Privacy policy

This Policy describes the rules for processing personal data of Makonkey users (makonkey.uz, mobile apps, Telegram bot, partner APIs).

Personal data means any information relating to an identified or identifiable natural person: full name, phone, email, passport details, geolocation, cookies, on-site activity history.

By continuing to use the service, you confirm your agreement with this Policy.

The data controller is [COMPANY NAME] LLC, registered in the Republic of Uzbekistan and a resident of IT Park Uzbekistan (see /legal/imprint).

The controller is included in the Register of Personal Data Operators of Uzbekistan. The data protection officer (DPO): privacy@makonkey.uz.

Contacts for requests: privacy@makonkey.uz; postal address — see /legal/imprint.

On registration: name, +998 phone number, email address, selected role (buyer, owner, agent).

When posting a listing: property address, characteristics, photos, price, description, deal type.

During service use: search and browsing history, favourites, saved selections, chat messages, reviews and ratings.

For escrow transactions: passport details of the parties, account details, property documents (stored encrypted with AES-256-GCM).

Technical data: IP address, device and browser type, OS, session identifiers, timestamps, referer.

Geolocation: approximate location from IP, or precise (with permission) — to suggest nearby properties.

We process data only for the following purposes: — registering and authenticating users; — displaying listings and matching suitable properties; — sending notifications on saved searches, chat, transactions; — processing payments and escrow transactions; — content moderation and fraud prevention; — improving the service (behaviour analysis, A/B testing); — communication with users (support, claims, surveys); — complying with Uzbek law (reporting, requests from authorised bodies).

We do not use your data for purposes other than those listed in this Policy without your separate consent.

Personal data is processed on the following bases: — user consent (registration, service use); — performance of a contract (provision of Platform services); — compliance with Uzbek law; — protection of legitimate interests of the controller and third parties (fraud prevention, security); — protection of life, health and other vital interests of the subject.

Consent can be withdrawn at any time via profile settings or a written request.

Account data: throughout the lifetime of the account plus 1 year after deletion (to resolve potential disputes).

Transaction and payment data: 5 years from the transaction date, as required by tax and financial law.

Logs and technical data: 90 days, after which they are anonymised for statistical purposes.

Moderation data (rejected listings, suspended users): 3 years to prevent repeat violations.

Marketing consents: until withdrawn, but no longer than 3 years from last activity.

After the retention periods expire, data is deleted or anonymised (aggregated such that no link to a specific user remains).

We do not sell your personal data. Sharing is possible in the following cases: — with partner processors (Click, Payme payment providers; Eskiz.uz SMS provider; cloud storage; transactional email services) — only to the extent required to provide the service; — with partner banks for mortgage applications (only with your separate consent); — upon request from authorised state bodies under the procedure established by law; — in case of company reorganisation (merger, acquisition) — with prior user notification; — with other service users — only data you publish yourself (name and phone in a listing).

All partners are required to maintain confidentiality and process data solely as we instruct.

Data is stored on servers located in the Republic of Uzbekistan, in accordance with personal-data localisation requirements (Decree UP-6079).

Limited technical data (Sentry monitoring logs, Plausible/Yandex Metrica analytics) may be processed outside Uzbekistan. We use only anonymised data or apply additional safeguards (encryption, access controls).

Cross-border transfer of personal data that requires consent (e.g. mortgages via international programmes) is carried out only with your prior written consent.

You have the right to: — receive information about what data is processed and for what purposes; — receive a machine-readable copy of your data (right to portability); — request correction of inaccurate or incomplete data; — request deletion (right to be forgotten) — except where retention is required by law; — restrict processing; — object to processing for direct marketing; — withdraw previously given consent; — lodge a complaint with the supervisory authority (State Inspectorate for Personal Data Protection of the Republic of Uzbekistan).

To exercise your rights, send a request to privacy@makonkey.uz. Response time: up to 30 days. For complex requests we may extend the period to 60 days with a notice.

We apply organisational and technical measures to protect your data: — encryption in transit (TLS 1.3) and at rest for sensitive data (AES-256-GCM for passport details and bank credentials); — password hashing (argon2id) — passwords are never stored in plain text; — two-factor authentication (optional, via SMS or TOTP); — least-privilege access control; — regular security audits and penetration tests; — encrypted backups; — protection against automated attacks (rate-limiting, CAPTCHA, anomaly monitoring); — staff training and confidentiality agreements.

In case of a breach likely to cause material harm to data subjects, we will notify the supervisory authority within 72 hours and affected users within a reasonable period.

We use cookies, browser local storage and similar technologies. Details — in the Cookie Policy (/legal/cookies).

In short: essential cookies are always on (the site won't work without them); analytics and marketing cookies require your consent via the cookie banner.

The service is not intended for persons under 18. We do not knowingly collect data from minors.

If you become aware that we have received a child's data without parental or legal-guardian consent, please notify privacy@makonkey.uz immediately — we will delete such data.

We may update this Privacy Policy when laws change, new features are introduced, or as a result of audits. The current version is always available at makonkey.uz/legal/privacy.

We notify you of material changes (new processing purposes, new recipients) 14 days in advance via email and push notification, with an option to withdraw consent.

Minor changes take effect from publication.

Send all data-processing questions to the data protection officer (DPO): Email: privacy@makonkey.uz Postal address: see /legal/imprint

If you believe your rights have been violated, you may also contact: — the State Inspectorate for Personal Data Protection of the Republic of Uzbekistan; — the court at your place of residence or the controller's location.