AKA CONNECT Privacy Policy

Version 1.2 · 30 September 2026

This document has been prepared to meet the requirements of Octobank JSC for the Merchant's website (Annex No. 3 to the Rules for the Provision of Internet Acquiring Services, clause IV.8) and the Rules for the Provision of Internet Acquiring Services of Octobank JSC, version No. 3, and to comply with the Law of the Republic of Uzbekistan "On Personal Data" No. ZRU-547 as amended by Law No. ZRU-1125 of 26.03.2026 (in force 27.03.2026) and Resolution of the Cabinet of Ministers of the Republic of Uzbekistan No. 415 of 29.07.2026.

1. General provisions

1.1. This Policy sets out the procedure for the collection, processing, storage, transfer and protection of personal data in connection with the use of the AKA CONNECT platform (the "Platform").

1.2. The personal data operator is AKACORP GLOBAL TECH LLC (the "Operator"), TIN/STIR 312414442, registered address: Farg'ona viloyati, Farg'ona shahri, Mash'al MFY, Mustaqillik shoh ko'chasi, 3S-uy.

1.3. This Policy has been developed in accordance with the Law of the Republic of Uzbekistan "On Personal Data" No. ZRU-547 of 02.07.2019, the Law of the Republic of Uzbekistan "On Electronic Commerce" No. ZRU-792 of 29.09.2022 and the Law of the Republic of Uzbekistan "On the Protection of Consumer Rights" No. 221-I of 26.04.1996.

1.4. This Policy applies to all products of the Platform: the AKA Connect web application at web.akaconnect.uz, the Operator's administration panel, the website akaconnect.uz together with its registration and demo request forms, the Operator's own WhatsApp number, the public API and the widgets that a Client places on its own resources. The AKA Support module (handling of enquiries, tickets, AI assistant, document recognition) forms part of the Platform and has no separate policy.

1.5. By using the Platform you confirm that you have read this Policy. Consent to data processing is given separately and may be withdrawn (Section 13).

2. Who is the operator of your data

Two independent parties process data on the Platform, and the Operator's role differs depending on whose data it is.

2.1. The key distinction. The content of conversations, enquiries, tickets, attachments and uploaded documents belongs to the Client. The Operator processes this data solely on the Client's instructions and only to the extent necessary to provide the service. The Operator does not independently determine the purposes of such processing.

2.2. The terms of processing of End User data, the Client's instructions, the list of sub-processors and the security measures are set out in Data Processing Agreement, which forms an integral part of the agreement with the Client and is provided to the Client on request.

2.3. The Client is solely responsible for having a lawful basis for processing the data of its End Users, for its own privacy notice and for obtaining the necessary consents.

2.4. The Operator does not use one Client's data in the interests of another Client and does not merge Workspaces.

3. Identification of the Client and Users

3.1. An account is created on registration on the Platform's website, in one of two types. The website asks only for what it needs to create the account:

3.2. No password is set at registration. Signing in to the Platform is done in the AKA Connect application, with the login issued when the Workspace is created and a six-digit code from an authenticator application on the User's own device. The Operator never receives that code and does not store the authenticator secret: it is shown once, at the moment the Workspace is created, and is not kept afterwards. Accounts created on the website before this change have a password, stored only as a hash.

3.3. The primary identifier of a User on the Platform is a confirmed email address.

3.4. After registration, a message containing a confirmation link is sent to the address provided. For an Organisation the Workspace is created only when that link is followed, so an unconfirmed address means no Workspace exists. For an Individual the Workspace is created at registration, and the confirmation link confirms the address.

3.5. The first registered User becomes the Account Owner and the Client Administrator. The list of roles and the scope of rights are set out in Public Offer.

3.6. The Workspace name is generated by the Platform from the organisation name (or, failing that, from the email address) and is shown to the Client together with its login. Users sign in at web.akaconnect.uz by entering that login, in the form name@workspace, and the code from their authenticator application. The Workspace name is not personal data.

3.7. One email address may be used in several Workspaces and in several roles. Role data is logically separated.

3.8. Users within a Workspace are created, modified and removed by the Client. The Operator does not manage the composition of the Client's team.

4. What data we collect

4.1. Account and User data

• email address (mandatory);
• account type — individual or organisation;
• for an organisation: its name and taxpayer number (INN/STIR);
• for accounts created before passwords were removed: a password hash (the password itself is never stored);
• the Workspace name and the login generated for the account;
• role and access rights;
• dates of registration, address confirmation and last sign-in.

Full name, telephone number, profile photograph, department, work schedule, interface language and notification settings are not asked for at registration. Where they exist, they are entered by the User or the Client inside the Workspace and form part of the Client's data.

4.2. Client organisation data collected at onboarding

Name, legal form, TIN/STIR, registered address, contact details of the authorised person, bank details, and licences and permits where the Client's activity requires them. The procedure is governed by the Operator's internal KYC rules.

4.3. Data of the Client's End Users

Processed on the Client's instructions (Section 2). The composition is determined by the channels the Client has connected and by the information the End User provides:

• channel identifier (Telegram identifier, WhatsApp phone number, email address, web chat session identifier);
• the name provided by the End User or obtained from the channel;
• the content of messages, attachments and files;
• the content and metadata of tickets, tasks and requests;
• information the Client enters itself into a customer or lead record;
• the content of documents and images submitted for recognition (OCR).

The Operator neither determines nor limits the composition of this data. The Client undertakes not to transfer special categories of personal data through the Platform unless separately agreed (the Data Processing Agreement, clause 3.2).

4.4. Enquiries sent to the Operator itself

These are enquiries about AKA CONNECT, where the Operator is the operator of the data rather than a processor.

• The demo request form on akaconnect.uz: full name, work email address, telephone number, company, role, team size, preferred date and time, and any message. The form also records the referral parameters described in clause 4.8.
• The Operator's WhatsApp number: the sender's WhatsApp number, the profile name WhatsApp provides, the language chosen in the menu, and the content of the conversation, including any demo request completed inside WhatsApp. These are stored in the Operator's own database on its server.

Both are also delivered to the Operator's internal working group in Telegram, so that a person can answer (Section 7).

4.5. Data processed by artificial intelligence

• the content of messages and documents passed to a model in order to generate a reply, classify an enquiry or perform recognition;
• the model's output: the generated reply, the category, extracted text;
• operational metrics: the number of calls to the model, the volume of units processed, the model identifier, processing time.

Artificial intelligence processing is enabled and disabled by the Client. The conditions of processing, including the model provider and the prohibition on using Client data to train models, are set out in the Data Processing Agreement, Section 6.

4.6. Service consumption data (Usage)

The number of active Users (agents), the number of enquiries and tickets, the number of calls to artificial intelligence, the number of document recognition units (OCR), storage volume, the number of API calls, the number of connected channels and Workspaces. This data is used to control Tariff limits, issue invoices and send notifications about approaching a limit.

4.7. Payment data

• payment status, payment transaction identifier, date, time and amount of the transaction;
• the masked card number (the first six and the last four digits), the name of the payment system, the result of 3-D Secure authentication;
• invoice, VAT invoice and acceptance certificate details — where payment is made by bank transfer;
• a card token — only where the Client has consented to saving the card for subsequent (including recurring) payments. The token is generated by the bank, contains no card data and does not allow it to be reconstructed.

The Platform does not request, receive, store or transmit the full bank card number, the CVV/CVC code, the card expiry date, one-time confirmation codes or credentials for access to payment applications. The acceptance and processing of card details are carried out on the side of the acquiring bank and its payment service, in an environment compliant with the requirements of the Payment Card Industry Data Security Standard (PCI DSS).

4.8. Technical data

• IP address, device and browser type, operating system version;
• login logs, Workspace activity logs, the administrative action log (audit log);
• error and failure logs, API call and webhook logs;
• cookies and similar technologies on the website (Section 11).

The website is delivered through Cloudflare, which receives the IP address and request details of every visitor before the request reaches the Operator's server (Section 7).

4.9. Registration and enquiry marketing attributes

Where a demo request is submitted, the following referral source parameters are recorded: utm_source, utm_medium, utm_campaign, utm_content, utm_term, landing page, referrer, partner identifier and coupon code. This data is used to assess the effectiveness of acquisition channels and to calculate partner remuneration.

4.10. Data we do not collect

The Platform does not purposely collect biometric data, health data, data on religious or political views or other special categories of data. Where such data enters the Platform within the correspondence or documents of End Users, its processing is carried out on the Client's instructions and the Client bears responsibility for having a lawful basis.

5. Why we process data (purposes and grounds)

6. Automated processing and artificial intelligence

6.1. The Platform automatically distributes enquiries, assigns them categories and priority, calculates service level indicators and consumption against Tariff limits. The rules for such processing are set by the Client.

6.2. Where the Client has enabled the artificial intelligence module, the Platform may automatically generate a reply to an End User, suggest a reply to an agent, classify an enquiry and extract text from documents.

6.3. An automatically generated reply is not a decision producing legal consequences for the End User. The Client must ensure that an enquiry can be transferred to a human employee and must inform the End User that they are interacting with an automated assistant.

6.4. The Operator's own WhatsApp number is answered by an automated assistant, which offers a menu, takes demo requests and hands the conversation to a member of staff on request. Anyone writing to it may ask for a person at any point.

6.5. The Operator calculates internal indicators for a Client's account — activity, engagement, churn risk — solely for the purposes of servicing and developing the relationship with the Client. These indicators relate to the organisation's account rather than to individual natural persons and produce no legal consequences for them.

7. To whom we transfer data

The Operator does not sell personal data. Transfer is possible only in the following cases:

7.1. Agreements are concluded with all processors obliging them to observe confidentiality and the requirements of the legislation of the Republic of Uzbekistan. The current list of sub-processors is maintained in an annex to the Data Processing Agreement and is provided to Clients on request.

7.2. The transfer to the acquiring bank of information constituting personal data and the payer's banking secrecy is carried out to the extent necessary to process the payment, the refund and the examination of a disputed transaction. The Client is notified of this before payment is made — in the Public Offer (Section 9) and on the payment page.

7.3. The Operator notifies the Client of an intended replacement or addition of a sub-processor at least 30 calendar days in advance. The Client may object in the manner set out in the Data Processing Agreement.

8. Localisation and cross-border transfer

8.1. Personal data is processed in accordance with Article 27-1 of the Law of the Republic of Uzbekistan "On Personal Data" as amended by Law No. ZRU-1125 of 26.03.2026.

8.2. Mandatory localisation. Personal data for which the legislation establishes a mandatory storage requirement within the territory of the Republic of Uzbekistan — biometric data, genetic data, and data of users of services of telecommunications operators of the Republic of Uzbekistan — is processed and stored in databases physically located within the territory of the Republic of Uzbekistan and is not transferred outside it.

8.3. Restriction on the composition of data. The Platform is not intended for the processing of biometric or genetic data. The Client is prohibited from transferring such data through the Platform. This condition is set out in the Data Processing Agreement, clause 3.2.

8.4. Other personal data may be processed and stored outside the Republic of Uzbekistan where one of the conditions provided for by Article 27-1 of the Law is met:

• the transfer is made to a state included in the list of states ensuring an adequate level of personal data protection, approved by the Cabinet of Ministers of the Republic of Uzbekistan;
• the Operator applies standard contractual clauses or binding corporate rules meeting the requirements of the authorised state body;
• the Operator complies with international standards in the field of personal data management and storage, the list of which is approved by the authorised state body.

8.5. The basis relied upon. The Operator relies on the first basis listed in clause 8.4 — transfer to states included in the list approved by Resolution of the Cabinet of Ministers of the Republic of Uzbekistan No. 415 of 29.07.2026. According to the recipients' own published information, the services named in Section 7 process data in the United States (Cloudflare, Google, Meta), in Japan and the United States (email delivery) and in the United Arab Emirates (Telegram). The list of recipients and countries of processing is set out in Annex 2 to the Data Processing Agreement and is provided to Clients on request.

8.6. Registration of the personal data database. The personal data database is registered in the state register in those cases where the mandatory localisation requirement applies to the data processed, in the manner set out in Article 20 of the Law.

8.7. Notification of a leak during cross-border transfer. On discovering a leak of personal data in the course of a cross-border transfer, the Operator notifies the authorised state body within 24 hours of establishing the fact and, within 72 hours, provides information on the causes of the leak and the measures taken to address it.

8.8. Artificial intelligence processing. The models that process the content of End Users' enquiries and documents are deployed on the Operator's infrastructure. The open models DeepSeek and Kimi are used. The content of enquiries is not transmitted to external model providers, and no cross-border transfer of personal data arises on this basis.

8.9. External artificial intelligence services. The Operator may use external artificial intelligence services, including Anthropic and OpenAI, solely to process data that is not personal data. The personal data of End Users, the content of their enquiries and the documents they upload are not transmitted to such services. The separation procedure is set out in the Data Processing Agreement, Section 6.

9. Retention periods

10. Deletion and export of data

10.1. The Client may at any time export the content of its Workspace in a machine-readable format using the Platform's tools.

10.2. On termination of the agreement, Workspace data is retained for 30 calendar days for export, after which it is deleted or anonymised within the following 30 calendar days. Data which the Operator is required by law to retain is excluded — in the first instance accounting, tax and payment documents.

10.3. The Client may request early deletion of Workspace data before the period specified in clause 10.2 expires. Deletion is irreversible.

10.4. When a User is removed from a Workspace, their personal data is deleted or anonymised; the messages and actions performed by that User are retained in the enquiry history as part of the Client's data.

10.5. End User requests for deletion of their data are fulfilled by the Client as operator. The Operator provides the Client with technical assistance in the manner set out in the Data Processing Agreement, Section 7.

10.6. Anyone who has written to the Operator's WhatsApp number or submitted the demo form may ask the Operator to delete that enquiry and the related conversation, using the address in Section 16.

11. Cookies and similar technologies

11.1. The website and the web application use technically necessary storage — the session, security and cross-site request forgery protection — and functional storage such as the chosen interface language. These are required for the site to work and are not used to follow visitors elsewhere.

11.2. Third-party technologies are loaded on the website:

• Google reCAPTCHA, on pages with a form, to tell people from automated abuse. Google receives the IP address and interaction signals of the visitor.
• Google Fonts, which serves the typeface the pages are set in. Google receives the IP address and browser details.
• The Meta Pixel, on every page, which reports page views to Meta together with Meta's own cookie identifiers, so that the Operator can measure its advertising.

11.3. A consent banner for the technologies in clause 11.2 is being introduced. Until it is in place these are loaded when the page opens; a visitor who does not want them can block third-party cookies and scripts in the browser's settings or with an extension, and the website continues to work, apart from the forms protected by reCAPTCHA.

11.4. The web chat widget that a Client places on its own website uses technically necessary browser storage to retain the enquiry session identifier. Notifying the End User of this is the responsibility of the Client as the owner of that website.

12. Security

12.1. The following measures are applied: encryption of transmission channels (TLS), role-based access control, isolation of Workspace data, logging of access to personal data, backup, storage of secrets outside the code, and authentication in the AKA Connect application by a code from an authenticator application.

12.2. Access by the Operator's staff to Workspace data is granted on a least-privilege basis.

12.3. Messages arriving from WhatsApp are accepted only where they carry Meta's cryptographic signature, so that no one else can deliver messages in Meta's name.

12.4. Support access to a Client's Workspace (impersonation). A member of the Operator's staff may log in to a Client's Workspace in order to resolve a fault. Such access:

• is never carried out covertly — a permanent banner indicating a support session is displayed in the interface;
• is recorded in a log stating the employee, the Workspace, the start and end time and the reason (the enquiry number);
• is granted only where the Client has raised an enquiry or in order to resolve an incident of which the Client is notified.

12.5. On discovering an incident involving personal data, the Operator notifies the affected Client as soon as possible after the incident is established. The Operator notifies the authorised body in respect of data for which it is itself the operator (Section 2). In respect of End User data, notification of the authorised body and of data subjects is carried out by the Client as operator; the procedure and timescales for providing the Client with the necessary information are set out in the Data Processing Agreement, Section 8.

12.6. The acceptance and processing of payment card details are carried out on the side of the acquiring bank, in an environment compliant with PCI DSS requirements. Transactions are confirmed by multi-factor authentication of the cardholder — using 3-D Secure technology and/or a one-time code from the issuing bank. The Platform does not store card details.

12.7. Data transmission between the user's device, the Platform and the acquiring bank is protected by TLS encryption; the Platform's website uses a valid SSL certificate.

13. Rights of the data subject

13.1. A personal data subject has the right to:

• know what data concerning them is processed and obtain a copy of it;
• correct inaccurate or outdated data;
• withdraw consent to processing (in so far as consent is the ground);
• request deletion of data or restriction of processing;
• opt out of marketing messages;
• appeal against the operator's actions to the authorised body.

13.2. Where to apply. If you are a User of the Platform, or you have written to the Operator through the website or its WhatsApp number, write to the address in Section 16. Requests are reviewed within 15 working days.

13.3. If you contacted a company through its chat, bot or support service running on the Platform, the operator of your data is that company, not the Operator of the Platform. Your request should be addressed to it. If a request reaches the Operator, it is forwarded to the relevant Client and the applicant is notified accordingly.

13.4. Withdrawal of consent does not extend to data which the Operator is required by law to retain.

14. Minors

14.1. The Platform is intended for professional use by persons with full legal capacity. The Operator does not purposely collect data of minors.

14.2. The Operator does not verify the age of End Users who contact a Client through connected channels. Compliance with age restrictions in the Client's own services is the Client's responsibility.

15. Changes to the Policy

15.1. The Operator may amend this Policy. The current version is published on the website stating the date on which it takes effect.

15.2. Clients are notified of material changes in advance — at least 30 calendar days — through the Platform or by email.

16. Contacts

Operator: AKACORP GLOBAL TECH LLC

• Full name: «AKACORP GLOBAL TECH» mas'uliyati cheklangan jamiyati
• Name in English: "AKACORP GLOBAL TECH" Limited Liability Company
• TIN/STIR: 312414442
• Date of state registration: 08.09.2025
• Registered address: Farg'ona viloyati, Farg'ona shahri, Mash'al MFY, Mustaqillik shoh ko'chasi, 3S-uy
• Telephone: +998 50 744 41 31
• Website: akaconnect.uz
• Email for personal data enquiries: [email protected]
• Person responsible for personal data processing: the Personal Data Protection Officer of AKACORP GLOBAL TECH LLC (enquiries — [email protected])