AKAConnect Data Processing Agreement
This document forms an integral part of the Public Offer for the Provision of Access to the AKAConnect Platform and sets out the terms on which the Operator processes personal data on the Client’s instructions.
1. The parties and their roles
1.1. The Client — a person that has concluded an agreement by accepting the Public Offer. In respect of the personal data of End Users, the Client is the personal data operator within the meaning of the Law of the Republic of Uzbekistan “On Personal Data” No. ZRU-547 of 02.07.2019: it determines the purposes and the composition of the data processed.
1.2. The Platform Operator — AKACORP GLOBAL TECH LLC, TIN/STIR 312414442 (the “Processor”). In respect of the personal data of End Users, the Processor acts on the Client’s instructions and does not independently determine the purposes of their processing.
1.3. End User — a natural person who contacts the Client through a communication Channel connected by the Client, and any person whose details the Client has entered into the Platform.
1.4. This Agreement does not apply to data in respect of which the Processor is an independent operator: the Client’s account and User data, payment data, data of visitors to akaconnect.uz and the Platform’s technical logs. Their processing is governed by the Privacy Policy.
1.5. In the event of a discrepancy between this Agreement and the Public Offer as regards the processing of End User personal data, this Agreement prevails.
2. Subject matter of the instruction
2.1. The Client instructs, and the Processor undertakes, to process the personal data of End Users solely to the extent and for the purposes necessary to provide the service under the Public Offer.
2.2. The subject matter, nature, purpose and duration of processing, the categories of data subjects and the categories of data are described in Annex 1 to this Agreement.
2.3. The Client’s documented instructions consist of: the Public Offer, this Agreement with its annexes, and the settings the Client configures in the Workspace interface — including the list of connected Channels, the enabling or disabling of artificial intelligence and document recognition, automation rules and retention periods where the Platform allows them to be configured.
2.4. The Processor processes data only on the Client’s instructions. Where the legislation of the Republic of Uzbekistan obliges the Processor to process data otherwise than on instructions, it notifies the Client before processing begins, unless such notification is prohibited by law.
2.5. If, in the Processor’s view, the Client’s instruction conflicts with personal data legislation, the Processor notifies the Client and may suspend performance of the instruction to that extent.
3. The Client’s obligations
3.1. The Client warrants that it:
- has a lawful basis for processing the data of its End Users for each purpose;
- has published its own privacy notice, available to its End Users, stating that a third-party processor is engaged to handle enquiries;
- has obtained consents where consent is the basis — including for advertising and informational messages;
- has informed End Users of the use of an automated assistant, where one is enabled;
- complies with the rules of the providers of the Channels it has connected.
3.2. The Client determines the composition of data entering the Platform. The Client undertakes not to transfer through the Platform special categories of personal data — biometric data, health data, data on religious, political and philosophical views, or criminal records — without prior written agreement with the Processor and without a corresponding lawful basis.
3.3. The Client is responsible for configuring the access rights of its Users and for revoking access in good time.
3.4. The Client is responsible for the accuracy and currency of data it enters into the Platform itself.
3.5. The Client shall indemnify the Processor for losses arising from processing carried out on an unlawful instruction of the Client.
4. The Processor’s obligations
4.1. To process the personal data of End Users only on the Client’s documented instructions and only for the purposes set out in Annex 1.
4.2. To ensure that persons authorised to process the data are bound by an obligation of confidentiality.
4.3. To apply the technical and organisational protective measures described in Annex 3.
4.4. Not to use the Client’s data for its own purposes, including not to use Workspace content to train artificial intelligence models and not to transfer it to other Clients.
4.5. To ensure the logical isolation of Workspaces: one Client’s data is not accessible to another Client.
4.6. To assist the Client in discharging its obligations as operator — in the manner set out in Sections 7 and 8.
4.7. On termination of the agreement, to delete or return the data in the manner set out in Section 12.
4.8. To provide the Client with the information necessary to demonstrate compliance with this Agreement, in the manner set out in Section 13.
4.9. To maintain a record of the categories of processing carried out on the Client’s instructions.
5. The Processor’s staff and support access
5.1. Access by the Processor’s staff to Workspace data is granted on a least-privilege basis and is subject to logging.
5.2. Login by a member of the Processor’s staff to a Client’s Workspace (a support session):
- is never carried out covertly — a permanent banner indicating a support session is displayed in the interface;
- is recorded in a log stating the employee, the Workspace, the start and end time and the reason (the enquiry number);
- is permitted only where the Client has raised an enquiry or in order to resolve an incident of which the Client is notified.
5.3. The Client may request an extract from the support session log for its Workspace.
6. Artificial intelligence and document recognition
6.1. Processing by artificial intelligence and document recognition (OCR) is enabled and disabled by the Client. Disabling is available in the Workspace settings.
6.2. Where processing is enabled, the Processor transmits to the model provider the content of messages and documents necessary to generate a reply, classify an enquiry or extract text.
6.3. The Processor undertakes to conclude an agreement with the model provider that provides for:
- a prohibition on using the transmitted data to train models;
- deletion of the transmitted data after processing, or within an agreed limited period;
- confidentiality and security obligations no lower than those established by this Agreement.
6.4. The models that process personal data are deployed on the Processor’s infrastructure. Open models (DeepSeek, Kimi) are used. Clauses 6.2 and 6.3 apply where an external model provider is engaged; the Processor notifies the Client of any such engagement in the manner set out in Section 9.
6.5. External artificial intelligence services. The Processor may use external artificial intelligence services, including Anthropic and OpenAI, solely to process data that is not personal data. The content of End Users’ enquiries, the documents they upload and any other personal data are not transmitted to such services. The separation is enforced by technical means on the Processor’s side; at the Client’s request the Processor describes the mechanism applied.
6.6. The Client is aware of, and accepts, that a model’s output is probabilistic and may contain errors. The Client must define the scope of application of artificial intelligence, ensure that an enquiry can be transferred to a human employee and review replies where the cost of error is material.
6.7. An automatically generated reply is not a decision producing legal consequences for the End User. If the Client uses artificial intelligence to make decisions producing such consequences, the obligation to safeguard the data subject’s rights rests with the Client.
7. Data subject rights
7.1. Requests from End Users concerning their rights — access, rectification, deletion, restriction of processing, withdrawal of consent — are fulfilled by the Client as operator.
7.2. The Processor provides the Client with the technical means to fulfil such requests itself: search, export, rectification and deletion of data in the Workspace interface.
7.3. Where the interface tools are insufficient, the Processor assists the Client within a reasonable period not exceeding 10 working days from the date of the Client’s request.
7.4. Where an End User’s request is addressed directly to the Processor, the Processor does not respond to it on the merits, forwards it to the relevant Client without undue delay and notifies the applicant accordingly.
7.5. The Processor notifies the Client of requests received from an authorised body concerning that Client’s data, unless such notification is prohibited by law.
8. Security incidents
8.1. The Processor notifies the Client of an incident of which it becomes aware affecting the personal data of that Client’s End Users without undue delay and no later than 24 hours after the incident is established.
8.2. The notification states: the nature of the incident, the categories and approximate volume of data affected, the likely consequences, the measures taken and proposed, and a contact point. Where full information is not available at the time of notification, it is provided as it is established.
8.3. Notification of the authorised body and of data subjects is carried out by the Client as operator. The Processor provides the Client with the information necessary for such notification.
8.4. The Processor itself notifies the authorised body of incidents affecting data in respect of which it is the operator (clause 1.4).
8.5. The Processor maintains a record of incidents and of the measures taken in respect of them.
9. Sub-processors
9.1. The Client gives general consent to the Processor engaging sub-processors to provide the service under the Public Offer.
9.2. The current list of sub-processors is set out in Annex 2 and published on the Platform’s website.
9.3. The Processor concludes an agreement with each sub-processor imposing obligations no lower than those established by this Agreement, and remains liable to the Client for the acts of the sub-processor as for its own.
9.4. The Processor notifies the Client of an intended replacement or addition of a sub-processor at least 30 calendar days in advance — through the Platform interface and by email.
9.5. The Client may submit a reasoned objection within 14 calendar days of the date of notification. The parties shall seek a solution in good faith; if no solution is found, the Client may terminate the agreement as regards the affected service, with a refund in the manner set out in the Public Offer, Section 11.
9.6. Which sub-processors are engaged for a particular Workspace depends on the Channels and features enabled by the Client.
10. Localisation and cross-border transfer
10.1. Personal data is processed in accordance with Article 27-1 of the Law of the Republic of Uzbekistan “On Personal Data” as amended by Law No. ZRU-1125 of 26.03.2026.
10.2. Mandatory localisation. Biometric data, genetic data and data of users of services of telecommunications operators of the Republic of Uzbekistan are processed and stored in databases physically located within the territory of the Republic of Uzbekistan and are not transferred outside it. The Platform is not intended for the processing of biometric or genetic data (clause 3.2 of this Agreement).
10.3. Other personal data may be processed and stored outside the Republic of Uzbekistan where one of the conditions of Article 27-1 of the Law is met: transfer to a state included in the list of states ensuring an adequate level of personal data protection approved by the Cabinet of Ministers of the Republic of Uzbekistan; application of standard contractual clauses or binding corporate rules meeting the requirements of the authorised state body; or compliance with international standards, the list of which is approved by the authorised state body.
10.4. The basis relied upon. The Processor relies on the first of the bases in clause 10.3 — transfer to states included in the list approved by Resolution of the Cabinet of Ministers of the Republic of Uzbekistan No. 415 of 29.07.2026. The Processor ensures that each recipient located outside the Republic of Uzbekistan processes data in a state included in that list, or that the transfer is made on another basis under clause 10.3.
10.5. A cross-border transfer arises in the following cases:
| Case | What is transferred | Basis |
|---|---|---|
| The cloud infrastructure provider, where located outside the Republic of Uzbekistan | Data to the extent stored and processed | Clause 10.4 |
| WhatsApp Business Platform | The End User’s identifier and message content | Clause 10.4; the transfer is unavoidable once the Client connects the Channel |
| Telegram | The End User’s identifier and message content | The same |
| An email provider outside the Republic of Uzbekistan | The address and content of the message | Clause 10.4 |
| Google (reCAPTCHA) | IP address, browser and device information | Clause 10.4 |
External artificial intelligence services (Anthropic, OpenAI) are not listed in this table: personal data is not transmitted to them (clause 6.5), so no cross-border transfer of personal data arises on that basis.
10.6. By connecting a Channel, the Client accepts that the content of messages in that Channel passes through its provider’s infrastructure on that provider’s terms. The Client must reflect this in its own privacy notice.
10.7. Registration of the personal data database is carried out by the Processor in the state register in those cases where the mandatory localisation requirement applies to the data processed, in the manner set out in Article 20 of the Law.
10.8. Notification of a leak during cross-border transfer. On discovering a leak of personal data in the course of a cross-border transfer, the Processor notifies the authorised state body within 24 hours of establishing the fact and, within 72 hours, provides information on the causes and the measures taken, while informing the Client in the manner set out in Section 8.
11. Security
11.1. The Processor applies the technical and organisational measures described in Annex 3.
11.2. The measures are reviewed in the light of technological developments and the nature of the data processed. A change of measures must not reduce the level of protection achieved.
11.3. The Client is responsible for measures on its side: keeping Users’ authenticator devices and keys safe, timely revocation of access, and the security of its own integrations and API keys.
12. Return and deletion of data
12.1. The Client may at any time export the content of its Workspace in a machine-readable format using the Platform’s tools.
12.2. On termination of the agreement, Workspace data is retained for 30 calendar days for export, after which it is deleted or anonymised within the following 30 calendar days.
12.3. The Client may request early deletion. Deletion is irreversible.
12.4. Excluded from deletion is data which the Processor is required by law to retain — accounting, tax and payment documents — and data in respect of which the Processor is an independent operator (clause 1.4).
12.5. Backups are deleted in accordance with the backup rotation cycle, the period of which is stated in Annex 3. Until deletion, backups remain protected on the general basis and are not used to restore deleted data other than in the course of disaster recovery.
12.6. At the Client’s request the Processor provides written confirmation of deletion.
13. Demonstrating compliance and audits
13.1. The Processor provides the Client on request with the information necessary to demonstrate compliance with this Agreement: a description of the measures applied, the list of sub-processors and information on where data is stored.
13.2. The Client may audit compliance with this Agreement no more than once every 12 months, giving the Processor at least 30 calendar days’ notice, and at any time following a confirmed incident affecting that Client’s data.
13.3. An audit is conducted during working hours, must not disrupt the operation of the Platform and may not extend to the data of other Clients or to information constituting the Processor’s trade secrets.
13.4. The Processor may offer, as sufficient evidence, an independent auditor’s report or a valid certificate of compliance, where obtained.
13.5. The costs of an audit initiated by the Client are borne by the Client, except where the audit reveals a material breach by the Processor.
14. Liability
14.1. Each Party is liable for breaches of personal data legislation within the scope of its role and its own acts.
14.2. The limitation on the Processor’s aggregate liability established by the Public Offer, clause 20.4, also applies to this Agreement, except where its application is not permitted by law.
14.3. The Client shall reimburse the Processor for amounts recovered from the Processor as a result of an unlawful instruction of the Client or a breach by the Client of Section 3.
15. Term and amendment
15.1. This Agreement is in force for the term of the agreement under the Public Offer and, as regards the obligations under Section 12, until deletion of the data is complete.
15.2. The Processor may amend this Agreement on giving the Client at least 30 calendar days’ notice. Amendments may not reduce the level of protection of End User data.
15.3. This Agreement is drawn up in the state language. The Russian and English versions are provided for the Client’s convenience; in the event of a discrepancy, the version in the state language prevails.
Annex 1. Description of the processing
Subject matter of the processing: the handling of enquiries from the Client’s End Users and of the associated data by means of the Platform.
Duration of the processing: the term of the agreement under the Public Offer plus the periods established by Section 12.
Nature and purpose of the processing: receipt, storage, display, routing, search, classification, automated reply, text recognition, generation of anonymised reporting, backup, deletion.
Categories of data subjects:
- End Users who have contacted the Client through connected Channels;
- persons whose details the Client has entered into the Platform (customers, leads, contacts).
Categories of personal data:
| Category | Composition | Source |
|---|---|---|
| Channel identifiers | Telegram identifier, WhatsApp phone number, email address, web chat session identifier | Communication Channel |
| Contact data | Name, phone number, email address | End User or Client |
| Enquiry content | Message text, attachments, files, voice messages | End User |
| Ticket and task data | Subject, description, status, priority, change history, comments | The Client and its Users |
| Customer and lead records | Information entered by the Client | Client |
| Documents for recognition | Images and files of documents and the text extracted from them | End User or Client |
| Technical enquiry data | IP address, device type, page of origin, time | Automatically |
Special categories of personal data: not provided for (clause 3.2).
Annex 2. Sub-processors
| Sub-processor | Purpose | Data processed | Place of processing |
|---|---|---|---|
| The open models DeepSeek and Kimi on the Processor’s infrastructure | Generation of replies, classification of enquiries, document recognition | The content of enquiries and documents | The Processor’s infrastructure; not transferred to third parties |
| Cloudflare, Inc. | Delivery and protection of the Platform’s websites | IP address and request details of every visitor and User | The provider’s infrastructure |
| Cloud infrastructure provider | Hosting of the Platform and data storage | All categories in Annex 1 | As stated in the current version of the list |
| Telegram | Delivery of messages in the Telegram Channel | Identifier and message content | The provider’s infrastructure |
| WhatsApp Business Platform | Delivery of messages in the WhatsApp Channel | Phone number and message content | The provider’s infrastructure |
| SMS provider | Confirmation codes and notifications | Phone number, message text | Republic of Uzbekistan |
| Email provider (Resend) | Delivery of email | Address and content of the message | As stated in the current version of the list |
| Google (reCAPTCHA) | Protection of forms against automated requests | IP address, browser and device information | The provider’s infrastructure |
| Octobank JSC, the “Octo” service | Acceptance of payment, refunds, examination of disputed transactions | The Client’s payment data (not End Users’ data) | Republic of Uzbekistan |
The current version of the list is published on the Platform’s website. For each recipient located outside the Republic of Uzbekistan, the state of processing must be included in the list approved by Resolution of the Cabinet of Ministers of the Republic of Uzbekistan No. 415 of 29.07.2026, or the transfer must be made on another basis provided for by Article 27-1 of the Law.
Anthropic and OpenAI are not sub-processors of personal data: only data that is not personal data is transmitted to those services (clause 6.5).
Annex 3. Technical and organisational measures
| Area | Measure |
|---|---|
| Data transmission | TLS for all connections; a valid SSL certificate on all Platform domains |
| Storage | Encryption of data at rest; storage of secrets outside the software code |
| Access control | A role model within the Workspace; least-privilege access for the Processor’s staff; two-factor authentication for administrative access |
| Isolation | Logical isolation of Workspaces; access to one Client’s data from another Workspace is prohibited |
| Logging | An administrative action log within the Workspace; a support session log; a log of access to personal data |
| Backup | Regular backups; backup retention period and restore testing in accordance with the Processor’s internal rules |
| Vulnerability management | Dependency updates; security testing in accordance with the Processor’s internal rules |
| Personnel | Confidentiality undertakings; training on personal data processing |
| Incident response | The procedure for detection, classification and notification under Section 8 |
| Deletion | The procedure under Section 12; confirmation of deletion at the Client’s request |
16. Data processing contacts
Personal Data Protection Officer, AKACORP GLOBAL TECH LLC
Email: [email protected]
Telephone: +998 50 744 41 31
