Places marked in square brackets will be filled in with the company’s details.
1. Who processes your data
The owner and operator of your personal data is [to be filled: legal name] (tax ID [to be filled: tax ID (STIR)], address: [to be filled: registered address]), “MEVASTAN” or “we” below.
This policy covers:
- the MEVASTAN mobile app (Android and iOS, app ID
uz.mevastan.app) for customers and business customers; - the mevastan.uz website;
- the Telegram bot used by MEVASTAN couriers.
We comply with the Law of the Republic of Uzbekistan “On personal data” (No. ZRU-547 of 02.07.2019) and other legislation.
Questions about personal data: [email protected].
2. Data we collect
| Category | Data | Source |
|---|---|---|
| Account | Phone number, name, app language | You enter it when you sign up |
| Confirmation code | One-time SMS code and the number of attempts | Generated by the system; a code is valid for 2 minutes |
| Addresses | Address as text (street, building, flat, landmark), a label (Home, Work, Other) and, if you choose, a point on the map | You enter them |
| Location | The device’s current coordinates | Only if you tap “My location” while entering an address and grant permission |
| Purchases | Cart, favourites, order history: products, quantity and actual weight, amounts, delivery method and time, comment, promo code used, order statuses | When you use the app |
| Payment | Payment method and status; for online payments, the transaction ID, result and masked card number from the payment provider | The app and Multicard |
| Business customer | Company name, tax ID, phone, address; after approval, registered address, bank account, bank code (MFO), director’s full name; proofs of payment (receipt, PDF), contract, invoices, reconciliation acts and other documents, debt and payment history | You or MEVASTAN’s accounting team |
| Device and technical | Push notification token, app version, operating system, IP address, request and error logs | The app and servers, automatically |
| Support requests | What you write or tell our support team | You |
We do not collect: your full card number, expiry date or CVV (they are entered only on the Multicard payment page; the payment result may include a masked card number), biometric or genetic data, your contacts, or background location. The app contains no advertising or tracking tools.
Couriers
MEVASTAN couriers (staff) work through a Telegram bot. The bot receives the courier’s Telegram ID, phone number and name and, during a shift, their Telegram live location. Only the latest point is kept, never a movement history, and it is used only to show couriers on a map to administrators.
The mevastan.uz website
The website uses no cookies or web analytics and collects no data through forms. The hosting provider (Cloudflare) may keep IP addresses and request data in technical logs for a short time to deliver the site and protect it from attacks.
3. Why we use it
| Purpose | Data | Legal basis (ZRU-547, art. 18) |
|---|---|---|
| Sign-up and sign-in | Phone number, confirmation code | Performance of the contract |
| Accepting, packing and delivering orders | Name, phone, address, order | Performance of the contract |
| Taking payments and refunds | Order amount and contents, payment status | Performance of the contract |
| Order status notifications | Notification token, order | Performance of the contract; your notification permission on the device |
| Business customers: reviewing requests, checking transfers, debt, invoices and reconciliation acts | Business customer data and documents | Performance of the contract; tax and accounting law |
| Reporting and bookkeeping | Orders and payments | Legal obligation |
| Security, fraud prevention, fixing errors | Technical data, logs | Legitimate interests of MEVASTAN and its users |
| Answering support requests | Request text, contact details | Performance of the contract; your consent |
SMS messages are sent only with confirmation codes. We do not sell your data, share it for advertising or make automated decisions based on it.
By signing up in the app you confirm that you have read this policy and consent to your data being processed for the purposes described here. You can withdraw consent at any time (section 6); your account is then deleted, because the app cannot work without this data.
4. Who we share it with
We share only what is needed to provide the service:
| Recipient | Why | Data |
|---|---|---|
| Eskiz.uz (Uzbekistan) | Sending the confirmation code by SMS | Phone number, SMS text |
| Multicard (Uzbekistan) | Online payment (Payme, Click, Uzum, Uzcard, Humo, Visa, Mastercard) and the fiscal receipt | Order number, amount and items. You enter card details directly on the Multicard page |
| Google LLC — Firebase Cloud Messaging; Apple — Apple Push Notification service | Delivering push notifications (on iOS, Firebase sends them through Apple) | Notification token and message text |
| Yandex — MapKit | Showing the map and picking an address point in the app | The map area viewed, the coordinates of the chosen point and technical device data |
| Telegram | Handing the order to a courier (via the courier bot) | Order number, your name, phone, address, map point, time slot, amount, payment method, comment |
| Server (VPS) provider | Running the app | All data stored on the server; the provider does not use it for its own purposes |
| Off-site backup storage ([to be filled: backup provider and country]) | Restoring data after a failure | An encrypted copy of the database and files; the provider cannot read it |
| Cloudflare | Delivering and protecting mevastan.uz, DNS | IP address and technical data when you visit the website |
| Zoho Mail | Email ([email protected], [email protected]) | The emails you send us and your address |
| Public authorities | Only where and as required by law | The data requested |
We share data only with organisations that provide the same or equal protection as this policy, and they use it only for the stated purpose.
Within MEVASTAN, data is seen only by staff who need it for their work — administrators, warehouse keepers, cashiers, accountants and couriers — each limited to their role.
5. Where data is stored and transfers abroad
The main database and uploaded files are stored on servers located in: [to be filled: country where the servers are located]. The encrypted backup copy: [to be filled: backup provider and country].
Firebase (Google), Apple, Yandex MapKit, Telegram, Cloudflare and Zoho servers, as well as the off-site backup storage, may be located outside Uzbekistan, so the data listed in section 4 may be transferred abroad. We carry out such transfers in line with articles 15 and 27¹ of the Law “On personal data”. We do not collect biometric or genetic data.
6. Your rights
Under article 30 of ZRU-547 you may:
- know which of your data is processed, for what purpose and who received it, and get a copy;
- have inaccurate or outdated data corrected or completed — under article 11 we do this within 3 days of your request;
- require processing to be suspended if the data is incomplete, outdated, inaccurate, unlawfully obtained or no longer needed;
- withdraw your consent and require your data to be destroyed;
- complain to the authorised state body or a court.
How to make a request:
- change your name and language, and change or delete your addresses, yourself under Profile in the app (a name is required and cannot be deleted);
- delete your account yourself under Profile › “Delete account” in the app, or send a request as described on the account deletion page;
- for anything else, write to [email protected] with the phone number your account is registered with. To confirm it is you, we may call that number.
We answer requests within the time limits set by law.
7. How long we keep data
| Data | Period |
|---|---|
| Account, addresses, cart, favourites, templates | While the account is active. Destroyed at once when deleted in the app, or within 30 days of a confirmed request |
| Confirmation codes | Valid for 2 minutes, unusable afterwards |
| Sign-in sessions and notification token | Removed when the account is deleted |
| Orders, payments, invoices, contracts, proofs of payment, reconciliation acts | The period set by accounting and tax law — at least 5 years after the reporting year. When an individual customer’s account is deleted, their name, phone, address and comment are removed from these orders; business customers’ orders keep the delivery address for invoices |
| Courier live location | Only the latest point, replaced on every update |
| Technical logs | The short period needed for security and fixing errors |
| Backups | 14 days, then overwritten automatically |
Once the purpose is achieved or the retention period ends, data is destroyed or anonymised.
8. How we protect data
- All connections between the app, the website and the servers are encrypted with HTTPS.
- The sign-in token is kept in the device’s secure storage.
- Staff sign in to the admin panel with a login and password; passwords are stored hashed; each person sees only the sections of their role, and changes are written to an audit log.
- Proofs of payment and documents open only to the business customer concerned and to authorised staff, through short-lived links.
- The database and files are backed up daily.
9. Device permissions
- Notifications — to tell you about your order’s status. You can turn them off in your phone settings at any time.
- Location — only when you tap “My location”, to find the address point.
- Camera and files — only when a business customer uploads a proof of payment.
10. Children
The app is intended for people aged 18 and over. People under 18 may use it only with the consent of a parent or legal guardian.
11. Changes
When the policy is updated, the “Last updated” date on this page changes. We will announce significant changes in the app in advance.
12. Contact
- Operator: [to be filled: legal name], tax ID [to be filled: tax ID (STIR)]
- Address: [to be filled: registered address]
- Personal data: [email protected]
- Support: [email protected], [to be filled: phone number]