PRIVACY POLICY

UFarmer Platform

Revision date: 02.09.2026 · Effective date: 02.09.2026

This Privacy Policy (the Policy) applies to the UFarmer mobile application and its web version (together — the Platform) and sets out the terms on which the User's personal data are processed.

The Policy is drawn up in accordance with the Law of the Republic of Uzbekistan "On Personal Data" and other legislation.

1. Data controllers — who processes what

Two controllers operate on the Platform, with clearly separated roles.

UFARM LLC — owner of the Platform's software and its technical operator.

Processes: account and profile data, authentication, technical logs and telemetry, agricultural calendar, weather, field and crop data, AI-scanner requests, chat, the learning module, and software subscription data.

• TIN: 312199054
• Address: Tashkent, Shaykhantakhur district, A. Navoiy street 25
• E-mail: contact@ufarmer.uz

AGRONEXUS LLC — operator of the electronic trading platform.

Processes: orders, payments and balance, delivery addresses, fiscal and accounting documents, settlements with sellers and contractors, returns and claims data.

• TIN: 313236569
• Address: Tashkent, Shaykhantakhur district, Chaqar MFY, Navoiy street 25
• E-mail: contact@ufarmer.uz

Each controller is responsible for data within its own area of activity. A request may be sent to either controller and will be forwarded to the appropriate one.

2. Consent

2.1. Registration on and use of the Platform constitute consent to the processing of data for the purposes and by the means set out in this Policy.

2.2. Separate consent is requested for certain features: camera and gallery, geolocation, notifications, contacts, as well as biometric identification and scoring.

2.3. If consent is not given, the corresponding feature will not operate, but the remainder of the Platform stays available.

2.4. Withdrawal of consent. The User may withdraw consent at any time — through the application settings or by contacting the address in section 13. Processing then ceases; however, data whose retention is required by law (accounting, fiscal and tax records) are kept for the statutory period.

3. What data are collected

3.1. Data provided by the User: full name, telephone number, e-mail address, role in the system (farmer, agro-pharmacy owner, agronomist, employee), profile settings, information about the farm, fields and crops, delivery address.

3.2. Order and payment data: order contents and history, payment amount and method, balance movements, fiscal receipts, returns and claims.

Card data. The Platform does not store the full bank card number, expiry date or CVV code. Card data are transmitted directly to a licensed payment organisation. Only the card token and the last digits of the number are stored on the Platform.

3.3. For legal entities and entrepreneurs: TIN/PINFL, bank details, certificate of registration, licences and permits, representative details.

3.4. Data collected automatically: IP address, date and time of access, device and operating system information, application and push identifiers, application version, technical logs, analytics events, stability reports.

3.5. User content: chat messages, photographs and videos (including for the AI scanner), documents and files.

3.6. Subject to separate consent: geolocation, camera and gallery, contacts, biometric data (identification via MyID), scoring data.

3.7. Data received from third parties: weather and mapping providers, payment and banking services, identification and scoring services, insurance and logistics partners.

4. Purposes of processing

• Operating the Platform: registration, authentication, profile and role management;
• placing orders, accepting payments, delivery and refunds;
• generating fiscal receipts and accounting documents, meeting statutory requirements;
• providing the agricultural calendar, weather, recommendations, AI scanner, chat and learning modules;
• user support: responding to enquiries, diagnosing faults;
• security and fraud prevention;
• analytics and quality improvement (in aggregated and anonymised form);
• where separate consent is given, sending marketing messages.

5. Legal bases for processing

• The User's consent;
• performance of the contract (offer) concluded with the User;
• compliance with the controllers' legal obligations — tax, accounting, fiscal and electronic commerce requirements;
• the controllers' legitimate interests — security, fraud prevention, service quality.

6. Transfer to third parties

Data are transferred only to the extent necessary and only to the following recipients:

Recipient	Purpose
Sellers and Contractors	fulfilling the order, delivery, providing the service
Payment organisations and banks	processing payments and refunds
Delivery services	handing over the goods
Fiscal data operator and tax authorities	fiscal receipts and reporting
Electronic document flow operator	invoices
Identification and scoring services	subject to separate consent
Insurance partners	subject to separate consent
State authorities	in the cases provided by law

Data are not sold to third parties for advertising purposes.

7. Place and periods of storage

7.1. Biometric data are processed and stored using technical facilities located within the territory of the Republic of Uzbekistan.

7.2. Other personal data are processed in compliance with the conditions established by law.

7.3. Personal data bases are registered in the State Register of Personal Data Bases in the manner provided by law.

7.4. Retention periods:

Type of data	Period
Account and profile	while the account is active and for 1 year after deletion
Order and payment data	the period established by law (for accounting records)
Fiscal receipts	the period established by law
Technical logs	up to 12 months
Marketing consent	until consent is withdrawn

Once the period expires, data are deleted or anonymised.

8. User rights

The User has the right to:

• obtain information about their data and its processing;
• request clarification and correction of inaccurate or incomplete data;
• request deletion of data or blocking of processing;
• withdraw consent;
• opt out of marketing messages;
• complain about the controller's actions to the authorised state body.

Requests are sent to the address in section 13. The response period is that established by law, but no more than 30 days.

Account deletion. The User may delete the account through the application settings or by contacting support. Documents whose retention is required by law (accounting, fiscal) are kept for the statutory period.

9. Data security

9.1. The controllers apply organisational and technical measures to protect data against unauthorised access, alteration, disclosure and destruction: channel encryption, role-based access control, logging and backups.

9.2. The User undertakes not to disclose authentication data (password, OTP codes) to third parties. Actions performed using such data are deemed the User's actions.

9.3. If an account is compromised, the User must notify support immediately.

10. Children

The Platform is not intended for persons under 18 years of age. If such data are found to have been collected in error, they are deleted.

11. Cookies and similar technologies

The web version uses cookies to maintain the session, remember settings and for analytics. The User may disable them in the browser settings — certain features may then become unavailable.

12. Changes to the Policy

The controllers may update the Policy. A new version is published on the Platform; the User is separately notified of material changes. The date of the current version is shown at the top of the document.

13. Contacts

For questions and requests concerning personal data:

• E-mail: contact@ufarmer.uz
• Telephone: +998 94 850-57-75
• Postal address: Tashkent, Shaykhantakhur district, Chaqar MFY, Navoiy street 25
• Support chat on the Platform

For orders, payments and refunds — AGRONEXUS LLC.

For the application, account and software modules — UFARM LLC.