Privacy policy

1. GENERAL PROVISIONS

1.1. This Privacy Policy (hereinafter — the "Policy") sets out the procedure for processing and protecting the personal data of users of the «Peakly» service.

1.2. Personal data operator:

1.3. The Policy has been developed in accordance with:

• the Law of the Republic of Uzbekistan No. ZRU-547 of 02.07.2019 "On Personal Data" (as amended by Law No. ZRU-1125 of 26.03.2026);
• the Law of the Republic of Uzbekistan "On Informatisation";
• the Law of the Republic of Uzbekistan No. ZRU-792 of 29.09.2022 "On Electronic Commerce" (Article 18);
• the Law of the Republic of Uzbekistan "On Protection of Consumer Rights".

1.4. The Policy applies to all data processed by the Operator through the websites peakly.uz, thepeakly.com and their subdomains, mobile applications, the Telegram bot @peakly_help_bot and other official channels (hereinafter — the "Service").

1.5. The Policy forms an integral part of the Public Offer and the Terms of Use. Use of the Service constitutes agreement with this Policy.

1.6. The Policy does not apply to the processing of data by Sellers after they receive it for the purposes of conducting a Tour — in that respect the Seller acts as an independent operator and bears its own responsibility (see clause 6.2).

---

2. KEY DEFINITIONS

---

3. PROCESSING PRINCIPLES

The Operator processes personal data on the basis of the following principles:

• lawfulness and fairness — processing is carried out on a lawful basis and does not infringe the subject's rights;
• purpose limitation — only data necessary for the stated purposes is processed;
• minimisation — the volume of data is not excessive in relation to the purposes;
• accuracy and currency — the Operator takes measures to ensure the accuracy of data;
• storage limitation — data is stored no longer than required for the purposes of processing or by law;
• confidentiality and security — organisational and technical protection measures are applied;
• transparency — the subject is informed of the purposes, scope and procedure of processing.

---

4. WHAT DATA WE PROCESS

4.1. Data provided by the User

4.2. Data collected automatically

4.3. Data received from third parties

• from Payment Providers — transaction status, the fact of successful or unsuccessful payment, payment identifier (full card details are not transferred to the Operator);
• from Sellers — information on actual participation in a Tour, check-in confirmation;
• from authentication services (Google, Apple, Telegram) — to the extent permitted by the User when connecting.

4.4. Data we do NOT process

The Operator does not collect or process:

• biometric personal data (fingerprints, facial images used for identification, voiceprints);
• genetic data;
• information on racial or ethnic origin, political views, religious beliefs, or membership of public associations;
• full payment card details — CVV/CVC, full card number, expiry date. This data is processed exclusively by licensed Payment Providers in accordance with the PCI DSS standard.

Health data voluntarily provided by the User (clause 4.1) is processed exclusively to ensure safety on the route, is transferred only to the Seller of the relevant Tour and (where necessary) to emergency services, and is deleted at the User's request.

4.5. Planned functionality

When route tracking and emergency call (SOS) features are introduced, processing of movement data will be carried out solely on the basis of separate explicit consent from the User, with the ability to disable it at any time. Until such features are introduced, this Policy will be supplemented with a corresponding section.

---

5. PURPOSES AND LEGAL BASES FOR PROCESSING

---

6. TO WHOM WE TRANSFER DATA

6.1. The Operator does not sell personal data and does not transfer it to third parties for their own independent marketing purposes.

6.2. Transfer to Sellers. When a Booking is placed, the Seller receives the data necessary to conduct the Tour:

• Participants' full names and contact phone numbers;
• Participants' ages;
• comments and special requests;
• passport data — for international Tours only;
• health data — only if the User has provided it voluntarily.

Important. From the moment the data is received, the Seller becomes an independent personal data operator and must process it solely for the purposes of conducting the Tour, must not transfer it to third parties, and must ensure its protection. The corresponding obligations are set out in Section 15 of the Public Offer. The Operator is not liable for the Seller's actions breaching these obligations, but takes enforcement measures where breaches are identified.

6.3. Transfer to processors (persons processing data on the Operator's instructions):

6.4. Transfers to processors are made under agreements containing provisions on confidentiality, purpose limitation and protection measures.

6.5. Transfers to state authorities are made solely on the basis of reasoned requests submitted in the manner prescribed by the legislation of the Republic of Uzbekistan.

6.6. Public display. The following data is displayed publicly in accordance with the privacy settings selected by the User: name and avatar, posts, reviews, comments, rating, number of completed Tours, list of friends and follows. The User controls the extent of public information through the Personal Account settings.

6.7. Succession. In the event of the Operator's reorganisation or transfer of the business, personal data may be transferred to the successor provided that the purposes of processing are preserved and data subjects are notified through the Service.

---

7. DATA STORAGE AND LOCALISATION

7.1. Localisation requirements. Pursuant to Article 27¹ of the Law of the Republic of Uzbekistan "On Personal Data" (as amended by Law No. ZRU-1125 of 26.03.2026), a closed list of categories is subject to mandatory storage within the territory of the Republic of Uzbekistan: biometric data, genetic data, and data of users of telecommunications operators' services.

7.2. The Operator does not process biometric or genetic data (clause 4.4) and is not a telecommunications operator. Accordingly, the personal data processed by the Operator does not fall within the categories subject to mandatory storage within the territory of the Republic of Uzbekistan, and the requirement to register the database in the State Register of Personal Data Bases does not apply to the Operator.

7.3. Actual location. The Operator's server infrastructure is located in the Republic of Uzbekistan — «NEW LINE SOLUTIONS» LLC (licence of the Ministry for Development of Information Technologies and Communications of the Republic of Uzbekistan AA No. 0006929). Backups are stored in the same location.

7.4. Cross-border transfer. When certain processors are used (push notification service, Telegram Bot API, mapping services), data may be transferred outside the Republic of Uzbekistan. Such transfers are carried out:

• to the minimum extent necessary;
• under agreements with processors containing data protection obligations;
• in the manner prescribed by the legislation of the Republic of Uzbekistan on cross-border transfer of personal data.

7.5. Retention periods:

7.6. Upon expiry of the retention period, data is destroyed or anonymised. Anonymised data may be used for analytics without time limitation.

---

8. PROTECTION MEASURES

8.1. Technical measures:

• transmission of all data over the secure HTTPS/TLS protocol;
• encryption of sensitive data at rest;
• storage of passwords exclusively as irreversible cryptographic hashes;
• two-factor authentication for Sellers and administrators;
• rate limiting and protection against brute-force attacks on authentication endpoints;
• access segmentation and role-based permissions;
• regular backups with restore verification;
• monitoring and logging of data access;
• regular software updates and remediation of vulnerabilities.

8.2. Organisational measures:

• appointment of a person responsible for organising the processing of personal data;
• adoption of an internal Regulation on the processing and protection of personal data;
• granting access to data only to employees who require it to perform their duties;
• execution of non-disclosure undertakings by employees;
• staff training on data protection matters;
• maintaining a register of processors and concluding agreements with them.

8.3. Incident response. Where unauthorised access is identified that creates a risk of infringing subjects' rights, the Operator:

• immediately takes measures to remedy the consequences;
• notifies the authorised state body in the manner and within the timeframes prescribed by law;
• notifies affected data subjects via available communication channels, describing the nature of the incident and recommended measures.

8.4. The Operator takes reasonable and sufficient protection measures but cannot guarantee absolute security of data transmission over the Internet. The User is also responsible for safeguarding their account access credentials.

---

9. COOKIES AND SIMILAR TECHNOLOGIES

9.1. The Service uses cookies and similar technologies (local storage, device identifiers).

9.2. Categories:

9.3. On the User's first visit to the Service, a notice is displayed allowing management of cookie categories. The User may change these settings at any time in the "Privacy settings" section of the Personal Account.

9.4. Disabling cookies in browser settings may cause certain features of the Service to malfunction.

---

10. RIGHTS OF THE DATA SUBJECT

10.1. The User has the right to:

10.2. Procedure for requests. A request is sent to support@peakly.uz stating: surname, name and patronymic; the phone number or e-mail address linked to the account; and the substance of the request. The Operator may request identity verification from the applicant to prevent disclosure of data to an unauthorised person.

10.3. Review period — 15 (fifteen) business days from receipt of the request. Where necessary, the period may be extended with notice to the applicant stating the reasons.

10.4. Limitations on deletion. The Operator may refuse to delete data to the extent necessary for:

• performance of uncompleted Bookings;
• compliance with accounting and tax legislation;
• handling claims and protecting the Operator's rights within the limitation period;
• preventing re-registration of a User blocked for gross breaches (a minimal set of technical identifiers is retained).

The Operator notifies the applicant of any refusal and its grounds.

10.5. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal. Withdrawal of consent to processing of data necessary for performance of the agreement makes further use of the corresponding functionality impossible.

10.6. Appeals. The User may apply to the authorised state body of the Republic of Uzbekistan in the field of personal data protection, and also to court.

---

11. THIRD-PARTY DATA

11.1. A User who provides the data of additional Participants when Booking must first obtain their consent (or that of a legal representative for minors) to the transfer of data to the Operator and the Seller.

11.2. A User who publishes content depicting other persons or containing their personal data must obtain their consent.

11.3. The User is responsible for the absence of such consent. Upon receiving a request from a person whose data has been posted without consent, the Operator deletes the relevant data and notifies the User who posted it.

---

12. DATA OF MINORS

12.1. The Service is not intended for independent use by persons under 18 years of age. Registration of persons under 14 is not permitted.

12.2. Persons aged 14 to 18 may use the Service with the consent of their legal representative.

12.3. Data of minor Participants (full name, age) may be provided by a legal representative when placing a Booking.

12.4. Where independent registration by a person under 14 is identified, the Operator deletes the account and associated data. A legal representative may contact support@peakly.uz to request deletion of a minor's data.

---

13. AUTOMATED PROCESSING

13.1. The Operator uses automated processing for:

• generating a personalised Tour feed and recommendations;
• ranking search results;
• pre-screening media materials for prohibited content;
• detecting suspicious activity and indicators of fraud.

13.2. Automated decisions producing legal effects (blocking an account, declining a payment) may be appealed by the User under clause 8.6 of the Terms of Use. The appeal is reviewed by an Operator employee.

13.3. The User may disable feed personalisation in the privacy settings. In that case the feed is generated by general algorithms without regard to individual history.

---

14. CHANGES TO THE POLICY

14.1. The Operator may make changes to the Policy. The current version is published at https://peakly.uz/legal/privacy, stating the effective date.

14.2. Material changes (expansion of processing purposes, new data categories, new recipients) will be notified to Users at least 10 (ten) calendar days before the changes take effect, via available communication channels.

14.3. Where changes require new consent from the User, processing on the new terms begins only after such consent is obtained.

---

15. CONTACTS

---

This Policy has been prepared in accordance with the Law of the Republic of Uzbekistan No. ZRU-547 of 02.07.2019 "On Personal Data", as amended by Law of the Republic of Uzbekistan No. ZRU-1125 of 26.03.2026.