Privacy Policy

1. General Provisions

This Privacy Policy ("Policy") defines the terms and procedures for the collection, storage, processing, use, and protection of personal data of users by Tiesti (hereinafter referred to as the Company).

The Policy has been developed in accordance with the laws of the Republic of Uzbekistan, including:

• the Law "On Personal Data" (No. ZRU-547, dated July 2, 2019);
• the Law "On Electronic Commerce" (No. ZRU-385, dated April 29, 2015);
• the Law "On Informatization";
• and also takes into account international data protection principles, such as those set out in the General Data Protection Regulation (GDPR) of the European Union.

This Policy applies to all users of the website, as well as to all online platforms, services, and digital systems operated by the Company. By using the website, users acknowledge and fully consent to the terms of this Policy.

2. Purpose and Scope of the Policy

The purpose of this Policy is to ensure the protection of the rights and freedoms of individuals in the processing of their personal data, to establish transparent rules for handling personal information, and to guarantee the confidentiality and integrity of user data.

This Policy applies to all individuals who interact with the Company through:

• the official website or any of its subdomains;
• online order forms and payment systems;
• electronic correspondence, messenger communications, or other digital channels.

The Company collects and processes personal data solely for legitimate business purposes and within the limits necessary to fulfill its contractual and legal obligations.

3. Key Definitions

For the purposes of this Policy, the following terms shall have the meanings set forth below:

• Personal Data — any information relating to an identified or identifiable individual;
• User — any natural person who accesses or uses the Company's website or services;
• Processing — any operation performed on personal data, including collection, storage, modification, transmission, or deletion;
• Operator (Controller) — Tiesti, a legal entity responsible for organizing and ensuring the processing and protection of personal data.

4. Sources and Methods of Data Collection

The Company obtains personal data directly from users through the following means:

• submission of online orders or registration forms;
• completion of contact or feedback forms;
• execution of payments through certified payment systems;
• automatic collection via cookies, IP addresses, browser data, device identifiers, and analytical tools.

The Company does not request, collect, or store data that is unnecessary for the specified purposes of processing.

5. Categories of Collected Data

The Company may collect and process the following categories of personal data:

• first name and last name;
• contact phone number and email address;
• delivery address;
• payment details (processed only through secure payment gateways);
• cookies, IP address, browser version, operating system, and device information.

Additionally, non-identifiable technical and analytical data may be collected to monitor website performance and improve user experience.

6. Purposes of Processing Personal Data

The Company processes personal data exclusively for lawful and legitimate purposes, including but not limited to:

• acceptance, confirmation, and fulfillment of customer orders;
• delivery of goods and provision of services;
• improvement of service quality and user experience;
• communication with users regarding orders, payments, or updates;
• conducting marketing, statistical, and analytical activities;
• compliance with applicable accounting and tax legislation;
• prevention of fraud, unauthorized transactions, and cybersecurity threats.

Personal data shall not be transferred to third parties without the explicit consent of the user, except as required by law.

7. Transfer of Data to Third Parties

Personal data may be transferred to the following categories of recipients solely for the purposes listed in this Policy:

• payment systems (e.g., Octobank, Sello Pay, Rahmat, Uzcard, Humo, Visa, MasterCard);
• delivery and logistics service providers;
• public authorities, when required under applicable legislation.

All third-party data transfers are governed by confidentiality and data protection agreements (NDAs) that require equivalent or higher standards of protection than those established by this Policy.

8. Data Retention and Security Measures

The Company retains personal data for a period of one (1) year from the date of collection, after which it is securely deleted or anonymized.

To ensure data security, the Company implements a comprehensive system of technical and organizational measures, including:

• secure data transmission using SSL/TLS encryption protocols;
• restricted access to internal databases;
• multi-factor authentication and role-based access control;
• regular backups, encryption, and security audits;
• internal confidentiality obligations for all employees and contractors.

In the event of unauthorized access, data leakage, or security incidents, the Company undertakes immediate measures to eliminate the threat and, where appropriate, notify affected users.

9. Cookie Policy

The Company uses cookies to ensure proper website functionality, analyze traffic, and optimize user experience. Cookies do not contain personally identifiable information and cannot be used to identify users.

Users may disable or delete cookies in their browser settings. However, doing so may limit access to certain website features or affect website performance.

10. User Rights

In accordance with applicable law, each user has the following rights regarding their personal data:

• to access information about their data and processing methods;
• to request correction, update, or deletion of data;
• to withdraw consent to data processing at any time;
• to restrict or object to certain processing activities;
• to file a complaint with the Personal Data Protection Agency of the Republic of Uzbekistan if they believe their rights have been violated.

Users may exercise these rights by submitting an official written request to companytiesti@gmail.com.

All requests are reviewed within 15 (fifteen) business days as required by law.

11. Data Protection Guarantees

The Company treats data security as a matter of corporate responsibility and legal compliance. All data transmitted through the Company's website is protected via HTTPS protocol, and all payments are processed through certified and secure payment gateways.

Internal information security measures include:

• employee access control policies and security clearances;
• continuous system monitoring and vulnerability testing;
• regular internal audits of compliance and risk management;
• immediate response to cybersecurity threats or incidents.

12. Amendments to the Policy

The Company reserves the right to amend or update this Policy at any time. The updated version will be published on the Company's official website and will take effect immediately upon posting. Users are encouraged to review the Policy periodically. Continued use of the website following any modifications shall constitute acceptance of the updated terms.

13. Contact Information

If you have questions regarding this Privacy Policy, please contact us:

© 2026 Tiesti. All rights reserved.

Last updated: January 6, 2026.

This Policy is the official privacy statement of Tiesti and applies to all digital services, websites, and electronic systems operated by the Company.