Privacy Policy

This Policy applies to the Mijozly website, customer workspaces, support interactions, and connected business channels operated by ЧАСТНОЕ ПРЕДПРИЯТИЕ "SYSTEMD" (Tax ID 307 865 310). It is based on the Law of the Republic of Uzbekistan No. ZRU-547 of July 2, 2019 “On Personal Data” (the Personal Data Law), including its current amendments.

The Personal Data Law applies to processing performed with or without information technologies. Mandatory provisions of Uzbekistan law prevail if they conflict with this Policy or a customer document.

Under the Personal Data Law, the owner determines the purposes and means of processing, while an operator performs processing. ЧП "SYSTEMD" is the owner for data collected for its website, contracting, billing, security, and support purposes. For data placed in a customer workspace, the customer generally determines the business purpose and Mijozly processes the data to provide the contracted service. The exact allocation follows the actual processing activity and the applicable customer agreement.

• Account and organization data: names, business contacts, roles, permissions, and workspace settings.
• CRM records: leads, contacts, companies, deals, tasks, meetings, notes, and relationship history.
• Communications: messages, call metadata and recordings where lawfully enabled, email events, attachments, and channel identifiers.
• Integration data: information received from systems a customer authorizes, including Meta, Telegram, telephony, and email services.
• Security and diagnostics: access and audit events, device and browser data, error details, trace identifiers, and abuse-prevention signals.

Data comes from the subject, an authorized customer or user, use of the service, or a connected system. A customer must have a lawful basis and any required notice or permission before submitting third-party personal data.

Personal data is processed only for declared purposes, including to:

• provide CRM, communication, telephony, analytics, integration, and workflow functions;
• create accounts, authenticate users, and enforce permissions and subscription terms;
• provide support, investigate incidents, prevent abuse, and protect the service;
• perform contracts, take requested pre-contract steps, and meet accounting or other legal duties.

Depending on the activity, Article 18 permits processing on the basis of the subject's consent; performance of a contract or requested pre-contract steps; compliance with a legal obligation; protection of legally protected interests; or legitimate interests that do not violate the subject's rights. Processing is not extended to an incompatible purpose without another lawful basis.

In accordance with Articles 10, 11, 12, and 19, Mijozly limits processing to data necessary and sufficient for the declared purpose, uses it for that purpose, and does not retain it in identifiable form longer than required. Inaccurate data must be corrected promptly. On a substantiated subject request, correction or supplementation must be completed no later than three days.

Mijozly does not sell customer personal data. Access may be provided to authorized workspace users, contracted infrastructure or communication providers, professional advisers, or competent public authorities where a lawful ground exists. Access is limited to the relevant function and protected by confidentiality, security, and contractual controls. Notices about transfer to a third party are provided where required by Articles 23 and 31.

Article 27-1, in its current 2026 wording, requires databases containing biometric data, genetic data, and personal data of users of telecommunications services operating in Uzbekistan to be located in Uzbekistan. Other personal data may be processed or stored outside Uzbekistan only where the statutory conditions are satisfied, including adequate foreign protection, compliant standard contractual clauses or binding corporate rules, or approved international standards.

The applicable location and transfer mechanism depend on the enabled service, provider, and category of data. A customer may request the relevant processing information before enabling an integration. This Policy does not by itself represent that every optional third-party system stores data in Uzbekistan.

Retention is defined by the purpose, customer agreement, record category, and legal obligations. Under Article 17, personal data must be destroyed when the processing purpose is achieved, consent is withdrawn or expires where consent is the applicable basis, or an effective court decision requires destruction, unless another lawful basis requires continued processing. Destruction means making restoration of the data impossible.

Data subject to a valid legal hold, accounting duty, security investigation, or dispute is restricted to that purpose and is not returned to ordinary use.

Articles 27 and 31 require legal, organizational, and technical measures to preserve privacy, integrity, and confidentiality and to prevent unlawful processing. Mijozly applies access controls, audit records, transport security, integration verification, operational restrictions, and incident monitoring appropriate to the service. Customers remain responsible for their users, credentials, devices, connected accounts, and workspace permissions.

A subject may request confirmation of processing, its grounds and purposes, methods, data categories and sources, retention period, applicable rights, and available cross-border information. A subject may also request correction, restriction, or destruction where the statutory grounds exist, and may appeal a refusal to the authorized state body or a court.

Send a written electronic request to info@mijozly.uz. Mijozly may verify identity and authority before disclosing or changing data. A written refusal to provide processing information must state the legal grounds and be sent within ten days as required by Article 22. Requests concerning customer- controlled workspace data may be coordinated with that customer.

Article 31 requires an owner or operator to register personal-data databases in the State Register where registration applies and to maintain the required processing information and safeguards. Publication of this Policy does not by itself prove that an operational database, transfer, or provider has completed every applicable compliance step. Material Policy changes are published here with a new revision and effective date, and this Policy does not replace a notice or consent required for a specific processing activity.