Consent to Personal Data Processing

Consent to Personal Data Processing

for the HPBS Website and Digital Services

Revision dated September 12, 2026

This consent sets out the terms for processing the personal data of users of the hpbs.uz website, its forms, and HPBS digital services. It applies in conjunction with the Privacy Policy and must be made available to the user before a form is submitted or an account is registered.

1 Operator Details

The consent applies to the hpbs.uz website, its official subdomains, forms, mobile versions, and HPBS digital services where the interface contains a link to this consent.

2 Data Subject’s Declaration

Freely, of my own will, and in my own interest, I consent to the processing of my personal data by HPBS LLC to the extent and for the purposes specified below. I confirm that I provide accurate data, have read the Privacy Policy, and understand the consequences of providing consent.

3 Personal Data

• surname, given name, and patronymic, where requested by the relevant form;
• telephone number, email address, and preferred method of communication;
• position, place of employment, organization name, and information about the authority of its representative;
• account identifier, authorization information, selected language, and profile settings;
• the contents of inquiries, applications, support requests, correspondence, and information voluntarily provided in attached files;
• technical data: IP address, cookies and similar identifiers, device and browser type, date and time of access, login and activity logs, and referral source;
• information about the use of services, pricing plan, orders, contracts, and payment status, without the Operator storing full bank card details.

The Operator does not ask users to submit special categories of personal data or biometric or genetic personal data through ordinary website forms. If a separate function requires such data, the Operator obtains separate consent in the form prescribed by law.

4 Purposes of Processing

• registration, identification, and management of the user’s account;
• provision of access to HPBS digital services and user support;
• processing an application, preparing a proposal, entering into and performing a contract, invoicing, and client support;
• responding to inquiries, providing technical support, and sending service operation and information security notices;
• protecting accounts, preventing abuse, investigating failures, and maintaining audit logs;
• analyzing and improving the operation of websites and services using aggregated and, where possible, anonymized data;
• complying with legal requirements and protecting the legitimate rights of the Operator and users.

5 Processing Operations and Methods

The Operator may collect, record, organize, accumulate, store, clarify, alter, supplement, retrieve, use, provide to authorized processors, transfer, anonymize, block, and destroy personal data. Processing may be carried out by automated and non-automated means, including combined processing.

Automated processing may be used to route applications, manage access, identify suspicious activity, perform analytics, and personalize the interface. Decisions that produce legal consequences for the user or otherwise significantly affect the user’s rights are not made solely by automated means without a separate lawful basis and the necessary safeguards.

6 Data Transfer

To achieve the stated purposes, the Operator may engage providers of hosting and cloud infrastructure, CMS and CRM systems, authorization, email and notification services, analytics, technical support and backup services, payment organizations, auditors, and consultants to process data. Only the necessary data are transferred to them, and access is granted under a contract that imposes obligations to maintain confidentiality and comply with security requirements.

Cross-border transfer is permitted only in compliance with the requirements of the laws of the Republic of Uzbekistan, including rules on adequate protection, applicable contractual safeguards, and other lawful bases. If data are transferred to a country without a recognized adequate level of protection and the data subject’s consent is required, this consent includes consent to such transfer only to the extent necessary for the service selected by the user and provided that the relevant recipient or category of recipients has been disclosed in advance.

7 Validity Period and Retention

Consent is valid from the date on which it is provided until the stated purposes of processing have been achieved or until it is withdrawn, unless longer retention is required by law, contract, or for the protection of lawful claims. Once the lawful bases cease to apply, the data are destroyed or anonymized in accordance with the established procedure. Information confirming the fact of consent and the user’s actions may be retained for the period necessary to comply with the law and protect the Operator’s rights.

8 Data Subject’s Rights and Withdrawal of Consent

I have been informed that I have the right to:

• obtain information about the existence, categories, bases, purposes, methods, and periods of processing of my data;
• request correction, temporary suspension of processing, or destruction of data in the cases provided for by law;
• withdraw consent by the same means by which it was provided or submit a written or electronic request to the Operator;
• apply to an authorized government body or court to protect my rights.

Withdrawal must be sent to privacy@hpbs.uz or to the Operator’s postal address. The request must include information enabling the applicant and the relevant account or inquiry to be identified. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal was received and does not terminate processing for which the Operator retains another lawful basis.

9 Form of Consent

Consent is deemed to have been provided when the user selects a separate checkbox that is not preselected and then clicks the button to submit the form, register, or continue using the service. The electronic record of consent must contain the date and time, text version, page address, form or account identifier, and other technical information that makes it possible to confirm that consent was obtained.

10 Separate Consent to Marketing Communications

Receipt of advertising and marketing communications is not a condition for using the website and HPBS’s core services. A separate voluntary consent applies to such communications:

☐ I consent to receiving news, invitations, and offers concerning products and events from HPBS LLC by email and telephone. I may opt out at any time by using the link in a message or contacting the Operator.

11 Recommended Text for Website Forms

☐ I consent to the processing of personal data by HPBS LLC in accordance with the Consent and confirm that I have read the Privacy Policy.

The words “Consent” and “Privacy Policy” must be active links and must open before the form is submitted.

12 Confirmation for a Paper Form

Legal Basis

Law of the Republic of Uzbekistan “On Personal Data” dated July 2, 2019, No. ZRU-547, as currently amended, including the amendments introduced by Law No. ZRU-1125 dated March 26, 2026.