;
- via the "Show contact" button, in accordance with the contact settings and the Plan.
The User can see on the Platform who revealed their contact and when.
5.3. On the classifieds board shop.agroimkon.uz, a listing and the contact details given in it are visible to all visitors. The User decides which contact details to provide.
5.4. On the agroimkon.uz website, only information about verified plots and products is published. It contains no phone numbers, email addresses, Telegram usernames or exact coordinates.
5.5. Operator staff have access to data to the extent necessary for their duties. Staff actions are logged.
6. Transfer of data to third parties
6.1. The Operator does not sell personal data. Data is transferred only in the cases set out in the Policy or provided for by law.
6.2. The Platform uses the following third-party services:
| Service | What it receives | Purpose | Where it processes data |
|---|---|---|---|
| Eskiz (SMS gateway) | phone number, SMS text with the code | sending sign-in codes and SMS notifications | Republic of Uzbekistan |
| Telegram | Telegram ID, username, phone number (if the User shares their contact with the bot), bot messages | sign-in via Telegram, Telegram Mini App, bot notifications | outside the Republic of Uzbekistan |
| OpenStreetMap (map tiles) | IP address, requested map fragment | displaying maps | outside the Republic of Uzbekistan |
| Yandex Maps (API) | IP address, map requests | map in the add-plot form | outside the Republic of Uzbekistan |
| Firebase Cloud Messaging (Google), once push notifications are enabled | push notification token, notification text | delivering push notifications to the mobile app | outside the Republic of Uzbekistan |
| Payment services (for example, Payme), once card payment is enabled | amount, invoice number, payment ID; the User enters card details on the payment service's side | accepting payment | Republic of Uzbekistan |
| Hosting provider | all data stored on the server (over an encrypted channel and with access protection) | hosting the Platform | outside the Republic of Uzbekistan (rented server; being moved to the Republic of Uzbekistan) |
6.3. The Platform obtains exchange rates from the Central Bank of the Republic of Uzbekistan. No personal data is transferred for this purpose.
6.4. Data is provided to state bodies at their lawful request, to the extent provided for by law.
6.5. If the Operator is reorganised or the Platform is transferred, data may pass to the legal successor. The successor must comply with this Policy.
7. Cross-border transfer and storage location
7.1. When the User signs in via Telegram or uses the Telegram Mini App, and when maps are displayed and (once enabled) push notifications are delivered, some data is transferred to services that process it outside the Republic of Uzbekistan (section 6.2). Such transfer is based on the User's consent in accordance with the Law 'On Personal Data'. The User may refuse it by signing in with an SMS code and not using the Telegram bot, the Mini App or push notifications. The main Platform features will remain available, except for features that work through these services.
7.2. The Platform databases are currently hosted on a rented server outside the Republic of Uzbekistan. Hosting data on this server is a cross-border transfer of the data and is carried out on the basis of the User's consent. The Operator is moving the personal data databases of citizens of the Republic of Uzbekistan to servers located in the Republic of Uzbekistan and will announce the completion of the move in a new version of this Policy. The Platform does not process biometric or genetic data. The storage of personal data and its cross-border transfer are governed by Articles 15 and 27¹ of the Law 'On Personal Data'.
8. Retention periods
| Data | Retention period |
|---|---|
| Account and profiles, plots, products, Listings, company card | for as long as the Account exists; after the Account is deleted, deletion or anonymisation within 30 days, except for the data in the rows below |
| Chat messages, Requests and their history, reviews | for as long as the Account exists; after deletion, deleted or anonymised together with the Account |
| Contact reveal log, complaints, blocks | for as long as the Account exists, but no more than 3 years from the date of the record |
| Invoices, payment information, closing documents | for the periods established by accounting and tax legislation |
| Information on the acceptance of documents (version, date, IP address) | for as long as the Account exists and for 3 years after its deletion, as evidence of consent |
| Log of Operator staff actions | 3 years |
| Web server logs (IP address, browser information, requested URL) | up to 14 days |
| Rate-limiting records (IP address, phone number) | up to 2 days |
| One-time sign-in codes | until used, no longer than 5 minutes |
| Enquiries submitted through website forms | up to 3 years |
| Backups | until routinely replaced by new copies, no longer than 30 days |
8.1. When the purpose of processing has been achieved, the period has expired or consent has been withdrawn, the data is deleted or anonymised. The exception is cases where the law requires the data to be kept.
9. Cookies and local storage
9.1. The agroimkon.uz website does not use third-party advertising or analytics cookies. Technical cookies are used only for Operator staff to sign in to the admin panel and for technical display settings of the website.
9.2. The app.agroimkon.uz platform and the shop.agroimkon.uz classifieds board store the following in the local storage of the browser or app:
- sign-in tokens;
- the selected language and theme;
- form drafts, records of document acceptance;
- temporary data for faster performance.
This data stays on the User's device. It is deleted when the User signs out of the Account, clears the browser data or uninstalls the app.
9.3. In the Telegram Mini App, Telegram passes signed launch data to the Platform: the Telegram user's ID, name and language. This data is verified and used only for sign-in.
10. User rights
10.1. The User has the right to:
- receive information about the processing of their personal data: what data, purposes, periods, recipients;
- require clarification, correction, blocking or deletion of data that is incomplete, outdated, inaccurate or unlawfully processed;
- require a temporary suspension of the processing of their personal data;
- withdraw consent to the processing of personal data;
- delete their Account;
- appeal against the Operator's actions to the authorised state body for personal data protection or to a court.
10.2. How to exercise these rights:
- most data can be changed or deleted by the User directly in the "Profile" and "Settings" sections of the Platform;
- the Account can be deleted in the app via "Settings" → "Delete account", or on request; see the Account deletion page for details;
- requests and withdrawals of consent are sent using the contact details in section 1. Please state the phone number of the Account. To protect against fraud, the Operator may ask you to confirm that the number belongs to you.
10.3. The Operator responds to a request within the time limit set by law: within 10 days of receiving the request; data is clarified or corrected within 3 days (Articles 11 and 22 of the Law 'On Personal Data').
10.4. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. After consent is withdrawn, the Account can no longer be used: the Account is deleted as described on the "Account deletion" page. Data that the Operator is required by law to keep is retained for the established period.
11. Data protection
11.1. The Operator applies legal, organisational and technical protection measures:
- all services run over the secure HTTPS (TLS) protocol;
- sign-in is password-free, using one-time codes with limits on the number and frequency of attempts; staff passwords are stored only as hashes;
- staff access is based on roles and permissions and limited to what is needed;
- staff actions involving Users' data are logged;
- contacts are not served in lists and cards, every contact reveal is logged, and limits against data harvesting apply;
- secret keys are stored separately from the program code;
- database backups are made.
11.2. No method of transmitting and storing data is completely secure. If a breach occurs that may affect Users' rights, the Operator takes measures to remedy it and notifies Users and the authorised bodies in the cases provided for by law.
12. Children
12.1. The Platform is intended for persons over 18. The Operator does not knowingly collect data of minors. If it turns out that an Account was created by a minor, the Operator will delete the Account and the data. This can be reported using the contact details in section 1.
13. Changes to the Policy
13.1. The Operator may amend the Policy. Each new version is published on this page with its version number and effective date. The Operator notifies Users of material changes on the Platform at least 30 days in advance. If the changes require new consent, the Platform will ask for it at the next sign-in.