Personal Data Processing and Security Policy
1. General Provisions
1. In order to fully comply with the applicable laws of the Republic of Uzbekistan, FE LLC “Get Experts Recruitment” (hereinafter referred to as the “Operator”) considers compliance with the principles of lawfulness, fairness and confidentiality in the processing of personal data, as well as ensuring the security of such processing, to be among its highest priorities.
2. This Policy on the Organisation of Personal Data Processing and Security at FE LLC “Get Experts Recruitment” (hereinafter referred to as the “Policy”) has the following characteristics:
• it has been developed to implement the requirements of the applicable laws of the Republic of Uzbekistan governing the processing and protection of personal data;
• it describes the methods and principles applied by the Operator when processing personal data; the rights and obligations of the Operator in relation to personal data processing; the rights of personal data subjects; and the measures taken by the Operator to ensure the security of personal data during processing;
• it is a publicly available document setting out the fundamental principles underlying the Operator’s activities in the processing and protection of personal data.
3. Before commencing the processing of personal data, the Operator notified the competent authority responsible for protecting the rights of personal data subjects of its intention to process personal data. The Operator updates the information contained in that notification in good faith and within the prescribed time limits.
2. Key Terms Used in This Policy
Personal data – information recorded on electronic, paper and/or other tangible media that relates to an identified individual or makes it possible to identify an individual.
Personal data subject (data subject) – the individual to whom the personal data relates.
Personal data database operator (operator) – a government body, individual and/or legal entity that processes personal data.
Processing of personal data – the performance of one or more operations involving the collection, systematisation, storage, alteration, supplementation, use, provision, dissemination, transfer, depersonalisation and destruction of personal data.
Automated processing of personal data – the processing of personal data using computer technology.
Dissemination of personal data – actions aimed at disclosing personal data to an unspecified group of persons, including publishing personal data in the mass media, posting it on the Internet or making it accessible by any other means.
Provision of personal data – actions aimed at disclosing personal data to a specific person.
Destruction of personal data – actions that make it impossible to restore personal data.
Depersonalisation of personal data – actions that make it impossible to determine which specific data subject the personal data belongs to.
Personal data database – a database in the form of an information system containing personal data.
Cross-border transfer of personal data – the transfer of personal data by the owner and/or operator outside the territory of the Republic of Uzbekistan.
Special categories of personal data – data concerning racial or social origin; political, religious or philosophical beliefs; membership in political parties or trade unions; physical or mental (psychological) health; private life; and criminal convictions.
Biometric data – personal data relating to the anatomical and physiological characteristics of a data subject.
Genetic data – personal data relating to inherited or acquired characteristics of a data subject, obtained through the analysis of a biological sample from the data subject or the analysis of another element providing equivalent information.
Personal data authorised by the data subject for dissemination – personal data made available to an unlimited number of persons through the data subject’s consent to the processing of personal data authorised for dissemination, in accordance with the procedure established by this Federal Law.
Person responsible for organising personal data processing – an individual or legal entity appointed by FE LLC “Get Experts Recruitment” to be responsible for organising the processing of personal data.
Personal data processing must be limited to specific, predetermined and lawful purposes. When providing consent to the processing of their personal data, a data subject must be informed of the purposes of processing. These purposes must be stated in the data subject’s consent form. Personal data must not be processed for purposes incompatible with those for which it was collected.
3. Key Rights and Obligations of the Operator
1. The Operator has the right to:
• obtain accurate information and/or documents containing personal data from the data subject;
• require the data subject to update or correct the personal data provided in a timely manner.
2. The Operator is obliged to:
• comply with personal data protection legislation;
• provide data subjects, upon request, with information concerning the processing of their personal data;
• approve the categories and scope of personal data necessary and sufficient to perform the relevant tasks;
• take measures to destroy personal data once the purpose of processing has been achieved, and in other cases prescribed by this Law;
• take the necessary legal, organisational and technical measures to protect personal data.
4. Key Rights and Obligations of Personal Data Subjects
1. A data subject has the right to know whether the Operator or a third party holds their personal data and what such data comprises.
2. A data subject has the right to obtain information about the Operator’s processing of their personal data upon request.
3. A data subject has the right to receive information from the Operator about the conditions for obtaining access to their personal data.
4. A data subject has the right to apply to the competent state authority or a court to protect their rights and legitimate interests in relation to their personal data.
5. A data subject has the right to consent to the processing of their personal data and to withdraw that consent, except in cases provided for by the laws of the Republic of Uzbekistan.
6. A data subject has the right to consent to the dissemination of their personal data by the Operator or a third party through publicly accessible sources of personal data.
7. A data subject has the right to require the Operator to temporarily suspend the processing of their personal data if the data is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the purposes of processing.
8. A data subject must provide the Operator only with accurate information about themselves and must provide documents containing personal data only to the extent necessary for the purpose of processing.
9. A data subject must inform the Operator of any updates or changes to their personal data.
10. A person who provides the Operator with false information about themselves, or personal data relating to another data subject without that person’s consent, shall be liable under the laws of the Republic of Uzbekistan.
5. Purposes of Collecting Personal Data
1. The processing of personal data by FE LLC “Get Experts Recruitment” is limited to specific, predetermined and lawful purposes.
2. FE LLC “Get Experts Recruitment” processes personal data for the following purposes:
• attracting and assessing candidates (job applicants) for vacant positions, including requesting additional information to assess their professional qualities in order to decide whether to reject an application or enter into an employment contract;
• entering into transactions and agreements of any kind with data subjects and subsequently fulfilling obligations under those transactions and agreements;
• informing data subjects in connection with professional activities, including providing information about events held and/or organised by the Operator;
• organising and conducting surveys, interviews, lectures and other events involving data subjects;
• carrying out human resources activities and maintaining personnel records for the Operator’s employees;
• managing employment and other directly related relationships, including assisting with recruitment, training and career advancement; establishing, calculating and paying salaries; and ensuring employees’ personal safety;
• providing and administering benefits, compensation and bonuses established by the laws of the Republic of Uzbekistan and the Operator’s internal policies;
• arranging voluntary medical insurance and accident-related life and health insurance;
• assisting with visas, invitations and travel tickets, and booking hotel accommodation;
• providing employees with mobile communication services;
• assisting with the provision of transportation services;
• organising incentive programmes for data subjects;
• acting as a representative, including issuing powers of attorney;
• conducting business operations, including sending and receiving correspondence and other postal items, translating documents, producing business cards and other printed materials, providing access to the Operator’s IT resources and supporting their use;
• obtaining (registering) and storing personal data and the media containing it in accordance with the laws of the Republic of Uzbekistan and the Operator’s internal regulations for the purpose of carrying out activities specified in the Company’s Charter;
• publishing data subjects’ personal data on publicly accessible resources, including websites of the Operator and companies within the same group, as well as official social media pages, for information purposes in cases provided for by law and the Operator’s internal policies, and to promote the brands of the Operator and its group companies and strengthen loyalty to the Operator’s brand;
• disclosing information and ensuring compliance with legal requirements when making management decisions;
• providing employees with electronic signatures;
• organising access control to the Operator’s premises;
• analysing user activity on the Operator’s websites and ensuring the proper functioning of those websites;
• protecting the Operator’s legitimate interests, including maintaining internal order and protecting property and assets;
• complying with mandatory requirements of the laws of the Republic of Uzbekistan concerning compulsory health and pension insurance, employment, civil law and taxation, including consumer protection and occupational health and safety requirements;
• providing data subjects with information, including information about the Operator’s services, and sending informational communications, including advertising and marketing materials;
• communicating with data subjects, including receiving and processing their enquiries and requests;
• collecting feedback from users of the Operator’s services, particularly regarding service quality, including for the purpose of providing recommendations about services provided or previously provided by the Operator;
• creating and maintaining a database containing personal data of individual representatives of legal entities, sole proprietors and event participants for business networking and contact purposes;
• creating and maintaining a database containing personal data of users and visitors of the Operator’s websites for communication and informational mailings;
• communicating and obtaining or providing information necessary for the Operator’s activities;
• performing other functions, exercising other powers and fulfilling other obligations imposed on the Operator by the laws of the Republic of Uzbekistan and its internal regulatory documents.
3. FE LLC “Get Experts Recruitment” does not process personal data in ways that are incompatible with the purposes for which the data was collected.
4. Databases containing personal data processed for mutually incompatible purposes must not be combined.
6. Legal Grounds for Processing Personal Data
1. This Policy has been developed in accordance with the applicable laws of the Republic of Uzbekistan governing the processing and protection of personal data.
2. In addition to the laws of the Republic of Uzbekistan governing the processing and protection of personal data, the legal grounds on which FE LLC “Get Experts Recruitment” processes personal data include:
• the Operator’s constituent documents;
• agreements entered into between FE LLC “Get Experts Recruitment” and data subjects;
• data subjects’ consent to the processing of their personal data;
• other grounds established by law under which consent to personal data processing is not required.
3. To implement this Policy, the head of the Operator has approved the “Regulations on the Organisation of Personal Data Processing and Security at FE LLC ‘Get Experts Recruitment’”, and the Operator has adopted other internal policies on personal data processing and protection.
7. Scope and Categories of Personal Data Processed and Categories of Data Subjects
1. In its activities, the Operator complies with the principles of personal data processing set out in Article 5 of Law of the Republic of Uzbekistan No. ZRU-547 “On Personal Data” dated 2 July 2019.
2. The Operator processes personal data relating to the following categories of data subjects:
• Job applicants;
• Employees;
• Former employees;
• Employees’ relatives;
• Individuals whose personal data is processed on behalf of another party;
• Candidates;
• Individual representatives of legal entities and sole proprietors;
• Users/visitors of the Operator’s website;
• Office visitors;
• Referees;
• Event participants;
• Interns.
3. The categories of personal data processed for each group of data subjects are listed below:
• Job applicants: surname, first name and patronymic;
• date of birth (day, month and year);
• place of birth;
• citizenship;
• sex;
• actual residential address;
• registered residential or temporary address;
• information about residence or temporary registration;
• telephone numbers, email addresses or other contact details;
• education details, including postgraduate professional education (level and mode of study, name of the educational institution, year of graduation, name and details of the qualification document, and qualifications and specialisation stated in that document);
• details of academic degrees and titles and the dates on which they were awarded;
• information about professional development and certification (number and date of issue of certificates of training completion);
• foreign language skills, proficiency levels and preferred language of communication;
• information about skills and professional experience, including computer skills (software proficiency and typing speed);
• professional field;
• specialisation;
• employment history and performance, including duties, employers (month and year of starting and leaving each job, job title and organisation name), promotions, disciplinary measures, transfers to new positions or workplaces, reasons for leaving employment and length of service;
• work permit;
• desired position;
• desired salary and salary level at the current or previous place of employment;
• preferred type of employment and working schedule;
• willingness to travel on business and relocate;
• information about important criteria when choosing an employer or job;
• referee details (surname, first name, patronymic, place of work and contact telephone number);
• marital status and information about children (including their number and ages);
• driver’s licence details (series and number), vehicle categories and driving experience;
• information about ownership or possession of a car;
• information about health-related restrictions on employment;
• interview results and decisions made;
• information about preferences, leisure activities, interests and hobbies;
• photograph;
• additional information required under federal laws governing specific cases and aspects of personal data processing;
• website usage data (location information; operating system type and version; browser type and version; internet service provider; the source from which the user arrived at the website; pages visited; number of page visits; browsing paths and movements within the website; session duration; entry points (third-party websites from which a user follows a link to the website); exit points (links on the website used to navigate to third-party websites); operating system and browser language);
• depersonalised data provided by web analytics services;
• IP address;
• cookies.
• Employees: surname, first name and patronymic;
• date of birth (day, month and year);
• place of birth;
• citizenship;
• sex;
• type and details of an identity document (series, number, date and issuing authority, and subdivision code);
• actual residential address;
• registered residential or temporary address;
• information about residence or temporary registration;
• telephone numbers, email addresses or other contact details;
• education details, including postgraduate professional education (level and mode of study, name of the educational institution, year of graduation, name and details of the qualification document, and qualifications and specialisation stated in that document);
• details of academic degrees and titles and the dates on which they were awarded;
• information about specialised professional knowledge and skills;
• information about professional development and certification (number and date of issue of certificates of training completion);
• foreign language skills and proficiency levels;
• information about skills and professional experience;
• professional field;
• specialisation;
• employment history and performance, including duties, employers (month and year of starting and leaving each job, job title and organisation name), promotions, disciplinary measures, transfers to new positions or workplaces, reasons for leaving employment and length of service;
• place of work and position held;
• personnel number, identification number or workplace access pass number;
• time and attendance records (arrival and departure times, other records of absence from the workplace, hours worked and contractual or department-standard hours, and leave status);
• information about annual paid leave, study leave and unpaid leave;
• work permit;
• desired position;
• desired salary;
• preferred type of employment and working schedule;
• willingness to travel on business and relocate;
• marital status;
• family composition (spouse, parents and children), including relationship, surname, first name, patronymic and year of birth;
• financial information: salary, pay rate, other accruals and payments, bank accounts used for salary and other payments, and taxes and insurance contributions payable or paid to extra-budgetary funds;
• bank account details;
• number of the state pension insurance certificate (SNILS);
• taxpayer identification number (TIN);
• military registration information and details of military registration documents;
• driver’s licence details (series and number), vehicle categories and driving experience;
• information about ownership or possession of a car;
• information about social benefits provided under the laws and regulations of the Republic of Uzbekistan;
• information about incentives and awards;
• information about disqualification or prohibition from holding certain positions or performing particular job functions;
• information contained in internal investigation materials;
• information from medical examination reports concerning an employee’s fitness or unfitness to perform their job duties;
• results of tests for the presence or absence of the novel coronavirus infection (COVID-19);
• results of tests measuring antibodies to the novel coronavirus infection (COVID-19);
• other information contained in employment agreements, individual or collective material liability agreements, apprenticeship agreements and service agreements;
• information about applications installed on an employee’s mobile device used for work purposes;
• information about preferences, leisure activities, interests and hobbies;
• assessments of professional and other personal qualities;
• international passport details, including dates of border crossings;
• photograph;
• video recordings or images;
• signature;
• additional information provided for by contractual terms and the requirements of federal laws governing specific cases and aspects of personal data processing.
• Employees’ relatives:
• surname, first name and patronymic;
• date of birth (day, month and year);
• type and details of an identity document (series, number, date and issuing authority, and subdivision code);
• registered address;
• actual residential address;
• degree of kinship.
• Individuals whose personal data is processed on behalf of another party:
• surname, first name and patronymic;
• date of birth (day, month and year);
• place of birth;
• citizenship;
• sex;
• type and details of an identity document (series, number, date and issuing authority, and subdivision code);
• actual residential address;
• registered residential or temporary address;
• information about residence or temporary registration;
• telephone numbers, email addresses or other contact details;
• education details, including postgraduate professional education (level and mode of study, name of the educational institution, year of graduation, name and details of the qualification document, and qualifications and specialisation stated in that document);
• details of academic degrees and titles and the dates on which they were awarded;
• information about specialised professional knowledge and skills;
• information about professional development and certification (number and date of issue of certificates of training completion);
• foreign language skills and proficiency levels;
• information about skills and professional experience;
• professional field;
• specialisation;
• employment history and performance, including duties, employers (month and year of starting and leaving each job, job title and organisation name), promotions, disciplinary measures, transfers to new positions or workplaces, reasons for leaving employment and length of service;
• place of work and position held;
• personnel number, identification number or workplace access pass number;
• time and attendance records (arrival and departure times, other records of absence from the workplace, hours worked and contractual or department-standard hours, and leave status);
• information about annual paid leave, study leave and unpaid leave;
• work permit;
• desired position;
• desired salary;
• preferred type of employment and working schedule;
• willingness to travel on business and relocate;
• marital status;
• family composition (spouse, parents and children), including relationship, surname, first name, patronymic and year of birth;
• financial information: salary, pay rate, other accruals and payments, bank accounts used for salary and other payments, and taxes and insurance contributions payable or paid to extra-budgetary funds;
• bank account details;
• number of the state pension insurance certificate (SNILS);
• taxpayer identification number (TIN);
• military registration information and details of military registration documents;
• driver’s licence details (series and number), vehicle categories and driving experience;
• information about ownership or possession of a car;
• information about social benefits provided under the laws and regulations of the Republic of Uzbekistan;
• information about incentives and awards;
• information about disqualification or prohibition from holding certain positions or performing particular job functions;
• information contained in internal investigation materials;
• information from medical examination reports concerning an employee’s fitness or unfitness to perform their job duties;
• other information contained in employment agreements, individual or collective material liability agreements, apprenticeship agreements and service agreements;
• information about preferences, leisure activities, interests and hobbies;
• assessments of professional and other personal qualities;
• international passport details, including dates of border crossings;
• photograph;
• video recordings or images;
• signature;
• additional information provided for by contractual terms and the requirements of federal laws governing specific cases and aspects of personal data processing.
• Candidates: surname, first name and patronymic;
• date of birth (day, month and year);
• place of birth;
• citizenship;
• sex;
• actual residential address;
• registered residential or temporary address;
• information about residence or temporary registration;
• telephone numbers, email addresses or other contact details;
• education details, including postgraduate professional education (level and mode of study, name of the educational institution, year of graduation, name and details of the qualification document, and qualifications and specialisation stated in that document);
• details of academic degrees and titles and the dates on which they were awarded;
• information about professional development and certification (number and date of issue of certificates of training completion);
• foreign language skills, proficiency levels and preferred language of communication;
• information about skills and professional experience, including computer skills (software proficiency and typing speed);
• professional field;
• specialisation;
• employment history and performance, including duties, employers (month and year of starting and leaving each job, job title and organisation name), promotions, disciplinary measures, transfers to new positions or workplaces, reasons for leaving employment and length of service;
• work permit;
• desired position;
• desired salary and salary level at the current or previous place of employment;
• preferred type of employment and working schedule;
• willingness to travel on business and relocate;
• information about important criteria when choosing an employer or job;
• referee details (surname, first name, patronymic, place of work and contact telephone number);
• marital status and information about children (including their number and ages);
• driver’s licence details (series and number), vehicle categories and driving experience;
• information about ownership or possession of a car;
• information about health-related restrictions on employment;
• interview results and decisions made;
• information about preferences, leisure activities, interests and hobbies;
• photograph;
• additional information required under federal laws governing specific cases and aspects of personal data processing;
• website usage data (location information; operating system type and version; browser type and version; internet service provider; the source from which the user arrived at the website; pages visited; number of page visits; browsing paths and movements within the website; session duration; entry points (third-party websites from which a user follows a link to the website); exit points (links on the website used to navigate to third-party websites); operating system and browser language);
• depersonalised data provided by web analytics services;
• IP address;
• cookies.
• Individual representatives of legal entities and sole proprietors:
• surname, first name and patronymic;
• date of birth (day, month and year);
• sex;
• type and details of an identity document (series, number, date and issuing authority, and subdivision code);
• telephone numbers, email addresses or other contact details;
• place of work and position held;
• company name and address;
• taxpayer identification number (TIN);
• signature;
• additional information provided for by contractual terms and the requirements of federal laws governing specific cases and aspects of personal data processing;
• website usage data (location information; operating system type and version; browser type and version; internet service provider; the source from which the user arrived at the website; pages visited; number of page visits; browsing paths and movements within the website; session duration; entry points (third-party websites from which a user follows a link to the website); exit points (links on the website used to navigate to third-party websites); operating system and browser language);
• depersonalised data provided by web analytics services;
• IP address;
• cookies.
• Users/visitors of the Operator’s website:
• surname, first name and patronymic;
• email address or other contact details;
• website usage data (location information; operating system type and version; browser type and version; internet service provider; the source from which the user arrived at the website; pages visited; number of page visits; browsing paths and movements within the website; session duration; entry points (third-party websites from which a user follows a link to the website); exit points (links on the website used to navigate to third-party websites); operating system and browser language);
• depersonalised data provided by web analytics services;
• IP address;
• cookies.
• Office visitors:
• surname, first name and patronymic;
• date of visit;
• arrival and departure times;
• type and details of an identity document (series and number).
• Referees:
• surname, first name and patronymic;
• telephone numbers;
• place of work and position held;
• email address or other contact details;
• company name.
• Event participants:
• surname, first name and patronymic;
• telephone numbers, email addresses or other contact details;
• place of work and position held;
• company name and address;
• photograph;
• video recordings or images;
• other additional information obtained during interactions.
• Interns:
• surname, first name and patronymic;
• date of birth (day, month and year);
• sex;
• type and details of an identity document (series, number, date and issuing authority, and subdivision code);
• telephone numbers, email addresses or other contact details;
• education details (level and mode of study and name of educational institution);
• signature;
• additional information provided for by contractual terms and the requirements of federal laws governing specific cases and aspects of personal data processing.
4. The Operator ensures that the nature and volume of personal data processed correspond to the stated purposes of processing and, where necessary, takes measures to eliminate any personal data that is excessive in relation to those purposes.
5. The Operator processes special categories of personal data with the written consent of the relevant data subjects, as well as in other cases provided for by the laws of the Republic of Uzbekistan.
8. Cookie Policy
1. This Cookie Policy sets out the procedure and conditions under which FE LLC “Get Experts Recruitment” uses cookies when users visit and use the website https://getexperts.uz/.
2. Cookies are small files stored on your device (such as a desktop computer, laptop, tablet or mobile phone) when you visit websites. Cookie information is stored in your browser and helps recognise you when you return to the website. Cookies allow us to improve our website and services.
3. Depending on the browser and device used by the job applicant, different sets of cookies may be used, including:
• Strictly necessary cookies. Without these cookies, the website may not display correctly in your browser. They include cookies used to remember information entered into forms and items placed in a shopping cart, as well as cookies storing technical information for audio and video files and information about the selected language and font.
• Preference cookies. These allow the website to remember information that changes its appearance or behaviour, such as the user’s language or region.
• Statistics cookies. These help website operators understand how visitors interact with the website (using Google Analytics and Yandex.Metrica). They make it possible to collect aggregated, depersonalised information about users.
• Marketing cookies. These are used to track visitors across websites, helping advertisers understand user preferences and display more relevant advertising.
Please note that the Operator uses cookies only with your consent. You may refuse cookies through your browser settings and your device settings.
4. The browser and/or device used by the job applicant may allow cookies to be blocked, deleted or otherwise restricted. Please note that if you delete or block cookies, you may not be able to access all website features, and some pages may not display correctly.
You may decide whether to allow cookies at all or adjust the settings of the browser you use to view the website. These options are available in your browser settings. Instructions are provided here:
• Edge
• Chrome
• Firefox
More information about cookies and how to manage them is available at this link.
By visiting the FE LLC “Get Experts Recruitment” website, you agree to this Policy, including the use by FE LLC “Get Experts Recruitment” of cookies and other data for subsequent processing by Google Analytics, Yandex.Metrica and other systems, and the transfer of such data to third parties for research, the performance of work or the provision of services.
9. Procedures and Conditions for Processing Personal Data
1. The Operator processes personal data subject to obtaining the data subject’s consent, except where the laws of the Republic of Uzbekistan permit processing without such consent.
2. A data subject decides whether to provide their personal data and gives consent freely, voluntarily and in their own interests.
3. Consent may be given in any form that makes it possible to confirm that it has been obtained. Where required by the laws of the Republic of Uzbekistan, consent must be given in writing.
4. Consent may be withdrawn by sending written notice to the Operator by post.
5. The Operator processes personal data by the following means:
• non-automated processing of personal data;
• automated processing of personal data, with or without transmission of the information obtained over information and telecommunications networks;
• a combination of automated and non-automated processing.
6. The Operator does not make decisions based solely on automated processing of personal data that produce legal effects concerning data subjects or otherwise affect their rights and legitimate interests.
7. The Operator’s processing of personal data includes the collection, systematisation, storage, alteration, supplementation, use, provision, dissemination, transfer, depersonalisation and destruction of personal data.
8. The Operator may transfer personal data to bodies conducting inquiries or investigations and to other authorised authorities on grounds established by the applicable laws of the Republic of Uzbekistan.
9. Where interaction with third parties is necessary to achieve the purposes of personal data processing, the Operator may transfer personal data to authorised third parties for those purposes.
10. The Operator may transfer personal data across borders (to the territory of a foreign state, to a foreign individual or to a foreign legal entity).
11. The Operator maintains publicly accessible sources of personal data relating to its employees (directories and address books). Personal data provided by a data subject may be included in such sources only with the data subject’s written consent or where required by the applicable laws of the Republic of Uzbekistan.
12. The Operator processes personal data authorised by data subjects for dissemination on the basis of separate consent obtained from the relevant data subject for such processing. The Operator enables data subjects to specify which personal data may be disseminated within each category of personal data listed in the consent to processing of personal data authorised for dissemination.
13. The Operator has established the following grounds for terminating the processing of personal data:
• achievement of the purposes of personal data processing and expiry of the maximum retention periods;
• the purposes of personal data processing no longer being necessary;
• the data subject or their legal representative providing evidence that the personal data was obtained unlawfully or is unnecessary for the stated purpose of processing;
• an inability to ensure the lawfulness of personal data processing;
• withdrawal of the data subject’s consent to personal data processing, where continued retention is no longer required for the purposes of processing;
• expiry of the limitation periods applicable to the legal relationships in connection with which personal data is or was processed.
14. Personal data is stored in a form that permits identification of the data subject for no longer than is necessary for the purposes of processing, unless a longer retention period is established by law or by an agreement to which the data subject is a party, beneficiary or guarantor.
10. Measures to Ensure Proper Organisation and Security of Personal Data Processing
1. When processing personal data, the Operator takes all necessary legal, organisational and technical measures to protect it against unauthorised or accidental access, destruction, alteration, blocking, copying, provision and dissemination, as well as other unlawful actions. Personal data security is ensured, in particular, by:
• appointing a person responsible for organising personal data processing;
• conducting internal monitoring and/or audits of compliance with Law of the Republic of Uzbekistan No. ZRU-547 “On Personal Data” dated 2 July 2019, regulations adopted under that Law, personal data protection requirements and the Operator’s internal policies;
• familiarising employees who directly process personal data with the laws of the Republic of Uzbekistan on personal data, including data protection requirements and the Operator’s internal policies on personal data processing, and/or providing those employees with training;
• identifying threats to the security of personal data processed in personal data information systems;
• implementing organisational and technical measures necessary to meet personal data protection requirements when personal data is processed in information systems;
• assessing the effectiveness of personal data security measures before a personal data information system is put into operation;
• maintaining records of electronic storage media containing personal data;
• detecting unauthorised access to personal data and taking appropriate measures;
• restoring personal data altered or destroyed as a result of unauthorised access;
• establishing access rules for personal data processed in information systems, and ensuring that all operations involving personal data in those systems are logged and recorded;
• monitoring the personal data security measures adopted and the level of protection of personal data information systems.
2. The duties and responsibilities of the Operator’s employees involved in processing and protecting personal data are established by the Operator’s “Regulations on the Organisation of Personal Data Processing and Security”.
11. Person Responsible for Organising Personal Data Processing
1. The rights, obligations and legal liability of the person responsible for organising personal data processing are established by Law of the Republic of Uzbekistan No. ZRU-547 “On Personal Data” dated 2 July 2019 and the “Regulations on the Organisation of Personal Data Processing and Security”.
2. The person responsible for organising personal data processing is appointed and relieved of their duties by order of the Operator’s General Director. When appointing this person, consideration is given to the official’s authority, competence and personal qualities, which should enable them to exercise their rights and fulfil their obligations under the “Regulations on the Organisation of Personal Data Processing and Security” properly and in full.
3. The person responsible for organising personal data processing:
• organises internal monitoring of compliance by the Operator and its employees with the laws of the Republic of Uzbekistan on personal data, including personal data protection requirements;
• informs, or ensures that employees are informed, about the provisions of the laws of the Republic of Uzbekistan on personal data, internal policies on personal data processing and personal data protection requirements;
• oversees the receipt and handling of enquiries and requests from data subjects or their representatives.
4. Contact details of the person responsible for organising personal data processing: FE LLC “Get Experts Recruitment”; telephone: +7 495 228 22 08; email: office@getexperts.uz; 12A Turkestan Street, Mirabad District, Tashkent, Republic of Uzbekistan.
12. Updating, Correcting and Destroying Personal Data; Responding to Data Subject Access Requests
1. Where personal data is found to be inaccurate or its processing unlawful, the Operator must update or correct the data or cease processing it, as applicable.
2. The inaccuracy of personal data or unlawfulness of its processing may be established by the data subject or by the competent state authorities of the Republic of Uzbekistan.
3. Upon receiving a written request from a data subject or their representative, the Operator must provide information about its processing of that data subject’s personal data.
4. The request must contain:
• the number of the principal identity document of the data subject and their representative;
• the date of issue of the document and the name of the issuing authority;
• information confirming the data subject’s relationship with the Operator (agreement number, date of execution, a designation or other relevant details), or other information confirming that the Operator processes the data subject’s personal data;
• the signature of the data subject or their representative.
5. The request may be submitted as an electronic document signed with an electronic signature in accordance with the laws of the Republic of Uzbekistan.
6. If the data subject’s request does not contain all the necessary information, or the data subject is not entitled to access the information requested, a reasoned refusal will be sent.
7. In accordance with the procedure set out in Clause 12.3, a data subject has the right to require the Operator to correct or destroy their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose of processing, and to take any measures provided for by law to protect their rights.
8. Once the purposes of personal data processing have been achieved, or if the data subject withdraws their consent, the personal data must be destroyed if:
• the agreement to which the data subject is a party, beneficiary or guarantor does not provide otherwise;
• the Operator is not entitled to continue processing without the data subject’s consent on grounds provided for by the Law of the Republic of Uzbekistan “On Personal Data” or other laws;
• no other agreement between the Operator and the data subject provides otherwise.
