Privacy policy

1. General terms and legal framework

2. Controller and allocation of roles

3. Sources and categories of data subjects

• the data subject directly, through a form, call, email, CV, contract, or solution settings;

• the subject’s employer, client, or business partner where it lawfully provides its representative’s business contact details;

• amoCRM and other client systems to which the client grants a SENZIB solution access;

• the browser, device, and security infrastructure when the website is requested;

• public professional sources where the subject has published information for business interaction.

4. Data collected through the website

• main request: name, phone, company, service, comment, website language, page, or product;

• partnership request: name, company, position, phone, email, website, partnership type, and comment;

• job application: name, phone, email, selected role, HH URL, portfolio URL, CV, and comment;

• communications: messages, dates, channel, agreed next steps, and review outcome;

• attribution: UTM parameters, page address, referring source, and referrer;

• technical data: IP address, request time, browser and device type, language, security signals, and automated-request verification result.

5. Data processed by SENZIB solutions and widgets

• account, installation, user, lead, contact, company, pipeline, and status IDs; account domain or subdomain; timezone and employee access settings;

• OAuth tokens, API keys, and integration credentials. Where stored by SENZIB infrastructure, sensitive credentials are encrypted and access-restricted;

• Property Sales Toolkit: real estate projects and units, property parameters, calculation settings, linked leads, and required Profitbase data;

• Profitbase Export: support contact details, Profitbase and Google connection details, spreadsheet and sheet identifiers, schedule, timezone, and export status;

• Meta Conversions: account, lead, and data-source IDs; client-selected contact, company, and lead fields; conversion event, value, and currency. Identity values such as phone and email are normalised and hashed before transfer where required by the Meta Conversions API protocol;

• service logs, operation dates, error codes, connected API responses, and diagnostic data without intentional collection of unrelated content.

6. Purposes of processing

• responding to requests and arranging a consultation, demonstration, or trial;

• preparing an audit, automation roadmap, specification, proposal, invoice, or contract;

• implementing, configuring, supporting, and improving CRM, accounting, telephony, integrations, and custom software;

• selling, activating, renewing, and supporting licences, subscriptions, and widgets;

• reviewing partnership proposals and job applications;

• authenticating integrations, executing user commands, synchronising and exporting data;

• sending client-configured events to Meta Conversions API and performing other selected solution functions;

• preventing abuse, securing systems, diagnosing faults, and monitoring quality;

• meeting accounting, tax, legal, and rights-protection obligations.

7. Legal bases

• the subject’s consent, captured by a form checkbox, written statement, or another verifiable method;

• the subject’s request and steps necessary before entering a contract;

• performance of a contract with the subject, client, partner, or subject’s employer;

• compliance with a legal obligation;

• legitimate rights and interests of the controller or third parties where the subject’s rights are not infringed;

• another basis permitted by the laws of the Republic of Uzbekistan.

8. Processing operations and methods

• collection, receipt, recording, organisation, accumulation, and storage;

• verification, correction, updating, modification, and matching;

• use, retrieval, and access by authorised employees and contractors;

• transfer between agreed systems, anonymisation, and hashing;

• access restriction, blocking, archiving, and deletion.

9. Recipients and service providers

• authorised SENZIB sales, analysis, implementation, support, development, and recruitment personnel;

• amoCRM for website requests and client communications;

• hosting, database, backup, monitoring, and security providers;

• Cloudflare Turnstile where form protection is enabled;

• Profitbase, Google, and Meta only when the client enables the relevant integration;

• software vendors and authorised distributors for licence activation and support;

• banks, payment, and accounting providers for settlement and mandatory records;

• public authorities or other persons where disclosure is required by law or a valid request.

10. Cross-border transfers

11. Retention and deletion

• form data is sent to amoCRM immediately. After confirmed delivery, the website database does not retain names, phone numbers, email addresses, comments, or CV content;

• the technical website log—language, page, product, UTM, source, status, and amoCRM technical IDs—is retained for no more than 30 days;

• requests and business communications in amoCRM are retained until the purpose, contractual relationship, and applicable claim periods end, then deleted or anonymised unless law requires further retention;

• unsuccessful candidate CVs are retained for up to 12 months unless the candidate requests earlier deletion or another lawful basis applies;

• contract, payment, accounting, and tax records are retained for statutory periods;

• widget data is retained while the connection is active and for the technically and legally required period after termination; a contract or product documentation may specify exact periods;

• backups are deleted through rotation and are access-restricted until deletion.

12. Security and incident response

• role-based access and least-privilege permissions;

• secure transport, secrets management, encryption of sensitive tokens, and backups;

• administrative and integration logs, fault monitoring, and request rate limits;

• component updates, vulnerability review, confidentiality procedures, and staff awareness;

• incident investigation, containment, and notices where required by law.

13. Data subject rights

• obtain information about the existence, scope, source, purpose, method, and period of processing;

• access personal data and information about recipients;

• request correction of inaccurate, incomplete, or outdated information;

• withdraw consent where consent is the basis;

• request suspension, blocking, or deletion where provided by law;

• object to unlawful processing and complain to the competent authority or a court;

• exercise other rights granted by applicable law.

14. How to submit a request

15. Third-party and children’s data

16. Policy changes and details