Privacy Policy

Rules for the Processing and Protection of Personal Data on the HPBS Website

About This Document in Brief

This Policy explains what personal data HPBS LLC receives, why such data are needed, how they are used and protected, to whom they may be disclosed, how long they are retained, and what rights the user has. It applies to the HPBS website, its feedback forms, and other channels of interaction with users.

1 General Provisions

1.1. This Privacy and Personal Data Processing Policy (the “Policy”) sets out the rules for the processing and protection of personal data by HPBS LLC (the “Operator,” “we”) when the HPBS website, its feedback forms, and other HPBS digital services are used.

1.2. The Policy has been developed in accordance with the Law of the Republic of Uzbekistan “On Personal Data,” No. ZRU-547 dated July 2, 2019, as amended, other applicable laws and regulations of the Republic of Uzbekistan, and the Operator’s contractual obligations to clients and users.

1.3. By using the websites, creating an account, submitting a form, or continuing to use a personal account after reviewing the Policy, the user confirms that they have read its terms. Where consent is required by law, the Operator requests it separately in a form that makes it possible to confirm that it has been obtained.

1.4. If a user provides another person’s data, the user confirms that there is a lawful basis for such disclosure and must inform that person of this Policy.

1.5. The Policy does not replace a separate consent to personal data processing, consent to marketing communications, a contract, a user agreement, or the terms of a specific service where such documents are required.

2 Scope

2.1. The Policy applies to the hpbs.uz website, including its pages, forms, official subdomains, and application programming interfaces.

2.2. The Policy also applies to requests submitted through feedback forms, event registrations, requests for demonstrations and commercial proposals, support services, CRM integrations, and other information systems used to provide services.

2.3. Third-party websites and services linked through external links operate under their own rules. The Operator does not determine the purposes and means of data processing by such independent parties.

3 Key Definitions

4 Data We Process

4.1. The categories of data depend on the selected resource, the user’s role, the terms of the contract, and the function used. The Operator may process:

• identification data: surname, given name, patronymic, position, organization, and role in a project or system;
• contact data: business and personal email address, telephone number, and contact address;
• account data: login, user identifier, information about roles and access rights, profile settings, and account status; passwords are stored securely and are not displayed to the Operator’s employees;
• request and interaction data: the contents of applications, correspondence, support requests, feedback, consents, and refusals;
• contractual and payment information: details of the client or counterparty, information about representatives, contracts, invoices, and payments; banking data are processed only to the extent necessary for settlements and accounting;
• project and corporate data that may contain information about employees, experts, auditors, verifiers, suppliers, and other process participants;
• registry data: information about applicants, rights holders, participants in climate projects, experts, and verifiers, where provided for by the rules of the relevant registry;
• technical data: IP address, date and time of access, device and browser type, operating system, language, referring URL, session identifiers, event logs, and error and security information;
• usage data: sections visited, actions performed, settings selected, interface responses, and aggregated usage metrics;
• information from cookies and similar technologies within the settings selected by the user.

4.2. The Operator does not request special categories of personal data or biometric or genetic data for ordinary registration and use of services. If their processing becomes necessary for a separate function, it will be carried out only on a basis provided for by law and with separate notice to the user.

4.3. Environmental, energy, financial, and production indicators of a legal entity are not personal data in themselves. However, this Policy applies to them if they make it possible to identify an individual directly or indirectly.

5 Sources of Data

5.1. The Operator obtains data:

• directly from the user when forms are completed, an account is registered, a contract is entered into, a profile is configured, or support is contacted;
• from the user’s client or employer, which grants the user access to a workspace;
• from authorized representatives, partners, contractors, auditors, and verifiers within the scope of a project or contract;
• automatically when the HPBS website and its forms are used;
• from lawfully available government, corporate, and public sources where this is necessary to verify a project, counterparty, climate claim, or registry entry;
• through integrations authorized by the user and imported files.

6 Purposes and Legal Bases of Processing

7 Processing Procedure

7.1. Processing may be carried out by automated, non-automated, or combined means. The Operator performs only the operations necessary for the stated purposes.

7.2. Access to data is granted according to a role-based model and to the extent necessary for an employee, client, expert, verifier, or contractor to perform their tasks. Actions within the system may be recorded in audit logs.

7.3. When HPBS digital services are used, access to data is provided within the scope of the authority granted. The Client is responsible for the lawfulness of disclosing the personal data of its employees and other persons.

7.4. Automated calculations and recommendations provided by HPBS services are intended for informational and operational support. Decisions that produce legal consequences for an individual must not be made solely on their basis without human review where required by law or contract.

8 Publication of Information

8.1. HPBS may publish information about projects, events, and services provided on the website. Before personal data are published, the user is informed of the categories of data to be published and, where required, provides separate consent to their dissemination.

8.2. Contact details, documents, signatures, identifiers, and other restricted-access information are not published unless publication is expressly provided for by law or by the data subject’s separate consent.

8.3. A user may submit a request to correct or delete published personal data or restrict access to them. The Operator considers the request with due regard to legal requirements and the rights of other persons.

9 Cookies and Analytics

9.1. The websites may use the following categories of cookies:

• strictly necessary cookies — ensure security, authorization, session persistence, and operation of core functions;
• functional cookies — remember the language, interface, and other user settings;
• analytics cookies — help assess traffic, performance, and usability in aggregate form;
• marketing cookies — are used only if they are actually enabled and the required consent has been obtained.

9.2. Optional cookies are activated in accordance with the user’s choice in the settings panel. The user may change that choice, delete cookies, or restrict their use through browser settings. Disabling strictly necessary cookies may interfere with authorization and certain functions.

9.3. If third-party analytics, chat, maps, video, or automated-request protection tools are connected to the websites, the user is provided with the necessary information before they are activated, and data are transferred on a lawful basis.

10 Disclosure of Data to Third Parties

10.1. The Operator may disclose data, only to the extent necessary, to the following categories of recipients:

• providers of hosting, infrastructure, backup, communications, technical support, and information security services;
• providers of CRM, business communication, and request management services;
• auditors, consultants, verifiers, and experts engaged for a specific project;
• partners and contractors involved in providing the ordered service;
• banks and payment organizations when settlements are made;
• government authorities, courts, and other authorized persons in the cases and according to the procedures provided for by law;
• a new owner or successor in the event of a reorganization or transfer of the relevant business, subject to continued compliance with confidentiality requirements.

10.2. Persons that process data on the Operator’s instructions undertake to maintain confidentiality, use the data only for the specified purposes, and apply appropriate safeguards.

10.3. The Operator does not sell personal data or disclose them for independent advertising use without the user’s separate consent.

11 Cross-Border Transfer and Place of Storage

11.1. The Operator arranges the storage and cross-border transfer of personal data in accordance with the requirements of the laws of the Republic of Uzbekistan.

11.2. Personal data that must be stored in the Republic of Uzbekistan are stored in the Republic of Uzbekistan. Other data may be stored or processed outside its territory where the conditions provided for by law and adequate safeguards are in place.

11.3. Before connecting an external cloud service, the Operator assesses the place of processing, contractual terms, security measures, and permissibility of the transfer. Separate consent of the data subject is requested where necessary.

12 Retention Periods and Destruction

12.1. Data are retained no longer than necessary for the purposes of processing, the validity period of consent, or performance of a contract, unless a longer period is established by law or is required to protect lawful rights.

12.2. The following guidelines apply unless a different period is established by contract or mandatory rules:

• request and account data — for the period necessary to process the request, perform the contract, and ensure security;
• applications and correspondence — for the period required to process the request and subsequently confirm its fulfillment;
• contractual, accounting, and payment documents — for the mandatory retention periods;
• security logs and technical backups — for the periods established by internal regulations, taking into account risks and the need to investigate incidents;
• marketing contacts — until consent is withdrawn or the relevant mailing is discontinued;
• project and service information — for the period necessary to perform the contract and comply with legal requirements.

12.3. Once the purpose has been achieved, data are destroyed, anonymized, or blocked unless their continued retention is required by law. Data are deleted from backups during the established update cycle while access restrictions remain in place.

13 Data Protection

13.1. The Operator applies legal, organizational, and technical measures appropriate to the nature of the data and the processing risks, including:

• role-based access control and the principle of least privilege;
• user identification and authentication, and session and password management;
• encryption of secure connections and, where applicable, data at rest;
• activity logging, event monitoring, and incident response;
• backup and recovery testing;
• software updates and control of vulnerabilities and configurations;
• employee training and contractual confidentiality obligations;
• contractor assessment and restriction of their access;
• periodic review of safeguards.

13.2. The user must keep account credentials confidential, use a strong password, refrain from sharing access with others, and promptly report suspicious activity.

13.3. No method of transmitting or storing information provides absolute security. If an incident is identified, the Operator takes measures to contain it, remedy its consequences, and notify affected persons and authorized authorities where required by law.

14 User Rights

14.1. To the extent provided for by law, the user has the right to:

• learn whether the Operator holds their personal data and obtain information about the categories and processing of such data;
• request the correction of incomplete, outdated, or inaccurate data;
• withdraw consent where processing is based on consent;
• request the temporary suspension of processing or destruction of data where lawful grounds exist;
• opt out of marketing communications;
• obtain information about the conditions under which access to data is granted;
• apply to an authorized government body or court to protect their rights and legitimate interests.

14.2. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal was received and does not terminate processing that is necessary to comply with legal requirements or protect the rights of the Operator and other persons.

15 Procedure for Submitting Requests

15.1. A request may be submitted through the feedback form or using the contact details of HPBS LLC published in the “Contacts” section of the HPBS website.

15.2. It is recommended that the request specify the surname and given name, contact details for the response, the resource used, the substance of the request, and information enabling the relevant data to be located. The Operator may request confirmation of identity and a representative’s authority in order to prevent unauthorized disclosure or alteration of data.

15.3. The Operator considers the request within the period and according to the procedure established by law. If fulfillment of the request is restricted by law, the terms of a contract, or the rights of other persons, the user is sent a reasoned response.

16 Minors’ Data

16.1. The services are intended primarily for professional and corporate use and are not designed for independent use by minors.

16.2. If the Operator becomes aware that a minor’s data have been obtained without the required consent of a legal representative, it will take steps to restrict processing and delete the data unless another lawful basis exists.

17 Obligations of Corporate Clients

17.1. A Client that uploads data to the platform or grants access to its employees independently ensures the existence of a lawful basis, notification of the data subjects, the appropriateness of the categories of data, and compliance with access restrictions.

17.2. If HPBS LLC processes data solely on the documented instructions of a Client, the allocation of responsibilities between the owner and the operator of the personal data database is determined by the contract. The Client must not upload special categories of personal data, biometric data, genetic data, or excessive data without prior written approval.

18 Amendments to the Policy

18.1. The Operator may amend the Policy as services develop or processing operations or laws change. A new revision takes effect on the date of publication unless it provides otherwise.

18.2. If material changes affect users’ rights or the purposes of processing, the Operator posts a prominent notice on HPBS resources and requests consent again where necessary.

19 Operator Contact Details

Personal data operator: HPBS LLC, Republic of Uzbekistan.

Inquiries concerning personal data are accepted through the feedback form and using the current contact details provided in the “Contacts” section of the hpbs.uz website.

20 Legal Basis

Law of the Republic of Uzbekistan “On Personal Data,” No. ZRU-547 dated July 2, 2019, current version: LexUZ

End of document