Privacy Policy

General Provisions and Scope
1.1. This Privacy Policy (hereinafter referred to as the “Policy”) defines the procedures and conditions for the collection, processing, storage, transfer, and protection of Personal Data by the JV LLC “CITY PAY GATE” (hereinafter referred to as the “Company” and/or “City Pay”) in providing cryptocurrency services under the City Pay brand.
1.2. This Policy applies to all Personal Data processed by the Company during User use of the City Pay website, mobile app, and electronic platform, as well as in the performance of contracts and the requirements of the legislation of the Republic of Uzbekistan.
1.3. This Policy has been developed and is applied in accordance with the laws of the Republic of Uzbekistan, including, but not limited to:
• The Law of the Republic of Uzbekistan “On Personal Data” dated July 2, 2019, No. ZRU-547;
• The Law of the Republic of Uzbekistan “On Combating the Legalization of Proceeds from Crime, the Financing of Terrorism, and the Financing of the Proliferation of Weapons of Mass Destruction” dated August 26, 2004, No. 660-II;
• regulatory legal acts of the National Agency for Prospective Projects of the Republic of Uzbekistan;
• other legislative acts of the Republic of Uzbekistan.
1.4. This Policy applies to individuals, sole proprietors, representatives, and beneficial owners of legal entities whose Personal Data is processed by the Company.
1.5. This Policy is an integral part of the City Pay Public Offer and applies in conjunction with it. In the event of any discrepancies between the provisions of this Policy and the Public Offer, this Policy shall apply with respect to the processing of Personal Data, unless otherwise provided by the legislation of the Republic of Uzbekistan.
1.6. By using City Pay services and/or providing their Personal Data, the User acknowledges their familiarity with this Policy. In cases expressly provided for by the legislation of the Republic of Uzbekistan, the processing of Personal Data is carried out based on the express consent of the Personal Data subject.
Company Information and Status in the Processing of Personal Data
2.1. The Personal Data operator under this Policy is:
Joint Venture in the Form of Limited Liability Company “CITY PAY GATE”
• TIN: 311606433
• Registration Number: 2568777
• Legal address: 100100, Republic of Uzbekistan, city of Tashkent, Yakkasaray district, Mukhandislar MSG, Shota Rustaveli street, bldg. 53B
2.2. The Company operates in the cryptoasset sector under licenses issued by the National Agency for Prospective Projects of the Republic of Uzbekistan on February 24, 2025, including:
• Crypto Depository License No. CD # 0004;
• Crypto Store License No. CD # 0012.
2.3. For the purposes of this Policy, JV LLC “CITY PAY GATE” is the Personal Data operator and independently determines the purposes, composition, methods, and terms of Personal Data processing within the limits established by the legislation of the Republic of Uzbekistan.
2.4. The terms “City Pay”, “Company”, “we”, “us” and “our” are used interchangeably in this Policy and refer to JV LLC “CITY PAY GATE”, unless the context otherwise requires.
Sources of Personal Data and Collection Methods
3.1. City Pay collects Personal Data to the extent necessary to provide services, fulfill contractual obligations, and comply with the requirements of the legislation of the Republic of Uzbekistan, including requirements in the area of combating the legalization of proceeds from crime, the financing of terrorism, and the financing of the proliferation of weapons of mass destruction.
3.2. City Pay may obtain Personal Data in the following ways:
3.2.1. Directly from the Personal Data subject
Personal data is provided by the User (Client) independently, including:
• upon account registration and/or verification;
• by completing forms, questionnaires, and applications on the City Pay website, mobile app, or electronic platform;
• by contacting customer support, submitting inquiries, requests, or complaints;
• by participating in surveys, research, or other events organized by City Pay.
3.2.2. When using City Pay services
Personal data may be generated and collected automatically when the User uses:
• the City Pay website and mobile app;
• the functionality of the electronic platform;
• crypto asset purchase and sale services;
• other City Pay digital tools and technical solutions.
3.2.3. During communications with City Pay
Personal data may be collected through User interactions with City Pay, including:
• email;
• phone calls;
• SMS messages;
• messages in instant messengers, social media, and online chat systems;
• other communication channels used by City Pay to provide services.
3.2.4. From publicly available sources
In cases stipulated by the legislation of the Republic of Uzbekistan, City Pay has the right to obtain Personal Data from publicly available sources, including:
• state and other official registries;
• public databases;
• other sources to which access is not restricted by law.
3.2.5. From Third Parties
City Pay has the right to receive Personal Data from Third Parties if such collection:
• is carried out lawfully;
• is necessary to fulfill contractual obligations;
• is required to comply with the legislation of the Republic of Uzbekistan. Such Third Parties may include, but are not limited to:
• authorized government agencies;
• banks and other financial institutions;
• organizations that identify and/or verify Users (clients);
• other contractors and partners of City Pay engaged in the course of legitimate activities.
3.3 City Pay does not collect Personal Data unlawfully and does not process Personal Data irrelevant to the stated processing purposes.
Categories of Personal Data subject to processing
4.1. As part of providing services, City Pay processes Personal Data to the extent proportionate and necessary to achieve the processing purposes stipulated by this Policy and the legislation of the Republic of Uzbekistan.
4.2. Depending on the status of the Personal Data subject, the nature of the services provided, and legal requirements, City Pay may process the following categories of Personal Data.
4.3. Personal data provided by the Personal Data subject
4.3.1. Data provided during registration and/or verification
• last name, first name (patronymic, if applicable);
• date and place of birth;
• citizenship;
• country of residence;
• personal identification number of natural person (PINFL) and/or taxpayer identification number (TIN);
• actual and/or registered residential address;
• gender;
• photographic image (including selfies) – in cases stipulated by the identification and verification procedures;
• other identification information provided in accordance with legal requirements.
4.3.2. Documentary data
• information and copies of identity documents;
• information about documents confirming the representative’s authority (if necessary).
4.3.3. Contact information
• Phone number;
• Email address;
• Postal address (if necessary).
4.3.4. Account details
• User name;
• Unique account identifier;
• Other information required for authorization and use of City Pay services.
4.4. Personal data generated when using City Pay services
4.4.1. Activity and transaction data
• Information about the use of City Pay services;
• Cryptocurrency transaction history;
• information about actions performed within the account.
4.4.2. Technical and technological data
• IP address;
• device type and model;
• operating system;
• browser type;
• mobile device identifiers;
• other technical parameters automatically transmitted when using digital services.
4.4.3. Communication data
• recordings of telephone conversations;
• email correspondence;
• messages sent via online chat, mobile app, and other communication channels.
This data may be processed for the following purposes:
• fulfilling User requests and instructions;
• ensuring service quality;
• compliance with legal requirements;
• preventing fraud and other illegal activities.
4.5. Personal data obtained from other legal sources
City Pay has the right to process Personal Data received:
• from authorized government agencies;
• from banks and other financial institutions;
• from organizations that identify and/or verify Clients;
• from government and other official registries;
• from publicly available sources – in cases and to the extent permitted by the legislation of the Republic of Uzbekistan.
4.6. Derivative and Analytical Data
City Pay reserves the right to generate aggregated and analytical data obtained through the analysis of Personal Data, including information about User behavior within City Pay services, provided that such data is used solely for the following purposes:
• improving service quality;
• ensuring security;
• compliance with legal requirements.
4.7. Personal Data of Third Parties
When a User provides City Pay with Personal Data of Third Parties (e.g., representatives or beneficial owners), the User confirms that they have a legal basis for such provision and the consent of the relevant parties.
4.8. Limiting the Scope of Processing
City Pay does not process Personal Data that is not related to the stated processing purposes and does not collect excessive amounts of Personal Data.
The list of Personal Data categories specified in this section is not exhaustive and may be supplemented in cases stipulated by the legislation of the Republic of Uzbekistan.
Purposes and legal basis for processing Personal Data
5.1. City Pay processes Personal Data solely for purposes directly related to the provision of services, fulfillment of contractual and legal obligations, and ensuring the security and legality of its operations.
5.2. Personal data is processed on the legal grounds stipulated by the Law of the Republic of Uzbekistan “On Personal Data” and to the extent necessary and proportionate to the stated processing purposes.
5.3. Personal Data Processing for Contractual Performance
City Pay processes Personal Data for the purposes of concluding and executing contracts to which the Data Subject is a party, including the City Pay Public Offer, including for the following purposes:
• providing services related to cryptoasset turnover;
• registering, maintaining, and administering User accounts;
• processing and executing cryptoasset purchase and sale transactions;
• sending service notifications (including notifications about account logins, transactions, technical changes, and terms and conditions updates);
• processing User requests, applications, and appeals;
• suspension, restriction, or termination of services in cases stipulated by the contract and law.
5.4. Processing Personal Data to Protect Legitimate Interests
City Pay has the right to process Personal Data to protect its legitimate interests and the interests of Third Parties, provided that such interests do not violate the rights and legitimate interests of the Personal Data subject, including:
5.4.1. Ensuring the quality and development of services
• Analysis of the City Pay service;
• Improving the User interface and customer experience;
• Testing and implementing new functions and services;
• Analysis of statistical and aggregated data.
5.4.2. Ensuring security and preventing violations
• Detecting, preventing, and combating fraudulent and other illegal activities;
• Ensuring compliance with City Pay’s terms of service;
• Preventing unauthorized access to accounts;
• Ensuring information and cybersecurity.
5.4.3. Interacting with Users
• Sending notifications related to the use of services;
• Reviewing inquiries, complaints, and claims;
• Conducting surveys and quality of service research without using Personal Data for marketing purposes, unless otherwise based on consent.
5.4.4. Protecting the rights and legitimate interests of City Pay
• establishing, enforcing, and defending legal claims;
• participating in court, arbitration, and administrative proceedings;
• conducting internal audits and reviews.
5.5. Processing Personal Data to fulfill legal obligations
City Pay processes Personal Data to comply with mandatory requirements of the legislation of the Republic of Uzbekistan, including, but not limited to:
• requirements of legislation on combating money laundering, terrorist financing, and the financing of the proliferation of weapons of mass destruction;
• license requirements established by the National Agency for Promising Projects of the Republic of Uzbekistan;
• tax, accounting, and other mandatory record-keeping requirements.
For the specified purposes, Personal Data may be processed, in particular, to:
• identify and verify clients and beneficial owners;
• determine the source of funds;
• determine the admissibility of providing services to a particular person;
• identify suspicious transactions;
• provide information to authorized government agencies and auditors in cases stipulated by law;
• manage legal and financial risks;
• ensure the safety and security of data.
5.6. Processing Personal Data based on the consent of the Data Subject
In cases expressly provided for by law, City Pay processes Personal Data based on the prior consent of the Data Subject.
5.6.1. Direct Marketing
With the consent of the Data Subject, City Pay has the right to send informational and marketing messages about products, services, promotions, and updates, including via:
• email;
• SMS messages;
• push notifications;
• phone calls.
5.6.2. Withdrawal of Consent
The Data Subject has the right to withdraw consent to the processing of Personal Data for the direct marketing purposes specified above at any time:
• via the opt-out option specified in the relevant messages;
• by contacting City Pay support.
Withdrawal of consent does not affect the processing of Personal Data carried out on other legal grounds, including contractual performance and legal requirements.
5.7. Limitation of Marketing Processing
City Pay does not engage in intrusive or uncontrolled advertising processing of Personal Data and does not transfer Users’ Personal Data to Third Parties for their own marketing purposes without a legal basis.
Consequences of Failure to Provide Personal Data
6.1. Providing Personal Data is a prerequisite for using City Pay services in cases where processing such data is required for:
• concluding and executing contracts;
• compliance with the requirements of the legislation of the Republic of Uzbekistan;
• compliance with license conditions and customer identification and verification procedures.
6.2. In the event of failure to provide, or provision of incomplete or inaccurate Personal Data, City Pay has the right to:
• refuse account registration;
• suspend or restrict access to certain services;
• refuse to process transactions;
• terminate contractual relations – in the cases and according to the procedure stipulated by the Public Offer and the legislation of the Republic of Uzbekistan.
6.3. Failure to provide Personal Data may result in the inability to:
• identify and/or verify the User;
• compliance with legislation on combating money laundering, terrorist financing, and the financing of the proliferation of weapons of mass destruction;
• fulfillment of City Pay’s obligations to regulators and supervisory authorities.
6.4. City Pay is not responsible for any failure to provide services due to the User’s refusal to provide Personal Data or the provision of inaccurate information.
6.5. Detailed information on account requirements, terms of service, and grounds for refusal or termination of service is contained in the City Pay Public Offer.
Use of Cookies and Other Technical Tools
7.1. When using the City Pay website and mobile app, cookies and other similar technical tools may be used to ensure the proper functioning of the services, improve their functionality, security, and ease of use.
7.2. Cookies are used, among other things, to:
• ensure the proper functioning of the website and mobile app;
• save User settings and session parameters;
• ensure information and technical security;
• collect aggregated statistical information about the operation of City Pay services.
7.3. City Pay does not use cookies to illegally collect Personal Data or conduct covert User tracking in violation of Uzbek law.
7.4. Detailed information on the types of cookies used, their storage periods, and how to manage them is available in the Cookie Policy published on the official City Pay website. This Policy is an integral part of the Public Offer and this Privacy Policy.
Transfer and Disclosure of Personal Data to Third Parties
8.1. City Pay transfers the Personal Data of clients and other Personal Data subjects to Third Parties only in cases and to the extent that such transfer:
• is necessary for the proper provision of services and fulfillment of contractual obligations;
• is required to comply with the requirements of the legislation of the Republic of Uzbekistan;
• is carried out for the purposes of combating money laundering, the financing of terrorism, and the financing of the proliferation of weapons of mass destruction;
• is based on the consent of the Personal Data subject or other legal basis stipulated by the legislation of the Republic of Uzbekistan.
8.2. Personal Data Transfer Cases
City Pay has the right to transfer Personal Data, in particular, in the following cases:
8.2.1. To specially authorized government agencies for financial monitoring, including the Department for Combating Economic Crimes under the Prosecutor General’s Office of the Republic of Uzbekistan – regarding suspicious transactions identified during internal audits within the timeframe and manner established by law.
8.2.2. To the National Agency for Promising Projects of the Republic of Uzbekistan – as part of its monitoring, control, and oversight of City Pay’s compliance with legal requirements and licensing conditions.
8.2.3. Upon legitimate requests from law enforcement, judicial, and other government agencies – in cases and according to the procedures expressly provided for by the legislation of the Republic of Uzbekistan.
8.2.4. For the purposes of settlements, clearing, and other transactions related to the provision of City Pay services, including interactions with:
• commercial banks;
• payment service providers;
• other financial institutions.
8.2.5. Organizations that identify, verify, and screen clients and beneficial owners – as part of compliance with legal requirements and City Pay’s internal procedures.
8.2.6. With the consent of the Personal Data subject or in other cases expressly provided for by the legislation of the Republic of Uzbekistan.
8.3. Transfer of Personal Data to Contractors and Service Providers
8.3.1. City Pay may transfer Personal Data to Third Parties engaged to provide services, including, but not limited to:
• IT and technology providers;
• platform and infrastructure solution operators;
• data storage and processing providers;
• external auditors and consultants.
8.3.2. Personal data may be transferred to such parties solely on the basis of agreements that stipulate:
• use of Personal Data only on behalf of City Pay;
• maintain confidentiality;
• implement organizational and technical measures to protect Personal Data in accordance with the laws of the Republic of Uzbekistan.
8.4. Corporate Changes and Succession
8.4.1. In the event of a reorganization, merger, division, sale of a business, or transfer of assets or rights, City Pay reserves the right to transfer Personal Data to the relevant successor.
8.4.2. Such transfer is permitted provided that the receiving party undertakes to comply with the requirements of the laws of the Republic of Uzbekistan and this Privacy Policy.
8.5. Principles and Security Measures for the Transfer of Personal Data
8.5.1. When transferring Personal Data, City Pay undertakes to:
• transfer Personal Data only to the extent necessary to achieve the transfer purposes;
• require recipients of Personal Data to maintain confidentiality;
• ensure the protection of Personal Data using legal, organizational, and technical measures.
8.5.2. City Pay does not sell Personal Data or transfer it to Third Parties for their own commercial or marketing purposes.
8.6. Consent and Legal Grounds
8.6.1. By providing Personal Data to City Pay, the Data Subject confirms that:
• the Personal Data is provided voluntarily;
• they have been informed of the purposes, methods, and grounds for processing the Personal Data;
• the processing and transfer of Personal Data is carried out within the limits established by the legislation of the Republic of Uzbekistan and this Policy.
8.6.2. This Policy does not constitute a waiver by the Data Subject of their rights under the Law of the Republic of Uzbekistan “On Personal Data”.
Personal Data Retention Periods
9.1. City Pay stores Personal Data no longer than necessary to achieve the processing purposes specified in this Policy and to comply with the requirements of the legislation of the Republic of Uzbekistan.
9.2. Personal data is processed and stored:
• during the term of the contractual relationship with the User;
• and after the termination of such relationship, for the periods established by the legislation of the Republic of Uzbekistan.
9.3. In particular, in accordance with the requirements of the legislation of the Republic of Uzbekistan on combating the legalization of proceeds from crime, the financing of terrorism, and the financing of the proliferation of weapons of mass destruction, City Pay is obligated to retain:
• identification data of Users (Clients);
• identification and/or verification materials;
• transaction information and business correspondence related to servicing the User (Client),
for at least five (5) years from the date of account closure or termination of contractual relations, unless a longer retention period is required by law.
9.4. Upon expiration of the retention period, Personal Data is subject to destruction or anonymization in accordance with the legislation of the Republic of Uzbekistan, except in cases where further storage is required by law or to protect the legitimate rights and interests of City Pay.
9.5. Information on the procedure for terminating the use of City Pay services, closing an account, and the associated consequences is contained in the City Pay Public Offer.
Rights of Personal Data Subjects
10.1. In accordance with the Law of the Republic of Uzbekistan “On Personal Data” dated July 2, 2019, No. ZRU-547, a Personal Data subject has rights with respect to their Personal Data within the limits and in the manner established by the legislation of the Republic of Uzbekistan.
10.2. Subject to the conditions and restrictions stipulated by law, a Personal Data subject has the right to:
• receive information about the processing of their Personal Data, including information on the composition of the Personal Data being processed, the purposes and legal grounds for processing, the sources of data, as well as information on the persons to whom the Personal Data was transferred in cases stipulated by law;
• access Personal Data processed by City Pay and receive copies of documents and/or records containing their Personal Data, in accordance with the procedure established by the legislation of the Republic of Uzbekistan;
• request clarification, updating, and/or supplementation of Personal Data if it is inaccurate, incomplete, or outdated;
• request blocking, termination of processing, deletion, or destruction of Personal Data in cases stipulated by the legislation of the Republic of Uzbekistan;
• revoke previously given consent to the processing of Personal Data at any time if the processing is carried out on the basis of such consent, except in cases where the processing is permitted on other legal grounds. In the event of consent withdrawal, City Pay will cease processing Personal Data and ensure its deletion or destruction unless there are other legal grounds for further processing.
• Appeal City Pay’s actions or inactions related to the processing of Personal Data in court or to the authorized state body overseeing Personal Data processing.
10.3. The rights of the Personal Data subject are exercised in accordance with the procedure and within the timeframes established by the legislation of the Republic of Uzbekistan and may be limited in cases expressly provided for by law.
10.4. This section does not provide for the granting of rights to the Personal Data subject that exceed those established by the legislation of the Republic of Uzbekistan.
Ensuring the Security and Protection of Personal Data
11.1. City Pay takes the necessary legal, organizational, and technical measures to protect Personal Data from unauthorized or accidental access, destruction, modification, blocking, copying, disclosure, distribution, and other illegal actions against Personal Data.
11.2. To ensure the security of Personal Data, City Pay, in particular, implements the following measures:
11.2.1. Developing, approving, and implementing internal documents defining City Pay’s policy on the processing and protection of Personal Data, as well as local regulations establishing procedures aimed at preventing, detecting, and eliminating violations of Personal Data laws;
11.2.2. Implementing legal, organizational, and technical measures to ensure the security of Personal Data, including, but not limited to:
• Identifying and assessing threats to the security of Personal Data during its processing;
• Using information security tools in accordance with legal requirements;
• Assessing the effectiveness of measures taken to ensure the security of Personal Data;
• Establishing and enforcing rules for access to Personal Data;
• Regularly monitoring the measures taken to ensure the security of Personal Data;
11.2.3. Identifying instances of unauthorized access to Personal Data and taking measures to prevent them and minimize possible consequences;
11.2.4. Taking measures to restore Personal Data altered or destroyed due to unauthorized access, in cases stipulated by law and City Pay’s internal procedures;
11.2.5. Constantly monitoring compliance with the requirements of the legislation of the Republic of Uzbekistan and City Pay’s internal documents regarding Personal Data protection.
Contact Information
12.1. For questions related to the processing and protection of Personal Data, as well as to submit inquiries, requests, or complaints, the Personal Data subject may contact City Pay using the following contact information:
• Email address: uzsupport@citypay.io.
12.2. For general information about City Pay services, as well as to contact customer support with other questions, Users can use the “Contact Support” section located on the official City Pay website and/or mobile app.
12.3. City Pay processes requests from Personal Data subjects in accordance with the procedures and timeframes established by the legislation of the Republic of Uzbekistan.
Changes to the Privacy Policy
13.1. City Pay reserves the right to amend and supplement this Privacy Policy to reflect:
• changes in City Pay’s operations;
• changes in applicable legislation of the Republic of Uzbekistan;
• updates to business processes, technologies, and internal procedures for processing Personal Data.
13.2. In the event of significant changes affecting the purposes of Personal Data processing, the legal basis for processing, the scope of data processed, or the procedure for exercising the rights of Personal Data subjects, City Pay will take reasonable measures to notify Users, including by sending a notice to their registered email address or other available means.
13.3. Minor changes, including editorial, stylistic, technical, and other changes that do not affect the rights and obligations of Personal Data subjects, take effect upon publication of the updated version of the Policy on the official City Pay website without further notice to Users.
13.4. The current version of the Privacy Policy is published on the official City Pay website, indicating the date of the last update. Users are advised to periodically review the current version of the Policy.
13.5. Previous versions of the Privacy Policy may be available on the official City Pay website or provided upon request in accordance with the legislation of the Republic of Uzbekistan.
Language Versions and Text Precedence
14.1. This Privacy Policy has been prepared in Uzbek, Russian, and English.
14.2. In the event of any discrepancies, contradictions, or inconsistencies between the Uzbek, Russian, and English versions of this Privacy Policy, the Uzbek version shall prevail.
Final Provisions
15.1. This Privacy Policy shall enter into force upon its approval by the authorized director of the Joint Venture in form of the Limited Liability Company “City Pay Gate”, and shall apply from that date.
15.2. In the event of changes to the legislation of the Republic of Uzbekistan in the area of Personal Data, as well as in the area of combating money laundering, terrorist financing, and the financing of the proliferation of weapons of mass destruction, this Privacy Policy shall apply to the extent consistent with such legislation until such changes are made.
15.3. Any issues not regulated by this Privacy Policy shall be resolved in accordance with the current legislation of the Republic of Uzbekistan, as well as the terms of the City Pay Public Offer and other applicable internal City Pay documents.