Privacy policy on the processing of personal data

Revision: 2026-11-05 · Consent text version: ilbirs-2026-11-v1

1. Operator

The operator and the owner of the personal data base (Article 4 of the Law) is ILBIRS AI LAB LLC, taxpayer identification number (STIR) 313042383. Address: 1375 Mustaqillik Street, Doʻstlik MFY, Sherobod District, Surkhandarya Region, Republic of Uzbekistan.

The person responsible for the processing and protection of personal data (part five of Article 31 of the Law) is Baxtiyor Yunusov.

Personal data is processed under the Law of the Republic of Uzbekistan of 2 July 2019 No. ZRU-547 "On personal data" (hereinafter — the Law), in its current edition. The Law applies to relations arising in the processing and protection of personal data, irrespective of the means of processing used, including information technologies (part one of Article 3 of the Law).

Questions about the processing of personal data, subjects' requests and withdrawal of consent — contact@ilbirs.ai or a letter to the operator's address above.

2. Scope of this policy

This policy describes the processing of personal data that the operator receives through the website https://ilbirs.ai — from the contact form on that site. Other websites and services of the operator are not covered by this document.

Together with the consent text, this policy serves as the written notification of the subject about the purposes of processing his personal data and about his rights under Article 30 of the Law, as required by part one of Article 23 of the Law.

3. What data is processed

From the form — whatever the visitor states:

Together with the enquiry, the date and time of its receipt and the version of the consent text are recorded. The consent tick is recorded with the time at which the server accepted the form; the exact moment the box was ticked in the browser is not measured. The version is needed to show which text exactly the visitor agreed to (part two, paragraph six of Article 31 of the Law — the operator must present evidence that the subject's consent was obtained).

Technical data:

• the IP address of the sender of the form — only as an irreversible fingerprint (HMAC under a secret key), to protect the form against automated abuse. The fingerprint is kept for no longer than 24 hours and is then physically deleted;
• the IP address and ordinary request details (date and time, page address, response code, browser information — the User-Agent string the browser sends with every request) — in the web server logs on the platform machine. Retention — §8;
• the country of the IP address. The sender's address is checked against an offline database mapping addresses to countries. Enquiries from addresses belonging to the Russian Federation are not accepted by the form: it returns a refusal (HTTP response code 451). Such an enquiry is neither parsed nor stored, and the address does not reach the enquiry database, the rate counters or the fingerprints; a record of the request itself — together with the IP address — does remain in the web server log, as for any other request to the site, for the period given in §8. Checking the country is also processing of personal data, and its legal basis is given in §5;
• the time taken to fill in the form — bot protection; measured by the form script without cookies (§13).

The operator does not request or collect special personal data (Article 25 of the Law), biometric and genetic data (Article 26 of the Law), passport data or payment details. Please do not state them in the "message" field.

4. Purposes of processing

• considering the enquiry sent through the form and contacting the sender about that enquiry;
• confirming the fact of consent and its terms (text version, time);
• protecting the form against spam and automated abuse, including limiting the acceptance of enquiries from regions the site is not intended for;
• performing the operator's obligations under the Law — answering subjects' requests, destroying data upon withdrawal of consent.

The purposes of processing do not go beyond the purposes stated when the data was collected (part two of Article 19 of the Law). Data from the form is not used for mailings and is not transferred to third parties for their own purposes. If the purpose of processing changes, the operator will request new consent (part three of Article 19 of the Law).

5. Legal basis of processing and consent

Data from the form is processed on the basis of the consent of the subject of personal data (part two, paragraph two of Article 18 of the Law), which the visitor gives by ticking the box in the form. The consent text is a separate document: it is published as a separate page: Consent to the processing of personal data.

Consent is given in a form that makes it possible to confirm the fact that it was obtained (part one of Article 21 of the Law): the version of the consent text and the time at which the server accepted the form with the ticked consent are stored together with the enquiry. Without a ticked consent the form is not accepted: the enquiry is rejected by the server and is not stored.

Consent may be withdrawn at any time — in the same form in which it was given, or in writing, including in the form of an electronic document (part seven of Article 21 of the Law). The procedure is in §9.

The legal basis for processing technical data (the IP address fingerprint, the web server logs, the country of the address and the time taken to fill in the form) is the exercise of the rights and legitimate interests of the operator, provided that the rights and legitimate interests of the subjects of personal data are not infringed (part two, paragraph six of Article 18 of the Law). This processing is needed only for the operability and security of the site: protection of the form against automated abuse and spam, limiting the acceptance of enquiries from regions the site is not intended for, and the analysis of failures and incidents. Plain IP addresses remain only in the web server logs for the period given in §8, while the IP address fingerprint is irreversible and is destroyed within 24 hours.

6. Who else takes part in the processing

• Enquiries are not transferred to third parties. The form sends no automatic reply to the sender.
• The notification of a new enquiry reaches the operator by email and contains no personal data of the sender: only the enquiry number, the domain, the time and the command with which the operator views the enquiry on the platform machine. The letter is sent through the cloud provider's email service from the address no-reply@ilbirs.ai.
• Infrastructure. The site, the receipt of the form, the enquiry database and the backups are located in the Oracle Cloud Infrastructure (OCI) cloud, in a data centre in Frankfurt (Germany). The place of processing and its legal basis are in §7.
• If personal data is transferred to a third party, the operator will notify the subject of this in writing within three days (part two of Article 23 of the Law).

7. Place of processing, storage outside Uzbekistan and cross-border transfer

Place. Enquiries from the form are stored and processed on a server in Germany, the backups — in object storage in the same region. Enquiry data is not copied outside that region.

Localization. Part two of Article 27¹ of the Law (as amended by the Law of 26 March 2026 No. ZRU-1125) requires mandatory storage in the territory of the Republic of Uzbekistan of only three kinds of data: biometric data of individuals, genetic data of individuals, and data of individuals who are users of the services of telecommunications operators carrying out their activities in the territory of the Republic of Uzbekistan. Data from the contact form belongs to none of these kinds, so the requirement of mandatory storage in the Republic of Uzbekistan does not apply to it.

Basis for storage outside the country. Personal data not covered by part two of Article 27¹ of the Law may be stored and processed outside the territory of the Republic of Uzbekistan where a foreign state is recognized as a state that ensures equal protection of personal data (part three, paragraph two of Article 27¹ of the Law). The list of such states is established by the Cabinet of Ministers of the Republic of Uzbekistan (part four of the same Article). The list was approved by Resolution of the Cabinet of Ministers of the Republic of Uzbekistan No. 415 of 29 July 2026, in force since 3 August 2026; the Federal Republic of Germany is included in it (item 10 of the annex). The server and the backups are located in Germany, so the condition of part three of Article 27¹ of the Law is met.

Cross-border transfer. Cross-border transfer of personal data is carried out to the territory of foreign states that ensure adequate protection of the rights of the subjects of personal data (parts one and two of Article 15 of the Law). Germany is on the list of states ensuring equal protection of personal data — the same list approved by Resolution of the Cabinet of Ministers No. 415 of 29 July 2026 (item 10 of the annex) on which the basis for storage above also relies (parts three and four of Article 27¹ of the Law). Enquiry data is not transferred to states outside the list.

State Register of Personal Data Bases. The enquiry database is not registered in it: under part one of Article 20 of the Law (as amended by Law No. ZRU-1125), registration covers personal data bases that, under part two of Article 27¹ of the Law, are subject to mandatory storage in the territory of the Republic of Uzbekistan, and the enquiry database does not fall under that requirement.

Data leak during cross-border transfer. If a leak of personal data during cross-border transfer is detected, the person responsible for the processing and protection of personal data (§1) notifies the authorized state body by email within 24 hours of detection and, within 72 hours, submits detailed information on the causes and on the measures taken (item 4 of Resolution of the Cabinet of Ministers No. 415 of 29 July 2026).

8. Retention periods

The retention period of personal data is determined by the date on which the purposes of its collection and processing are achieved (part three of Article 10 of the Law), and the processing period does not exceed the period for which the subject's consent is valid (part seven of Article 19 of the Law).

• an enquiry from the form — 12 months from the date of receipt, after which it is automatically deleted physically. Earlier deletion — upon withdrawal of consent or a subject's request (§9);
• backups — the configured periods are 14 days for the local snapshots and 30 days for the copies in object storage. A deleted enquiry leaves the copies when the period of the last copy that contains it expires;
• the IP address fingerprint — no longer than 24 hours, after which it is physically deleted;
• web server logs (they contain the IP address and the User-Agent string) — on the platform machine, the configured period is 90 days. They do not leave that machine: outwards the platform sends only metrics without personal data.

The periods for the copies and the logs are configured periods, not guaranteed maximums: what deletes them is not a timer tied to the exact period but a periodic clean-up that runs later. The platform cleans up the local snapshots once a day, selecting those older than fifteen full days — so a snapshot lives longer than the configured 14 days; and if an upload of the copies to the storage fails, the clean-up is not carried out on that run and the snapshot is deleted on the next successful run. The copies in object storage are deleted by the lifecycle rule of the storage, and the web server log by the daily rotation: only files that have already been closed leave the log, and only once their first record is older than the period. The platform promises no upper limit for the actual deletion. The periods for the enquiry (12 months) and for the IP address fingerprint (24 hours) are kept by the service itself, which checks them every 15 minutes.

9. Rights of the subject of personal data

Under Article 30 of the Law the subject has the right to:

• know that the operator holds his personal data and what it consists of;
• receive, upon request, information on the processing of his personal data and on the conditions for providing access to it;
• give consent to the processing of his personal data and withdraw such consent;
• give consent to the distribution of his personal data in public sources of personal data — the operator does not request such consent and does not include data in public sources;
• require the temporary suspension of the processing of his personal data where it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the purposes of processing;
• apply to the authorized state body in the field of personal data or to a court on matters of the protection of his rights and legitimate interests in relation to his personal data.

The information a subject is entitled to receive upon request is listed in part one of Article 22 of the Law: confirmation of the fact of processing, the grounds and purposes of processing, the methods of processing, the name and location of the operator, the composition of the data and the source from which it was obtained, the periods of processing including storage, the procedure for exercising the rights under Article 30, and information on the cross-border transfer that has taken place or is envisaged.

How to apply: by letter to contact@ilbirs.ai or to the operator's address in §1. For the operator to find the enquiry, it is enough to state the email address or the phone number that was in the form.

Response times. Change and addition of personal data — no later than three days from the moment of the request, and where the data does not correspond to reality — without delay from the moment such a discrepancy is established (Article 11 of the Law). A notification of refusal to provide information concerning the processing of personal data is sent in writing within ten days (part five of Article 22 of the Law); such a refusal may be appealed to the authorized state body or to a court (part six of Article 22 of the Law).

After consent is withdrawn, the enquiry is physically deleted, leaves the backups when the period of the last copy that contains it expires (§8), and contact regarding the enquiry ceases.

10. Actions with personal data

Processing of personal data (Article 4 of the Law) is the collection, systematization, storage, modification, supplementation, use, provision, distribution, transfer, anonymization and destruction of personal data.

With the data from the form the operator performs only those of these actions that are needed for the purposes in §4: collection, systematization, storage, modification and supplementation (upon a subject's request), use and destruction. There is no distribution of personal data (disclosure to an indefinite range of persons, Article 14 of the Law) and no inclusion of it in public sources (Article 29 of the Law). The list matches the list in the consent text — the documents are in step with each other.

11. How the processing is carried out

Processing is carried out both with and without the use of automation.

Decisions affecting the rights and legitimate interests of the subject and giving rise to legal consequences are not taken solely on the basis of automated processing (Article 24 of the Law). No profiling is carried out.

Special personal data (Article 25 of the Law), as well as biometric and genetic data (Article 26 of the Law), is not processed.

12. Protective measures and actions in the event of a leak

The operator takes legal, organizational and technical measures to protect personal data, ensuring protection against interference in private life, the integrity and preservation of the data, compliance with its confidentiality and the prevention of unlawful processing (Article 27 of the Law). Personal data is not disclosed or distributed without the subject's consent or another lawful basis (Article 28 of the Law). The work related to the processing and protection of personal data is ensured by the responsible person named in §1 (part five of Article 31 of the Law).

In practice this means:

• access to the enquiry database is available only to the operator's authorized persons, over a secure channel; the database file is accessible only to the service account;
• the log of the service that receives the enquiries, the metrics and the notification emails contain no personal data of senders: the service records the domain, the enquiry number, the outcome and the notification status — without the IP address and without the content of the enquiry;
• the web server log is a separate one: it contains the IP address, the User-Agent string and the ordinary request details (§3), including those of the requests the form refused on the basis of country (code 451). The log stays on the platform machine for the period given in §8, and access to it is available only to the operator's authorized persons;
• the backups are kept in private object storage; the platform machine has rights only to create, read and list the objects of that storage — it cannot delete or overwrite them, so a compromised server cannot destroy the copies in the storage. The local snapshots on the machine itself are not under that protection: the machine deletes them itself according to the period given in §8;
• deletion by retention period and upon request is physical, together with the cleaning of the database service files;
• if a leak during cross-border transfer is detected — notification of the authorized state body within the time limits and in the manner set out in §7.

Persons guilty of violating the legislation on personal data bear liability in the established manner (Article 33 of the Law; Article 46² of the Code of the Republic of Uzbekistan on Administrative Liability, Article 141² of the Criminal Code of the Republic of Uzbekistan).

13. Cookies, analytics and external services

The site sets no cookies. There are no external web analytics counters, advertising pixels or third-party widgets on the site: fonts, styles and images are served from the same domain, and the only form script measures merely the time taken to fill in the form (bot protection) and sets no cookies. There is no view counter and no other visitor statistics on the site.

14. Changes to the policy and language versions

The current edition is published on the website https://ilbirs.ai; the date of the edition is given at the beginning of the document. A change to the consent text means a new version of the consent string (see Consent to the processing of personal data); enquiries already accepted keep the version that their sender saw.

The policy and the consent text are published in three languages — Russian, Uzbek and English. All three versions are equal in content: the Uzbek and English texts are exact translations of the Russian text. The consent version is the same for all three.

15. Legal basis

Primary sources. The official texts of the acts of the Republic of Uzbekistan are published in Uzbek; the Russian and English versions on lex.uz are unofficial translations.

Two notes on the sources. First, the English translation of Article 27¹ published on lex.uz reflects the previous edition of that Article (processing of the personal data of citizens of the Republic of Uzbekistan in technical means located in the country); the wording used in §7 above is translated from the current Uzbek text as amended by Law No. ZRU-1125. Second, Article 25 of the Law was amended by the Law of 11.09.2026 No. ZRU-1174, and the translation of those amendments has not yet been published; the form collects no special personal data, so this does not affect the text of the policy — to be re-checked at the next edition.