Introduction
City Pay is committed to protecting your privacy and ensuring the security of your personal data when you use our services.
This Privacy Policy (hereinafter referred to as the "Policy") is intended to inform you about how and why we collect and process your personal data. In addition, this Policy describes your rights regarding your personal data and the ways to protect them.
This Policy is governed by and interpreted in accordance with the legislation of the Republic of Uzbekistan.
This Policy forms an integral part of our Terms and Conditions and should be read together with them.
Who are we?
CityPay (citypay.uz) is the brand of the following company: "CITY PAY GATE" Joint Venture Limited Liability Company (TIN: 311606433), a crypto-asset depository operating under License No. CD0004 issued by the National Agency for Perspective Projects. Registered address: 112 Maxtumquli Street, Yashnobod District, Tashkent 100016 (hereinafter referred to as "CITY PAY GATE" LLC, "we", "us", or "City Pay").
For the purposes of this Policy and in accordance with the personal data protection legislation of the Republic of Uzbekistan, City Pay acts as the personal data operator responsible for processing your personal data.
How do we collect your information?
We collect personal data when you interact with us and use our services or products. In some cases, you provide this information directly, for example, when registering or contacting us. In other cases, third parties may provide us with information about you.
In addition, to comply with legal obligations or protect our legitimate interests, we may collect information from publicly available sources such as internet search engines, public registers, and other public sources.
We may collect your information through the following methods:
— when you register or verify your account to use our products/services;
— when you use our products/services;
— when you use our website/mobile application and their functionalities;
— when you participate in our research/surveys;
— when you contact us (including via email, telephone calls, SMS messages, social media, online chat, or other technical means);
— from internet search engines, public registers, social media, and other publicly available sources;
— from third parties, including our business partners and other organizations (for example, verification providers), primarily for business, operational, and regulatory compliance purposes.
What information about you do we process?
When providing you with services and related products, we may process the following categories of information, in a scope proportionate to the purpose of processing:
A) Information you provide to us
During the registration/verification process:
Identification information: such as country of residence, citizenship, place of birth, first name, last name, personal identification number, current or registered address, gender, date of birth, "selfie", and others;
Document information: such as a photo identity document or a copy thereof (for verification purposes);
Contact information: such as current or registered address, telephone/mobile phone number, email address;
Account access information: such as username and unique user account number ("userID");
Special category data: biometric data, in particular the unique characteristics of your face (for verification purposes), in accordance with the Law of the Republic of Uzbekistan No. O‘RQ-547 "On Personal Data" dated July 2, 2019.
While using City Pay services:
Activity and behavioral information: such as information about how you use our products/services, including your online activity (for example, transaction history) and behavioral information, which may also be processed by our contractors/service providers;
Technical information: information about the device you use to access our services/products (for example, model, operating system, IP address, browser type, mobile device identifier, application).
Contact information:
A) Records of telephone calls and other communications with us or our employees (for example, messages sent via email, online chat, or other methods) (via email, website, mobile application, mobile communications, and other methods) — we may monitor or record telephone calls and correspondence with us. We do this to verify that your instructions have been correctly carried out; resolve requests or issues; comply with regulatory requirements; improve service quality; train employees; and detect or prevent fraud and other crimes;
Research-related information: such as information about the questions asked and your responses within the scope of our surveys, including information regarding the quality of our services, your level of satisfaction, and your requirements.
B) Personal data obtained from other sources:
Information obtained from our business partners (for example, identification/verification organizations) and other third parties (for example, information obtained from the State Services Agency of the Republic of Uzbekistan for identification/verification purposes);
Where personalized services are provided to you, we may use information from third parties, such as information from your Facebook profile, to better understand your preferences and provide more effective personalization;
Public information: information about you obtained from publicly available sources.
C) Generated/derived information:
Information that we create based on extracted or generated data (that is, information created by us through the analysis of your data), such as information about your behavior, segmentation, preferences, and similar information.
D) Information about third parties
If you provide us with another person's personal data, you must not do so without that person's permission. If information about another person is provided by you, or if another person discloses information about you, such information may be combined with the personal data we already hold and used in the ways described in this Policy.
This list of the types of personal data we collect is not exhaustive, and additional information may be requested from you where we consider it necessary and justified.
For what purposes and on what legal grounds do we process your personal data?
City Pay adheres to the principle of transparency regarding the purposes and legal grounds for collecting and processing your personal data.
First and foremost, collecting and processing your data is necessary to provide you with the services and products you have chosen. In addition, your data is used to personalize and improve your experience with our services and products, as well as to keep you regularly informed about important information. In certain cases, we are also required to collect and process your data in order to comply with legal obligations.
In accordance with the Law of the Republic of Uzbekistan No. O‘RQ-547 "On Personal Data" dated July 2, 2019, we are required to specify the legal grounds on which we rely when processing your personal data.
We rely on different legal bases for different types of processing:
A) Contractual basis — where processing your data is necessary to enter into a contract with you or to perform an existing contract to which you are a party. Our Terms and Conditions, which you accepted when creating your account, define the contractual terms and the services provided to you:
To provide our services under the contract:
— to provide services related to virtual assets, related activities, or online content, provide information about them, and process your requests and inquiries;
— for "service administration" purposes, such as password reset reminders, service notifications (for example, technical support for the website/mobile application), updates to our Privacy Policy or Terms and Conditions, notifications that your City Pay account has become inactive, and asking whether you wish to resume using it before it is closed;
— to process your transactions.
B) Legitimate interests — where processing your data is necessary to protect our legitimate interests or those of third parties for the purposes set out below, provided that such interests do not override your rights as a personal data subject.
To personalize your experience:
— to provide a more relevant and personalized service; for example, we may use your transaction history to provide personalized recommendations and products.
To improve our services/products:
— to ensure the most convenient online navigation possible;
— to conduct analyses and research to improve the services we provide;
— to test new products, systems, or services and verify updates to existing systems;
— to evaluate marketing effectiveness, conduct marketing research, and provide training;
— to model our customer base and perform statistical and trend analyses for the purpose of developing and improving our products and services.
To communicate and interact with you:
— to contact you by telephone, email, post, or social media regarding matters related to our services;
— to administer promotions and tournaments in which you participate;
— to invite you to participate in customer surveys, questionnaires, and other marketing research conducted by City Pay or by other organizations on our behalf;
— to respond to your requests and complaints.
To improve the security and convenience of your transactions:
— to prevent, stop, or detect any actions that violate the City Pay Terms and Conditions;
— to prevent or detect fraudulent activities, including the detection of third-party software used in peer-to-peer (P2P) transfers.
To protect legal rights and interests:
— for example, to establish or defend a legal claim.
For corporate governance purposes:
— for example, to ensure corporate oversight by the City Pay group of owners, including monitoring and verifying compliance with group policies and standards (for example, through audits).
C) To comply with legal obligations — where it is necessary to comply with mandatory legal requirements to which we are subject under applicable law (including compliance with AML/CFT requirements in accordance with the Law of the Republic of Uzbekistan No. 660-II "On Combating the Legalization of Proceeds from Criminal Activity, the Financing of Terrorism, and the Financing of the Proliferation of Weapons of Mass Destruction" dated August 26, 2004 (as amended)):
— to determine your actual geolocation in order to comply with licensing requirements;
— to ensure that our services are provided only to persons who meet the licensing conditions;
— to detect, prevent, and prosecute criminal activities;
— to verify your identity and, where necessary, determine the source of funds involved in any transaction;
— to carry out appropriate anti-fraud checks;
— to provide access to information to regulators, tax authorities, other supervisory authorities, and audit organizations where required by law;
— to assess and manage potential risks;
— to ensure data security.
D) Based on your consent
Processing your personal data for direct marketing purposes
Based on your prior consent, and in accordance with the Law of the Republic of Uzbekistan No. O‘RQ-547 "On Personal Data" dated July 2, 2019, we process your personal data for direct marketing purposes. This enables us to send you personalized marketing messages and notifications about offers, bonuses, products, and other updates through various channels, including email, SMS, push notifications, telephone calls, and postal mail. We generally obtain such consent through the registration form on our website/mobile application or by obtaining your consent through a dedicated pop-up notification.
How can you withdraw your consent?
You have the right to withdraw your consent to the processing of your data for direct marketing purposes at any time. If you no longer wish to receive marketing communications, you may withdraw your consent by:
— using the unsubscribe function included in any marketing communication you receive (for example, "Unsubscribe", "SMS OFF");
— contacting our customer support service by telephone, email, or online chat.
Please note that opting out of marketing communications through the methods described above will not prevent you from receiving service-related communications regarding your account, such as transaction notifications or other messages related to your accounts.
We may use the information we hold about you to display advertisements tailored to you on third-party websites (for example, Facebook, Google, Instagram, and others). If you do not wish to see targeted advertising from us, certain third-party websites provide options to opt out of receiving advertisements from specific advertisers.
Possible consequences of not providing personal data
Please note that if you choose not to provide your personal data, this may prevent us from fulfilling our legal obligations, performing the contract, or providing the services necessary to maintain your account. Failure to provide personal data may result in our decision not to provide you with products or services.
More detailed information about our services and account requirements is set out in our Terms and Conditions.
Use of Cookies
For more information about how we use Cookies, please refer to the Cookie Policy available on our website. For more information about how we use Cookies, please refer to the Cookie Policy available on our website, which also forms an integral part of our Terms and Conditions.
With whom and when do we share your personal data?
City Pay may share your information with other parties where it is necessary for the proper performance and provision of services, where required by law, where it serves the legitimate interests of City Pay, or where another legal basis exists for the transfer of the information. Additional information regarding our contractual relationships with third parties is provided in our Terms and Conditions.
For example, where we transfer your personal data to third parties providing services on our behalf, as well as to other third parties in the course of fulfilling our legal obligations and/or improving the products and services offered to our customers.
Other examples of transferring your personal data include transactions relating to the merger or sale of our business. Even where such transfers occur, we ensure that your personal data will only be used for the purposes set out in this Policy.
We may transfer your personal data to third parties in the following cases:
— to your contractual/legal representatives in order to exercise your rights;
— when providing you with products/services or informing you of significant changes or updates to the functions and operation of those products/services;
— to ensure the effective fulfillment of City Pay's legal and contractual obligations and compliance with regulatory requirements;
— to any regulatory authority, supervisory authority, law enforcement authority, court, or where otherwise required by applicable legal provisions;
— to establish, exercise, or defend our legal rights;
— for the purposes of detecting and monitoring financial crime and fraud, we may transfer your personal data to third parties, including payment service providers and financial institutions.
In addition, if City Pay has reasonable grounds to suspect that violations related to your account have occurred, we reserve the right to disclose your personal data to the relevant parties;
— to ensure the provision of our services to you, we may share information with service providers. For example, providers of technology services (platform providers, etc.), data storage and integration services, payment processing services (for example, commercial banks, payment service providers, and others), or companies that assist us in promoting our products and services online;
— with external auditors who may conduct independent audits;
— with the City Pay group of shareholders for corporate governance purposes, for example, to perform corporate oversight functions (including ensuring compliance with group policies and standards, as well as for audit and verification purposes (for example, through audits));
— with any organization to which we are selling, transferring, or negotiating the sale or transfer of our business or any of our rights or obligations under any contract with you. If such a transfer or sale takes place, the organization receiving your personal data may use it in the same manner as we do; or
— with other legal successors to our business.
In accordance with the Law of the Republic of Uzbekistan No. O‘RQ-547 "On Personal Data" dated July 2, 2019, where City Pay transfers data to third parties, it takes all reasonable security measures to ensure compliance with the requirements of the legislation of the Republic of Uzbekistan.
International data transfers
As noted above, depending on the products you choose, we may need to transfer your personal data to third parties providing the relevant services. In addition, given the global nature of the Internet, using the network to collect and process personal data inevitably involves the international transfer of data.
When your data is transferred to other countries, we ensure that there is an appropriate personal data transfer agreement providing for the necessary organizational and technical measures to ensure an adequate level of protection of your personal data, in accordance with the Law of the Republic of Uzbekistan No. O‘RQ-547 "On Personal Data" dated July 2, 2019.
Processing of Biometric Data
During the verification process on the City Pay website/mobile application, City Pay processes your biometric data, in particular the unique characteristics of your face, using the software of an authorized data processor.
The purpose of processing biometric data is to ensure City Pay's compliance with the requirements of the legislation of the Republic of Uzbekistan, in particular to implement preventive measures (such as identification and verification) provided for by the Law of the Republic of Uzbekistan No. 660-II "On Combating the Legalization of Proceeds from Criminal Activity, the Financing of Terrorism, and the Financing of the Proliferation of Weapons of Mass Destruction" dated August 26, 2004 (as amended).
Both City Pay and the authorized data processor have implemented sufficient organizational and technical measures to reduce the risks associated with processing, thereby ensuring data security in accordance with the requirements of the Law of the Republic of Uzbekistan No. O‘RQ-547 "On Personal Data" dated July 2, 2019.
How long do we retain your personal data?
We retain your data only for the period reasonably necessary to achieve the purposes of processing described in this Policy and to comply with our legal obligations.
We retain your data for as long as you remain our active customer. After your customer relationship has ended, we retain the data for the period necessary to comply with our legal obligations, including tax, regulatory, and anti-money laundering requirements. For example, the AML/CFT rules under the Law of the Republic of Uzbekistan No. 660-II "On Combating the Legalization of Proceeds from Criminal Activity, the Financing of Terrorism, and the Financing of the Proliferation of Weapons of Mass Destruction" dated August 26, 2004 (as amended) require City Pay to retain account-related information for at least 5 years after the account has been closed.
Information on how to discontinue using our services and close your account is provided in our Terms and Conditions.
Your rights
In accordance with the Law of the Republic of Uzbekistan No. O‘RQ-547 "On Personal Data" dated July 2, 2019, and subject to certain conditions, you have specific rights in relation to the personal data we process about you.
In particular, you have the following rights:
— to obtain information about the data being processed about you, including what personal data is being processed, the purposes and legal grounds for processing, how the data was collected, and to whom the personal data has been disclosed;
— to access the personal data we hold about you and obtain copies of documents/records containing your personal data in accordance with the legislation of the Republic of Uzbekistan;
— to request the correction, updating, and/or completion of inaccurate, incorrect, and/or incomplete data;
— to request the restriction of processing, deletion, or destruction of the data;
— to request the blocking of personal data;
— to withdraw/refuse at any time the consent previously given for the processing of your data and request the deletion of the data processed on the basis of such consent. Unless there are other legal grounds provided by law, we will cease processing the data and delete it;
— where your data is processed on the basis of your consent and where technically feasible, to request the portability of the personal data you have provided to us. This includes receiving the data in a structured, commonly used electronic format or having it transferred to another personal data operator;
— if a decision producing legal, financial, or other significant consequences for you has been made solely on the basis of automated processing of your data, to request human involvement in the decision-making process, except where automated processing is carried out on the basis of your consent, is necessary for entering into or performing a contract, or is otherwise provided for by law;
— to apply to us and/or to a court and/or to the State Inspectorate for Supervision in the Sphere of Informatization and Telecommunications of the Republic of Uzbekistan ("Uzkomnazorat") if your rights have been violated.
Restrictions of your rights
Your rights relating to personal data may be restricted in cases expressly provided for by the legislation of the Republic of Uzbekistan, where such restriction does not violate fundamental human rights and freedoms, is necessary and proportionate in a democratic society, and where the exercise of those rights may threaten:
— national security, information and cybersecurity, and/or defense interests;
— public security interests;
— the prevention, investigation, prosecution of crimes, criminal proceedings, and the administration of justice;
— important financial or economic (including monetary, budgetary, and tax), public health, and social protection interests of the country;
— the establishment of violations of professional ethics, including standards applicable to regulated professions, committed by the personal data subject and the imposition of liability;
— the exercise of the functions and powers of regulatory and/or supervisory authorities in areas established by law;
— the protection of your rights and freedoms as a personal data subject and those of other persons, including freedom of expression;
— the protection of state, commercial, professional, and other secrets protected by law;
— the establishment of a legal claim or defense.
Accordingly, in compliance with the legislation of the Republic of Uzbekistan, we reserve the right to restrict your rights relating to your personal data. Such obligations may arise from various legal requirements. Please be assured that any restriction of your rights will be reasonable and proportionate to the purpose of the restriction.
Security of your data
At City Pay, ensuring the security of the personal data you entrust to us is our highest priority. Therefore, we regularly update and apply security measures and standards to protect the confidentiality, integrity, and availability of your personal data.
We take all reasonable measures, including physical, technical, and organizational security measures, to ensure that your personal data is processed securely in accordance with this Policy and applicable data protection standards. City Pay also implements physical, technological, and procedural controls to protect your data against unauthorized access, use, disclosure, loss, or destruction.
Our employees are appropriately informed (including being trained in data protection and information security) and comply with confidentiality and data security policies and procedures in accordance with applicable legislation and internal organizational documents.
If, as a user, you have any concerns regarding activity on your account, such as unfamiliar transactions in your transaction history or unexpected changes to your balance, please contact us immediately.
Contact information
If you have any questions or complaints regarding the protection of personal data, please contact us at:
You may also contact our customer support service by telephone, email, or online chat by visiting the "Contact Us" page on our website or mobile application.
Changes to the Privacy Policy
We may update this Policy from time to time to reflect changes in our activities and applicable regulations. In addition, where necessary, we may make technical amendments or corrections to this document.
You will be notified of any significant and substantive changes to the purposes of processing, the responsible party, or the procedure for exercising the rights of personal data subjects under this Policy by a notification sent to your registered email address.
Changes that do not affect the substance or are insignificant, such as spelling corrections, stylistic updates, or minor clarifications, will be reflected in the updated version of the Policy published on our website, with the revised date clearly indicated.
We recommend that you review this Policy periodically to stay informed about how we process your personal data. The date of the latest update is indicated at the top of the document. Previous versions of our Privacy Policy are also available on our website.
Inconsistency between language versions of the Privacy Policy
In the event of any inconsistency or discrepancy between the Uzbek language version of this Privacy Policy and any version in another language, the Uzbek language version shall prevail. Similar provisions regarding discrepancies between language versions are also provided for in our Terms and Conditions.