Privacy Policy
1. General Provisions
1.1. This Privacy Policy (hereinafter, the "Policy") applies to all information that JSC "NATIONAL INNOVATIVE PAYMENT TECHNOLOGIES" (hereinafter, "ATMOS") obtains about an individual during their use of ATMOS programs and products, the provision of ATMOS services, and during the fulfillment by ATMOS of any other agreements or contracts aimed at providing services to an individual (hereinafter, the "User").
1.2. ATMOS is a company that provides access to software in electronic form as stipulated by the functionality of the ATMOS Service.
1.3. Use of ATMOS services constitutes the User's unconditional agreement with this Policy and the conditions for processing the User's information specified herein. In case of disagreement with these conditions, the User must refrain from using ATMOS services.
1.4. ATMOS has the right to unilaterally amend this Privacy Policy and shall inform the User through informational messages via all communication channels.
2. User Information Received and Processed by ATMOS
2.1. To provide payment and other services to Users, ATMOS receives and processes the following information:
2.1.1. Information that the User has independently entered into the ATMOS Service at any stage of interaction:
Full name;
gender;
date of birth;
residential address;
passport serial number and expiration date;
personal identification number;
passport photo and/or selfie (user photo);
contact phone number;
bank card number and expiration date.
2.1.2. Data about all stages of interaction with the ATMOS Service, received automatically from the device used to access the ATMOS Service, including, but not limited to:
2.1.2.1. Information about phone numbers from the device's address book (used to facilitate Users' money transfer transactions, account for these transactions, etc.).
2.1.2.2. Information about the User's device location (based on cellular network operator data and GPS signals, used to inform the User of additional services available and determined by their location, to collect analytics on application usage based on location, etc.).
2.1.2.3. Photographic images obtained using the camera and stored in the device's memory (for completing a profile, identification, reading QR codes, etc.).
2.1.2.4. Information about the User's mobile device, such as the mobile device model, operating system version, unique device identifiers, as well as data about the mobile network and mobile phone number.
2.1.2.5. Information about transactions performed, such as the location, time, and amount of the transactions, the type of payment method, data about the seller and/or service provider, as well as other information related to the performance of the aforementioned transactions.
2.1.3. User data obtained through agreements concluded by ATMOS with third parties for the purpose of providing services to Users by ATMOS or third parties.
2.2. By using any Service provided by ATMOS, the User consents to ATMOS using their data for subsequent processing by automated systems, and to ATMOS receiving data from and transferring data to its counterparties and Partners for the purpose of providing services to Users. When accepting this information, ATMOS assumes that it was obtained lawfully and that its transfer to ATMOS was authorized by the individual.
2.3. ATMOS guarantees that any third party (ATMOS counterparties and Partners) that gains access to User data obtained in accordance with this Policy will ensure unconditional compliance with the terms of this Policy and the protection of user data in accordance with it.
2.4. ATMOS may obtain publicly available information when the User uses third-party resources.
2.5. ATMOS does not have the ability to verify the legal capacity of an individual, nor does it verify the information provided by the individual. ATMOS proceeds on the assumption that the individual has provided sufficient, reliable, and current information about themselves.
3. Purposes of Collecting and Processing User Personal Information
3.1. ATMOS collects and stores only the personal information necessary for providing the ATMOS Services or fulfilling agreements with the User, except in cases where legislation requires the mandatory collection and storage of certain personal information. Personal information is stored for no longer than is required for the purposes of its processing, unless a different storage period for such personal information is established by the legislation of the Republic of Uzbekistan or the Policy on the Use of ATMOS Services by the User.
3.2. ATMOS may use the User's personal information for the following purposes:
3.2.1. To fulfill agreements with ATMOS, as well as agreements concluded with ATMOS's counterparties and Partners, including for the purposes of User identification/simplified identification and providing the User with the opportunity to use all available ATMOS services;
3.2.2. To provide payment services to Users, including other Services rendered by the Company;
3.2.3. To conduct scoring and analysis of the User's solvency;
3.2.4. To identify the User;
3.2.5. To communicate with the User and process incoming inquiries from Users, including the subsequent transfer of such inquiries and requests to the Company's counterparties for fulfillment;
3.2.6. To identify Users in accordance with the Law "On Payments and Payment Systems" and other legislative and regulatory legal acts under which the Company is vested with the relevant powers and obligations;
3.2.7. To take measures to counter the legalization of proceeds from criminal activity, the financing of terrorism, and the financing of the proliferation of weapons of mass destruction, including customer due diligence and identification;
3.2.8. Identifying and/or preventing conditions that facilitate actions, using the ATMOS Service, which violate legal requirements and this Policy;
3.2.9. Offering users personalized Company Services;
3.2.10. Conducting statistical and other research based on anonymized data;
3.2.11. Conducting marketing campaigns for clients, including for the purpose of distributing offers to participate in promotions initiated by the Company jointly with its partners, and for clients to receive prizes/rewards stipulated by such promotions;
3.2.12. Distributing advertising and informational materials, including targeting advertising materials and other information brought to the attention of clients;
3.2.13. Improving the quality of the Company's services and their usability, and developing new Company services.
4. Procedure and Conditions for Processing, Storing, and Transferring Personal Data
4.1. ATMOS shall take necessary and sufficient organizational and technical measures to protect User information from unlawful or accidental access, destruction, alteration, blocking, copying, distribution, as well as from other unlawful actions by third parties.
Specifically, ATMOS constantly improves its data collection, storage, and processing methods, including physical security measures, to counter unauthorized access to ATMOS systems for the purpose of theft, phishing, and other types of fraud. ATMOS also restricts employee, contractor, and agent access to User information, stipulating strict contractual confidentiality obligations, the breach of which will result in liability and penalties.
4.2. The ATMOS Company has the right to transfer personal data to third parties in the following cases:
4.2.1. With the User's consent.
4.2.2. The transfer is necessary to provide the User with payment services, ATMOS Services, as well as services from ATMOS partners and contractors.
4.2.3. The transfer of information to ATMOS company partners, including affiliates, as part of joint projects;
4.2.4. The transfer of information to third parties is necessary for the ATMOS company to properly fulfill an agreement or contract with the individual concerned;
4.2.5. the transfer of information to third parties that support ATMOS services, to the extent necessary to provide such technical support;
4.2.6. the transfer is stipulated by the legislation of the Republic of Uzbekistan;
4.2.7. the transfer occurs as part of a sale or other transfer of the business (in whole or in part), in which case all obligations to comply with the terms of this Policy are transferred to the acquirer;
4.2.8. to ensure the ability to protect the rights and legitimate interests of ATMOS or third parties in cases where ATMOS has sufficient grounds to believe that an individual is violating the requirements of applicable law.
4.2.9. The data is obtained from publicly available sources.
4.3. Within the ATMOS.ID service, ATMOS, with the User's consent, transfers the User's selfie and passport data (full name, PINFL, date of birth, photograph, gender; passport series, number, date of issue, and expiration date) to an external system integrated with the ATMOS.ID service for the purposes of identification and provision of services to the User in the external system.
4.4. In this case, third parties undertake to comply with the terms of this Policy.
4.5. Furthermore, if agreements with third parties are in place, a third party has the right to entrust the processing of personal data to ATMOS in the following cases:
4.5.1. the User's consent is provided in written form, including as an electronic document;
4.5.2. if the decision is made in fulfillment of a contract between the third party and the personal data subject or to fulfill the terms of a previously concluded contract;
4.5.3. as provided for by law.
4.6. ATMOS has the right to distribute and/or provide third parties with access to information about an individual without any restrictions after such information has been processed in a way that removes any details that could identify the individual (depersonalization of information), as well as after the statistical processing of this information.
4.7. ATMOS has the right to use information about an individual for the purposes of analyzing its audience's interests and preferences, adapting ATMOS services according to the results of the aforementioned analysis, and for online advertising purposes to the extent necessary to display it to the target audience.
5. Rights and Obligations of the User
5.1. The User has the right:
5.1.1. to know about the existence and composition of their personal data held by ATMOS and any third party;
5.1.2. to receive information from ATMOS about the processing of their personal data upon request;
5.1.3. to receive information from ATMOS about the conditions for providing access to their personal data;
5.1.4. to apply to an authorized state body or a court regarding the protection of their rights and legitimate interests concerning their personal data;
5.1.5. to give consent to the processing of their personal data and to withdraw such consent, except in cases stipulated by the Law "On Personal Data";
5.1.6. to give consent to ATMOS, as well as to a third party, for the dissemination of their personal data in publicly available sources;
5.1.7. to demand from ATMOS the temporary suspension of the processing of their personal data if the data is incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purposes of processing;
5.1.8. to independently manage personal data received from ATMOS, including the transfer of such data to third parties.
5.2. The User's right to access data processed by ATMOS is exercised by submitting a request to ATMOS. When identifying the User, if there are doubts about the User's identity, ATMOS has the right to request additional information from the User necessary for authentic identification.
User data that has been made publicly available by the User or obtained from a publicly available source is not subject to provision to the User upon their request.
The User's request shall be reviewed within 30 calendar days, and this period may be extended depending on the complexity of its processing.
5.3. The personal data of a data subject who is recognized as legally incapacitated or having limited legal capacity shall be managed by their legal representative.
5.4. The data subject has an obligation to provide their personal data for the purposes of protecting the foundations of the constitutional order of the Republic of Uzbekistan, morality, health, and the rights and legitimate interests of citizens of the Republic of Uzbekistan, as well as ensuring the defense and security of the state.
6. Data Modification and Deletion
6.1 If ATMOS has doubts regarding the User's identity during the identification process, it has the right to request additional information from the User required for authentic identification.
In this case, the User's access to ATMOS Services may be restricted due to the inability to identify the User.
6.2. Upon fulfillment of the User's request to delete personal data, ATMOS will fully and irrevocably anonymize the User's personal data.
6.3. In the event of a request to delete personal data, the following rules apply:
6.3.1. ATMOS has the right to retain a portion of your personal data as part of its legitimate business interests, including to combat fraud and enhance security.
6.3.2. ATMOS has the right to store and use your personal data to the extent necessary to comply with legal requirements;
6.3.3. information that you have shared with others (e.g., reviews, forum posts) may remain publicly available even after your data is deleted, but your authorship attribution will be removed. Some copies of your information may be retained in our database without any means of personal identification;
6.3.4. due to the implementation of a system to protect against accidental or malicious data corruption or loss, backup copies of your personal data will be deleted after a certain delay.
7. Other Provisions
7.1. ATMOS reserves the right to propose changes and/or additions to this Policy by publishing a new version of the Agreement. The User's use of any ATMOS Service under the new terms constitutes acceptance of such a proposal by conclusive action.