Privacy policy

1. Who processes your data

This policy explains how the GRAPHIX online store (graphix.uz, the “Site”) collects, uses, keeps and protects the personal data of its visitors and customers. It is written in line with the Law of the Republic of Uzbekistan “On Personal Data”.

The owner and operator of the data is the Seller: sole proprietor Boboyev Abdurahmon Furqat oʻgʻli (GRAPHIX). The Seller’s postal address is given in the Terms of use.

For privacy questions: abdurahmonboboyev.magic@gmail.com, +998 50 788 84 36 or Telegram: @greatestamal.

The document is published in Uzbek, Russian and English; if the versions differ, the Uzbek text applies.

2. What we collect

Your account

Username, first name (optional), phone number and whether it has been confirmed, password, and when the account was created and last signed into. The password is stored only as a one-way hash — nobody, including us, can read it.

Orders

The recipient’s full name and phone number; the region and district or city; the post office postcode or the street and house number; the coordinates of the pin, if you drop one on the map; your note to the order; the products, prices, delivery method and charge, payment method, the order’s status and the history of its changes.

Payment

When you pay with Click, we receive only the order number, the amount and whether the payment went through. Your card number and other card details are entered with Click and never reach us.

Reviews and messages

Your review (rating, text, photos) and the order it belongs to; a message you send through the contact form (subject and text) together with the phone number on your account.

Cart and saved designs

The products in your cart and the designs you have saved with the heart. If you are not signed in, your cart is linked to a session in your browser.

Technical data

The web server’s logs record your IP address, browser and device type, the page opened and the time. Your IP address is also used to limit repeated attempts such as password guessing; for that it is kept as a one-way hash for up to 60 minutes.

We use no advertising or analytics tracking (no analytics counters, no ad pixels, nothing of the kind).

3. Why we use it

• Your account — confirming your phone number, resetting your password by SMS code, keeping the account secure;
• Fulfilling orders — checkout, taking payment, preparing the parcel and handing it to Uzpost, contacting you;
• Customer service — answering your questions, handling exchange and return requests;
• Reviews — checking and publishing them on the Site;
• Security — preventing fraud and abuse;
• Legal duties — keeping accounting and tax records.

We process data on the basis of your consent (given when you register), of performing a contract you are party to, and of the Seller’s obligations under the law.

We never send marketing SMS. The only messages your phone receives from us are service messages — confirmation codes.

4. Who we share it with

We do not sell your data or pass it to anyone for advertising. It goes only to the services below, and only as much of it as each needs to do its job:

• Eskiz (eskiz.uz) — SMS delivery: your phone number and the text of the confirmation code;
• Click (click.uz) — payments: the order number and amount; Click takes your card details itself;
• Uzpost (Oʻzbekiston pochtasi JSC) — delivery: the recipient’s full name, phone number and address or post office;
• Google — Google Maps: the map does not load when the page opens. Your browser loads Google’s script only when you press “From the map”, and only then does Google receive your IP address and technical details about your browser. If you drop a pin, its coordinates are sent to Google to look up the address. If you never open the map, nothing is sent to Google at all;
• Telegram — notices of new orders, payments, messages and reviews reach the store’s staff through the store’s Telegram bot. An order notice contains the recipient’s name, phone number and address (with the pin’s coordinates, if one was dropped on the map), the items and the order note; a message notice contains the sender’s name, phone number and message;
• Our hosting provider — the Site and its database run on a rented server in Warsaw, Poland: everything we keep is stored there (section 5).

Where the law requires it, data may be disclosed at the request of the competent public authorities.

5. Transfers outside Uzbekistan

The Site’s server and database are in Warsaw, Poland, so your data is stored and processed outside Uzbekistan. Poland is a member of the European Union, where personal data is protected by the EU General Data Protection Regulation (GDPR).

Google’s and Telegram’s servers are outside Uzbekistan too. Data is transferred abroad in line with the Law, including on the basis of your consent: by registering and accepting this policy, you also consent to these transfers.

We do not collect biometric or genetic data — the kinds the Law requires to be kept in Uzbekistan.

6. How long we keep it

• Your account — until you ask us to delete it. An unconfirmed account is deleted when its confirmation code expires (5 minutes), unless a cart or an order is attached to it;
• Orders — for the period the law sets for accounting and tax records (under current rules, at least three years). These records are kept until that period ends even if your account is deleted;
• Carts without an account — deleted 30 days after they were created;
• Reviews — for as long as they are published on the Site, or until you ask us to remove them;
• Messages — for as long as it takes to resolve what you wrote to us about;
• Web server logs — 30 days;
• Attempt counters (a hash of your IP address) — up to 60 minutes.

When a retention period ends, or the purpose of processing has been met, the data is deleted or made anonymous.

7. Cookies and browser storage

The Site uses only the cookies it cannot work without:

• sessionid — remembers that you are signed in, and holds your cart if you are not; lasts 14 days;
• csrftoken — protects forms against forged requests; up to one year;
• graphix_lang — remembers the language you chose; one year;
• messages — carries a one-off notice such as “Added to cart” to the next page and disappears once it has been shown.

Your browser’s temporary storage (sessionStorage) holds two drafts: the sign-up form without the password, so it is not lost while you read the terms, and the checkout form, while you look at the post office map. This storage is cleared when you close the tab and is never sent to us.

No advertising or tracking cookies are used. If you open the map, Google may collect technical data under its own rules — see Google’s privacy policy.

You can turn cookies off in your browser settings, but signing in and the cart will then stop working.

8. Your rights

Under the law you have the right to:

• know who processes your data, why and how;
• see the data we hold about you;
• have wrong or out-of-date data corrected;
• have your data destroyed (except what the law requires us to keep);
• withdraw your consent — your account is then closed;
• complain to the public authority responsible for personal data, or to a court, if you believe your rights have been breached.

You can change your name and username yourself in your account settings. For anything else, contact us by phone, Telegram or email; we check that a request really comes from you through the phone number on your account. We reply within 10 days and correct wrong data within 3 days.

9. How we protect it

Your connection to the Site is encrypted (HTTPS). Passwords are stored only as one-way hashes. Only authorised staff can reach the database and the order management panel. Sign-in and code attempts are limited. Location data is removed from review photos.

If a data breach happens, we will tell you as soon as we can and, where the law requires it, the competent authority.

10. Children

The Site is intended for people aged 18 and over. The data of anyone younger is processed only with the consent of a parent or other legal guardian. If you find out that your child has registered without your consent, write to us and we will close the account.

11. Changes to this policy

If this policy changes, the new version is published on this page with its number and the date it takes effect, and the list of earlier versions stays at the bottom of the page. If the law requires your consent before we use your data for a new purpose, we will ask for it first.