PRIVACY POLICY
in relation to the processing of personal data

1. GENERALITIES

1.1. This policy regarding the processing of personal data (hereinafter the Policy) sets out the basic provisions regarding the processing of personal data of users of the site (hereinafter the Subject of personal data) collected by LLC "Booking System" (hereinafter the Administration) on its website hotelios.uz (hereinafter – the site).

1.2. The administration is guided by the following basic principles of personal data processing:

• the processing of personal data should be carried out on a legal and fair basis;
• the processing of personal data should be limited to the achievement of specific, predetermined and legitimate goals;
• processing of personal data incompatible with the purposes of personal data collection is not allowed;
• it is not allowed to combine databases containing personal data, the processing of which is carried out for purposes incompatible with each other;
• only personal data that meet the purposes of their processing are subject to processing;
• the content and volume of the processed personal data shall correspond to the stated purposes of processing;
• processed personal data should not be excessive in relation to the stated purposes of their processing;
• when processing personal data, the accuracy of personal data, their sufficiency, and, where necessary, relevance in relation to the purposes of processing personal data shall be ensured;
• the administration shall take the necessary measures or ensure that they are taken to remove or clarify incomplete or inaccurate data;
• storage of personal data shall be carried out in a form that allows to determine the subject of personal data, no longer than the purpose of processing personal data, if the period of storage of personal data is not established by law, the contract, one of the parties;
• the processed personal data shall be destroyed or depersonalized upon achievement of the purposes of processing or in case of loss of the need to achieve these purposes, unless otherwise provided by law.

1.3. The processing of personal data is carried out solely for the purpose of providing services, for which the subject of personal data applies to the website of the Administration.

1.4. The personal data subject makes a decision to provide his / her personal data and gives his / her consent to their processing freely, by his / her will and in his / her interest. Consent to the processing of personal data must be specific, informed and conscious. Consent to the processing of personal data may be given by the subject of personal data or his representative in any form that allows to confirm the fact of its receipt, unless otherwise provided by Law. In case of obtaining consent to the processing of personal data from the representative of the personal data subject, the powers of this representative.

2. RIGHTS OF PERSONAL DATA SUBJECTS

2.1. The subject of personal data has the right to receive the following information (hereinafter – information):

• confirmation of personal data processing by the Administration;
• legal grounds and purposes of personal data processing;
• purposes and methods of personal data processing used by the Administration;
• name and location of the Administration, information about persons (except employees of the Administration) who have access to personal data or to whom personal data may be disclosed on the basis of an agreement with the Administration or on the basis of legislation within the jurisdiction of the Administration;
• processed personal data relating to the relevant subject of personal data, the source of their receipt, unless another procedure for the submission of such data is provided by Law;
• terms of processing of personal data, including the terms of their storage;
• the procedure for the subject of personal data of his rights;
• information on the TRANS-border data transfer carried out or envisaged;
• other information provided by the current legislation within the jurisdiction of the Administration..

2.2. The subject of personal data has the right to require the Administration to clarify his personal data, block or destroy them if the personal data are incomplete, outdated, inaccurate, illegally obtained or are not necessary for the stated purpose of processing, as well as to take measures provided by law to protect their rights.

2.3. Information must be provided to the subject of personal data by the Administration in an accessible form, and they should not contain personal data relating to other subjects of personal data, except in cases where there are legal grounds for the disclosure of such personal data.

2.4. The information is provided to the personal data subject or his representative by the Administration when applying or when receiving a request from the personal data subject or his representative. The request must contain the number of the main document proving the identity of the personal data subject or his representative, information on the date of issuance of the document and the issuing authority, information confirming the participation of the personal data subject in relations with the Administration (contract number, date of the contract, verbal designation and (or) other information), or information otherwise confirming the fact of processing of personal data by the Administration, the signature of the personal data subject or his representative.

2.5. If the data, as well as the processed personal data, have been provided to the subject of personal data at his request, the subject of personal data has the right to re-apply to the Administration or send him a repeated request in order to obtain information and familiarize himself with such personal data not earlier than thirty days after the initial request or direction of the initial request.

2.6. Processing of personal data for the purpose of promoting goods, works and services on the market by means of direct contacts with a potential consumer by means of communication, as well as for political campaigning is allowed only with the prior consent of the personal data subject. The said processing of personal data shall be deemed to be carried out without the prior consent of the personal data subject, unless the Administration proves that such consent was obtained.

2.7. It is prohibited to make decisions on the basis of exclusively automated processing of personal data that give rise to legal consequences with respect to the subject of personal data or otherwise affect his rights and legitimate interests.

2.8. A decision that generates legal consequences with respect to the subject of personal data or otherwise affects his rights and legitimate interests can be made on the basis of exclusively automated processing of his personal data only if there is consent in writing of the subject of personal data or in cases provided for by Federal laws, which also establish measures to ensure compliance with the rights and legitimate interests of the subject of personal data.

2.9. The administration is obliged to explain to the personal data subject the procedure for making a decision on the basis of exclusively automated processing of his / her personal data and the possible legal consequences of such a decision, to provide an opportunity to object to such a decision, as well as to explain the procedure for protecting the personal data subject's rights and legitimate interests.

2.10. If the personal data subject believes that the Administration processes his / her personal data in violation of the requirements of the law or otherwise violates his / her rights and freedoms, the personal data subject has the right to appeal against the actions or inaction of the Administration to the authorized body for the protection of the rights of personal data subjects or in court.

2.11. The personal data subject has the right to protect his rights and legitimate interests, including compensation for damages and (or) compensation for moral damage in court.

3. RESPONSIBILITIES OF THE ADMINISTRATION

3.1. When collecting personal data, the Administration is obliged to provide the subject of personal data, at his request, with the information specified in paragraph 2.1 of this Policy.

3.2. If the provision of personal data is mandatory in accordance with the law, the Administration is obliged to explain to the subject of personal data the legal consequences of refusal to provide his personal data.