1.1. Client and User Registration Data

Such data includes:

• company or sole-proprietor name
• tax ID (TIN), registration and contact details
• information about the director, accountant, signatories and other authorised representatives
• the User's full name
• job title, phone number, email address
• data required for registration, authorisation and platform access

Purpose: to register the Client, identify the User, grant access to the platform, and configure the personal workspace.

1.2. Digital Signature (E-IMZO) Data

CFO.UZ may use E-IMZO / EDS data to identify the User, verify authority, sign documents, and perform legally significant actions within the platform.

Purpose: authorisation, signing of electronic documents, confirmation of User actions, and ensuring the legal validity of operations.

1.3. Documents & Data You Upload

Users may upload or create contracts, invoices, bills, acts, delivery notes, tax invoices, payment documents, HR documents, reports, registries, and other business documents in CFO.UZ.

Purpose: creation, storage, approval, signing, accounting, and archiving of documents within the platform functionality.

1.4. Financial, Accounting, Tax & Operational Data

When using CFO.UZ, the platform may process data relating to payments, bank statements, accounting entries, tax calculations, reporting, warehouse inventory, goods, employees, payroll, counterparties, outstanding balances, and analytical metrics.

Purpose: automation of accounting, taxation, financial reporting, warehouse operations, payments, analytics, and business management control.

1.5. Technical Information

The Operator may collect technical information about platform usage, including IP address, login date and time, device type, browser, operating system, in-system actions, technical logs, and error details.

Purpose: ensuring security, preventing unauthorised access, error analysis, improving platform performance, and providing technical support to Users.

1.6. Files, Images & Device Data

Certain platform features may request access to files, the camera, or device storage in order to upload documents, scan materials, attach supporting evidence, or recognise document details.

Purpose: enabling document upload, recognition, signing, and storage functionality.

2.1. The Operator processes only the information required to provide access to CFO.UZ, operate the platform's functionality, fulfil the agreement with the Client, and comply with the legislation of the Republic of Uzbekistan.

2.2. Personal data is processed in accordance with the Law of the Republic of Uzbekistan "On Personal Data" and other applicable regulatory acts.

2.3. The Operator implements the necessary organisational and technical measures to protect data against unauthorised access, modification, destruction, copying, distribution, and other unlawful actions.

2.4. Client and User data may be retained for the duration of the contractual relationship with the Operator and for such additional periods as required to fulfil legal obligations, confirm operations, and protect the rights of both parties.

2.5. Personal data of citizens of the Republic of Uzbekistan is processed and stored in compliance with the requirements of Uzbekistan legislation.

2.6. The Operator does not transfer personal data or confidential information to third parties without the consent of the Client or User, except as required by law.

2.7. The Operator may transfer data to government authorities, banks, EDS / E-IMZO operators, technical infrastructure providers, electronic document exchange services, and other partners strictly to the extent necessary for the relevant platform functionality or compliance with legal requirements.

2.8. The Operator may use anonymised platform usage data for analytics, service quality improvement, feature development, and stability enhancement of CFO.UZ. Such data does not allow identification of a specific Client or User.

2.9. The Client independently determines which Users are granted access to the platform and is responsible for the correct assignment of access rights.

2.10. Users must safeguard their login, password, EDS, and authentication credentials, and must not share them with third parties.

3.1. Information placed by the Client on CFO.UZ may contain commercial, financial, accounting, tax, HR, and other confidential information.

3.2. The Operator undertakes not to disclose such information to third parties without the Client's consent, except in cases expressly provided for by the legislation of the Republic of Uzbekistan.

3.3. Confidential information includes, but is not limited to:

• Client documents
• Payment and banking transaction data
• Accounting and tax reports
• Employee and payroll information
• Counterparty data
• Warehouse inventory and goods transactions
• Financial analytics, reports, and management metrics
• Account settings, roles, and access rights

3.4. The obligation of confidentiality is effective throughout the period of platform use and continues after the termination of the contractual relationship for the period established by the agreement or by law.

4.1. The Operator implements security measures including separation of access rights, action logging, technical monitoring, backup copies, suspicious activity controls, and secure data transmission channels.

4.2. If a security incident is detected that may affect the Client's data or platform usage, the Operator takes remedial action and notifies the Client where required by the nature of the incident or by law.

4.3. The Client and User must immediately notify the Operator of any loss of EDS, compromise of access credentials, suspected unauthorised login, or any other security breach.

7.1. This Policy is governed by the legislation of the Republic of Uzbekistan.

7.2. For all matters not regulated by this Policy, the parties are guided by the CFO.UZ offer agreement and the current legislation of the Republic of Uzbekistan.

7.3. This Policy enters into force from the moment of its publication on the CFO.UZ website or in the platform interface.