Libro.uz Privacy and Personal Data Processing Policy

1. General Provisions

1.1. The Policy describes which personal data of users of the website libro.uz and the Libro application (hereinafter - the Platform) are processed, for what purpose and for how long, and how a user can manage their data.

1.2. The owner and operator of the personal data database is Billy's School LLC, TIN 308126864, 77 Temur Malik Street, Mirzo-Ulugbek District, Tashkent 100000 (hereinafter - the Operator).

1.3. The Policy has been developed in accordance with the Law of the Republic of Uzbekistan "On Personal Data" and the Law "On Electronic Commerce".

1.4. By logging in to the Account, the user (hereinafter - the Data Subject) confirms that they have read the Policy and consents to the processing of their data on its terms.

2. What Data We Process

We do not receive or store bank card numbers: they are entered on the payment system's page. We do not collect biometric, genetic or special personal data (about health, beliefs, origin, etc.).

3. Purposes and Grounds for Processing

Data are used only for the stated purposes. For a new purpose, the Operator will request new consent (Art. 19 of the Law). No decisions producing legal consequences for the Data Subject are made solely by automated means.

4. Consent of the Data Subject

4.1. Consent is given electronically at login: on the login page, the Data Subject sees links to the User Agreement and the Policy and confirms the login with a code from the Telegram bot (Art. 21 of the Law).

4.2. Consent to messages about new releases and promotions is given separately and does not affect the ability to buy and read books.

4.3. The Data Subject may withdraw consent in the same form in which it was given: by deleting the Account (the "Delete account" section in "My library"), by turning off messages about new releases, or by a written request to office@hrtest.uz. After withdrawal, the Operator stops processing and destroys the data, except for data that it is required to keep by law (Section 5).

5. Where and How Long We Store Data

5.1. All Platform data are stored and processed on a server physically located in the territory of the Republic of Uzbekistan. Backups are stored there as well.

5.2. Retention periods:

5.3. Upon expiry of the period, data are destroyed so that they cannot be restored, or are anonymized (Arts. 16 and 17 of the Law).

6. To Whom Data Are Transferred

6.1. The Operator does not sell personal data and does not transfer them for third-party advertising.

6.2. Data are transferred only to those without whom the Platform cannot operate, and only to the extent necessary:

6.3. Telegram processes data on its servers, which may be located outside Uzbekistan, in accordance with its own privacy policy. By using login via the Telegram bot, the Data Subject consents to such cross-border transfer (Art. 15 of the Law).

6.4. Rights Holders and authors receive only anonymized sales and reading statistics, without data on specific buyers.

6.5. The Operator will notify the Data Subject within three days of any transfer of data to a third party not specified in this section (Art. 23 of the Law).

7. How We Protect Data

• data transmission between the device and the Platform is encrypted (HTTPS, TLS certificates);
• database passwords and access keys are stored on the server separately from the code and are not transmitted over open channels;
• employee access to data is limited by roles and granted only to those who need it for their work; employees are required to maintain confidentiality (Arts. 12 and 28 of the Law);
• login only with a one-time code, and limits on login attempts and on requests from one IP;
• regular backups;
• in the event of a leak or a suspected leak, the Operator takes measures to stop it and notifies the affected Data Subjects and the authorized body in the manner established by law.

8. Rights of the Data Subject

8.1. The Data Subject has the right (Arts. 22 and 30 of the Law) to:

• know what data about them the Operator holds and receive a list of such data;
• receive information about the purposes, methods and periods of processing and about the recipients of the data;
• demand correction or completion of inaccurate data - the Operator does so no later than three days from the date of the request (Art. 11 of the Law);
• demand temporary suspension of processing if the data are incomplete, outdated, inaccurate or not needed for the purposes of processing;
• withdraw consent and delete the Account;
• appeal against the Operator's actions to the authorized state body (the State Personalization Center under the Cabinet of Ministers) or to a court.

8.2. How to exercise these rights:

• devices are unlinked in the "My devices" section;
• the Account is deleted in the "Delete account" section in "My library"; the consequences are described in the User Agreement (Section 6);
• other requests - to office@hrtest.uz, indicating the phone number linked to the Account.

8.3. If the provision of information is refused, the Operator informs the Data Subject of the reason in writing within ten calendar days (Art. 22 of the Law).

9. Cookies, Camera and Technical Data

9.1. The website uses essential cookies and the browser's local storage to keep the User logged in to the Account and to remember the interface language and the Reader settings. Without them, login and reading do not work.

9.2. The mobile application stores session data and protected copies of books for offline reading on the device.

9.3. The camera is used only to scan ISBN barcodes: in the mobile app when searching for a book and in the store cabinet when adding a book to the shelf. The camera turns on only when the User taps the scan button. The image is processed on the device and is neither stored nor transmitted; only the recognised ISBN number is sent to the server. Camera access can be denied in the device or browser settings.

9.4. The Platform does not use external analytics services. Visit and reading statistics are collected by the Operator's internal tools and are not transferred to third parties.

9.5. The User may delete cookies in the browser settings; after that, the User will need to log in again.

10. Changes and Contacts

10.1. The Operator may amend the Policy by publishing a new version on the Platform. If the purposes of processing or the range of recipients change, the Operator requests new consent (Art. 19 of the Law).

10.2. Person responsible for the processing and protection of personal data (Art. 31 of the Law): Dilshod Saidbilol ugli Saydmuratov, Director.

10.3. Contacts for data matters: e-mail office@hrtest.uz, phone +998 94 361 39 93, postal address: 77 Temur Malik Street, Mirzo-Ulugbek District, Tashkent 100000, Billy's School LLC.

10.4. The Policy is drawn up in the Uzbek, Russian and English languages; in the event of discrepancies, the Uzbek text prevails.