Legal
Privacy Policy
Of the GoVPN mobile application and website
BYTEBLOOM Limited Liability Company
General Provisions
1.1. This Privacy Policy (hereinafter — the Policy) applies to all information that BYTEBLOOM LLC (hereinafter — the Company) may obtain about the User in the course of providing services through the GoVPN mobile application and the website vpn.bytebloom.uz (hereinafter jointly — the Application).
1.2. Use of the Application, including registration in it, constitutes the User's unconditional consent to this Policy and to the terms of personal data processing set out herein. If the User does not agree with these terms in whole or in part, the User may refrain from using the Application.
1.3. When processing the User's personal data, the Company complies with the Law of the Republic of Uzbekistan No. ZRU-547 “On Personal Data” dated 2 July 2019 and other applicable legislation.
1.4. This Policy applies only to the GoVPN Application. The Company is not responsible for third-party websites accessible through the Application. A User who does not agree with the terms of this Policy must discontinue use of the website and uninstall the Application.
Terms and Definitions
2.1. Company — BYTEBLOOM Limited Liability Company, the operator of the GoVPN service.
2.2. Application — the GoVPN dedicated software built on mobile technologies and intended to provide the User with a VPN connection and related services online, together with the website vpn.bytebloom.uz.
2.3. User — a legally capable natural person who uses the Application.
2.4. Personal data — any information relating to a specific natural person or making it possible to identify such person. This includes all data transmitted, explicitly or implicitly, in the course of using the Application.
2.5. Personal data processing — any action or set of actions performed with or without the use of automation tools, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion, and destruction.
2.6. Depersonalization — actions as a result of which it becomes impossible, without the use of additional information, to determine that data belongs to a specific User.
2.7. Third parties — all persons other than the Company and the User, unless otherwise provided by law.
Types of Data Collected
Account data
3.1.1. During registration and use of the Application, the Company collects and processes the following data:
- phone number or email address;
- name provided by the User (if any);
- subscription type, tariff plan, subscription start and end dates;
- device model, operating system type and version, Application version, language settings, unique device identifier;
- history of the User's requests to the support service.
3.1.2. The User decides independently whether to provide data. The Company proceeds on the assumption that the User provides reliable, complete and up-to-date information, and does not separately verify its accuracy.
Payment data
3.2.1. When arranging a subscription and making payments, the following data is processed:
- the selected payment method (Payme, Click, Uzcard, Humo, and other licensed payment systems of the Republic of Uzbekistan);
- transaction identifier, amount, currency, date and status.
3.2.2. Payments are made through licensed payment organizations of the Republic of Uzbekistan. Full bank card details (card number, CVV/CVC code, expiry date) are not stored on the Company's servers and are processed directly by the payment provider in accordance with the requirements of the international PCI DSS standard.
3.2.3. Information about payment transactions is retained for the period established by law for the purposes of accounting, fulfilment of tax obligations and resolution of possible disputes.
Data on Internet traffic and visited websites
3.3.1. Information about which websites (domains) the User has visited via the VPN connection is processed by the Company exclusively in depersonalized (anonymized) form.
3.3.2. In doing so:
- information about visited websites is not linked to the User's identity, account, phone number or IP address;
- such data is analyzed only in the form of aggregated statistics, without identifying individual users;
- depersonalized data is not re-linked to a specific User.
3.3.3. The Company does not keep the User's personal browsing history and does not store logs that would make it possible to establish that a specific User visited a specific website.
3.3.4. Depersonalized traffic statistics are used for the following purposes:
- improving service quality and planning server capacity;
- detecting and eliminating technical failures and cyberattacks;
- overall analysis of the Application's performance.
3.3.5. For the purposes of providing services and accounting for tariff limits, technical data on the date and duration of the connection, the selected server location and the total volume of transferred traffic may be processed. This data does not include the content of the websites visited by the User.
Purposes of Data Processing
4.1. The Company processes only the data necessary to provide services to the User. The User's data may be used for the following purposes:
- identifying the User and ensuring secure access to the account;
- providing the VPN service; arranging, renewing and managing the subscription;
- accepting payments, processing refunds and maintaining settlements;
- communicating with the User: service notifications, processing of requests and technical support inquiries;
- improving service quality, enhancing usability and developing new features;
- conducting statistical and other research based on depersonalized data;
- sending marketing messages and offers about new products, subject to the User's separate consent;
- ensuring compliance with the legislation of the Republic of Uzbekistan.
Data Storage and Protection
5.1. Users' personal data is stored and processed on servers located in the territory of the Republic of Uzbekistan (in accordance with the requirements of Article 27-1 of Law No. ZRU-547).
5.2. The Company takes the necessary legal, organizational and technical measures to protect personal data against accidental or unauthorized access, destruction, modification, blocking, copying and dissemination, including:
- encryption of communication channels (TLS);
- storage of passwords in hashed form;
- restriction of access rights;
- activity logging.
5.3. Access to the data is granted only to authorized employees who are directly involved in providing the services and have assumed confidentiality obligations.
5.4. Personal data is retained for as long as the account remains active and, after the account is deleted, for the period established by law, after which it is destroyed or depersonalized.
Amendments to the Policy
7.1. The Company has the right to amend this Policy unilaterally. The new version of the Policy takes effect from the moment of its publication on the website vpn.bytebloom.uz or in the Application.
7.2. The User may be notified of material changes via the Application interface, a push notification or email. Continued use of the Application after the changes take effect constitutes the User's consent to the new version.
Company Details and Contact Information
BYTEBLOOM Limited Liability Company
Address
Tashkent city, Olmazor district, Qichqiriq mahalla, Qora-Qamish 1/3, house 59-a
TIN
310073387