Privacy Policy

Baxtlilar · Edition in force from the date of official publication · Version 1.2 · English

BAXTLILAR · LEGAL DOCUMENTS

English

Version 1.2 · Enters into force on the date of its official publication on the Baxtlilar Platform.

Operator: “Bahtli bo‘laman” LLC. Current edition: baxtlilar.app and Telegram Mini App.

1.1. This Privacy Policy determines the procedure and conditions for the processing of the personal data of users of the Baxtlilar Platform, including the categories of personal data and the sources from which they are obtained, the purposes, grounds and methods of their processing, the conditions for their provision to third parties and cross-border transfer, the retention periods, the protection measures applied, as well as the rights of Users in respect of their personal data.

1.2. The Policy applies to the Baxtlilar Telegram Mini App, the informational website https://baxtlilar.app, registration and verification, Questionnaire/Profile, Matching and recommendations, Interest and Mutual Interest, Chat, support, moderation, security, payment transactions via external links and the related administrative and technical processes.

1.3. The Operator of personal data is “Bahtli bo‘laman” LLC, Taxpayer Identification Number (INN) 305628985, registered address: 100000, Republic of Uzbekistan, Tashkent city, Chinobod Street, building 1, apartment 47.

In the cases provided for by legislation and by this Policy, third parties may be engaged in the processing of personal data, including providers of technical, infrastructure, communication, verification, payment and other services necessary for the functioning of the Platform.

1.4. Personal data are processed in accordance with the Law of the Republic of Uzbekistan of 2 July 2019 No. ZRU-547 “On Personal Data” in the edition in force, other applicable regulatory legal acts of the Republic of Uzbekistan, as well as this Policy and the applicable consents of the User. The Law applies to the processing of personal data irrespective of the means used, including information technologies.

1.5. The Policy applies together with the User Agreement, the User Consents, the Cookie Policy, the Public Offer and other Baxtlilar documents relating to a specific feature.

1.6. The Operator independently determines the composition of the personal data necessary and sufficient for providing the relevant feature of the Platform and achieving the stated purposes of processing. If processing is objectively necessary for the chosen feature, refusal to provide the relevant data or consent may make that feature unavailable. An optional consent must not restrict features for which such processing is not required.

2.1. The Operator processes personal data on lawful grounds, for specific, predetermined and lawful purposes and to the extent necessary and sufficient for achieving the relevant purposes of processing and for providing and developing the functionality of the Platform.

2.2. Data are not used for covertly determining a “person’s value”, for selling access to the user or for circumventing the user’s decision, privacy and consent.

2.3. Access of the Operator’s employees, engaged specialists and other authorised persons to personal data is granted to the extent necessary for performing the relevant official, contractual or technical functions. The Operator is entitled to apply the separation of access rights, the recording of the actions of users of information systems, access logs and other organisational and technical control measures, taking into account the category of data, the nature of the operations, the level of risk and the requirements of information security.

2.4. Special categories of personal data, biometric data, documents provided for identification or verification, verification selfie, as well as the content of the personal correspondence of Users are not used in standard product analytics in identifiable form if such processing is not required for the relevant purpose and does not have a proper legal basis.

2.5. The Operator maintains the confidentiality of personal data and does not disclose or disseminate them to third parties without the consent of the User or another legal basis provided for by legislation. The Operator does not sell the personal data of Users to advertisers or other third parties as an independent object of commercial sale.

3.1. The above list reflects the possible composition of the data processed. Baxtlilar does not carry out mandatory collection of all the listed categories of data in respect of each User. The actual volume of the data processed depends on the stage of use of the Platform, the country of the User, the features chosen by the User, the method of verification and other applicable circumstances.

3.2. In the MVP, Baxtlilar does not use information on health or disability as a Matching criterion and does not collect a medical file for the standard user journey. If a separate feature requiring such data appears in the future, it must receive a separate legal basis, consent and updated documents.

4.1. Individual profile answers may reveal religious or philosophical beliefs, information on private and family life and other special personal data. Such information is processed only for the stated purposes and where there is an appropriate legal basis, and, in cases where this is required by the legislation of the Republic of Uzbekistan — on the basis of the separate consent of the User.

4.2. Biometric data used to establish the identity of the User are processed only to the extent necessary for the chosen method of verification, where the consent of the User exists or in other cases expressly provided for by the legislation of the Republic of Uzbekistan.

4.3. In the case of verification through MyID, the Operator retains the MyID request identifier (request ID) and the personal data related to that request that have actually been received from MyID and are necessary for confirming identity and age, managing the account and complying with the requirements of legislation. The composition of these personal data is limited to the information actually received in the specific request; the Operator does not claim to receive any fields that the MyID service does not transmit. Photos or images of documents, selfie, video images of the face, biometric images and biometric templates received or generated in the course of the MyID check are not retained on the Operator’s servers hosted with Airnet. The biometric check is carried out on the MyID side within the terms of that service and the consent given by the User. The request data are not disclosed to other users.

4.4. In the case of manual international verification, documents, live selfie and other necessary materials may be processed by Baxtlilar to the extent necessary for conducting the check, ensuring security and confirming its result, where there is an appropriate legal basis and with access to such data being restricted.

4.5. A request to a state information system is permitted only for a specific envisaged feature and only where the required ground/consent exists. The response received undergoes minimisation: only the normalised result that is actually needed for the purpose of the check is stored in the product database.

4.6. Internal reasons for refusal, unprocessed responses of state and other external information systems, documents and special or other sensitive information are not disclosed to other Users, except in cases where such disclosure is expressly provided for by legislation.

5.1. Directly from the user — during registration, completion of the profile, configuration of privacy, communication, payment, contacting support and use of other features.

5.2. From the launch data of the Telegram Mini App and other Telegram data that are available to the Platform in accordance with the technical rules of Telegram and the actions of the user.

5.3. From MyID, the Operator retains only the MyID request identifier (request ID) and the personal data related to it that have actually been received under that request, except for photos and other biometric images and templates. MyID images of documents and selfie are not retained on the Baxtlilar infrastructure. Other services may be used only after they have actually been connected, with notification of the User.

5.4. Where an official connection exists — from Raqamli ma’lumotlar platformasi or another state information system under a specific permitted service.

5.5. From Click, Payme or another payment provider actually connected — to the extent necessary for confirming the status of the transaction.

5.6. Automatically — in the course of the operation of the system: statuses, logs, security events, technical diagnostics, recommendations and the actions of the user.

5.7. From another user — if that user submits a complaint, provides evidence or reports a possible violation.

5.8. The User must not transmit through support passwords, SMS codes, PIN, CVV, the full bank card number or documents not related to the specific enquiry.

5.9. Personal data may also come from other sources in cases where their receipt and further processing are permitted by the legislation of the Republic of Uzbekistan and correspond to the purposes specified in this Policy

6.1. Registration, authorisation, operation and protection of the account.

6.2. Confirmation of age, identity and, where an appropriate mechanism and legal basis exist, of individual items of information necessary for admission to the Platform or for the use of individual features, including information on marital status.

6.3. Creation, saving, moderation and limited display of the profile.

6.4. Formation of Matching, recommendations, Interest, Mutual Interest, Active Connection, Saved Profiles and related states.

6.5. Operation of Photo Privacy and of the voluntary disclosure of the photo and contacts.

6.6. Delivery of messages, manual translation of a selected message, approximate activity status and other Chat features.

6.7. Implementation of Jiddiy qaror and Oila qurdik.

6.8. Consideration of complaints and appeals, application and review of blocking and other restrictions, conduct of repeat verification, detection, prevention and investigation of fraud, abuse, violations of the Platform Rules and other security threats.

6.9. Confirmation of payments, activation of plans and features, refunds and accounting.

6.10. Support of users, diagnosis of errors, ensuring information security and the resilience of the service.

6.11. Performance of the obligations provided for by the legislation of the Republic of Uzbekistan, consideration and fulfilment of the lawful demands of authorised state bodies, as well as the establishment, exercise and protection of the rights and legitimate interests of Users, the Operator and third parties.

6.12. Conduct of product, technical and statistical analytics, assessment of the quality, security and effectiveness of the Platform, development and improvement of its features. For such purposes the Operator, where possible, uses minimised, aggregated and/or depersonalised data.

7.1. Matching may automatically check the conditions of admission to selection, the two-way mandatory criteria and other compatibility parameters, and thereafter form and rank recommendations in accordance with the Matching logic applied.

7.2. Matching may take into account family intentions, attitude towards children, family model, values, religious and other preferences, geography, languages, readiness to relocate, lifestyle, approximate time frame of readiness for marriage and other parameters provided for by the Platform. Information relating to special personal data is used in Matching only where there is a legal basis provided for by the legislation of the Republic of Uzbekistan and, where this is required, the relevant consent of the User.

7.3. The field “Special requirements / important wishes” is stored and moderated as informational text, but is not in itself converted into an automatic Hard Filter and is not used as a hidden criterion for excluding candidates.

7.4. Not every profile field takes part in Matching. A separate mode may be defined for each field: public display, Matching-only, private storage, moderation, verification or another mode.

7.5. Payment history, the plan of the candidate, the value of property, the popularity of the profile, the number of views/saves and documents are not used as an indicator of a person’s value.

7.6. Matching and the recommendations formed on its basis are of an informational and advisory nature, are not a decision on entering into a relationship or entering into marriage and do not in themselves give rise to legal consequences for the User. The decision to begin, continue or end interaction with another User is taken by the User independently.

7.7. Voluntary TIPI / Big Five: the answers to 10 statements and the five calculated indicators are processed exclusively for the preparation of a personal report subject to the separate consent C-10. The use of these indicators in Matching is permitted only subject to the additional independent consent C-11. Refusal of C-10 or C-11 does not prevent the use of basic Matching. The said indicators are not a diagnosis and do not guarantee compatibility.

8.1. Profiles are not published as an open catalogue on the internet. The approved part of the profile is shown to a limited circle of eligible candidates within Baxtlilar.

8.2. The User chooses one of the available profile photo modes: “Always hidden”, “After Mutual Interest” or “Open profile”. The default mode — “Always hidden”.

8.3. In the “Always hidden” mode, the actual photo file must not be transmitted to the client until the owner gives separate permission to a specific Active Connection.

8.4. In the “After Mutual Interest” mode, the photo becomes available only to the relevant pair after Mutual Interest has occurred.

8.5. In the “Open profile” mode, the photo may be visible to eligible candidates in recommendations and in the profile.

8.6. A paid plan does not cancel Photo Privacy and does not open hidden data without the envisaged action of the user.

8.7. Other users are not shown the surname, first name, patronymic (if any), exact date of birth, telephone number, Telegram user ID, PINFL, documents, verification selfie, exact address, payment data, complaints, internal comments and technical risk indicators.

8.8. The exchange of contacts is a separate voluntary action of a specific pair, if such a feature is enabled.

9.1. The existence or absence of a registered marriage is a material criterion for the admission of the User to the publication of a profile and participation in Matching.

9.2. The User shall state information on marital status truthfully and keep it up to date. A User who is in a registered marriage is not admitted to the publication of a profile and participation in Matching in accordance with the rules of the Platform.

9.3. Where there is a legal basis provided for by legislation and the technical possibility, Baxtlilar is entitled to check information on the existence or absence of a registered marriage through state information systems or other permissible sources.

9.4. Where information is identified that indicates the possible existence of a valid registered marriage of the User, an inconsistency in the data provided by the User or the need for an additional check, Baxtlilar is entitled to temporarily suspend the publication of the profile and to restrict access to Matching and other related features until the check is completed and the disputed situation is resolved.

9.5. Information on marital status is processed to the extent necessary for checking admission to the Platform, forming the profile, Matching, ensuring security, preventing violations and enforcing the Platform Rules.

10.1. Messages are processed for delivery and for the operation of Chat. Baxtlilar does not use the text of private correspondence for advertising profiling.

10.2. In the MVP, Baxtlilar does not carry out automatic AI analysis of private correspondence in order to assess character, compatibility or hidden “red flags”. If such a feature is introduced, the conditions of data processing are subject to additional legal assessment and, where necessary, the relevant documents of the Platform are updated.

10.3. Access of the employees and engaged specialists of the Operator to the content of correspondence is permitted only within the limits of their official or contractual duties and where it is necessary for the relevant purpose of processing. Arbitrary access to correspondence or viewing it for personal purposes is not permitted.

10.4. In the event of a complaint, an authorised specialist may gain access to the specific message, limited context, related technical information and the attached evidence to the extent necessary for its consideration.

10.5. Access to complaints, documents and other sensitive materials is granted taking into account the official role and the principle of necessary access. The Operator is entitled to log access and other significant actions to the extent provided for by the security systems applied and by internal procedures.

10.6. Upon a lawful request of a competent state body, data may be provided to the extent and in the manner provided for by legislation.

11.1. A payment may be completed through the external payment page of Click, Payme or another provider actually connected.

11.2. The payment provider independently processes card details in accordance with its own terms and the requirements of the legislation of the Republic of Uzbekistan. Baxtlilar does not receive and does not store the PIN code, the CVV/CVC code and the full bank card number if such data are processed directly by the payment provider and are not transmitted to the Operator.

11.3. Baxtlilar may receive the amount, currency, date, external ID, payment status, product/plan and the information necessary for activation, reconciliation, refund and accounting.

11.4. Payment data are not used as a Matching criterion and are not regarded as an indicator of the personal value or attractiveness of the User. At the same time, information on the fact of payment and on the plan in force may be used for providing the corresponding scope of features and for applying the limits and other conditions of the purchased plan.

12.1. To the extent necessary for a specific feature, data may be accessible to or be transferred to: Telegram; MyID/OneID and other verification providers; state information systems where the service is connected; Click/Payme; providers of server infrastructure, translation and support; technical contractors; professional advisers, as well as authorised state bodies and other persons in the cases provided for by the legislation of the Republic of Uzbekistan.

12.2. The Operator takes the organisational and technical measures provided for by legislation and reasonably necessary to limit the volume of the data transferred to the relevant purpose of processing and, when choosing providers, takes into account the applicable requirements for the confidentiality and security of personal data. Where necessary, the relevant requirements for the processing, confidentiality and protection of data are set out in the contractual relations with such persons.

12.3. Third-party services may also independently determine individual purposes of processing within their own services and apply their own terms and policies. This applies in particular to Telegram and to payment providers.

12.4. The transfer of personal data to partners and other third parties for the provision of individual services is carried out where there is a legal basis provided for by legislation. If such transfer is covered by consent previously given by the User or is carried out on another ground provided for by legislation, obtaining separate consent for each such transfer is not required. In cases where legislation requires the separate consent of the User, the Operator obtains such consent in the established manner.

13.1. Baxtlilar complies with the requirements of Article 27¹ of the Law of the Republic of Uzbekistan “On Personal Data” in the edition of Law No. ZRU-1125 of 26 March 2026.

13.2. Personal data that, in accordance with legislation, are subject to mandatory storage in the territory of the Republic of Uzbekistan are stored in the territory of the Republic of Uzbekistan. The relevant personal data databases are registered in the State Register of Personal Data Databases in cases where such registration is mandatory in accordance with legislation.

13.3. Personal data that do not belong to the categories subject to mandatory storage in the territory of the Republic of Uzbekistan may be stored and processed outside it, subject to compliance with the conditions established by the legislation of the Republic of Uzbekistan.

13.4. The storage and processing of personal data outside the Republic of Uzbekistan, as well as their cross-border transfer, are carried out where the conditions and guarantees provided for by legislation exist, including with account taken of the level of protection of personal data in the relevant foreign state and of other mechanisms for ensuring their protection provided for by legislation.

13.5. The actual countries of hosting, the specific providers and the cross-border processing mechanism applied must correspond to the real technical architecture and contractual scheme of the Operator. In the event of a material change in such circumstances, the Policy is updated.

13.6. Baxtlilar’s own servers are hosted with the provider Airnet (Republic of Uzbekistan). In the case of verification through MyID, the Operator retains the MyID request identifier (request ID) and the personal data related to that request that have actually been received from MyID and are necessary for confirming identity and age, managing the account and complying with the requirements of legislation. The composition of these personal data is limited to the information actually received in the specific request; the Operator does not claim to receive any fields that the MyID service does not transmit. Photos or images of documents, selfie, video images of the face, biometric images and biometric templates received or generated in the course of the MyID check are not retained on the Operator’s servers hosted with Airnet. The biometric check is carried out on the MyID side within the terms of that service and the consent given by the User. The request data are not disclosed to other users. The conditions of independent data processing by the providers Telegram, MyID, Click/Payme and other external providers are determined by the applicable documents, and the mention of Airnet does not mean that the data of other organisations are stored on the Baxtlilar servers.

14.1. The said retention periods are determined taking into account the purposes of processing of the relevant data and the applicable requirements of the legislation of the Republic of Uzbekistan. A specific retention period may be extended if further storage is necessary for considering a complaint or an appeal, conducting a check or an investigation of a violation or an incident, resolving a payment, contractual or judicial dispute, asserting or defending lawful claims, as well as performing obligations or lawful demands provided for by legislation.

14.2. After the purposes of processing have been achieved and in the absence of a ground provided for by legislation for further storage, personal data are destroyed or, if further use of the data is permitted by legislation and does not require identification of the User, are depersonalised.

14.3. Hiding the profile or activating Account Pause terminates the participation of the profile in new recommendations, but does not mean deletion of the account or cessation of the processing of the personal data necessary for maintaining the account, ensuring security, performing the obligations of the Operator and other purposes provided for by this Policy.

14.3a. For MyID data, storage is limited to the request ID and the personal fields related to it that are necessary for the purposes of this Policy. MyID document photos, selfie and biometric images/templates are not retained on the Baxtlilar side and are not included in the retention periods of the materials of the Operator.

14.4. The TIPI / Big Five results and the answers to the questions are stored only for as long as the relevant lawful ground and purpose of processing remain. Upon withdrawal of C-10, the preparation and display of the personal report cease; upon withdrawal of C-11, the use of the results in Matching ceases, irrespective of the fate of the personal report. The period for the deletion and retention of data already processed is determined by the lawful grounds and the technical regulations; the specific period and the physical deletion from backup copies must be confirmed before the publication of this edition.

15.1. Baxtlilar applies legal, organisational and technical measures for the protection of personal data, including role-based and minimally necessary access, protection of administrative accounts and sessions, logging of significant and sensitive actions to the extent provided for by the systems applied and by internal procedures, encryption during the transfer of data, applicable protection measures during storage, backup and control of the access of employees and contractors.

15.2. The external integrations of MyID, OneID, Raqamli ma’lumotlar platformasi and other services are implemented with the application of the technical security measures provided for by the Operator. API keys, VPN credentials and other secrets are not placed in client code that is open or accessible to the User, if such placement may create a risk of unauthorised access.

15.3. Raw responses of external providers undergo checking and minimisation; standard technical logs must not contain superfluous personal or sensitive data.

15.4. Employees and contractors are prohibited from using user data out of personal interest, making unauthorised exports or screenshots, transmitting information through personal channels, publishing, selling or using it outside the official purpose.

15.5. Where signs of an information security incident are identified, the Operator takes measures that are necessary and proportionate to the circumstances, including restricting or terminating suspicious access, preserving the necessary technical information and evidence, determining the nature and volume of the data affected, taking measures to eliminate the causes and consequences of the incident, and also notifies personal data subjects, authorised state bodies or other persons in the cases, in the manner and within the time limits expressly provided for by the legislation of the Republic of Uzbekistan.

15.6. No information system can guarantee the absolute impossibility of an incident. This does not release the Operator from the obligation to apply the protection measures that are provided for by law and are reasonable.

16.1. Within the limits established by legislation, the user is entitled to learn about the processing of his or her personal data and to receive the information provided for by law.

16.2. The User is entitled to apply to the Operator with a demand for the amendment or supplementation of personal data that are incomplete, outdated, inaccurate or untrue, in the manner provided for by the legislation of the Republic of Uzbekistan.

16.3. The User may change the available settings of Photo Privacy, activity, geography, notifications and profile visibility.

16.4. The User is entitled to withdraw previously given consent in the manner and form provided for by the legislation of the Republic of Uzbekistan. The consequences of such withdrawal, including the cessation of the relevant processing and the destruction of personal data, are determined by legislation. If, in respect of individual data, there is an independent ground provided for by legislation for their further processing, such processing may be carried out within the limits of the relevant ground.

16.5. If a consent necessary for a core feature is withdrawn, the relevant feature may become unavailable; upon withdrawal of consent to the publication of the profile, the profile is hidden from recommendations.

16.6. The User is entitled to demand the temporary suspension of the processing of personal data and their destruction in the cases and in the manner provided for by the legislation of the Republic of Uzbekistan.

16.7. For protection against an unauthorised request, the Operator is entitled to verify the identity of the applicant in a reasonable manner.

16.8. Requests are sent to support@baxtlilar.uz. The User is also entitled to apply to the authorised state body or to a court in the manner established by law.

17.1. Baxtlilar records mandatory and functional consents in the Consent Registry.

17.2. A record may include: the code/type of consent, the version of the text, language, purpose, user identifier, date and time, method of confirmation, the related use case/provider/service code and the withdrawal status.

17.3. Consent is given in a form that makes it possible to confirm the fact of its receipt and the expression of will of the User. In cases where the nature of the processing requires separate consent, it may be confirmed by an active action of the User in the interface. For special personal data, consent is drawn up in written form, including in the form of an electronic document, if it is consent that is the ground for their processing.

17.4. For the processing of special personal data, biometric identification and other features for which legislation requires the separate consent of the User, the relevant consent is drawn up with respect to the specific purpose and scope of processing in the manner provided for by the legislation of the Republic of Uzbekistan.

The provision of data at the lawful demand of an authorised state body is carried out on the relevant legal basis and does not require obtaining the separate consent of the User, if legislation provides for another ground for such processing or transfer.

17.5. In the event of a material change in the purpose, the composition of special/biometric data, the recipients or the conditions of cross-border processing, new consent may be required.

18.1. Baxtlilar may send the service, payment, legal and security-related notifications necessary for the operation of the account.

18.2. Marketing and advertising messages are sent where the prior consent of the User exists in cases where such consent is required by the legislation of the Republic of Uzbekistan, with the provision of an accessible means of refusing to receive them further

18.3. The informational website https://baxtlilar.app may use cookies and similar technologies. The specific categories, purposes, periods and third-party tools are governed by the Cookie Policy, which must correspond to the services actually connected.

18.4. Baxtlilar is intended only for persons who have reached the age of 18. Where there are reasonable grounds to believe that the User has not reached the established age, the Operator is entitled to temporarily restrict access to the account and to request the information necessary for checking age. If minority is confirmed, access to the Platform is terminated and the personal data are destroyed, with the exception of data whose further storage is permitted or required by legislation or is necessary on another ground provided for by law.

19.1. The Operator may update the Policy in the event of a change in legislation, the product, the categories of data, the providers, the countries of processing or the security measures.

19.2. If amendments to the Policy provide for a change in the purposes of processing of personal data or other changes that go beyond the consent previously given by the User, the Operator obtains new or additional consent in cases where this is required by the legislation of the Republic of Uzbekistan.

19.3. The current edition is published at https://baxtlilar.app and/or in the Telegram Mini App.

19.4. Questions about the processing of personal data and the exercise of the rights of the user are sent to support@baxtlilar.uz; official enquiries — to info@baxtlilar.uz.