Privacy policy

01

Who processes your data

This policy explains how ASMO GROUP processes the personal data of visitors to the IT boʻlim website and of people who try the demo conversation with Aziz.

Operator

ASMO GOLD OSIYO LLC, TIN 309894170, registered address: 42-a Galaba Street, Galaba MFY, Yangiyul District, Tashkent Region, Republic of Uzbekistan (“ASMO GROUP”, “we”) is the owner and operator of the personal data database. IT boʻlim is a division within the company.

Scope

the it.asmo.uz website, the request and brief forms, the demo conversation with Aziz, and website visit statistics

Law

the Law of the Republic of Uzbekistan “On Personal Data” No. ZRU-547 of 2 July 2019, as amended (the “Law”)

Terms are used as in the Law (Article 4): personal data is information that relates to a specific person or makes it possible to identify them; processing means actions with it — collection, systematization, storage, modification, use, transfer, anonymization, destruction.

02

What data we receive

Only what we need: data you type or say yourself, and technical data without which the website and the demo don’t work.

Request and brief

phone number; name and company name (if you give them); the service and plan you choose; a convenient time to call; comment; brief answers; website language; the page the request was sent from; advertising campaign tags (UTM) if you came via an advertising link; a short summary of the demo conversation if the request is sent after the demo

Demo conversation with Aziz

your voice (recognized on the fly, not stored and not used to identify you), the transcript, its short summary, the duration, the language and the cost in ElevenLabs units — only with your consent (section 12)

Demo limit and protection

a random device identifier (created in your browser after consent) and your IP address — to count the 2-minute daily limit and protect the demo from bots. On the server both are stored only as an irreversible hash with a salt that changes every month

Visit statistics

which pages were opened, where you came from, UTM tags, browser language, screen size, browser, operating system and device type, country, region and city by IP address, and site events: request sent, demo started or finished, language or display mode changed, a tap on the phone, Telegram or email. The IP address is not stored — only a session hash with a monthly salt; there are no names, phone numbers or request texts in the statistics

Technical data

IP address, page address, browser type and request time — in the web server log; the request service stores the IP address only as a hash

Website settings

language, display mode, the dismissed language hint, checklist marks in the article, the selected service, UTM tags and the demo session number — stored in your browser; of these only the UTM tags and the demo session number go to the server, and only together with a request (section 10)

We don’t ask for special categories of data, such as health, beliefs or criminal record. Please don’t share them in a request or in the conversation with Aziz.

03

Why we need it

• To call you back, answer your questions and prepare an offer for your request.
• To run the demo conversation: Aziz hears your question and answers by voice.
• To check the quality of the demo — using the short summary and the transcript while ElevenLabs keeps it.
• To count the demo limit and protect the website from bots and abuse.
• To keep the website running and secure, find errors and keep anonymized statistics — which pages are read and from which devices, so we can improve the site.
• To prove that you gave consent: we keep the version of the consent text, the time, the language and the page.
• If you become our client — to perform the contract.

We don’t sell data, share it for advertising or use it for other purposes. If the purpose changes, we will ask for your consent first (Article 19 of the Law).

04

Legal grounds and consent

We process data on the grounds set out in Article 18 of the Law:

Your consent

request — when you tick “I agree to a call from a manager and to the processing of my personal data under the Privacy Policy, including transfer abroad” next to the send button (without the tick the request is not sent); demo — when you press “I agree, start” in the window before the conversation

Your request

steps at your request before a contract is signed: calling you back and preparing an offer

Contract

if you become our client — to perform it

Legitimate interest

server logs, bot protection and anonymized statistics — to keep the website running and secure without infringing your rights

You can withdraw consent at any time — in the same form in which you gave it, or in writing, for example by email to info@asmo.uz (Article 21 of the Law). Withdrawal does not affect processing carried out before it.

05

Where data is stored and who receives it

Data goes only to those without whom the service can’t work, and only as much as they need:

Company server (France) and the primary copy in Uzbekistan

requests and the consent log, address and device hashes, short summaries and records of demo conversations, limit counters, visit statistics, server logs

Our call center gateway and Telegram

the request card (name, company, phone, service, plan, call time, comment, brief, demo summary, page) is written to our call center request database on the same server and arrives as a message from our Telegram bot in the managers’ chat; Telegram’s servers are outside Uzbekistan, and the transfer is based on your consent

ElevenLabs (USA)

in the demo, turns your voice into text and Aziz’s answer into speech. It does not record or store audio; it keeps the transcript and its short summary for 30 days. ElevenLabs is a participant in the EU-US Data Privacy Framework

AI model provider (USA)

Google, the Gemini model — via ElevenLabs: prepares Aziz’s answer from the transcript; the text is processed under the provider’s terms

Government bodies

only where the law requires it

Each recipient gets data only for its own task. We pass data to third parties, or entrust its processing to them, only with your consent, to perform a contract with you or where the law provides for it (Articles 28 and 31 of the Law).

06

Transfers outside Uzbekistan

The primary copy of the data is kept in Uzbekistan; the company’s working server is hosted in France, ElevenLabs and the AI model provider are in the USA, and Telegram’s servers are outside Uzbekistan. So your data is transferred abroad — this is cross-border transfer (Article 15 of the Law). France is on the list of countries with adequate protection approved by the Cabinet of Ministers; the USA — for participants in the EU-US Data Privacy Framework, which include ElevenLabs.

Each recipient gets only what it needs: ElevenLabs — your voice during the conversation (without storing it) and the demo transcript; the AI model provider — the text only; Telegram — the request card. The basis is your consent: in the demo you give it with the button before the conversation, for a request — with the tick next to the send button. Without consent, the demo won’t start.

The Law requires the personal data of citizens of Uzbekistan to be stored in the country (Article 27¹): the primary copy of the website data is kept in Uzbekistan, and processing takes place on a server in Europe on the conditions set by the Law.

07

How long we keep data

We keep data until the purpose for which it was collected is achieved (Article 10 of the Law). Retention periods by type:

Requests and briefs

while we discuss the work; if no contract is signed, we delete them 12 months after the last contact; if one is signed, we keep them while it is in force and as long as the law requires. Copies in the call center database and in Telegram follow the same period: we delete the message from the chat, and Telegram keeps it under its own rules

Consent log

text version, time, language, page, address hash — 3 years

Demo conversation

the transcript at ElevenLabs — 30 days, then deleted automatically; on the company server the short summary is kept for 3 months (if you left a request after the demo — together with it), the duration, language and cost — 12 months; audio is stored nowhere. If you withdraw consent, we delete it earlier

Limit counters and bot protection

device and address hashes for the demo are counted per day and stop matching when the monthly salt changes; the request counter per address — 24 hours; used bot-check solutions — until the challenge expires (30 minutes)

Visit statistics

14 months, then deleted

Server logs

rotated by size, no longer than 90 days

Website settings

in your browser until you delete them (some — until you close the tab)

When the period expires, the purpose is achieved, consent is withdrawn or a court decision takes effect, the data is destroyed beyond recovery (Article 17 of the Law).

08

Your rights

Under the Law (Article 30, unless another article is given), you have the right to:

• know whether we hold your data and what it is;
• get information about processing: on what grounds and why, by what methods, who has access, where the data came from, how long it is kept and whether it is transferred abroad (Article 22);
• have inaccurate or incomplete data corrected or completed — within three days of your request (Article 11);
• demand a temporary suspension of processing if the data is incomplete, outdated, inaccurate, unlawfully obtained or not needed for the purpose;
• withdraw consent — we will then destroy the data processed on that basis (Article 17);
• apply to the authorized state body for personal data or to a court to protect your rights.

Send your request via the contacts in section 13. To avoid disclosing data to a stranger, we may ask you to confirm that the number or email is yours. If we refuse to provide information, we will tell you in writing within ten days (Article 22).

Aziz is a voice assistant: he answers questions and takes requests, but makes no decisions that have legal consequences for you (Article 24).

09

Security and data breaches

We take legal, organizational and technical measures so that data isn’t lost, altered or accessed by outsiders (Articles 27 and 31 of the Law):

• only employees who need it for their work have access to requests and demo summaries;
• employees must not disclose personal data they learn at work;
• data is transferred over a secure connection (HTTPS);
• the IP address and device identifier are stored only as hashes; the bot check runs on our server without third-party services; server access is by key only, and keys and passwords are kept in closed files; the demo agent accepts a conversation only with a one-time token from our server.

If a data breach or other personal data incident occurs, we will act without delay to stop it and limit the consequences, tell the people affected what happened and what they should do, and notify the authorized body within the time limits set by law.

10

Cookies and browser storage

The website uses no advertising or tracking cookies. Visit statistics are kept by our own counter (Umami) on our server — without cookies, without sharing with third parties, and without storing the IP address.

Settings and conveniences

language, display mode, the dismissed language hint, checklist marks in the article, the service selected for the form, the transition between pages — stored in the browser (localStorage / sessionStorage) and not sent to us; to delete them, clear the site data in your browser

Advertising campaign tags and the demo session number

kept until you close the tab and sent to the server only together with your request

Device identifier for the demo

a random number that the browser creates after your consent and sends to the server when the demo starts — to count the 2-minute daily limit; the server keeps only its hash. To delete it, clear the site data in your browser

If we add advertising pixels or third-party counters, we will update this section and ask for consent where required.

11

Children

The website and the demo are intended for adults and companies. If you are under 18, please don’t leave a request or start the demo: under the Law, consent for minors is given in writing by their parents or guardians (Article 21). If we learn that we have received a child’s data without such consent, we will delete it.