User Consents

Baxtlilar · Edition in force from the date of official publication · Version 1.2 · English

BAXTLILAR · LEGAL DOCUMENTS

English

Version 1.2 · Enters into force on the date of its official publication on the Baxtlilar Platform.

Operator: “Bahtli bo‘laman” LLC. Current edition: baxtlilar.app and Telegram Mini App.

1.1. This document sets out which separate consents and confirmations may be requested from a Baxtlilar user and at which point of the user journey they apply.

1.2. Consent is given voluntarily after reading the relevant text and the Privacy Policy and is expressed by an active, unambiguous action in the interface in a form that makes it possible to confirm the fact that it was obtained. Consent to the processing of special personal data is executed in writing. Biometric data used to establish the identity of the user are processed with the user’s consent, except in the cases provided for by legislation.

1.3. Silence, inaction and a pre-ticked checkbox are not deemed to be consent where the relevant processing requires the user’s expression of will.

1.4. Refusal of an optional consent must not restrict features for which the relevant processing is not objectively required.

1.5. If processing is objectively necessary for the use of a particular feature and consent is the applicable lawful ground, refusal of such consent may mean that it is impossible to complete registration, pass verification, publish the profile or use the specific feature.

1.6. Baxtlilar records in the Consent Registry the code and version of the consent, the language, the purpose, the date and time, the user identifier, the method of confirmation and, for an external integration, where necessary the provider/service code and other minimum information necessary to prove the expression of will.

1.7. The user may withdraw a specific consent in the same form in which it was given, or in writing through the available settings or at the address support@baxtlilar.uz. Withdrawal does not cancel the lawfulness of processing carried out before the withdrawal and entails the termination of processing carried out solely on the basis of that consent, as well as the destruction of the relevant data in the manner established by legislation, if their further processing or storage is not permitted on another lawful ground.

1.8. If the processing changes materially — for example, a new purpose, a new category of special/biometric data or a new recipient outside the previously stated purposes appears and there is no other lawful ground for the processing — the Platform requests a new separate consent. The provision of personal data to state bodies on the basis and within the limits of the requirements of legislation does not require a new consent of the user to be obtained.

3.1. This action confirms that the user has read the current version of the User Agreement and the mandatory rules of the Platform, accepts their terms and undertakes to comply with them when using Baxtlilar.

3.2. Acceptance of the User Agreement does not replace the separate consents to the processing of special personal data or biometric data and is not deemed to be a universal consent to any future methods of processing.

3.3. The code and version of the relevant document, the date and time of its acceptance, the user identifier and the method of acceptance are recorded separately from other consents.

☐ I have read the Baxtlilar User Agreement and the mandatory rules of the Platform and accept their terms and undertake to comply with them when using Baxtlilar. [MANDATORY FOR REGISTRATION]

4.1. “Bahtli bo‘laman” LLC processes the personal data necessary for registration, the operation and protection of the account, the generation of recommendations, interaction within the Platform, support, safety, confirmation of payment and compliance with the applicable requirements of legislation, on the grounds provided for by legislation, including the necessity of concluding and performing the User Agreement.

4.2. Such data may include: Telegram user ID, display name, username, language, telephone number, internal identifier, profile data, preferences and settings that do not constitute special personal data, avatar, photos, if they are not used for biometric identification, blockings, requests to support, technical events, IP address, device, information on the plan and the payment status. Information on the private life of the user, including Interest, Mutual Interest, Saved Profiles, Active Connections and Jiddiy qaror, does not constitute basic personal data and is processed in accordance with the separate consent C-02.

4.3. Processing may include the collection, recording, systematisation, storage, rectification, use, transfer and provision to the necessary processors, restriction of access, depersonalisation, deletion and destruction of data within the purposes and legal bases specified in the Privacy Policy.

4.4. Data may be transferred only to the extent necessary to the providers actually used: Telegram, verification providers, payment providers, server infrastructure, support and other processors, where there is a relevant legal basis and in compliance with the requirements established by legislation for the localisation and cross-border transfer of personal data.

4.5. Baxtlilar does not sell personal data and does not use the payment history or the plan as an indicator of a person’s worth in Matching.

☐ I have read the Privacy Policy and confirm that the processing of basic personal data is necessary for registration, performance of the User Agreement and the operation of the main features of Baxtlilar. [MANDATORY CONFIRMATION FOR THE MAIN FEATURES]

5.1. Certain profile questions and actions of the user within the Platform may reveal religious beliefs, information on private and family life, personal boundaries and other special personal data, including information generated when using Interest, Mutual Interest, Saved Profiles, Active Connections and Jiddiy qaror.

5.2. The consent applies only to those sensitive fields that the user has actually decided to fill in, and to information on private life generated through the voluntary use of the relevant features. If a question is optional, the user may skip it. Consent C-02 is given in writing, including in the form of an electronic document, and is recorded in the Consent Registry.

5.3. Such information may be used for the profile, Matching, recommendations, privacy and safety only within the purpose specified in advance.

5.4. Not every sensitive field takes part in Matching. The mode of use of a specific field must be communicated to the user before it is filled in. The use of information for a new purpose is permitted only after a new separate consent of the user has been obtained.

5.5. Baxtlilar does not collect medical files and does not use information on health status or disability as a Compatibility Score factor. Such processing may be introduced only for a separate feature after the user has been informed in advance and a separate written consent, including in the form of an electronic document, has been obtained.

☐ I give consent C-02 to the processing of those special personal data and that information on private life which I voluntarily provide in the relevant profile fields or generate when using the relevant features, for the purposes of Baxtlilar specified in advance.

[SEPARATE CONSENT; ONLY FOR THE RELEVANT FIELDS AND FEATURES]

6.1. During identity verification through MyID, the data actually necessary to perform the request and confirm the identity of the User may be processed. The MyID request identifier (request ID) and the personal data associated with it from the service’s response, with the exception of photos, are stored on the Baxtlilar side. MyID may process images of documents, selfie and other biometric materials in its own process; however, Baxtlilar does not store these images or biometric templates on its servers.

6.2. When performing the biometric comparison, the MyID service may process the facial image and the biometric data generated from it on its own side. The Baxtlilar Operator does not receive for storage and does not store photos, video images of the face or biometric templates of MyID; only the request ID and the personal data associated with it, without photos, are stored on its side.

6.3. The set of personal fields received by Baxtlilar is determined by the actual response of MyID and by the purpose of confirming identity; excessive fields must not be stored. During verification through MyID, the Operator stores the MyID request identifier (request ID) and the personal data associated with that request which have actually been received from MyID and are necessary for confirming identity and age, managing the account and complying with the requirements of legislation. The set of these personal data is limited to the information actually received in the specific request; the Operator does not claim to receive any fields that the MyID service does not transmit. Photos or images of documents, selfie, video images of the face, biometric images and biometric templates received or generated in the course of the MyID check are not stored on the Operator’s servers hosted with Airnet. The biometric check is carried out on the MyID side within the terms of that service and the consent given by the User. The request data are not disclosed to other users.

6.4. In the scenario of a check through MyID, the Operator does not store photos of documents, selfie/live selfie, video images of the face or biometric templates, either temporarily or permanently. If an independent manual check involving the storage of materials is introduced in the future, its procedure, time limits and a separate consent must be established and published before such processing begins.

6.5. Identity verification does not confirm the character, intentions, income or safe behaviour of the user and does not mean that all the information in the profile has been checked.

☐ I separately and voluntarily consent to the processing of my personal data necessary for identity verification by means of MyID. I understand that MyID may carry out the check using biometric images on its own side; only the MyID request ID and the personal data associated with it that were received under that request, except for photos, are stored in Baxtlilar. Baxtlilar does not store images of documents, selfie or biometric materials of MyID. I have read the Privacy Policy and the terms of the relevant check.

7.1. This block applies only after Baxtlilar has actually been connected to the relevant state information system and only if the consent of the user is required for the specific request in accordance with legislation or the rules of the relevant system.

7.2. Baxtlilar does not use a single general consent for unlimited access to all state data. Each use case must have a specific purpose, a set of information that is clear to the user and an identifiable state information system and, where there is one, an operator or provider of the integration.

7.3. Where the relevant integration and lawful grounds exist, a state request may be used, in particular, to confirm identity, age or the fact that there is no registered marriage, if such a service is provided and its use is legally permitted.

7.4. Before the request, the interface must without fail inform the user of: which information is requested or which fact is confirmed; why this is necessary; from which system and through which operator the request is made; which result is stored by Baxtlilar and for what period; what will happen in the event of refusal; the period or principle of validity of the consent, if applicable.

7.5. Baxtlilar stores the minimum necessary normalised result of the request, for example VERIFIED / NOT_VERIFIED / MANUAL_REVIEW, the date, the service/provider code and the operation identifier, if this is sufficient for the purpose. An excessive original response of the system must not be stored unnecessarily. The stored result is subject to deletion or depersonalisation after the purpose has been achieved or the established retention period has expired, if its further storage is not required by legislation.

7.6. Consent to one state request is not deemed to be consent to other state data or other purposes.

7.7. A change in the purpose of the request, the set of information requested, the state information system or the recipient of the data requires that the user be informed anew and, if applicable, that a new separate consent be obtained. If the request concerns special personal data, the consent is executed in writing, including in the form of an electronic document.

☐ I give separate consent C-04 to the performance of the specific request indicated in the interface to the indicated state information system and to the processing of the minimum necessary result obtained solely for the purpose communicated to me. [IN THE FORM OF AN ELECTRONIC DOCUMENT; ONLY BEFORE THE SPECIFIC REQUEST]

The terms of a separate request to a state information system apply only where the relevant feature has actually been connected and the necessary ground, document and separate consent exist. A description alone does not mean that the relevant service has been enabled.

8.1. I give consent to the creation of my profile and to the limited display of the part of it selected by me and permitted by the Platform for placement to other verified users who meet the established Matching criteria, in accordance with the privacy settings and the safety rules.

8.2. The profile may show the display name, age, country/city or general region, languages of communication, education, profession/field of activity, marital status, whether there are children, a description, values, family intentions and other information, if before publication the interface allows the user to determine or see the visibility mode of the relevant field. Information relating to special personal data or private life may be shown only where there is an applicable consent C-02 and a visibility mode selected by the user.

8.3. The surname, first name, patronymic, exact date of birth, telephone number, Telegram user ID, PINFL, documents, verification selfie, exact address, payment data, complaints and internal technical information are not shown to other users, (unless the user has separately and knowingly selected a feature provided for by the Platform for the transfer of specific contact details).

8.4. To take part in Matching, the user confirms that the user is not in a current registered marriage and undertakes to update the marital status in a timely manner. Upon entering into a registered marriage, the user shall cease the publication of the profile and participation in Matching.

8.5. The “Special requirements / important wishes” field may be shown to the extent provided for by the interface, but is not in itself used as a mandatory automated criterion for excluding candidates (Hard Filter).

8.6. The approximate time frame of readiness for marriage may be used as a compatibility factor, but is not a promise to enter into marriage within the stated time frame.

8.7. The user may hide the profile or put it on pause. This stops it being shown to new candidates and stops the generation of new recommendations, but does not mean the immediate deletion of all account data. Information previously transferred within existing connections or correspondence is processed in accordance with the relevant feature and the Privacy Policy.

☐ I give consent C-05 to the placement of the selected part of my profile and to its being made available for viewing by other users within Baxtlilar, as well as to its use in Matching and recommendations in accordance with the visibility settings selected by me and the rules of the Platform. [MANDATORY FOR PUBLICATION OF THE PROFILE AND PARTICIPATION IN MATCHING]

9.1. The user independently selects one of the available Photo Privacy modes:

9.1.1. “Always hidden” — the default mode: the real profile photo is hidden from candidates; the user may separately open it to a specific Active Connection.

9.1.2. “After Mutual Interest” — the approved profile photo becomes available to the relevant pair after Mutual Interest and remains visible within the relevant connection according to the rules of the Platform.

9.1.3. “Open profile” — the approved profile photo may be visible to eligible candidates in recommendations and in the profile. This mode does not mean that the photo is placed publicly on the internet or shown to persons who do not have the access provided for by the Platform.

9.2. The choice of mode is recorded as a privacy setting. The user may change the mode within the available settings. A switch to a less restricted mode is made only by an active action of the user. A change of mode applies for the future and does not cancel access to the photo previously granted to other users until the new setting has been technically applied.

9.3. In the “Always hidden” mode, an individual permission to open the photo to a specific Active Connection is a separate action of the user. Before it is performed, the interface must clearly indicate to which user the photo is being opened. The user may withdraw such a permission, after which further display of the photo to the relevant user ceases.

9.4. Consent in respect of the profile photo does not extend to the verification selfie, a document or other closed images. The profile photo is not used for biometric identification or comparison on the basis of C-06; such processing is governed by the separate consent C-03.

9.5. A paid plan does not replace or cancel Photo Privacy and does not give other users access to the photo in circumvention of the mode selected by its owner.

☐ I select the Photo Privacy mode indicated by me in the interface and understand to which users, under which conditions and to what extent my profile photo will be available. [BEFORE PUBLICATION OF THE PHOTO / WHEN THE MODE IS CHANGED]

10.1. If the user presses “Translate”, the text of the specific selected message may be transferred to the translation provider actually connected, to the extent necessary to perform the translation. Before the first such transfer, the user is informed of the translation provider or category of translation providers, the purpose of the transfer and, in the case of cross-border processing, the country in which the data are processed.

10.2. The original text is stored as part of the correspondence in accordance with the established retention periods, and the automatic translation may contain errors and inaccuracies. The user assesses the translation independently and must not regard it as guaranteed to be accurate.

10.3. Baxtlilar does not transfer the entire chat history to the translation provider, unless this is required for a selected and separately explained feature. The transfer of the context of the correspondence is permitted only after the user has been informed in advance of the volume of messages to be transferred and has performed the relevant active action.

10.4. If the provider changes in such a way that the country of processing or the category of recipient changes, or the purpose, scope or conditions of processing change materially, the user is given a new notice before such processing begins and, where this is required by legislation, a new separate consent is requested.

10.5. The translation provider may process the transferred text only to perform the translation and must not use it for advertising, building a user profile, training its own models or other independent purposes, unless the user has given a separate consent to this. The transferred data must not be stored for longer than the period necessary to perform the translation, except in the cases provided for by legislation.

☐ I understand that when the “Translate” feature is used, the selected text may be transferred to the provider or category of providers of automatic translation indicated in the interface solely to perform this feature. The pressing of the “Translate” button in itself confirms my request for translation of the selected message. [ON FIRST USE / WHEN THE TERMS CHANGE MATERIALLY]

11.1. The user may separately agree to receive Baxtlilar news, promotions, promotional offers, information on new features and other marketing messages through the channels separately selected by the user, including Telegram, push notifications, SMS and e-mail, if the relevant channels are available.

11.2. Marketing consent is optional, is not ticked in advance and may be withdrawn at any time through the account settings, the link provided in the message or another available method. Withdrawal of consent is free of charge and does not affect the use of the main features of Baxtlilar.

11.3. Opting out of marketing does not stop necessary service, payment and legal messages and safety notifications. Such messages must not contain advertising or promotional offers that are not directly related to their service, payment or legal purpose or to ensuring safety.

11.4. Consent C-08 extends only to marketing messages of Baxtlilar. The transfer of contact details to third parties for their own marketing or the sending of offers of such parties requires a separate consent of the user.

☐ I wish to receive Baxtlilar marketing messages through the channels separately selected by me and understand that I may opt out of them at any time free of charge. [OPTIONAL]

12.1. This block is not a universal permission to transfer data to all partners of Baxtlilar. Consent C-09 is given separately in respect of a specific partner and a specific service.

12.2. If the user independently selects Individual or another separate service that requires the transfer of data to a third party, the following must be shown to the user before the transfer: the full name and contact details of the recipient, its role in the processing of the data, the purpose of the transfer, the exact list of data to be transferred, the actions envisaged with them, the period of processing and storage or the procedure for determining it, the conditions for withdrawal of consent and the consequences of refusal. If the data are transferred outside the Republic of Uzbekistan, the country of transfer and the applicable conditions of cross-border processing are additionally indicated.

12.3. If the special service is not used, C-09 is not requested. Refusal of C-09 may entail only the impossibility of providing the selected separate service and must not restrict the main features of Baxtlilar for which such a transfer is not objectively required.

12.4. The partner may use the data received only for the purpose indicated to the user. The transfer of the data to another recipient or their use for a new purpose is permitted only where there is a relevant legal basis and, where this is required, a new separate consent of the user.

12.5. The user may withdraw C-09 in the manner specified in section 1 of this document. Withdrawal terminates the further transfer and processing of data on the basis of this consent, but does not cancel the lawfulness of processing previously carried out and does not prevent the storage of data that is mandatory in accordance with legislation.

☐ I give consent to the transfer of the exact list of my personal data indicated in the interface to the indicated partner for the specific service selected by me on the terms communicated to me, including cross-border transfer, if it is expressly indicated. [SEPARATELY FOR EACH PARTNER AND SERVICE; ONLY WHEN SUCH A SERVICE IS ACTUALLY USED]

Refusal prevents the relevant processing from starting, and withdrawal terminates further processing on the basis of the consent. Withdrawal has no retroactive effect and does not terminate processing carried out on the basis of a contract, the requirements of legislation or other lawful grounds.

14.1. The Backend is the source of truth for the status of consents. The client interface must not by itself treat a consent as obtained without server-side recording.

14.2. A consent must be versionable: a change of the text must not overwrite the history of the previously accepted version.

14.3. For C-04, the linking of the consent to a specific use case/provider/service code and, if required, to the operation identifier must be supported.

14.4. For Photo Privacy, the general mode of the user and the individual Photo Grant/Revocation for a specific pair should be stored separately.

14.5. Upon withdrawal, the date, time, initiator and new state must be recorded; the data must not be physically deleted automatically until other lawful grounds for storage have been checked.

14.6. Consent events must not contain the text of private correspondence, a full document, biometric images or other excessive data.

14.7. Legally significant texts of consents must be available to the user before confirmation and be stored in the archive of versions.

14.8. For TIPI / Big Five, consents C-10 and C-11 are recorded as separate events, must be unticked by default, may be withdrawn independently and are not a condition for the use of basic Matching. The existence of the text of the agreement without an actual consent event does not confirm consent.

Consents C-10 and C-11 to voluntarily taking TIPI / Big Five and to the use of the results in Matching are given separately. Both consents are optional, are recorded individually and may be withdrawn independently.

☐ I voluntarily consent to the processing by “Bahtli bo‘laman” LLC of my answers to the 10 statements of TIPI / Big Five (scale 1–7) and of the calculated indicators of the five personality factors for the purpose of generating and displaying my personal information report. I understand that this is not a medical or psychological diagnosis and not a guarantee of compatibility. I have read the Privacy Policy, may decline to take the test and may withdraw the consent in the manner specified in it.

☐ I separately and voluntarily permit “Bahtli bo‘laman” LLC to use my calculated TIPI / Big Five indicators as one of the additional factors in the generation of personal recommendations (Matching). I am aware that the result is not a guarantee of compatibility, that refusal does not restrict the main Matching and that this consent may be withdrawn independently of the consent to the personal report.

For C-10 and C-11, separate consent forms that are unticked by default are used. C-11 is valid only while C-10 is in effect. The user receives the full text with the version, and the Operator records the user identifier, the code, the version, the language, the date and time, and the fact of the giving and withdrawal of the consent to the extent necessary.