# Personal Data Processing Policy ## Annex No. 5 to public offer SS-OFERTA-2026-001 **Edition:** `SS-PRIVACY-2026-001` **Date:** 2026-10-06 **Controller:** Creative Space LLC (trading as Skillspace) This Policy describes how we process personal data (**PD**) when you use **https://skillspace.uz**, enrol, pay, and receive training services. --- ## 1. Controller and contacts 1.1. **Controller:** Creative Space LLC TIN: 312 381 311 Director: NAJMIDDINOV ABBOSXON ALISHER O'GLI Legal address: Toshkent shahri, Yashnobod tumani, Ma'rifat MFY, Farg'ona yo'li ko'chasi, 23-uy Training centre: Tashkent, Shaykhantakhur district, Koratosh 44 Phone: +998 95 090 09 09 Email: support@skillspace.uz Website: https://skillspace.uz 1.2. For PD requests email **support@skillspace.uz** with subject “Personal data”. 1.3. Processing follows the Law of the Republic of Uzbekistan “On Personal Data” and other applicable rules. --- ## 2. Whose data we process 2.1. **Customer** — the person who enrols and/or pays (including a parent / legal representative). 2.2. **Learner** — the person taking the course (may be the same as the Customer). 2.3. Website visitors — technical logs/cookies as needed for the site and statistics. 2.4. For Learners under **18**, consent is given by the legal representative. --- ## 3. Categories of data 3.1. **Identity:** full name of Customer and Learner, date of birth / age of Learner. 3.2. **Contact:** phone (required), email (if provided), messenger account (if used). 3.3. **Training:** course, order Specification, schedule, attendance, final exam results, certificate issuance. 3.4. **Payment:** payment status, amount, payment/contract id (`SS-YYYY-######`), refunds; we do not store full card numbers — the payment provider does. 3.5. **Technical:** IP, user-agent, session id, timestamps, offer/consent checkbox states, material access logs. 3.6. **Image and voice:** marketing photo/video and/or online class recordings — only under section 8 and the offer. 3.7. We do not request biometric or genetic data as a separate category for enrolment. If that changes, we will ask for separate consent and meet localisation rules. --- ## 4. Purposes 4.1. Conclude and perform the contract (public offer), create the Specification. 4.2. Communicate about enrolment, schedule, payment, refunds, exams and certificates. 4.3. Record offer acceptance and consents (evidence in a dispute). 4.4. Provide access to digital materials and track attendance. 4.5. Accounting, fiscal receipts (when online cash register is connected), tax records. 4.6. Safety of premises/platform and abuse prevention. 4.7. Improve the site/service (aggregated / anonymised stats where possible). 4.8. Marketing (mailings, publishing photo/video) — **only** with separate optional consent; refusal does not affect training. --- ## 5. Legal bases 5.1. Consent of the data subject (or legal representative) — checkbox at enrolment/payment. 5.2. Performance of a contract to which the subject is a party (or which the Customer concludes for the Learner). 5.3. Legal duties of the Controller (accounting, lawful authority requests). --- ## 6. How we collect and process 6.1. Data are entered on the website, sent in chat/messenger, or given to centre staff. 6.2. Processing includes: collection, recording, storage, use, transfer (section 7), anonymisation, deletion. 6.3. Processing may be automated (site, API, CRM) or manual (paper attendance logs, if any). --- ## 7. Recipients 7.1. **Payment / acquiring / BNPL providers** — to take payment and refunds (named on the payment page when connected). 7.2. **Website hosting** — Firebase / Google Cloud (site, API, logs). Cross-border transfer — section 9. 7.3. **Messengers** (Telegram, etc.) — if you write there or ask for notices. 7.4. **Video / LMS tools** — for online format. 7.5. **Public authorities** — only when legally required. 7.6. Others — only with consent or as needed to perform the contract and allowed by law. 7.7. We do not sell PD. --- ## 8. Photo, video, class recordings 8.1. Marketing capture and publication of image/voice — **only** with separate optional consent. Refusal does not block the contract or studies. 8.2. Withdraw marketing consent via support@skillspace.uz; applies going forward. 8.3. Online class recordings for teaching quality — with participant notice; not used for ads without consent under 8.1. --- ## 9. Storage location and cross-border transfer 9.1. We aim to meet rules on locating technical means for Uzbek citizens’ PD in Uzbekistan and registering the database in the State Register. 9.2. **State Register entry number:** ________________ (filled after registration). 9.3. Until registration, processing is limited to the minimum needed for pre-enrolment and existing contracts. 9.4. Cross-border transfer (e.g. cloud hosting) — with adequate protection and, where required, consent or another lawful basis. --- ## 10. Retention 10.1. Offer-acceptance and access logs — **at least 3 years** after the contract ends. 10.2. Contracts, Specifications, payment and accounting records — for periods required by accounting/tax law. 10.3. Training data (attendance, exam, certificate) — at least 3 years after the course ends, unless law requires longer. 10.4. Marketing consents — until withdrawal or purpose ends. 10.5. Afterwards — deletion or anonymisation if no longer needed. --- ## 11. Security 11.1. Staff access limited to need-to-know. 11.2. HTTPS, role-based accounts. 11.3. On a PD incident we take remedial steps and notify the authority/subjects where required by law. --- ## 12. Your rights You (or your legal representative) may: 12.1. Obtain information about processing of your PD. 12.2. Request correction, blocking or deletion of inaccurate / unlawful data. 12.3. Withdraw consent (where processing is based on consent) — without affecting lawfulness before withdrawal or contract duties where the basis is the contract. 12.4. Withdraw marketing / photo-video consent. 12.5. Lodge a complaint with the PD authority and/or a court. Email **support@skillspace.uz**. We reply within a reasonable time, usually within **15 calendar days**, unless law sets another deadline. --- ## 13. Cookies 13.1. The site may use technical cookies / local storage (UI language, session, consents). 13.2. Disabling cookies may limit some features. --- ## 14. Changes 14.1. The current edition is always at **https://skillspace.uz/privacy**. 14.2. Material changes are published on the site. For existing contracts, the edition in force when the offer was accepted applies, unless law requires otherwise. --- ## 15. Link to the offer 15.1. This Policy is **Annex No. 5** to the Skillspace public offer: https://skillspace.uz/oferta 15.2. On training terms the offer and Specification prevail; on PD processing this Policy and the Personal Data Law prevail. --- *End of edition SS-PRIVACY-2026-001*