DISP WORLD Platform
Republic of Uzbekistan, Tashkent
7 August 2026
This Personal Data Processing Policy (the “Policy”) sets out the procedure and conditions under which GR ATTRACTOR Limited Liability Company (the “Operator”) processes personal data when providing access to the DISP WORLD platform available on the Internet at https://dispworld.com/ (the “Platform”), and describes the personal data protection measures implemented by the Operator. This Policy has been developed in accordance with the Law of the Republic of Uzbekistan “On Personal Data” dated 2 July 2019 No. ZRU-547 (the “Personal Data Law”), as well as other regulatory legal acts of the Republic of Uzbekistan in the field of information and personal data protection. This Policy applies to all personal data processed by the Operator that the Operator receives or may receive from the User in the course of using the Platform.
1. GENERAL PROVISIONS
1.1. For the purposes of this Policy, the terms and definitions below shall have the following meanings:
“Personal Data” means information relating to an identified individual or enabling that individual to be identified. For the purposes of this Policy, Personal Data include any information that the Operator receives from the User or collects about the User in the course of using the Platform, including: first name, last name, email address, nickname, date of birth, country of residence, as well as technical data automatically transmitted by the User’s device when accessing the Platform, including IP Address, browser data, operating system data and session parameters.
“Operator” means GR ATTRACTOR Limited Liability Company, registered in the Republic of Uzbekistan, which independently or jointly with other persons organizes and/or carries out the processing of Personal Data and determines the purposes of Personal Data processing, the composition of the Personal Data and the operations performed with them. The Operator’s details are set out in Section 15 of this Policy.
“User” means any individual who is a Personal Data subject and who, in the course of using the Platform, independently provides Personal Data to the Operator or whose data are received by the Operator automatically in connection with use of the Platform. For the purposes of this Policy, the term “User” covers all Platform participant roles: Guests, Registered Users, Organizers, Mentors, Judges and Advertisers.
“Platform” means the DISP WORLD digital ecosystem and software available at https://dispworld.com/, including all of its functional modules, interfaces and integrated services.
“Processing of Personal Data” means any action or operation performed on Personal Data, including collection, recording, systematization, accumulation, storage, clarification (updating, alteration), retrieval, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion and destruction of Personal Data.
“Automated Processing of Personal Data” means the processing of Personal Data by means of computer technology without direct human involvement.
“Non-automated Processing of Personal Data” means the processing of Personal Data where actions involving such data are performed with direct human involvement, without the use of computer technology or in combination with its use.
“Dissemination of Personal Data” means actions aimed at disclosing Personal Data to an indefinite number of persons.
“Provision of Personal Data” means actions aimed at transferring Personal Data to a specific person or a specific group of persons.
“Blocking of Personal Data” means the temporary suspension of Personal Data processing, except where processing is necessary to clarify the Personal Data.
“Destruction of Personal Data” means actions as a result of which it becomes impossible to restore the content of Personal Data in an information system and/or as a result of which the physical media containing the Personal Data are destroyed.
“Depersonalization of Personal Data” means actions as a result of which, without the use of additional information, it becomes impossible to determine that Personal Data belong to a specific User.
“Confidentiality of Personal Data” means the mandatory requirement imposed on a person who has obtained access to Personal Data not to permit their dissemination without the consent of the subject or another lawful basis.
“Cross-border Transfer of Personal Data” means the transfer of Personal Data to the territory of a foreign state, to a foreign public authority, or to a foreign individual or legal entity.
“Authorized Body” means the state authority of the Republic of Uzbekistan that exercises control and supervision in the field of Personal Data processing in accordance with the legislation of the Republic of Uzbekistan.
“Identity Verification” (“KYC”, Know Your Customer) means the procedure for verifying the identity of a User applying for a commercial role on the Platform, carried out through an external Verification Provider, following which the Operator receives only the final verification status.
“Legal Entity Verification” (“KYB”, Know Your Business) means the procedure for verifying a legal entity applying for the Advertiser role, including verification of the company’s registration details and the authority of its representative.
“Verification Provider” means an external organization that carries out identity or legal entity verification on the Operator’s instructions.
“Cookies” means small pieces of data sent by the Platform’s server and stored on the User’s device, which are used to maintain the session, provide authorization and perform other technical functions.
“IP Address” means the numerical identifier of the User’s device on the Internet, automatically transmitted when the Platform is accessed.
1.2. All other terms and definitions used in this Policy shall be interpreted in accordance with the legislation of the Republic of Uzbekistan and generally accepted rules for interpreting the relevant concepts in the field of information technology and data protection.
1.3. The terms and definitions used in this Policy may be used in the singular or plural depending on the context.
1.4. The section headings in this Policy are provided solely for convenience and shall have no independent literal legal meaning.
1.5. This Policy sets out the procedure and conditions for the Operator’s processing of Personal Data, including the procedure for transferring Personal Data to third parties, the specific features of Cross-border Transfers, the procedure for Users to exercise their rights, the Personal Data protection system and the procedure for considering User requests.
1.6. This Policy enters into force upon its approval by the Operator and shall remain in force indefinitely until replaced by a new version. The Operator may amend this Policy without the User’s prior consent. Amendments enter into force when the new version of the Policy is posted on the Platform. Where material amendments affect Users’ rights, the Operator shall notify Users at the email address provided during registration at least 15 (fifteen) days before such amendments enter into force.
1.7. This Policy applies to all Personal Data processing activities carried out through the Platform, both by automated and non-automated means. The Operator does not control and is not responsible for third-party websites and services that the User may access through links on the Platform; such websites process data under their own rules.
2. LEGAL BASES FOR PERSONAL DATA PROCESSING
2.1. The Operator processes Users’ Personal Data in accordance with the following regulatory legal acts of the Republic of Uzbekistan:
– Law of the Republic of Uzbekistan “On Personal Data” dated 2 July 2019 No. ZRU-547;
– Law of the Republic of Uzbekistan “On Informatization” dated 11 December 2003 No. 560-II;
– Law of the Republic of Uzbekistan “On Electronic Commerce” dated 29 September 2022 No. ZRU-792;
– Law of the Republic of Uzbekistan “On Principles and Guarantees of Freedom of Information” dated 12 December 2002 No. 439-II;
– Law of the Republic of Uzbekistan “On Cybersecurity” dated 15 April 2022 No. ZRU-764;
– Law of the Republic of Uzbekistan “On Education” dated 23 September 2020 No. ZRU-637 (applicable insofar as data are processed when educational services are provided through the Platform);
– other regulatory legal acts of the Republic of Uzbekistan governing information processing and Personal Data protection.
2.2. The User’s Personal Data are processed on the following legal bases:
2.2.1. User consent – Personal Data are processed for the purposes specified in Section 3 of this Policy on the basis of the User’s consent expressed by checking the relevant box when registering on the Platform or when performing a specific action requiring the processing of the relevant category of data.
2.2.2. Performance of a contract – processing of data required to perform the User Agreement to which the User is a party, as well as to provide access to a Tariff Plan, carry out identity and legal entity verification and perform the Operator’s other contractual obligations.
2.2.3. The Operator’s legitimate interest – processing of technical and analytics data to ensure Platform security, prevent fraud and abuse, and improve service quality, provided that such legitimate interest does not conflict with Users’ rights and freedoms.
2.2.4. Compliance with legal requirements – processing of data where such processing is required by the legislation of the Republic of Uzbekistan or by the legislation of the User’s country of residence insofar as it applies to the Operator.
2.3. The User’s Personal Data are also processed on the basis of and for the performance of the User Agreement governing use of the Platform, to the extent necessary for the Operator to duly perform its obligations under that Agreement.
2.4. The Operator uses recommendation algorithms to generate personalized content, including suggestions of Events, Courses and Mentors based on the User’s behavior and preferences on the Platform. When analytics services are enabled, the relevant User behavior data are processed only where the User has given consent through the Cookie Management Mechanism. The Operator does not make automated decisions that produce legally significant consequences for the User (denial of service, change of Tariff Plan, etc.) without human involvement.
3. PURPOSES OF PERSONAL DATA PROCESSING
3.1. The Operator processes Personal Data only to the extent necessary to achieve specific, predetermined purposes. Personal Data may not be processed for purposes incompatible with those for which the data were collected. When processing Personal Data, the Operator does not combine databases containing Personal Data that are processed for mutually incompatible purposes.
3.2. The Operator processes Users’ Personal Data for the following purposes:
3.2.1. Registration, authorization and Account administration – creating and maintaining the User’s Account, identifying the User when logging in to the Platform, restoring access to the Account and ensuring Account security.
3.2.2. Providing access to Platform functionality – processing data required to perform the User Agreement and provide access to Tariff Plans, Events, Courses, Live Streams, advertising tools and the blockchain registry in accordance with the User’s role.
3.2.3. Identity and legal entity verification – transferring the necessary data to an external Verification Provider to verify the identity of Users applying for the roles of Organizer, Mentor or Judge and to verify legal entities applying for the Advertiser role. The Operator receives and stores only the final verification status.
3.2.4. Payment processing – transferring to the payment provider the data required to process transactions when Tariff Plans are paid for. Full bank card details are not stored on the Operator’s servers.
3.2.5. Communication with Users – sending technical and service notifications regarding Account status, verification, Tariff Plans, Events and Courses; notifications concerning complaints, moderation decisions and amendments to Platform documents. Marketing communications are sent only where the User has given separate consent.
3.2.6. Support and handling of requests – processing data required to review User requests, claims and complaints and to maintain the history of Users’ interactions with the support service.
3.2.7. Content moderation and security – processing data to identify and prevent breaches of the User Agreement, fraud, abuse and other unlawful activities on the Platform.
3.2.8. Analytics and Platform improvement – processing depersonalized or pseudonymized data on User behavior in order to improve Platform functionality, analyze the user experience and correct errors. Analytics data are processed only where the User has given consent.
3.2.9. Recommendation algorithms – processing data on the User’s behavior and preferences on the Platform in order to generate personalized content where the User has given the relevant consent.
3.2.10. Compliance with legal requirements – processing data in cases expressly provided for by the legislation of the Republic of Uzbekistan, including in response to requests from Authorized Bodies.
4. COMPOSITION AND CATEGORIES OF PERSONAL DATA PROCESSED
4.1. The composition of the Personal Data processed depends on the User’s role on the Platform and the actions performed by the User while using it. The Operator processes only the data required to achieve the specific purposes set out in Section 3 of this Policy.
4.2. Data collected from all Users during registration:
Email address – the primary identifier of the User’s Account, used for authorization, sending technical notifications and password recovery. Providing an email address is a mandatory condition of registration.
Password – stored in encrypted form; the Operator has no access to the password in plain text.
Name (nickname) – the User’s public identifier on the Platform, used in the profile and when interacting with other Users.
Date or year of birth – used to confirm compliance with the Platform’s age requirements. For Users aged 13 to 17, the fact that the User has declared that parental or legal representative consent is available is additionally recorded.
Country of residence – used to apply the Platform’s territorial rules, determine the applicable law and select the corresponding language version of the interface.
4.3. Data generated during Live Streams and live sessions:
The User’s image (video image) and voice transmitted during Live Streams of Events, live sessions held by Mentors or other broadcasts involving the User.
This category of data is processed exclusively in real time for the purpose of conducting the broadcast and is not stored on the Platform’s servers after the broadcast ends, unless otherwise expressly provided for by Platform functionality and the User’s consent.
By participating in a Live Stream with the video camera or microphone enabled, the User confirms consent to the processing of the User’s image and voice to the extent necessary to conduct that broadcast. If the User’s image may qualify as biometric data within the meaning of Article 26 of the Law of the Republic of Uzbekistan “On Personal Data”, it is processed exclusively on the basis of the User’s explicit consent, which is deemed to have been given by voluntarily enabling the video camera when joining the broadcast.
4.4. Additional data voluntarily provided by the User when completing the profile:
First name and last name – may be mandatory for commercial-role profiles (Organizer, Mentor, Judge) for verification purposes.
Telephone number – may be added by the User to the profile where required for a specific role, verification procedure or operation.
Profile photograph – uploaded voluntarily by the User and displayed in the User’s profile.
4.5. Data collected during Identity Verification (KYC) for the roles of Organizer, Mentor and Judge:
Identity Verification is carried out through an external Verification Provider.
During verification, the User provides the Verification Provider with an identity document (passport or identity card) and other data required to complete the verification. The Operator receives from the Verification Provider only the final verification status: “verification not started”, “verification in progress”, “identity verified”, “verification rejected” or “re-verification required”.
Copies of documents, biometric data, photographs of documents and other source data provided by the User to the Verification Provider are not stored on the Operator’s servers. If a verification identifier is required for audit and technical traceability purposes, it is stored without copies of documents and without excessive Personal Data.
4.6. Data collected during Legal Entity Verification (KYB) for the Advertiser role:
Company name; taxpayer identification number (TIN) or an equivalent company registration number under the law of the country of registration; country of registration of the company; first name, last name and position of the company representative; the representative’s email address; the representative’s telephone number; the company’s website address (if any); and field of activity (where necessary).
These data are processed to verify the lawfulness of granting the legal entity access to the Platform’s advertising tools.
4.7. Technical data collected automatically when the Platform is used:
IP Address of the User’s device – used to ensure session security, identify attempted unauthorized access and statistically analyze the audience’s geographical distribution in depersonalized form.
HTTP request headers – technical data transmitted by the User’s browser or application whenever the Platform’s servers are accessed.
Cookie data – processed in accordance with the Cookie and Analytics Policy; Technical Cookies are used for authorization and session maintenance, while Analytics Cookies are used only where the User has given consent.
Browser and operating system information (User-Agent string) – used to ensure compatibility between the Platform interface and the User’s device.
Platform behavior data – pages viewed by the User; Events, tournaments and Courses visited or subscribed to by the User; and data on the duration and nature of interaction with Content. These data are used for analytics and to generate personalized recommendations where the User has given the relevant consent.
4.8. Data generated while using the Platform:
Tariff payment history – the date, amount and status of transactions for Tariff Plans; retained for accounting purposes, dispute resolution and compliance with legal requirements.
Verification status and history – the final KYC or KYB status, the date on which verification was completed and the verification identifier assigned by the provider.
Content created by the User – descriptions of Events and Courses, advertising materials, reviews, judging protocols and other materials published by the User on the Platform.
History of complaints and requests – requests submitted by the User, complaints submitted against the User and the decisions taken on them.
Consent records – the date and version of consents expressed by the User during registration and use of the Platform, together with recorded technical attributes (IP Address, User-Agent and timestamp).
4.9. Special categories of Personal Data:
In the ordinary operation of the Platform, the Operator does not collect or process special categories of Personal Data, including information on racial or ethnic origin, political opinions, religious beliefs, health status or biometric data.
An exception applies where the User voluntarily provides such information in free-form text fields (for example, in the profile description or the text of a support request); in that case, the Operator processes the information solely for the purpose of reviewing the relevant request.
5. PROCEDURE AND CONDITIONS FOR PERSONAL DATA PROCESSING
5.1. The Operator carries out mixed Personal Data processing, both by automated means (processing registration data, technical data, Tariff payment data and verification data) and without automated means (manual moderation, review of requests and decisions on blocking).
5.2. In accordance with the Law of the Republic of Uzbekistan “On Personal Data” dated 2 July 2019 No. ZRU-547 (as amended by Law No. ZRU-1125 dated 26 March 2026), only the following categories of Personal Data are subject to mandatory storage in the territory of the Republic of Uzbekistan: biometric data of individuals; genetic data of individuals; and data of individuals who are users of services provided by telecommunications operators operating in the territory of the Republic of Uzbekistan. These categories of data are stored on servers physically located in the territory of the Republic of Uzbekistan and are registered in the State Register of Personal Data Databases. Other Personal Data of Users may be stored and processed on servers located outside the Republic of Uzbekistan where one of the following conditions is met: the foreign state has been recognized by the Cabinet of Ministers of the Republic of Uzbekistan as providing an adequate level of Personal Data protection; the Operator has adopted and complies with standard contractual clauses or binding corporate rules meeting the requirements approved by the authorized state authority; or the Operator complies with international standards in the field of Personal Data management and storage, the list of which is approved by the authorized state authority.
5.3. Users’ Personal Data shall remain confidential, except where the User voluntarily makes information publicly available by posting it in publicly accessible sections of the profile.
5.4. The Operator applies the data minimization principle: only the Personal Data required for the specific processing purposes set out in Section 3 of this Policy are processed. If the User provides data in excess of what is necessary, the Operator may refrain from processing such excessive data.
5.5. In the event of loss or unauthorized disclosure of Personal Data, the Operator shall take immediate measures to remedy the incident, notify the Authorized Body within the time limits established by the legislation of the Republic of Uzbekistan and inform Users whose data may have been affected within a reasonable period.
6. PERSONAL DATA RETENTION PERIODS
6.1. The Operator retains Users’ Personal Data for no longer than is necessary to achieve the purposes of processing or comply with legal requirements. The Operator establishes the following retention periods by category of Personal Data:
6.1.1. Account data (email address, name, nickname, country and date of birth) – retained for the entire period during which the Account remains active. After the Account is deleted at the initiative of the User or the Operator, the data shall be destroyed or depersonalized within 3 (three) days, except for data whose retention is required by the legislation of the Republic of Uzbekistan or is necessary to protect the Operator’s legitimate interests within the periods established by this Policy. In technically justified cases (backups, cascading deletion from distributed systems), the destruction period may be extended to 30 (thirty) calendar days, provided that access to the data is restricted immediately upon receipt of the request.
6.1.2. Consent records (fact, date and version of consent, IP Address and User-Agent) – retained for 5 (five) years from the date consent is given or until expiry of the limitation period for potential disputes relating to the fact that consent was given, whichever occurs later.
6.1.3. Verification status (KYC/KYB) – the final verification status is retained throughout the existence of the Account and for 3 (three) years after its deletion for the purposes of resolving potential disputes and complying with legal requirements.
6.1.4. Tariff payment data – payment history, including amounts, dates and statuses, is retained for 5 (five) years from the date of the transaction in accordance with the accounting and tax legislation of the Republic of Uzbekistan.
6.1.5. Technical data (IP Addresses, HTTP headers, session data and access logs) – retained for 1 (one) year from collection for the purposes of ensuring Platform security and operation, unless a different period is required by applicable law.
6.1.6. Analytics data – depersonalized data on Users’ behavior on the Platform are retained for 2 (two) years from collection.
6.1.7. History of complaints, requests and moderation decisions – retained for 3 (three) years from the date the relevant request is closed or the decision is made, for the purpose of resolving potential disputes.
6.1.8. Content created by the User (descriptions of Events and Courses, reviews and advertising materials) – retained throughout the period of publication and for 1 (one) year after its deletion by the User or the Operator, for the purpose of resolving potential disputes.
6.1.9. Data in the Advertiser’s KYB questionnaire – company name, registration details and representative details – retained throughout the period during which Advertiser status remains in force and for 3 (three) years after it ends.
6.2. Upon expiry of the established retention periods, Users’ Personal Data shall be destroyed or depersonalized. Data are destroyed using methods that prevent restoration of their content.
7. TRANSFER OF PERSONAL DATA TO THIRD PARTIES
7.1. The Operator transfers Users’ Personal Data to third parties only in the cases provided for by this Policy, the User Agreement or applicable law. Personal Data may be transferred to third parties without the User’s consent solely in cases expressly established by the legislation of the Republic of Uzbekistan.
7.2. The Operator may transfer Users’ Personal Data to the following categories of third parties:
7.2.1. Identity and legal entity Verification Provider (KYC/KYB) – for the purposes of verifying the identity of Users applying for commercial roles and verifying legal entities applying for the Advertiser role. The Operator transfers to the provider the data required to initiate verification and receives only the final status in return. For the first release, the Verification Provider is selected from local providers operating in the Uzbek region. The agreement with the Verification Provider includes obligations to maintain confidentiality and protect Personal Data obtained during verification.
7.2.2. Payment provider – for the purpose of processing payments for Tariff Plans. The Operator transfers to the payment provider the data required to carry out the transaction (to the extent determined by the specific provider) and receives the transaction status. Full bank card details are not stored on the Operator’s servers. Kapitalbank e-commerce (for Uzbekistan and Central Asia) and Stripe (for the European environment in supported jurisdictions) are used as payment providers.
7.2.3. Cloud infrastructure and server hosting provider – for the purposes of technically supporting Platform operation, data storage and backup. The infrastructure provider acts as a data processor on the Operator’s instructions and may not use Users’ data for its own purposes.
7.2.4. Streaming and CDN infrastructure provider – for the purposes of technically supporting Live Streams and delivering video Content to Users. The technical data required for broadcasts to function are transferred.
7.2.5. Analytics services – where the User has given consent, data on behavior on the Platform may be transferred to analytics services (in particular Google Analytics 4) in depersonalized form or to the extent determined by the User’s consent settings. Google Analytics 4 is loaded only after the User has given explicit consent; by default, analytics permissions have the status “denied”.
7.2.6. Authorized public authorities – the Operator may transfer Personal Data to public authorities and law enforcement bodies of the Republic of Uzbekistan and other states in response to lawful requests made in the prescribed manner, to the extent necessary to comply with the relevant request.
7.3. The Operator takes the necessary measures to ensure that third parties to whom Users’ Personal Data are transferred process them solely for the purposes determined by the Operator and provide an appropriate level of protection. Agreements containing obligations to maintain the confidentiality of Personal Data are concluded with such persons.
7.4. Where the User’s Personal Data are transferred to a third party, the Operator shall notify the User in writing, including in the form of an electronic document, within 3 (three) days of the transfer, except where such notification is not provided in accordance with the legislation of the Republic of Uzbekistan: when public authorities exercise their powers; where Personal Data are processed to protect the User’s rights and legitimate interests until it becomes possible to obtain the User’s consent; or in other cases provided for by law.
8. CROSS-BORDER TRANSFER OF PERSONAL DATA
8.1. Due to the international nature of the Platform’s activities, Users’ Personal Data may be transferred to the territory of foreign states for the purpose of ensuring Platform operation. Cross-border Transfers of Personal Data are carried out in accordance with the legislation of the Republic of Uzbekistan and only where the legal bases specified in Section 2 of this Policy are available.
8.2. The Platform is intended for Users from the following first-release regions: Türkiye, Uzbekistan, Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, other Central Asian countries, and a test European environment. In connection with serving Users from these countries, Personal Data may be transferred to the relevant jurisdictions in the following cases:
– transfer in connection with the operation of the Stripe payment provider to support payments in the European environment;
– transfer in connection with the operation of cloud and CDN infrastructure providers whose servers may be located in different regions;
– transfer of analytics data to analytics services where the User has given consent.
8.3. The Operator carries out Cross-border Transfers of Personal Data on the basis of Article 27-1 of the Law of the Republic of Uzbekistan “On Personal Data” (as amended by Law No. ZRU-1125 dated 26 March 2026): only biometric data, genetic data and data of users of telecommunications operator services are subject to mandatory storage in the territory of the Republic of Uzbekistan, while other Personal Data may be transferred and stored abroad where one of the following conditions is met: the foreign state is recognized as providing an adequate level of protection; the Operator has adopted standard contractual clauses or binding corporate rules meeting the requirements of the Authorized Body; or the Operator complies with international standards, the list of which is approved by the Authorized Body. Where none of these bases is available, the transfer is carried out with the subject’s consent, executed in accordance with this Policy and the Consent to the Processing of Personal Data.
8.4. By giving consent to the processing of Personal Data in the manner provided for by this Policy, the User also consents to the Cross-border Transfer of the User’s Personal Data in the cases specified in this Section, provided that such transfer is carried out solely for the purpose of ensuring Platform operation and subject to the required protection measures.
8.5. The Operator does not transfer Personal Data to third parties beyond the minimum data required for the specific purpose of the transfer.
9. PERSONAL DATA PROTECTION MEASURES
9.1. The Operator takes the necessary legal, organizational and technical measures to ensure the security of Personal Data and protect them against unlawful or accidental access, destruction, alteration, blocking, copying, dissemination and other unlawful actions.
9.2. The Personal Data protection system applied by the Operator includes the following measures:
9.2.1. Technical protection measures: use of secure connections (HTTPS) when transmitting data between the User’s device and the Platform’s servers; encryption of passwords and other sensitive data during storage; segregation of employees’ access rights to Personal Data according to the minimum-necessity principle; use of safeguards against unauthorized access; and regular data backups.
9.2.2. Organizational protection measures: limiting access to Users’ Personal Data to employees and authorized persons who require such access to perform their duties; familiarizing employees who have access to Personal Data with this Policy and the Operator’s internal data-protection documents; and taking measures to terminate access to data when an employee leaves or the employee’s duties change.
9.2.3. Incident-response measures: procedures for timely detection of unauthorized access to Personal Data; notifying the Authorized Body of incidents within the time limits prescribed by law; the ability to promptly restore Personal Data damaged or destroyed as a result of unauthorized access; and continuous monitoring of the level of Personal Data protection.
9.3. Information systems in which Personal Data are stored are hosted by providers that ensure the required physical and information-security measures. Biometric data, genetic data and data of users of telecommunications operator services are stored exclusively on servers located in the territory of the Republic of Uzbekistan, in accordance with the requirements of the Law of the Republic of Uzbekistan “On Personal Data” as amended by Law No. ZRU-1125 dated 26 March 2026. Other Personal Data may be stored on servers located outside the Republic of Uzbekistan subject to the conditions set out in Section 5.2 of this Policy.
9.4. The Operator is not responsible for unauthorized access to the User’s Personal Data resulting from the User’s failure to comply with security requirements when handling Account credentials (disclosing the password to third parties, using weak passwords or using public networks without protective measures).
9.5. The Operator shall register Personal Data databases containing categories of data subject to mandatory localization in the territory of the Republic of Uzbekistan (biometric data, genetic data and data of users of telecommunications services) in the State Register of Personal Data Databases in accordance with Article 20 of the Law of the Republic of Uzbekistan “On Personal Data” dated 2 July 2019 No. ZRU-547. Registration is carried out on an application basis by notifying the State Personalization Centre under the Cabinet of Ministers of the Republic of Uzbekistan. The Operator shall notify the Authorized Body of each change to the data required for registration no later than 10 (ten) calendar days from the date of the change.
9.6. In accordance with Article 31 of the Law of the Republic of Uzbekistan “On Personal Data” and the Model Procedure for Personal Data Processing approved by Order of the Ministry of Justice of the Republic of Uzbekistan No. 3478 dated 15 November 2023, the Operator appoints an official responsible for organizing work related to the processing and protection of Personal Data. That official ensures compliance with the requirements of the legislation of the Republic of Uzbekistan in the field of Personal Data, interaction with the authorized state authority and Personal Data subjects. Contact details of the person responsible for Personal Data processing: gr22attract@gmail.com.
9.7. In the cases provided for by the Law of the Republic of Uzbekistan “On Cybersecurity” dated 15 April 2022 No. ZRU-764, the Administration notifies the authorized state authority of cybersecurity incidents and cybercrimes affecting the Platform’s information systems. The Administration takes measures to prevent the loss of digital traces required for incident analysis and cybercrime investigations and retains information required for the analysis of cybersecurity incidents and the investigation of cybercrimes for the period necessary to complete the investigation of the relevant incident and comply with mandatory requirements of the Authorized Bodies, but no longer than justified by those purposes, in accordance with Article 16 of the Law of the Republic of Uzbekistan “On Cybersecurity” dated 15 April 2022 No. ZRU-764. If a cyber incident affecting Users’ Personal Data is identified, the Administration simultaneously notifies both the competent cybersecurity authority and the competent Personal Data authority within the time limits established by law.
10. RIGHTS OF USERS AS PERSONAL DATA SUBJECTS
10.1. Each User, as a Personal Data subject, has the following rights in relation to the User’s Personal Data processed by the Operator:
10.1.1. Right to information – the User may obtain from the Operator information as to whether the User’s Personal Data are being processed and, if they are, information on the purposes of processing, the composition of the data processed, their sources, the list of persons to whom the data are transferred, the processing and retention periods, and other information provided for by the legislation of the Republic of Uzbekistan.
10.1.2. Right of access to data – the User may obtain a copy of the User’s Personal Data processed by the Operator. Access is provided within 3 (three) days from receipt of the request. In technically complex cases requiring an export to be generated from several systems, the period may be extended to 10 (ten) business days, provided that the User is notified of the reasons for the extension.
10.1.3. Right to clarification and correction – the User may request clarification, correction or supplementation of Personal Data that are incomplete, inaccurate or outdated. The Operator makes the necessary changes no later than 3 (three) days after the User’s request, provided that documentary evidence confirming the accuracy of the new data is available. Personal Data found to be inaccurate are corrected immediately after the inaccuracy is established.
10.1.4. Right to erasure – the User may request deletion of the User’s Personal Data where: the processing is no longer necessary for the purposes for which the data were collected; the User withdraws consent to processing and there is no other legal basis for processing; or the data were obtained unlawfully or are processed in breach of legal requirements. The data are deleted within 3 (three) days from receipt of the request; in technically justified cases (backups, cascading deletion from distributed systems), the destruction period may be extended to 30 (thirty) calendar days, provided that access to the data is restricted immediately, except for data whose retention is required by law or is necessary to protect the Operator’s legitimate interests.
10.1.5. Right to restriction of processing – the User may request the temporary suspension of processing of the User’s Personal Data (blocking) in the cases provided for by law, including while an objection to processing is being considered.
10.1.6. Right to withdraw consent – the User may withdraw consent to the processing of Personal Data at any time by sending the relevant request to the Operator using the contact details specified in Section 15 of this Policy. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. Upon receiving the withdrawal, the Operator ceases to process Personal Data on the basis of that consent and destroys the data within 3 (three) days, unless another legal basis exists for further processing or storage. Withdrawal of consent may make certain Platform functions unavailable.
10.1.7. Right to appeal – the User may appeal against the Operator’s decisions and actions relating to the processing of the User’s Personal Data to the authorized body of the Republic of Uzbekistan responsible for protecting the rights of Personal Data subjects, as well as to a court.
10.2. To exercise the rights listed above, the User sends a written request to the Operator at the email address specified in Section 15 of this Policy. The request must contain: the name and email address associated with the Account; a description of the substance of the request; and attachments consisting of documents confirming the User’s identity and substantiating the request, where necessary.
10.3. The Operator considers User requests within 10 (ten) business days from receipt and sends a response to the applicant’s email address. This period may be extended by no more than 5 (five) business days if the Operator sends a reasoned notice.
11. PROCESSING OF DATA OF MINOR USERS
11.1. The Platform is available to Users who have reached the age of 13. Persons under 13 may not register on the Platform. If the Operator becomes aware that data relating to a person under 13 were obtained without proper consent, such data shall be deleted immediately.
11.2. For Users aged 13 to 17, a mandatory condition of registration is confirmation that parental or legal representative consent is available, given by checking the relevant box during registration. The Operator treats this confirmation as consent in electronic form that makes it possible to verify the fact of its receipt, in accordance with Article 21 of the Law of the Republic of Uzbekistan “On Personal Data”. The confirmation is recorded by the Platform system together with technical attributes. As the Platform grows, the mechanism for obtaining consent from parents and legal representatives may be expanded through additional verification tools.
11.3. The Administration may at any time expand the tools used to verify age and obtain the consent of parents or legal representatives for minor Users in line with the development of the Platform’s technical infrastructure and the current legal requirements of the countries in which it operates.
11.4. Commercial roles – Organizer, Mentor and Judge – are available only to Users who have reached the age of majority under the law of their country of residence and, in all cases, are at least 18 years old.
11.5. When processing the data of Users who are minors, the Operator pays heightened attention to data minimization and security.
12. COOKIES AND ANALYTICS
12.1. The Platform uses Cookies and similar technologies to support its operation, perform analytics and generate personalized Content. Detailed information on the Cookies used, their purposes, retention periods and management procedures is set out in the Cookie and Analytics Policy, which forms an integral part of the User Agreement.
12.2. Technical Cookies required for Platform operation (authorization session Cookies) are used on the basis of the contract with the User and do not require separate consent. Analytics Cookies are used only where the User has given explicit consent through the Cookie Management Mechanism when first visiting the Platform. The User may change consent settings at any time.
13. COOKIES AND THIRD-PARTY SERVICES
13.1. The Platform plans to use Google Analytics 4 to analyze traffic and User behavior. Google Analytics 4 is loaded only after the User has given explicit consent. By default, all analytics and advertising permissions have the status “denied”; they are activated only after the User gives consent through the Cookie Management Mechanism. The User may reject analytics or change the User’s decision at any time; rejecting analytics does not restrict Platform functionality.
13.2. Behavior data transferred to the analytics service may be sent to Google servers that may be located outside the Republic of Uzbekistan. Google Analytics processes data in accordance with Google’s privacy policy.
14. CONSENT TO THE PROCESSING OF PERSONAL DATA
14.1. The User decides freely, of the User’s own will and in the User’s own interest, whether to provide Personal Data and consent to their processing. The User’s consent to the processing of Personal Data is freely given, specific, informed and unambiguous.
14.2. In accordance with Article 23 of the Law of the Republic of Uzbekistan “On Personal Data”, the Operator notifies the subject of the purposes of Personal Data processing and the subject’s rights when the data are included in a Personal Data database. This notification is provided by allowing the User to review the Personal Data Processing Policy and the Consent to the Processing of Personal Data during registration on the Platform. Checking the relevant box during registration confirms that the User has received the notification.
14.3. Consent to the processing of Personal Data is executed as a separate document – the Consent to the Processing of Personal Data – separately from the User Agreement and other documents confirmed by the User during registration. The User expresses consent by checking the relevant box when registering on the Platform.
14.4. Where the User’s Personal Data are processed on the basis of and for the performance of the User Agreement, such processing is carried out on the basis of the contract, and separate consent is not required to the extent strictly necessary for the Operator to perform its contractual obligations.
14.5. The User may withdraw consent to the processing of Personal Data at any time in accordance with Clause 10.1.6 of this Policy.
15. FINAL PROVISIONS
15.1. Commencement of use of the Platform constitutes the User’s acceptance of this Policy. If the User does not agree with this Policy, the User must stop using the Platform.
15.2. This Policy and the relationship between the User and the Operator arising in connection with its application are governed by the legislation of the Republic of Uzbekistan, primarily the Law of the Republic of Uzbekistan “On Personal Data” dated 2 July 2019 No. ZRU-547.
15.3. This Policy is permanently available to the public on the Platform. The current version of the Policy is available at: https://dispworld.com/
15.4. All questions relating to this Policy, Personal Data processing and the exercise of Users’ rights shall be sent to the Operator using the following contact details:
Email for Personal Data inquiries: gr22attract@gmail.com
Email for legal inquiries: gr22attract@gmail.com
15.5. If one or more provisions of this Policy are declared invalid or unenforceable, the remaining provisions shall remain valid and enforceable.
OPERATOR DETAILS
GR ATTRACTOR Limited Liability Company
254, 1st Passage, Usta Shirin Street, Miskin CSG, Almazar District, Tashkent, Republic of Uzbekistan
TIN: 313127023
Bank: JSCB KAPITALBANK, Kapital 24 Branch
MFO: 01158 | SWIFT: KACHUZ22
Email: gr22attract@gmail.com
Platform website: https://dispworld.com/