COOKIE AND ANALYTICS POLICY

DISP WORLD Platform

Republic of Uzbekistan, Tashkent

7 August 2026

This Cookie and Analytics Policy (the “Policy”) constitutes an integral part of the User Agreement of the DISP WORLD platform, available on the Internet at: https://dispworld.com/ (the “Platform”), and is addressed to all Platform Users without exception, including Guests who visit public pages without registration. This Policy describes which cookies and similar tracking technologies are used by the Platform, the purposes for which they are used, the data collected through them, how Users can manage their consent settings, and how data collected through cookies and analytics tools relate to the Personal Data Processing Policy. This Policy has been developed taking into account the requirements of the Law of the Republic of Uzbekistan “On Personal Data” No. ZRU-547 dated 2 July 2019 and generally accepted international standards for informing Users about the use of tracking technologies. In the event of any conflict between this Policy and the User Agreement in relation to the use of cookies and analytics, this Policy shall apply as the specific document; in all other respects, the User Agreement shall apply.

1. TERMS AND DEFINITIONS

1.1. For the purposes of this Policy, in addition to the terms defined in the User Agreement, the following terms and definitions shall apply:

“Cookies” (“cookie”) means small text data files sent by the Platform’s web server and stored by the browser on the User’s device (computer, smartphone, tablet or other device) when the Platform is visited. Cookies contain small pieces of text and are used to store information required for browser operation and to provide Platform functionality. Cookie specifications are described in RFC 2109 and RFC 6265.

“Technical Cookies” (“mandatory cookies”, “necessary cookies”) means cookies strictly necessary for the technical operation of the Platform: User authentication, maintenance of an active session, protection against CSRF attacks, proper operation of forms and other basic technical functions. Without Technical Cookies, the Platform cannot function properly.

“Analytics Cookies” means cookies used to collect data about Users’ behavior on the Platform, including pages visited, actions performed, session duration and other indicators that allow the Administration to analyze and improve the Platform. Analytics Cookies are used only with the User’s consent.

“Advertising Cookies” means cookies used to track Users’ behavior for advertising purposes, including personalized advertising and retargeting. Advertising Cookies are not used within the Platform’s MVP; this term is included in order to provide Users with comprehensive information about possible cookie categories.

“Session Cookies” means cookies that are automatically deleted from the User’s device when the browser is closed or the session ends. Session Cookies are not stored permanently on the device.

“Persistent Cookies” means cookies that remain stored on the User’s device after the session ends for a specified period established when they are created. Persistent Cookies allow the Platform to “recognize” the User on subsequent visits.

“Third-party Cookies” means cookies placed on the User’s device not directly by the Platform, but by third-party services integrated with the Platform, such as analytics services. Third-party Cookies are processed by the relevant third parties in accordance with their own privacy policies.

“First-party Cookies” means cookies placed directly by the Administration when the User uses the Platform.

“Similar Tracking Technologies” means technologies that perform functions similar to cookies but are implemented through other technical means: web beacons (pixels), browser local storage (LocalStorage), session storage (SessionStorage), device fingerprinting and other technologies for identifying devices and sessions. In this Policy, all such technologies are considered together with cookies.

“Google Analytics 4” (“GA4”) means the web analytics service of Google LLC planned for integration into the Platform to analyze User behavior. GA4 uses both first-party and third-party cookies and similar technologies to collect data about use of the Platform.

“Consent to the Use of Cookies” means the User’s freely given, specific, informed and unambiguous authorization to use Analytics Cookies and other non-essential cookies on the User’s device. Consent is expressed through the Cookie Management Mechanism when the Platform is first visited and may be changed or withdrawn by the User at any time.

“Cookie Management Mechanism” means a tool provided by the Platform to Users for managing cookie consent settings: accepting or rejecting individual cookie categories and changing consent previously expressed.

“IP Address” means the numerical identifier of the User’s device on the Internet, automatically transmitted when the Platform is accessed and recorded by the Platform’s servers in technical logs.

“Anonymized Data” means data from which all information enabling a specific User to be identified has been removed or replaced, as a result of which the data cannot be associated with a specific individual without additional means.

1.2. Other terms and definitions shall have the meanings assigned to them in the User Agreement and other Platform documents.

2. GENERAL PROVISIONS

2.1. The Platform uses cookies and Similar Tracking Technologies to ensure its operation, improve functionality and analyze User behavior. Use of the Platform without Technical Cookies is impossible, as they are a mandatory condition for its proper operation. Analytics Cookies and other non-essential cookies are used solely with the User’s explicit consent.

2.2. This Policy describes the current state of cookie use on the Platform as of the date of publication. As the Platform develops, the list of cookies and analytics tools used may change. Before new tools using Analytics Cookies or Advertising Cookies are introduced, this Policy will be updated and Users will be invited to consent to the use of the new cookie categories.

2.3. This Policy supplements the Personal Data Processing Policy and must be read together with it. Data collected through Technical Cookies are processed on the basis of the contract with the User, namely the User Agreement, and do not require separate consent. Data collected through Analytics Cookies are processed on the basis of the User’s consent.

3. CATEGORIES OF COOKIES USED

3.1. The Platform uses the following categories of cookies:

3.1. Technical (mandatory) Cookies

3.1.1. Technical Cookies are placed automatically by the Administration when the Platform is visited and are strictly necessary for its operation. Without Technical Cookies, the Platform cannot authenticate the User, maintain an active session or properly process requests. Separate User consent for the use of Technical Cookies is not required because they are technically necessary for the provision of information services.

3.1.2. Technical Cookies used by the Platform include the following types:

– Authentication session identifier (session_id or equivalent) — a unique identifier of the active session of an authenticated User, which keeps the User signed in to the account during the current visit. This cookie is deleted when the browser is closed or the session expires. Authentication on the Platform is impossible without it.

– Authentication token (auth_token or equivalent) — an encrypted token that allows the Platform to identify an authenticated User on repeat visits without requiring the password to be entered again during the specified period. It is stored for the validity period of the token or until the User signs out of the account.

– CSRF protection (csrf_token or equivalent) — a technical security token that protects the Platform and Users against CSRF (Cross-Site Request Forgery) attacks, in which malicious websites may initiate unauthorized actions on behalf of the User. This cookie is a mandatory element of Platform security.

– Interface preference cookie — Technical Cookies that store the Platform interface settings selected by the User, including language preferences, display parameters and other basic settings required for correct display of the Platform.

– Consent status cookie (consent_status or equivalent) — a Technical Cookie that records whether the User has consented to or rejected the use of Analytics Cookies through the Cookie Management Mechanism. This cookie is required so that the Platform does not repeat the consent request on every visit after the User has already expressed a decision. Without this cookie, the Platform cannot “remember” the User’s cookie decision.

3.1.3. Technical Cookies are not used for advertising or marketing purposes. Data collected through them are limited to the minimum scope necessary for the technical operation of the Platform and are not transferred to third parties for commercial purposes.

3.2. Analytics Cookies

3.2.1. Analytics Cookies allow the Administration to understand how Users interact with the Platform: which pages they visit, which functions they use, how long they remain on the Platform, which devices they use, and other indicators of User behavior on the Platform. These data are used solely to improve the Platform, its functionality and the user experience.

3.2.2. Analytics Cookies are used by the Platform only where the User has given explicit consent through the Cookie Management Mechanism. By default, all analytics permissions have the status “denied”. Analytics Cookies are activated only after the User expresses consent through the Cookie Management Mechanism.

3.2.3. At present, Analytics Cookies on the Platform are implemented through the following tool:

Google Analytics 4 (GA4) — a web analytics service of Google LLC. GA4 collects anonymized or pseudonymized data about User behavior: pages visited, actions performed (clicks and transitions), session duration, device and browser type, approximate geographic location (at country or regional level), and sources of referral to the Platform. The data are transferred to Google LLC and processed by it in accordance with Google’s privacy policy, available at: https://policies.google.com/privacy. Google servers may be located outside the Republic of Uzbekistan. GA4 is not loaded or initialized until the User has given explicit consent. After consent is obtained, GA4 is activated and begins collecting data. Advertising personalization in GA4 is not enabled by default.

3.2.4. When using GA4, the Administration applies the following data minimization measures: Users’ IP Addresses are anonymized before being transferred to GA4; GA4 advertising tracking and remarketing functions are disabled; GA4 data are not used to create advertising profiles of Users.

3.2.5. The User may at any time reject the use of Analytics Cookies or change consent previously expressed through the Cookie Management Mechanism on the Platform. Rejection of Analytics Cookies does not restrict access to Platform functionality and does not have any adverse consequences for the User.

3.3. Advertising Cookies

3.3.1. Advertising Cookies used for targeted advertising, retargeting and the creation of advertising profiles are not used within the Platform’s MVP. The Administration does not install social media advertising pixels, including Facebook Pixel, TikTok Pixel or equivalents, and does not use advertising tracking technologies.

3.3.2. If the Administration decides in the future to integrate Advertising Cookies or pixels, this Policy will be updated before their introduction, and Users will be invited to provide separate consent to their use through an updated Cookie Management Mechanism.

4. SUMMARY TABLE OF COOKIES USED

4.1. The current list of cookies used on the Platform is provided in the table below. The Administration undertakes to keep this table current and update it whenever the list of cookies used changes.

4.2. The actual cookie names may differ slightly from those shown in the table depending on the technical implementation. The User may view the cookies actually placed in the browser settings.

4.3. In addition to cookies, the Platform uses the following client-side data storage technologies:

LocalStorage — a data storage mechanism in the User’s browser used by the Platform to store technical interface settings. Data in LocalStorage are not automatically transmitted to the server with every request, as cookies are, and are retained until explicitly deleted by the User or the system.

SessionStorage — a similar data storage mechanism, but limited to the duration of the current browser tab.

5. RECOMMENDATION ALGORITHMS AND PERSONALIZATION

5.1. The Platform uses recommendation algorithms to generate personalized content: suggestions of events, courses and Mentors based on the User’s behavior and preferences on the Platform. Recommendation algorithms rely on User behavior data collected both as part of the Platform’s technical operation and, where consent is given, through analytics tools.

5.2. Personalized recommendations based on behavioral data are generated only where the User has consented to the use of Analytics Cookies. If Analytics Cookies are rejected, the User will continue to receive content on the Platform, although it may be less personalized.

5.3. The Administration does not make automated decisions producing legally significant consequences for the User, such as denial of service or a change of tariff, solely on the basis of algorithmic processing of the User’s behavioral data without human involvement. Any decisions that materially affect the User’s rights are made by authorized representatives of the Administration.

6. COOKIE MANAGEMENT MECHANISM AND OBTAINING CONSENT

6.1. When the Platform is visited for the first time, the User is shown a cookie notice (banner) containing: a brief description of the cookie categories used; information that Technical Cookies are used by default; an invitation to consent to or reject the use of Analytics Cookies; a link to the full text of this Policy; and the control buttons “Accept All”, “Necessary Only” and “Customize”.

6.2. The consent mechanism is implemented in accordance with the following principles:

6.2.1. “Denied by default” principle. By default, all analytics and advertising permissions have the status “denied”. Analytics Cookies are activated solely after the User has given explicit consent. GA4 and other analytics tools are not loaded or initialized before consent is obtained.

6.2.2. Voluntariness principle. The User may reject Analytics Cookies without any consequences for access to Platform functionality. Rejection of Analytics Cookies does not result in restrictions on use of the Platform.

6.2.3. Specificity principle. Consent is requested separately by cookie category. The User may accept some categories and reject others.

6.2.4. Modifiability principle. The User may at any time change consent previously expressed through the relevant section of the Platform settings or through the Cookie Management Mechanism available at the bottom of every Platform page.

6.3. The fact that consent or rejection has been expressed is recorded by the Platform together with the following technical attributes: version of the consent text; date and time of consent; categories selected by the User; IP Address at the time consent was expressed, in anonymized form; interface language at the time consent was expressed. These data are stored in the consent status cookie on the User’s device and in the Platform system for the periods established by the Personal Data Processing Policy for consent data.

7. MANAGING COOKIES THROUGH BROWSER SETTINGS

7.1. In addition to the Cookie Management Mechanism provided by the Platform, the User may manage cookie settings directly in the browser settings. Most modern browsers allow Users to: view installed cookies and their content; delete individual cookies or all cookies at once; block cookies from individual websites or all websites; use private browsing mode (incognito), in which cookies are not retained after the browser window is closed.

7.2. The procedure for managing cookies depends on the browser used. Approximate paths to the settings in the most common browsers are provided below:

– Google Chrome: Settings → Privacy and security → Cookies and other site data.

– Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data.

– Safari (macOS): Settings → Privacy → Manage Website Data.

– Safari (iOS): Settings → Safari → Privacy & Security.

– Microsoft Edge: Settings → Cookies and site permissions → Manage cookies.

– Opera: Settings → Advanced → Privacy and security → Cookies.

7.3. Important notice: disabling Technical Cookies in the browser settings will make authentication on the Platform impossible and cause a number of its functions to operate incorrectly. The Administration does not guarantee proper operation of the Platform where Technical Cookies are disabled. Disabling Analytics Cookies in the browser settings will not affect the availability of Platform functionality.

7.4. To withdraw consent to the use of data by Google Analytics 4, the User may also use Google’s “Opt-out Add-on” for browsers, available at: https://tools.google.com/dlpage/gaoptout. This add-on prevents data from being sent to GA4 regardless of the cookie settings on a particular website.

8. DATA COLLECTED THROUGH COOKIES AND ANALYTICS

8.1. Technical data collected automatically whenever the Platform is accessed, regardless of whether analytics consent has been given, include: the IP Address of the User’s device, used for technical processing of the request and retained in server logs for the period established by the Personal Data Processing Policy; HTTP request headers, containing technical data about the browser, operating system and request parameters; the date and time of access to the Platform; and the addresses of requested pages. These data are collected to ensure the security and operation of the Platform and are not used to create User profiles.

8.2. Analytics data collected through GA4, solely where the User has given consent, include: Platform pages visited and the duration of visits; the User’s actions on the Platform, including clicks, link transitions, completion of forms and use of functions; information about the User’s device, including device type, operating system, browser and screen resolution, in anonymized form; approximate geographic location at country and regional level, without a precise address, based on a partially anonymized IP Address; the source of referral to the Platform, including a search engine, direct entry or a link; and the User’s navigation paths through the Platform.

8.3. Analytics data transferred to GA4 are anonymized or pseudonymized to the maximum extent possible before transfer. Users’ complete IP Addresses are not transferred to GA4. The Administration does not transfer to GA4 data enabling the User to be identified, including the name, email address, telephone number or equivalent data.

9. TRANSFER OF DATA TO THIRD PARTIES THROUGH COOKIES

9.1. Data collected through the Platform’s First-party Technical Cookies are not transferred to third parties for commercial purposes. Access to server logs containing technical data is restricted to the Platform’s cloud infrastructure provider, acting as a data processor on behalf of the Administration.

9.2. Where the User has consented to Analytics Cookies, data about the User’s behavior on the Platform are transferred to Google LLC for processing within Google Analytics 4. Google LLC may process these data on servers located outside the Republic of Uzbekistan. Google processes the data in accordance with its privacy policy and the Data Processing Terms entered into with the Administration.

9.3. The Administration does not sell User data collected through cookies to third parties and does not transfer them to advertising networks for targeted advertising.

10. RETENTION PERIODS FOR DATA COLLECTED THROUGH COOKIES

10.1. Retention periods for data collected through cookies are determined as follows: technical server log data, including IP Addresses and access times, are retained for 1 (one) year from collection; data concerning the User’s cookie consent are retained for the validity period of the consent status cookie, generally up to 1 year, and in the Platform system for the periods established by the Personal Data Processing Policy for consent data; analytics data transferred to GA4 are retained in accordance with the GA4 data retention settings established by the Administration.

10.2. Upon expiry of the established retention periods, the data are deleted or anonymized automatically in accordance with the procedures applied by the Administration and the relevant third parties.

11. COOKIE NOTICE (BANNER)

11.1. When the Platform is visited for the first time, the User is shown a banner with the following content:

“We use two types of cookies: mandatory Technical Cookies for authentication and proper operation of the Platform, without which sign-in is impossible; and Analytics Cookies (Google Analytics 4) to analyze use of the Platform and improve it, solely with your consent. Advertising Cookies are not used in the Platform’s MVP. You may accept all cookies, reject Analytics Cookies or customize your selection. Rejection of Analytics Cookies does not restrict operation of the Platform. Further details are available in the Cookie and Analytics Policy.”

11.2. The banner is displayed until the User expresses a cookie decision by clicking one of the following buttons: “Accept All”, “Necessary Only” or “Customize”. Once the decision has been expressed, the banner is hidden. On repeat visits, the banner is not displayed if the consent status cookie is stored on the User’s device.

11.3. A link to the Cookie Management Mechanism is available to Users on all Platform pages, allowing a previously expressed decision to be changed at any time.

12. USERS’ RIGHTS IN RELATION TO COOKIES

12.1. In relation to cookies and Similar Tracking Technologies used by the Platform, the User has the following rights:

12.1.1. Right to information — the User may review this Policy at any time; it contains comprehensive information about the cookies used on the Platform, their purposes and retention periods.

12.1.2. Right to reject — the User may reject Analytics Cookies through the Platform’s Cookie Management Mechanism or browser settings without any consequences for access to Platform functionality.

12.1.3. Right to change consent — the User may at any time change consent previously expressed for the use of Analytics Cookies through the Platform’s Cookie Management Mechanism.

12.1.4. Right to withdraw consent — the User may at any time withdraw consent to the use of Analytics Cookies. Withdrawal of consent does not affect the lawfulness of data processing carried out before withdrawal.

12.1.5. Right to delete cookies — the User may at any time delete cookies stored by the Platform on the User’s device through the browser settings.

12.2. To exercise the rights specified in Clause 12.1 of this Policy, the User may: use the Cookie Management Mechanism directly on the Platform; use the browser settings; or submit a request to the Administration at the email address specified in the Administration Details section of this Policy: gr22atract@gmail.com.

13. SPECIAL CONDITIONS FOR USERS FROM CERTAIN JURISDICTIONS

13.1. The Platform is intended for Users from Türkiye, the countries of Central Asia (Uzbekistan, Kazakhstan, Kyrgyzstan, Tajikistan and Turkmenistan), and a European test environment. Cookie and consent requirements differ significantly among jurisdictions. This Policy has been developed taking into account the laws of the Republic of Uzbekistan and generally accepted international standards.

13.2. Users from Türkiye are subject to the requirements of the Law on the Protection of Personal Data (KVKK — Kişisel Verilerin Korunması Kanunu), which, in relation to obtaining cookie consent, are generally compatible with the approach implemented in this Policy. Consent is requested explicitly, and refusal is possible without consequences for access to the Platform.

13.3. Users from Central Asian countries are subject to the requirements of the relevant national personal data laws. With respect to the use of cookies and obtaining consent, this Policy follows principles analogous to the requirements of the laws of the Republic of Uzbekistan.

13.4. For Users in the European test environment, this Policy implements principles comparable to the requirements of the EU Cookie Directive and the GDPR regarding explicit consent, separate consent requests by category, and the ability to reject without adverse consequences.

14. AMENDMENT OF THIS POLICY

14.1. The Administration may amend this Policy unilaterally in the following cases: integration of new analytics tools using cookies; changes to the categories of cookies used; changes to legislation or regulatory requirements of applicable jurisdictions concerning cookies and consent; and other material changes to the technical implementation or legal context of cookie use.

14.2. Where material amendments are made to this Policy, the Administration notifies Users in accordance with Section 17 of the User Agreement at least 15 (fifteen) days before the amendments enter into force. When new categories of non-essential cookies are introduced, the Administration updates this Policy before their implementation and invites Users to consent to the new categories through the updated Cookie Management Mechanism.

14.3. The current version of this Policy is permanently available on the Platform at: https://dispworld.com/legal/cookie-policy/. Continued use of the Platform after amendments enter into force constitutes acceptance of the amended terms.

15. FINAL PROVISIONS

15.1. Commencement of use of the Platform, including visiting its public pages, means that the User has reviewed this Policy. Analytics Cookies are used solely where explicit consent has been expressed through the Cookie Management Mechanism.

15.2. This Policy and relations arising in connection with its application are governed by the laws of the Republic of Uzbekistan, primarily the Law of the Republic of Uzbekistan “On Personal Data” No. ZRU-547 dated 2 July 2019.

15.3. All questions relating to this Policy and the use of cookies on the Platform shall be submitted to the Administration using the following contact details:

Email for personal data and cookie inquiries: gr22attract@gmail.com

Email for general inquiries: gr22attract@gmail.com

15.4. If one or more provisions of this Policy are held invalid or without legal effect, this shall not affect the validity of the remaining provisions.

ADMINISTRATION DETAILS

Limited Liability Company “GR ATTRACTOR”

254, 1st Passage, Usta Shirin Street, Miskin CSG, Almazar District, Tashkent, Republic of Uzbekistan

TIN: 313127023

Email for cookie and personal data inquiries: gr22attract@gmail.com

Email for general inquiries: gr22attract@gmail.com

Platform website: https://dispworld.com/