Revision 7 dated 11 September 2026. The current contact-form version was introduced on 10 September 2026.
1. Controller
In this Policy, the legal entity specified above is referred to as “iSystems” or the “controller”.
2. Scope
This Policy applies to personal-data processing connected with use of the public pages of isystems.uz, the server-side contact form, related technical logs, and subsequent business communication about an inquiry.
This Policy does not automatically apply to information systems or projects that iSystems develops or operates for clients; separate agreements and data-processing documents may apply to those relationships.
3. Data processed
Contact form. The user directly provides a name, work email address, project description and, optionally, company name. The server also records a unique inquiry number, form language, the legal basis of taking steps at the user’s request before a possible contract is concluded, acknowledgement of the Policy, confirmation that a request is being submitted, the Policy version and cryptographic checksum of its archived revision, and server timestamps for request acknowledgement and creation, expressed in a common international time format. New ordinary contact-form requests do not record separate information about the consent previously obtained.
Technical data. To protect the form, an IP address may be used briefly in memory by the request-rate limiter. The IP address and information about the browser type and version are not stored in the inquiry record. The server address that receives contact-form submissions does not keep an HTTP access log, and the application operating log does not contain the user’s name, email address or message text.
Browser-local state. The site uses persistent browser-local storage only for the selected interface theme and temporary session storage to restore page position briefly when switching languages. Contact-form content is not written to either store.
4. Purposes of processing
- receiving, reviewing and routing an inquiry;
- contacting the requester and discussing a potential project or services;
- taking steps at the data subject's request before a possible contract is concluded;
- protecting the form, preventing abuse and diagnosing technical errors;
- documenting the lawfulness of prior processing and protecting the rights of iSystems and the data subject within applicable law.
5. Legal grounds and minimization
The primary legal basis for processing ordinary contact-form data is the necessity to take steps at the data subject’s own request before potentially entering into a contract, as provided by Article 18 of Law No. ZRU-547. The second required confirmation control records that the user is submitting such a request and asks iSystems to make contact; it is not a separate consent to personal-data processing. Separate consent is used only in other cases where iSystems selects consent as the independent legal basis and obtains the particulars required by law.
The data set is limited to what is necessary and sufficient for these purposes. The form is not intended for special personal data, biometric or genetic data, state secrets, trade secrets, or other information requiring a special protection regime.
The principal applicable act is the Law of the Republic of Uzbekistan dated 2 July 2019 No. O‘RQ-547 “On Personal Data”, as amended. If a translation differs from the official text, the official Uzbek text prevails.
6. How the server form works and how the request is evidenced
When the user submits the form, the browser transmits the data over an encrypted connection to the iSystems server that receives the contact form. Before submission, iSystems does not store the form contents and the site does not write them to browser-local storage.
The server revalidates required fields, data format and size, acknowledgement of the Policy, confirmation of the request, language and Policy version. After successful validation, the inquiry and request evidence are written in a single indivisible operation. If storage does not complete, the user does not receive a success response.
Request evidence includes the unique inquiry number, the legal basis of taking steps at the user’s request before a possible contract is concluded, acknowledgement of the Policy, confirmation that the request was submitted, the Policy version, cryptographic checksum of the published archive revision and server time in a common international format. After storage, the system sends an internal notification over an encrypted connection to the corporate mail server to the corporate mailbox info@isystems.uz. The notification contains the name, company (if provided), email address, inquiry text, language, time and unique inquiry number. The service parameters of the email set the reply address to the requester’s email address so an authorized person can reply directly from corporate email. The corporate mail server and the info@isystems.uz mailbox are hosted on the same iSystems server in the Republic of Uzbekistan; form contents are not sent to an external cloud email provider. The server-side record remains the authoritative record of the inquiry.
7. Recipients, processing location and cross-border transfers
Inquiry content is available only to authorized iSystems personnel who need it to review the inquiry, administer the protected store or meet statutory obligations. Form contents are not sent to external customer-management, analytics or advertising systems, third-party form-processing services, or automated visitor-verification services.
The primary repository, local backups, and the corporate mail server hosting info@isystems.uz are located on the same iSystems server in the Republic of Uzbekistan. When the virtual-server service was arranged, iSystems received confirmation that the infrastructure is hosted in the Republic of Uzbekistan; for the current processing scope, this is accepted as the basis for determining the hosting country. Network registration data is treated only as an additional technical indicator and does not replace that confirmation. If the provider, facility or replication arrangement changes, the hosting country will be reassessed before the processing change.
No routine cross-border transfer of contact-form content is intended. If storage, processing or transfer outside the Republic of Uzbekistan is required in the future, iSystems will identify the country, recipient and applicable condition under Articles 15 and 27¹ of Law No. O‘RQ-547 and update this Policy before that operation begins.
Under the literal text of the current second part of Article 27¹, mandatory storage in Uzbekistan applies to biometric data, genetic data, and data of individuals using services of telecommunications operators operating in Uzbekistan. The current contact form does not request those categories. If the data set or service changes, the applicability of State Register requirements under Article 20 and Article 27¹ will be reassessed before the processing change.
8. Retention, erasure and backups
An inquiry that does not become part of a contractual or project relationship is retained for no more than 180 days from receipt unless the processing purpose is achieved or ceases earlier. The name, company, email address and message are then erased.
Email copy of the inquiry. The notification in info@isystems.uz is an operational copy used to review and answer the inquiry. When the inquiry is closed, transferred to a separate contractual/project process, or an erasure request is fulfilled, the responsible person deletes the original notification and its copies from working mail folders and Trash without undue delay and in any event within three days. Any subsequent business correspondence, if created, belongs to the relevant separate process and its retention rules.
Once the purpose of the contact-form processing is achieved — including when an inquiry is closed without further engagement or necessary information has been moved into a separate contractual or project process — direct personal data in the original contact record are destroyed without undue delay and in any event within three days. Standard procedures for closing an inquiry or transferring it into a separate contractual or project process erase these data immediately; a daily automated check of retention periods provides an additional control. This limit reflects paragraph 23 of Model Procedure No. 3478.
A technical record evidencing the request, without name, company, email address or message, may be retained for up to three years from the request acknowledgement date where a lawful basis remains for documenting prior processing and protecting rights; it is deleted earlier if that basis no longer exists. Historical records created under the previous consent model retain their own information about the consent previously obtained and retention clock. A technical identifier used to prevent duplicate processing of the same submission is kept for no more than 24 hours. The application operating log is kept for up to 7 days.
Backups: after the automated retention check runs, a local backup of the contact database is created once per day on the same server. The copy contains encrypted data, does not contain the primary encryption key, is accessible only to a dedicated technical account, is created with file permissions that allow only the file owner to read or modify the file, and is retained for no more than 2 days so that earlier copies containing personal data already erased from the active database also expire within the three-day destruction window.
Resilience limitation: a same-server backup protects against some logical failures and accidental deletion, but it is not an independent recovery copy for a complete infrastructure failure and does not protect against total loss of the server or its disk subsystem. iSystems intentionally uses this model for the current processing environment; the Policy is reviewed before any change in backup location, recipients or method.
9. Cookie files, browser-local storage and external services
The current site does not set its own cookie files, use analytics or advertising cookie files, or load third-party tracking tools. A separate notice about cookie files is therefore not used.
Persistent browser-local storage and temporary session storage are used only for the interface purposes described in section 3. If the composition or direction of data transfers changes, this section and, where necessary, the user-notice mechanism will be reviewed before or at the same time as new processing is introduced.
10. Data subject rights and termination of processing
A data subject may request information about the existence and composition of their personal data and its processing, ask for correction, temporary suspension, restriction or termination of processing and destruction where provided by law, and give or withdraw consent.
A request for correction, restriction, termination of processing or erasure may be sent to info@isystems.uz. It is advisable to provide the email used in the form and/or the unique inquiry number. To prevent disclosure to another person, iSystems requests only reasonably necessary identity verification; a passport is not automatically required. Where processing in a separate process is based on consent, the data subject may also withdraw that consent in the prescribed manner.
11. Security and confidentiality
iSystems applies legal, organizational and technical measures proportionate to the processing, including encrypted connections, server-side input validation, safe storage queries, request size and rate controls, an isolated server process, minimized logging, access control, and indivisible recording of the inquiry together with request evidence.
Data are not published or disclosed to third parties without the subject's consent or another applicable lawful basis. Access is granted on a need-to-know basis.
Storage encryption. Name, company, email address and message are stored only in encrypted form with integrity protection and a 256-bit key. Each record uses its own random encryption parameter, and the inquiry context is cryptographically bound to the encrypted data. The primary encryption key is stored separately from the database and is made available only to the server process through a protected system mechanism. Email-address lookup stores only a non-reversible cryptographic verification value.
Access auditing. Administrative content access, search, correction, restriction, contract handoff and erasure actions are recorded in a separate semantic audit trail without the personal-data content itself. Interactive access to the storage directory is additionally recorded in the operating system audit log. Backups contain the encrypted data but not the encryption key.
12. Document versions and contact
The current version is published at isystems.uz/en/privacy.html. The version changes when the legal text changes materially. To verify request evidence, iSystems retains the published archived text version of the Policy, whose cryptographic checksum is stored with the inquiry.
Questions about personal-data processing may be sent to info@isystems.uz.