1. Introduction
City Pay is committed to protecting your privacy and ensuring the security of your personal data when you use our services.
This "Privacy Policy" (hereinafter referred to as "Policy") aims to inform you about how and why we collect and process your personal data. Additionally, this Policy outlines your rights and remedies concerning your personal data.
This Policy is governed by and interpreted in accordance with the laws of the Republic of Uzbekistan. This Policy is part of and should be read together with our Terms and Conditions
2. Who are we?
City Pay (https://citypay.uz/) is a brand of the following company: "CITY PAY GATE" Mas'uliyati Cheklangan Jamiyati Qo'shma Korxonasi (TIN: 311606433), a Crypto Depositary under the License #CD0004 issued by the National Agency of Perspective Projects. Legal Address: Tashkent city 100016, Yashnabad district, Makhtumkuli street, house 112 (hereinafter, "CITY PAY GATE" LLC is referred to as "we", "us" or "City Pay").
For the purposes of this Policy and in accordance with Uzbekistan data protection legislation, City Pay acts as the "data controller" in relation to the processing of your personal data.
3. How do we collect your data?
We collect personal information when you interact with us and use our services or products. In some cases, this information is provided directly by you, such as when you register or contact us. In other instances, third parties may supply us with information about you. Additionally, to fulfill legal obligations or protect legitimate interests, we may gather data from publicly available sources, such as internet search engines, registries, and other public sources.
We may collect your data in the following ways:
when you register or verify an account to access our products/services;
when you use our products/services;
when you use our website/mobile application and its features;
when you participate in our research/surveys;
when you communicate with us (including via email, phone calls, SMS messages, social media, live chat or other technical means);
from publicly available sources, such as internet search engines, registries, social networks, and others;
from third parties, including our business partners and other organizations (for instance such as verification organizations), primarily for business, operational, and regulatory compliance purposes.
4. What type of information do we process about you?
When delivering services to you and offering the relevant services/products, the information processed by us may include the following categories of data in proportion to the purpose of their processing:
A) Information you provide to us
At registration/verification:
Identification data: for example, country of residence, citizenship, place of birth, first name, last name, personal identification number, actual or registered address, gender, date of birth, "selfie" and others;
Documentary data: for instance, a photographic identification document or a copy thereof (for verification purposes);
Contact information: for example, actual or registered address, telephone/mobile number, e-mail address;
Your account access details: for example, username ("username") and unique user account number ("userID");
Special category of data: biometric data, in particular, your facial features (for verification purposes) as regulated by the Law "On Personal Data" of the Republic of Uzbekistan dated July 2, 2019, No. O'RQ-547.
Through your use of City Pay's services:
Activity and behavioral data: for example, information about how you use our products/services, including information about your online activity (for example transaction history) and behavior that may also be processed by our contractors/service providers;
Technological data: information about the device you use to access our services/products (for example, model, operating system, IP address, browser type, mobile device identifier, application);
Communication Data: telephone call recordings and other communications (for example, e-mails and messages via live chat or other means) with us or our employees (via e-mail, website, mobile application, mobile and other means) - we may monitor or record phone calls and your correspondence with us. We might do this to check that we have carried out your instructions correctly; to resolve queries or issues; for regulatory purposes; to help improve our quality of service; to help us train our staff; or to help detect or prevent fraud or other crimes;
Research-related Information: for example, information related to the questions we ask you as part of a survey we organize and your answers to them, such as, among others, our service quality, satisfaction and requirements.
B) Personal data obtained from other sources:
Data obtained from our business partners (for example, identification/verification organizations) and other third parties (for example, data obtained from the State Services Agency of the Republic of Uzbekistan for identification/verification purposes);
In instances where personalized services are extended to you, we may utilize third-party data, such as insights from your Facebook profile, to gain deeper insights into your preferences and provide more effective personalization;
Public data: information obtained about you from publicly available sources.
C) Generated/derived data:
Information we generate from extracted or generated data (data created by us analyzing your data), such as data about your behavior, segmentation, preferences, etc.
D) Information about third parties
If you give us personal information about someone else then you should not do so without their permission. Where information is provided by you about someone else, or someone else discloses information about you, it may be added to any personal information that is already held by us and it will be used in the ways described in this Policy.
This list of personal data types collected by Us is not exhaustive and further information may be requested from you when We consider it fair and necessary to do so.
5. Why and on what grounds do we process your personal data?
City Pay is committed to transparency regarding the purposes and basis for collecting and processing your personal data.
First and foremost the collection and processing of your data is essential for providing you the services and products you've selected. In addition, your data is used to personalize and improve your experience using our services and products, and to contact you from time to time with important information. In some cases, we need to collect and process your information to comply with the legal obligations.
In accordance with the Law "On Personal Data" of the Republic of Uzbekistan dated July 2, 2019, No. O'RQ-547, we are obligated to specify the particular legal bases we rely upon when processing your personal information. We rely on different bases for different processing activities:
A) On the basis of a contract - when data processing is necessary to enter into a contract with you or for the performance of an existing contract to which you are a party. Our Terms and Conditions, which you agreed to at the stage of creating an account, establish the terms of the contract and the services we provide to you:
To make our services available to you as part of our contract:
to provide services in relation to virtual assets, activities or online content, to provide you with information about them and to deal with your requests and inquiries;
for "service administration purposes", such as password reminders, service messages, such as website/mobile application maintenance, updates to our Privacy Policy or Terms and Conditions, to let you know if your City Pay account has become inactive and to ask if you would like to use it again before we close it;
to process your transactions.
B) On the basis of legitimate interests - when the processing of your data is necessary to protect our legitimate interests or those of third parties for the purposes listed below, except where such interests are overridden by your rights as a data subject.
To personalize your experience:
to offer a more relevant, tailored service; for instance, we could use your transaction history to provide personalized recommendations and products;
To improve our services/products:
to provide you with the most user-friendly online navigation experience;
for analysis and research purposes so that we may improve the services offered by us;
to test new products, systems, or services and to check updates to existing systems;
to evaluate the effectiveness of marketing and for market research and training;
for customer modeling, statistical and trend analysis, with the aim of developing and improving products and services.
To contact and interact with you:
contact you about our services, for example by phone, email, post or social media;
manage promotions and tournaments you participate in;
invite you to take part in customer surveys, questionnaires and other market research activities carried out by City Pay and by other organizations on our behalf;
respond to your queries and complaints.
To make your transactions safer and more enjoyable:
to deter, prevent, or detect any activities conducted in breach of the City Pay's Terms and Conditions;
to prevent or detect unfair practices, including, but not limited to, the use of third-party software in peer-to-peer transfers.
For the protection of legal rights and interests:
For example, to substantiate a legal claim or defense.
For corporate governance purposes:
For instance, by the owner group of City Pay to ensure corporate oversight, including ensuring and verifying compliance with group policies and standards (for example, through audits).
C) To fulfill legal obligations - when it is necessary in order to comply with mandatory legal obligations to which we are subject under the applicable laws (including AML/CFT regulations under the Law "On Combating the Legalization of Proceeds from Crime, the Financing of Terrorism, and the Financing of the Proliferation of Weapons of Mass Destruction" of the Republic of Uzbekistan dated August 26, 2004, No. 660-II, as amended):
to determine your actual geo-location to comply with our license requirements;
to make sure we offer our services to eligible persons as per licensing conditions;
to ensure crime detection, prevention, and prosecution;
to verify your identity and where necessary, establish the source of funding in any transaction;
to carry out appropriate anti-fraud checks;
to provide data access to regulators, tax authorities, or other supervisory bodies and audit firms as required by law;
to assess and manage any potential risks;
to ensure the security of data.
D) Based on your consent
Processing of your personal data for direct marketing purposes
With your prior consent, in accordance with the Law "On Personal Data" of the Republic of Uzbekistan dated July 2, 2019, No. O'RQ-547, we will process your personal data for direct marketing purposes. This allows us to send you tailored marketing messages and communications about offers, bonuses, products, and other updates through various channels, including email, SMS, push notifications, phone calls and post. Typically, we obtain this consent through the registration form on our website/mobile application, or by your agreement to a special "Pop-up" notification.
How can you opt out?
You have the right to withdraw your consent to the processing of your data for direct marketing purposes at any time. If you do not wish to receive marketing communications, you can request to withdraw your consent:
By using the opt-out functionality provided in any marketing communications you receive (for example, "Unsubscribe", "SMS OFF");
Contact our Customer Service team via phone, email or live chat;
Kindly be informed that by opting out through the aforementioned method, you will not hinder your receipt of communications related to the provision of services connected to your account, such as transactional alerts or notifications related to your accounts.
We may use information that we hold about you to show you relevant advertising on third-party sites (e.g. Facebook, Google, Instagram, etc.). If you do not wish to be shown targeted advertising messages from us, some third-party sites allow you to request not to see messages from specific advertisers on that site in future.
6. Potential consequences of not providing personal information
Please note that if you choose not to provide your personal data it may prevent us from meeting legal obligations, fulfilling a contract, or performing services required to run your account. Not providing your personal data may result in Our decision not to provide you with products or services.
More details about our services and account requirements are described in our Terms and Conditions.
7. Use of Cookies
To find out more about how we use Cookies, please refer to our Cookies Policy located on our website. To learn more about how we use cookies, please refer to our Cookie Policy located on our website, which is also part of our Terms and Conditions.
8. With whom and when do we share your personal information?
City Pay may share your data with others when it's essential for the proper performance and delivery of the services, as required by law, serves the legitimate interests of City Pay or when there's another legal basis for sharing. Additional information about our contractual relationships with third parties can be found in our Terms and Conditions.
For example, when we share your personal data with third parties that provide services to you on our behalf, and with other third parties in the course of complying with our legal obligations and/or for the purpose of improving our products and services offered to our customers. Other examples of when we share your personal information include when we enter any kind of merger or business sale. Even when it is shared, we ensure that your personal information will only be used for the purposes outlined in this Policy.
We may share your personal information with third parties in the following cases:
To your contractual/legal representatives, in order to exercise your rights;
When delivering products/services to you, or notifying you of either important changes or developments to the features and operation of those products/services;
To ensure that City Pay effectively fulfills its legal duties and contractual obligations, and to guarantee compliance with regulations;
In the event of an obligation imposed by any regulatory, supervisory, law enforcement, enforcement agency, court, or any applicable legal provision;
To establish, exercise, or defend our legal rights;
For financial crime and fraud detection and control purposes, we may transfer your personal data to third parties, including but not limited to payment service providers and financial institutions. Furthermore, we reserve the right to disclose your personal data to relevant parties where City Pay has reasonable grounds to suspect irregularities involving your account;
To ensure the provision of our services to you, we may share your data with service providers. For instance, this includes companies that assist us with technological services (such as platform providers and others), data storage and integration, payment processing (such as commercial banks, payment service providers and others) or the online promotion of our products and services.
With external auditors who may carry out independent checks;
For corporate governance purposes with City Pay's shareholder group, such as for the implementation of corporate oversight objectives (including ensuring compliance with group policies and standards, and for auditing and verification purposes (e.g., through auditing));
To an organization we sell or transfer (or enter into negotiations to sell or transfer) any of our businesses or any of our rights or obligations under any agreement we may have with you. If the transfer or sale goes ahead, the organization receiving your personal data can use your personal data in the same way as us; or
To any other successors in title to our business.
In accordance with the Law "On Personal Data" of the Republic of Uzbekistan dated July 2, 2019, No. O'RQ-547, in the event that City Pay transfers data to third parties, all reasonable security measures will be taken to comply with the requirements of Laws of Uzbekistan.
9. International data transfers
As mentioned above, depending on the products you choose to use we may need to share your personal data with the third parties that provide those services. Furthermore, given that the Internet is a global environment, using the Internet to collect and process personal data necessarily involves the transmission of data on an international basis.
When we transfer your data to other countries, we ensure that an appropriate personal data transfer agreement is in place, which provides for appropriate organizational and technical measures for the proper protection of your personal data in accordance with the Law "On Personal Data" of the Republic of Uzbekistan dated July 2, 2019, No. O'RQ-547.
10. Biometric data processing
During the verification process on the website/mobile application, City Pay will process your biometric data, in particular, your facial features through the software of an authorized data processor.
The purpose of the biometric data processing is City Pay's compliance with the requirements set out by the legislation of Uzbekistan, in particular, the implementation of preventive measures (such as identification and verification) provided for by the Law "On Combating the Legalization of Proceeds from Crime, the Financing of Terrorism, and the Financing of the Proliferation of Weapons of Mass Destruction" of the Republic of Uzbekistan dated August 26, 2004, No. 660-II, as amended.
Both City Pay and the authorized data processor have implemented adequate organizational and technical measures to mitigate processing risks, thereby ensuring the security of data as required by the Law "On Personal Data" of the Republic of Uzbekistan dated July 2, 2019, No. O'RQ-547.
11. How long do we retain your personal data?
We will retain your data only for as long as it is reasonably necessary to fulfill the specific purposes of data processing outlined in this Policy and to comply with our legal obligations.
We retain your data for as long as you are an active customer with us. Once you are no longer our customer, we will retain the data for as long as is necessary to comply with our legal obligations, including tax, regulatory and anti-money laundering obligations. For instance, anti-money laundering and anti-terrorist financing regulations oblige City Pay to retain account-related data for at least 5 years following account closure, in accordance with the Law "On Combating the Legalization of Proceeds from Crime, the Financing of Terrorism, and the Financing of the Proliferation of Weapons of Mass Destruction" of the Republic of Uzbekistan dated August 26, 2004, No. 660-II, as amended.
Information about terminating the use of our services and closing your account is contained in our Terms and Conditions.
12. Your rights
In accordance with the Law "On Personal Data" of the Republic of Uzbekistan dated July 2, 2019, No. O'RQ-547 and subject to certain preconditions, you have specific rights regarding the personal data we process about you.
In particular, you have the right to:
Receive information regarding data processed about you, including which personal data are being processed, what is the purpose of data processing and what are the legal grounds of data processing, the ways in which the data were collected and to whom the personal data were disclosed;
Review your personal data we keep and obtain copies of the documents/records including your personal data as set out in the legislation of Uzbekistan;
Request to rectify, update and/or complete erroneous, inaccurate and/or incomplete data;
Request the termination of data processing, deletion or destruction;
Request blocking of personal data;
Withdraw/refuse your previously given consent for data processing at any time and request the deletion of information processed based on this consent. We will cease data processing and delete the processed data if there are no other legal grounds for processing as stipulated by the law;
If the data is processed on the basis of your consent and this is technically possible, you can ask for your personal data, provided to us by you, to be ported or transferred. This involves receiving the data in a structured, usable, electronic format, or having it transferred to another data controller;
If decision is made with respect to you through the means of automated data processing, which creates legal, financial or other substantial consequences for you, request an inclusion of human resources in the decision-making process except when the data is being processed through automated means on the basis of your consent, this is necessary for conclusion/performance of the agreement or such processing is determined by the legislation;
In case of a breach of your rights, submit a request to us and/or the court and/or the State Inspectorate for Control in the Sphere of Informatization and Telecommunications of Uzbekistan ("Uzkomnazorat").
13. Limitation of your rights
Your rights related to personal data may be restricted if it is expressly provided for by the legislation of Uzbekistan, does not violate fundamental human rights and freedoms, and is a necessary and proportionate measure in a democratic society, and the exercise of these rights may jeopardize:
national security, information security and cyber security and/or defense interests;
public safety interests;
the prevention of crime, investigation of crime, criminal proceeding and exercise of justice;
interests relating to financial or economic (including monetary, budgetary and taxation), public health and social protection issues of importance to the country;
the detection of the data subject's violations of professional ethical standards, including those of a regulated profession, and the imposition of liability on the data subject;
the exercise of the functions and powers of regulatory and/or supervisory bodies in the areas defined by law;
the protection of the rights and freedoms, including freedom of expression, of you as a data subject and others;
the protection of state, commercial, professional and other secrets provided for by law;
the substantiation of a legal claim or a statement of defense.
Hence, adhering to the legislation of Uzbekistan, we reserve the right to restrict your rights related to personal data. Such obligations may arise from various legal requirements. Be assured, that any limitations imposed on your rights will be reasonable and proportionate to the intended purpose of the restriction.
14. Security of your data
At City Pay, safeguarding the security of the personal data you entrust to us is our top priority. That's why we continuously update and enforce security measures and standards to protect the confidentiality, integrity, and availability of your personal data. We employ all reasonable measures, including physical, technical, and organizational security measures, to ensure that your personal data is processed securely, in accordance with this Policy and applicable data protection standards. City Pay also implements physical, technological and procedural controls to protect your data from unauthorized access, use, transfer, loss or destruction.
Our employees are properly informed (including through data protection and information security trainings) and follow your data privacy, security policies and procedures in accordance with the law and internal organizational documents.
Should you as user have any doubts about the activity on your account, such as unrecognized transactions in the transaction history or surprising changes in the balance, please contact us immediately.
15. Contact
If you have any questions or complaints regarding personal data protection, please contact us at: uzsupport@citypay.io.
Additionally, to reach out our Customer Service team via phone, email or live chat - please visit our Contact us page on the website or in mobile application.
16. Changes to the Privacy Policy
We may periodically update this policy to reflect changes in our operations and applicable regulations. Additionally, if necessary, we may introduce technical modifications or corrections to the document.
For any significant and substantive changes to this policy—such as modifications to the purposes of data processing, changes in the responsible party, or updates to how data subjects exercise their rights—you will be notified via a message sent to your registered email address.
Non-substantive or minor changes—such as typographical corrections, stylistic updates, or minor clarifications—will be reflected in the updated policy document, which will be published on our website with the date of revision clearly indicated.
To stay informed about how we process your personal data, we recommend periodically reviewing this policy. The date of the latest update can be found at the top of the document. Previous versions of our privacy policy are also available on our website.
17. Discrepancy between linguistic versions of the Privacy Policy
In the event of inconsistency or discrepancy between the Uzbek text and any of the other linguistic versions of this Privacy Policy, Uzbek text shall prevail. Similar provisions regarding language version discrepancies are contained in our Terms and Conditions.