Scope and data controller

This policy applies to personal information processed through shahnur.software and shahnursoftware.uz, our contact and enquiry channels, business development communications, and the administration of our client and supplier relationships.

ShahNur Software LLC, based in Tashkent, Republic of Uzbekistan, is the controller of personal information processed for these purposes unless a different entity is identified in a project-specific notice or agreement.

When we build or operate a product on a client's instructions, the client may be the controller and ShahNur Software may act as its processor. In that situation, the client's privacy notice and our agreement with that client determine how the information is handled.

Information we collect

The information we collect depends on how you interact with us. It may include:

• Identity and contact details, such as your name, business email address, telephone number, company, role, and preferred language.
• Enquiry and project information, including your message, objectives, budget range, technical requirements, files, and other information you choose to provide.
• Commercial and relationship information, such as proposals, contracts, billing details, project history, feedback, and correspondence.
• Technical and usage information, such as IP address, browser and device type, operating system, referring page, pages visited, approximate location derived from IP, event timestamps, and analytics identifiers.
• Security and compliance information needed to prevent abuse, investigate incidents, verify authority, comply with law, or protect our legal interests.

How we collect information

We collect information directly from you when you complete a form, email or call us, request a proposal, enter into an agreement, attend a meeting, or otherwise communicate with us.

We also collect limited technical information automatically through server logs, cookies, pixels, analytics tools, and similar technologies. In appropriate business contexts, we may receive professional contact information from your employer, colleagues, service providers, referral partners, or publicly available business sources.

Why we use information

Depending on the circumstances and the law that applies, we process personal information with your consent, to take steps at your request before entering into a contract, to perform a contract, to comply with legal obligations, or for legitimate interests that are not overridden by your rights.

• To receive, route, and respond to enquiries and prepare proposals.
• To negotiate, deliver, support, secure, and administer software and related services.
• To manage client, supplier, and partner relationships, invoicing, records, and internal operations.
• To operate, troubleshoot, measure, and improve our websites, services, content, and user experience.
• To protect users, systems, and our business against spam, misuse, fraud, security threats, and legal claims.
• To comply with legal, tax, accounting, regulatory, and lawful government requirements.
• To send relevant business communications where you have requested them or where otherwise permitted by law, with an option to opt out.

Contact forms and communications

When you submit our contact form, we process the details entered in the form, the page from which the request was sent, the selected website language, and the submission time. We use this information to review, route, and respond to the request and to maintain an appropriate business record.

Form submissions may be delivered to authorised members of our team through Telegram's bot and messaging infrastructure. Please use the form only for information that is appropriate for this communication channel. We may retain subsequent email, telephone, or meeting correspondence as part of the enquiry or client record.

Cookies and analytics

Our websites may use cookies, local storage, server logs, and similar technologies for functionality, security, performance measurement, and analytics. We currently use Google Analytics and Yandex Metrica where they are enabled in our website configuration. These providers may process technical and usage information under their own terms and privacy documentation.

You can restrict or delete cookies through your browser settings and may use provider opt-out tools where available. Blocking some technologies can affect website functionality. Where applicable law requires consent for non-essential technologies, consent is the relevant legal basis and may be withdrawn at any time without affecting earlier lawful processing.

When we share information

We do not sell or rent personal information. We disclose it only when reasonably necessary for the purposes described in this policy, subject to appropriate confidentiality, security, and contractual controls where required.

• To authorised ShahNur Software personnel and contractors who need the information for their work.
• To hosting, cloud, communications, analytics, security, development, payment, accounting, and other service providers acting for us.
• To professional advisers, auditors, insurers, banks, and prospective transaction parties under appropriate duties of confidentiality.
• To courts, regulators, law-enforcement bodies, or other authorities when disclosure is required or permitted by law.
• To protect the rights, safety, property, and security of ShahNur Software, our clients, users, or others, or to establish, exercise, or defend legal claims.
• In connection with a merger, investment, financing, reorganisation, sale of assets, or similar corporate event, subject to lawful safeguards.

International data transfers

We operate from Uzbekistan and work internationally. Our service providers, clients, and team members may therefore process information in countries other than the country where it was collected. Those countries may have different data-protection laws.

When a cross-border transfer requires safeguards, we use appropriate legal and organisational measures, which may include contractual protections, adequacy mechanisms, data processing agreements, access controls, transfer assessments, or another lawful basis. Certain categories of data may also be subject to localisation or transfer restrictions under applicable Uzbek law.

How long we keep information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including to provide services, maintain business and security records, meet legal and accounting duties, resolve disputes, and enforce agreements.

• General enquiries are ordinarily retained for up to 24 months after the last substantive interaction, unless they lead to a client relationship or a longer period is justified.
• Client, supplier, transaction, and project records are retained for the contract term and applicable statutory, limitation, tax, accounting, audit, and dispute periods.
• Security logs are generally retained for up to 12 months unless an incident, investigation, or legal duty requires longer retention.
• Analytics data is retained according to our configuration and the applicable provider settings, and may be aggregated or de-identified.

Security

We use reasonable administrative, technical, and organisational measures designed to protect personal information against unauthorised access, loss, alteration, disclosure, or destruction. Measures are selected with regard to the nature, scope, context, and risk of the processing and may include access controls, least-privilege practices, encryption in transit, backups, monitoring, secure development practices, and confidentiality obligations.

No website, transmission method, or storage system is completely secure. We therefore cannot guarantee absolute security. You are responsible for using secure devices and channels and for informing us promptly if you suspect an unauthorised disclosure or security issue involving your interaction with us.

Your privacy rights

Depending on your location and the applicable law, you may have rights to receive information about processing, access personal information, correct inaccurate information, request deletion or restriction, object to certain processing, receive portable information, and withdraw consent.

Rights are not absolute. We may need to verify your identity and authority before acting, and we may retain or continue processing information where a legal exemption, contractual necessity, overriding legitimate ground, or legal obligation applies. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

• Send requests to info@shahnur.software and describe the right you wish to exercise.
• We may ask for proportionate information to verify identity and prevent unauthorised access.
• You may opt out of marketing communications at any time by using the provided mechanism or contacting us.
• You may also lodge a complaint with the competent data-protection or regulatory authority in your jurisdiction.

Children's privacy

Our website and business services are intended for organisations and adults and are not directed to children. We do not knowingly solicit personal information from children through the website. If you believe a child has provided information to us without appropriate authorisation, contact us so that we can assess and take appropriate action.

Automated decision-making

We do not use information collected through our general website enquiry process to make solely automated decisions that produce legal or similarly significant effects. If this changes for a particular service, we will provide an appropriate notice and any rights required by law.

Third-party websites and services

Our website may link to services, social platforms, client projects, or websites operated by others. We do not control their privacy or security practices. Their own notices and terms apply when you leave our website or interact with their services.

Changes to this policy

We may update this policy to reflect changes in law, technology, our services, or our practices. The revised version will be posted on this page with an updated date. If a change materially affects how we use information already collected, we will provide additional notice or request consent where required by law.

Contact and complaints

Questions, requests, or complaints about this policy may be sent to ShahNur Software LLC at info@shahnur.software or directed to our office in Tashkent, Republic of Uzbekistan. Please include enough detail for us to identify the relevant interaction and respond appropriately.

We will review privacy complaints in good faith. You also retain the right to contact the competent supervisory, data-protection, consumer-protection, or judicial authority where applicable.