Privacy Policy on the Processing and Protection of Personal Data of the Trendly Platform

Personal data operator

OOO "USER GENERATED CONTENT"

Platform

https://trendly.uz/

Contact e-mail

[email protected]

Address for inquiries

Posira MFY, Boghishamol Street, building 260-a

This Privacy Policy defines the procedure for processing and protecting the personal data of Users of the Trendly Platform, as well as the rights of Users and the obligations of the Operator when processing personal data. The document has been prepared with regard to the legislation of the Republic of Uzbekistan on personal data and, where applicable, the requirements of the EU General Data Protection Regulation (GDPR).

1. General provisions

1.1 This Privacy Policy on the processing and protection of personal data (the “Policy”) applies to the personal data of Users of the Trendly Platform. For the purposes of this Policy, a User means any natural person whose personal data is processed in connection with visiting, registering on, or using the Platform, including Influencers, Brand representatives, Agency representatives, site visitors, applicants and persons contacting support. Other terms are used as defined in the Trendly Offer, unless this Policy expressly provides otherwise.

1.2 For the purposes of this Policy, User roles are defined in accordance with the Trendly Offer and other Platform documents. Unless this Policy expressly provides otherwise, Brand, Influencer, Agency, Partner, Processor and Recipient of personal data are the persons and roles defined in the corresponding Trendly Platform documents. In the event of conflicting terms, this Policy applies to personal data processing, and the Trendly Offer applies to Platform usage terms and contractual relations.

1.3 Before completing registration on the Platform, the User is given the opportunity to review this Policy, and the User confirms such review and gives consent to the processing of personal data by performing an active confirming action in the Platform interface. By accepting this Policy, the User consents to the processing of personal data defined by this Policy and qualifying as personal data under the legislation of the Republic of Uzbekistan, for the purposes, in the manner and on the terms set out in this Policy. Without such consent, registration and use of functionality that requires processing of personal data are not possible. If separate consent is required for specific operations, such consent is requested separately before the relevant processing begins.

1.4 This Policy applies together with the Trendly Offer, Cookie Policy and any separate consents of the User, where such documents or consents govern personal data processing on the Platform. In the event of any conflict between this Policy and other Platform documents on personal data processing matters, the provisions of this Policy and the requirements of applicable law shall apply.

1.5 The Operator organises the processing, storage and transfer of personal data in accordance with the legislation of the Republic of Uzbekistan on personal data. Where requirements for storage in the territory of the Republic of Uzbekistan, registration of personal data databases and/or special rules on cross-border transfer apply to particular categories of personal data, databases or processing operations, the Operator takes measures to comply with such requirements. Where the GDPR or other foreign data protection legislation applies to the processing, the Operator takes measures to comply with such requirements to the applicable extent.

2. Terms and definitions

2.1 The following terms are used for the purposes of this Policy:

• Personal data any information recorded on electronic, paper and/or other tangible media that relates to an identified natural person or makes it possible to identify them directly or indirectly.
• Data subject a natural person to whom personal data relates. Within the Platform, such a subject may be a User, an Influencer, a Brand representative, an Agency representative, a site visitor, an applicant, a person contacting support, or any other natural person whose personal data is processed by the Operator.
• User any natural person who visits the Platform, registers on it, signs in, uses the Platform functionality, acts on behalf of a Brand or Agency, posts or accepts Campaign terms, uploads materials, receives payments, submits inquiries or otherwise interacts with the Platform.
• Operator the legal entity that, independently or together with engaged persons, organises and/or carries out personal data processing and defines the purposes, composition and methods of such processing.
• Owner of a personal data database the person who owns a personal data database and determines the order of possession, use and disposal of such a database within the limits set by law.
• Personal data database an information system or structured array of personal data in which personal data is stored and processed with or without the use of technical means.
• Processing of personal data any action or set of actions performed on personal data, including collection, recording, systematisation, storage, modification, supplementation, use, provision, transfer, dissemination, anonymisation, blocking and destruction.
• Collection of personal data the Operator obtaining personal data directly from the User, through the User’s actions on the Platform, through Platform interfaces, from partners and/or third parties on a lawful basis, and from other sources where permitted by applicable law.
• Use of personal data actions with personal data aimed at achieving previously stated processing purposes, including User registration, providing access to the Platform, supporting Campaigns, processing payments, moderation, analytics, support, resolving disputes, ensuring security and complying with legal requirements.
• Consent of the data subject a free, specific, informed and unambiguous expression of the data subject’s will to process their personal data, made by an active confirming action, including ticking a separate, non-pre-filled checkbox in the interface, signing an electronic document, confirming via OTP/code or any other action that allows the fact, content, date and version of the consent to be evidenced.
• Third party any person who is not the data subject, the Operator or a person acting on behalf of the Operator, to whom personal data may be transferred on a lawful basis and within the stated processing purposes.
• Processor / engaged person a person who processes personal data on behalf of the Operator and within the purposes and instructions defined by the Operator.
• Recipients of personal data persons or categories of persons to whom the Operator may transfer personal data within the stated processing purposes, including payment providers, banks, SMS and e-mail operators, cloud and server infrastructure providers, CRM/helpdesk systems, analytics services, moderation contractors, technical contractors, accounting and legal consultants, and government authorities in cases provided by law.
• Cross-border transfer of personal data the transfer of personal data outside the Republic of Uzbekistan to a foreign state, a foreign natural or legal person, or an international organisation in the cases and manner provided by applicable law.
• Anonymisation of personal data actions as a result of which it becomes impossible to attribute personal data to a specific subject without the use of additional information.
• Blocking of personal data temporary suspension of personal data processing where required to verify their accuracy, the lawfulness of the processing, to consider a data subject’s request or to comply with legal requirements.
• Destruction of personal data actions as a result of which personal data becomes irrecoverable and can no longer be used to identify the data subject.
• Personal data security incident a security breach that has led or may lead to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
• Platform the Trendly digital platform, including the website, mobile application, personal cabinets, interfaces, databases, integrations, forms, services, technical solutions and other digital tools used for interaction between Brands, Influencers, Agencies and other Users.
• Campaign an offer, task, project or other form of interaction between a Brand, Influencer and/or Agency posted via the Platform, containing cooperation terms, content requirements, deadlines, remuneration, the procedure for confirming completion and any other terms required to perform the relevant interaction.
• Partners persons and organisations, including banks, payment institutions, cloud and communication services, analytics services, advertising accounts, government authorities and authorised organisations, with which the Operator has contractual relations or interacts on another lawful basis, and whose services, systems or functions are used to operate the Platform. Depending on the nature of the services and processing purposes, Partners may act as independent controllers/operators, joint controllers/operators, processors, recipients of personal data or third parties, and carry out processing in accordance with applicable law, their own policies where applicable, and/or agreements with the Operator.

2.2 The main terms used in this Policy are defined in section 2 of this Policy, the Trendly Offer, the User Agreement and/or other Platform documents. Terms not expressly defined in those documents are used in their generally accepted meaning, and where such terms have a specific legal meaning, in the meaning established by applicable law.

3. Composition of personal data

3.1 Depending on the User’s role, the functionality used and the nature of the interaction with the Platform, the Operator may process the following categories of personal data:

• 3.1.1 identification data: surname, first name, patronymic, date of birth, gender, citizenship, language of communication, profile photo, image and other information voluntarily provided in the account;
• 3.1.2 contact data: phone number, e-mail address, mailing address, logins, account identifiers, information on means of communication and notification channels;
• 3.1.3 company, Brand or Agency data: name, representative’s position, TIN, banking and registration details, information about the representative, information for concluding and performing contracts;
• 3.1.4 data required for posting, reviewing, accepting, performing and completing Campaigns, including Campaign terms, applications, materials, posting confirmations, statuses, reports and information for calculating remuneration;
• 3.1.5 document data and information required for identification, integrity checks, compliance with legal requirements, KYC/AML procedures, tax accounting and bookkeeping, where such processing is necessary;
• 3.1.6 data obtained via social networks, advertising accounts, API integrations, payment, identification, analytics and other partner services connected by the User/Operator, including account identifiers, public and authorised profile information, statistics, metrics, reports, statuses, connection information and other data to which access has been granted by the User or obtained by the Operator on another lawful basis;
• 3.1.7 technical and device data: IP address, cookies, user agent, browser information, operating system, time zone, interface language, log files, network parameters, device identifiers, dates and times of actions on the Platform;
• 3.1.8 data on User actions on the Platform: registration, sign-in, page views, transitions, clicks, file uploads, applications, Campaign statuses, messaging, support inquiries, reviews, complaints, moderation results, history of operations and payments;
• 3.1.9 other information voluntarily provided by the User to the Operator within specific Platform functionality and required for the previously stated processing purposes.

3.2 The Operator does not seek to collect excessive personal data and proceeds from the principle of processing sufficiency. If certain information is not required for a specific purpose, the Operator may refrain from requesting it or delete it once it is no longer needed.

3.3 The User is obliged to provide accurate, up-to-date and lawfully obtained information. If the User provides the Operator with personal data of third parties, the User confirms that there is a lawful basis for such transfer, including the consent of the relevant person where such consent is required by law. The User is responsible for the consequences of providing inaccurate, outdated, unlawfully obtained data or data that infringes the rights of third parties.

4. Purposes of personal data processing

4.1 The Operator processes personal data for predefined, lawful and fair purposes, including:

• 4.1.1 creation, confirmation and maintenance of the User’s account, providing access to the Platform and its functionality;
• 4.1.2 enabling the posting, review, acceptance, performance and completion of Campaigns, including the publication of Campaign terms by the Brand, the response or acceptance of a Campaign by the Influencer, the exchange of materials, confirmation of task completion, calculation of remuneration, dispute resolution, reporting and performance of the terms agreed by the parties through the Platform’s functionality;
• 4.1.3 conclusion, performance, amendment and termination of contracts (campaigns), processing orders, applications, payments, refunds, disputes, claims and inquiries;
• 4.1.4 carrying out checks, moderation, prevention of fraud, abuse, circumvention of rules, duplicates, fake activity, unfair conduct and infringement of third-party rights;
• 4.1.5 keeping accounting, tax, management and other mandatory records, complying with legal requirements and lawful requests of authorised bodies;
• 4.1.6 sending service messages, account activity notifications, confirmation codes, security alerts, Campaign status updates, settlement notices and other significant action notifications;
• 4.1.7 improving the quality of the Platform, testing, analytics, audit, developing new features, statistical research, anonymised reporting and marketing improvements;
• 4.1.8 ensuring information security, backups, recovery, incident investigation and the protection of the rights and lawful interests of the Operator, Users and Partners;
• 4.1.9 sending news, offers, marketing and advertising materials where separate consent or another appropriate legal basis exists, taking into account the User’s right to opt out of such communications.

4.2 The Operator does not process personal data for purposes incompatible with those for which they were originally collected, unless expressly permitted by law, this Policy or a separate consent of the data subject.

4.3 If the Operator intends to process personal data for a new purpose incompatible with the previously stated purposes, the Operator will obtain separate consent from the User before such processing begins, unless otherwise permitted by applicable law.

5. Legal bases for processing

5.1 The Operator processes personal data on one or more of the following bases:

• 5.1.1 the User’s consent;
• 5.1.2 the necessity to conclude and perform a contract, Offer, Campaign terms or other agreement to which the User is a party or representative;
• 5.1.3 the necessity to fulfil the Operator’s obligations imposed by the legislation of the Republic of Uzbekistan or other applicable law;
• 5.1.4 the necessity to protect the rights and lawful interests of the Operator, Users, Partners and third parties, provided this does not infringe the rights and freedoms of the data subject;
• 5.1.5 the necessity to review inquiries, claims, complaints and disputes, prevent fraud and ensure the security and protection of the Platform;
• 5.1.6 other grounds expressly provided by applicable law.

5.2 Where processing requires User consent, such consent is given through an active confirming action by the User: ticking a separate, non-pre-filled checkbox in the interface, clicking a confirmation button accompanied by clear consent text, signing an electronic document, confirming via OTP/code, or in any other manner that allows the fact, content, date and version of the consent to be evidenced.

5.3 Silence, inactivity, pre-ticked boxes and the mere continued use of the Platform do not constitute consent where applicable law requires separate consent.

5.4 The User has the right to withdraw consent in the manner specified in this Policy or in the Platform interface. Withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal and does not stop processing if it is necessary for the Operator on another lawful basis, including performance of a contract, compliance with the law, accounting and tax records, protection of rights or dispute resolution.

5.5 Marketing communications, non-essential cookies/analytics, publication of certain profile data, receipt of data from certain Partners and other operations that require separate consent are carried out only where such consent has been given, unless otherwise permitted by applicable law.

6. Procedure for processing personal data

6.1 Personal data is processed by the Operator automatically using the Platform and its information systems, as well as manually by the Operator’s employees and/or engaged persons where this is necessary to provide support, moderation, handle inquiries and disputes, make payments, keep records, ensure Platform security or comply with legal requirements.

6.2 The Operator obtains personal data:

• 6.2.1 directly from the User when registering, completing the profile, responding to a Campaign, uploading materials, undergoing checks or contacting support;
• 6.2.2 from the User’s actions on the Platform;
• 6.2.3 from Brands, Agencies and other Users where they have a lawful basis for transferring such data;
• 6.2.4 from payment, communication, analytics, identification services, social networks, advertising accounts, API integrations and other Partners, where such transfer is required for the Platform’s operation, takes place with the User’s consent or on another lawful basis and complies with applicable law;
• 6.2.5 from publicly available sources, where permitted by law and connected to the previously stated processing purposes.

6.3 Within the purposes specified in this Policy, the Operator may perform actions necessary for processing personal data, including collection, recording, systematisation, storage, clarification, updating, use, transfer, provision, matching, anonymisation, blocking, deletion and destruction of the data.

6.4 The Operator takes reasonable measures to maintain the accuracy of personal data and may request confirmation or update of information where necessary to perform obligations, ensure security or comply with the law.

7. Cookies, analytics and similar technologies

7.1 The Platform may use cookies, SDKs, pixels, tags, browser local storage, event logs and other similar technologies to ensure the service’s operability, authorisation, settings retention, account protection, analytics, statistics, interface improvement and, where there is a legal basis, advertising communication.

7.2 Cookies and similar technologies that are necessary for the Platform’s operation may be used without separate consent, where permitted by applicable law. Non-essential analytical, advertising and marketing cookies are used where the User has consented, where such consent is required by law.

7.3 The User may change browser or device settings, restrict the storage of cookies or delete them. However, such actions may affect the availability of certain Platform functions or its correct operation.

7.4 If the Platform interface provides a separate mechanism for managing cookies or similar technologies, the User’s decisions made through such mechanism apply to the extent and for the term provided by the corresponding interface or the Cookie Policy.

8. Transfer of personal data to third parties

8.1 The Operator transfers personal data, or entrusts its processing, to third parties only where this is necessary to achieve the stated processing purposes, perform a contract or Campaign terms, provide Platform functionality, process payments, communicate with the User, host content, store data, conduct analytics, provide technical support, ensure security, resolve disputes, recover debts or comply with legal requirements.

8.2 Such persons may include banks and payment providers, SMS and e-mail operators, cloud and server infrastructure providers, CRM and helpdesk systems, web analytics services, anti-fraud solutions, moderation and technical support contractors, accounting and legal consultants, integration partners, advertising accounts, as well as other contractors of the Operator to whom transfer is necessary for a lawful processing purpose.

8.3 The Operator transfers personal data to government authorities, courts, law enforcement, tax, supervisory and other authorised bodies only in the cases, manner and to the extent provided by law. Unless prohibited by law, a judicial act or the requirement of an authorised body, the Operator may notify the User of receipt of such a request.

8.4 The transfer of personal data pursuant to a lawful request of an authorised body is not a personal data security incident if such transfer is carried out in the manner and to the extent provided by law.

8.5 The Operator requires engaged persons to maintain confidentiality, apply appropriate protective measures and use personal data only within the scope of the assignment received or their own lawful basis.

8.6 The list of main categories of recipients of personal data, transfer purposes and categories of transferred data is set out in Appendix 1 to this Policy. The Operator may publish on the Platform a separate up-to-date list of the main suppliers, processors and other recipients of personal data, including their name, role in personal data processing, categories of transferred data, transfer purposes and, where necessary, the country in which such recipient is located. Such list may be updated by the Operator as the composition of suppliers, processors, integration partners and other recipients of personal data changes.

9. Cross-border transfer and localisation of data

9.1 Where cross-border transfer of personal data is required for the Platform’s operation, storage of backups, analytics, communications, cloud infrastructure or other lawful purposes, such transfer is carried out in compliance with the legislation of the Republic of Uzbekistan and, where applicable, the GDPR.

9.2 The Operator ensures storage and processing of personal data in accordance with the requirements of the legislation of the Republic of Uzbekistan, including localisation requirements for particular categories of personal data, where such requirements apply to the relevant data and processing operations.

9.3 Personal data not subject to mandatory storage in the territory of the Republic of Uzbekistan may be processed outside its territory subject to the conditions and protective measures provided by law.

9.4 By using the Platform and providing the relevant consent where required, the User understands that certain technology providers, communication services and other contractors of the Operator may be located outside the Republic of Uzbekistan, provided that such organisation of processing does not contradict applicable law.

9.5 Where the GDPR applies to the processing and personal data is transferred outside the European Economic Area, the Operator takes the applicable measures to ensure the lawfulness of such transfer, including the use of contractual, organisational and technical safeguards to the extent required by the GDPR.

10. Retention periods for personal data

10.1 Personal data is retained no longer than required by the processing purposes, the terms of the contract, the term of consent, mandatory document and information retention periods, and the need to protect the rights and lawful interests of the Operator and other persons.

10.2 Upon achieving the processing purposes, expiry of the retention period, withdrawal of consent or where other legal grounds cease to apply, personal data is subject to destruction, anonymisation or blocking, unless longer retention is required by law or for dispute resolution, performance of an obligation, accounting, tax or other mandatory records.

10.3 The Operator may retain anonymised data without any time limit if such data no longer makes it possible to identify the data subject directly or indirectly.

10.4 Indicative criteria for retention periods by data category are set out in Appendix 1. Specific periods may differ depending on applicable law, the nature of the contract, the Campaign status, the existence of a dispute, claim, audit or mandatory record-keeping.

11. Rights of the data subject

11.1 The data subject has the right to:

• 11.1.1 receive information about the processing of their personal data to the extent provided by law;
• 11.1.2 request clarification, supplementation, correction, blocking or destruction of their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained or not required for the stated processing purpose;
• 11.1.3 withdraw previously given consent for the processing of personal data in a form permitted by law;
• 11.1.4 object to processing in the cases provided by law;
• 11.1.5 request the cessation or restriction of processing, where such right is provided by applicable law;
• 11.1.6 obtain a copy of their personal data or request data portability, where such right applies under the GDPR or other applicable law;
• 11.1.7 appeal the Operator’s actions or omissions to the authorised state body or to a court;
• 11.1.8 exercise other rights provided by the legislation of the Republic of Uzbekistan, the GDPR or other applicable law.

11.2 To exercise their rights, the data subject may submit a request to the Operator using the contact details specified in this Policy. The Operator may request information necessary to identify the applicant and verify their authority.

11.3 The Operator considers requests from data subjects within the timeframes set by applicable law and takes measures based on the outcome of the request within the limits of its obligations and technical capabilities.

12. Obligations of the User

12.1 The User is obliged to provide accurate and up-to-date personal data, update it promptly upon changes, comply with legal requirements and not post information about third parties on the Platform without sufficient legal basis.

12.2 The User is responsible for the security of their credentials, devices, passwords, confirmation codes and other means of accessing the Platform. If unauthorised access is suspected, the User must immediately notify the Operator.

12.3 The User must not use the Platform for the unlawful collection, publication, dissemination or transfer of personal data of third parties.

13. Measures to protect personal data

13.1 The Operator takes the necessary legal, organisational and technical measures to protect personal data from accidental or unlawful access, destruction, alteration, blocking, copying, dissemination, provision, loss and other unauthorised actions.

13.2 Such measures may include access control, user and administrator action logging, internal regulations, contractual confidentiality obligations, backups, antivirus protection, incident detection tools, encryption where technically feasible, log audits, staff training and other security measures commensurate with the nature of the data processed and the risks involved.

13.3 The Operator takes the necessary organisational and technical measures to protect personal data within the Platform, its information systems and processing operations under the Operator’s control. The Operator is not responsible for actions, omissions, failures, security incidents or other circumstances arising outside the Operator’s area of control, including the operation of communication networks, the User’s devices, third-party sites, applications, payment, communication, analytics, social, advertising and other external services.

13.4 If a personal data security incident is detected, the Operator takes measures to contain it, assess the consequences, eliminate the causes and, where required by applicable law, notify data subjects and/or authorised bodies.

14. Processing of minors’ data

14.1 If the Platform functionality may be used by minors, the processing of their personal data is carried out taking into account legal requirements and, where required, with the consent of parents, adopters, guardians or other legal representatives.

14.2 The Operator may request confirmation of age, legal representative status or relevant consent where this is necessary for the lawfulness of the processing.

14.3 If the Operator becomes aware that a minor’s personal data is being processed without the necessary consent of a legal representative, the Operator may restrict access to the relevant functionality, request confirmation of consent or delete the relevant data if its further processing has no lawful basis.

15. Links to third-party resources

15.1 The Platform may contain links to websites, applications, payment pages, social networks, messengers and other third-party resources. The Operator does not control such resources and is not responsible for their content, security or personal data processing policies.

15.2 The User is obliged to review the privacy policy of the relevant third-party resource before using it.

16. User inquiries and communication procedure

16.1 On matters relating to personal data processing, the User may contact the Operator using the details set out in the “Operator details” section at the end of this Policy.

16.2 The request must contain information sufficient to identify the applicant, a description of the subject of the request and contact details for sending a reply. The Operator may refuse to disclose information to a person whose identity or authority has not been sufficiently confirmed.

17. Amendments to the Policy

17.1 The Operator may make changes and additions to this Policy at any time, including when there are changes in law, business processes, the composition of services, data processing methods or the structure of the Platform.

17.2 A new version of the Policy takes effect upon its publication on the Platform, unless a different date is expressly stated in the new version. If the changes affect processing that requires separate consent of the User, the Operator will request such consent before the relevant processing begins.

17.3 The current version of the Policy is permanently available on the Platform at: https://trendly.uz/privacy-policy.

Appendix 1. Personal data processing map

This map describes the main categories of personal data, processing purposes, legal bases, indicative retention periods and categories of recipients. The specific set of data and retention periods depend on the User’s role, Platform functionality, Campaign terms, legal requirements and the Operator’s actual processes.