Privacy Policy

This Privacy Policy (the “Policy”) governs the collection, storage, use, and protection of personal data of users of the mobile application “Point Coffee” (the “App”), developed and operated by LLC “ORZU HAVAS INVESTMENT” (the “Operator”).

The Policy is prepared in accordance with:

• The Law of the Republic of Uzbekistan “On Personal Data” dated July 2, 2019 No. ZRU-547;
• App Store publication rules (Apple App Store Review Guidelines, § 5.1);
• Google Play requirements for privacy policies (Google Play Developer Policy);
• Other applicable laws of the Republic of Uzbekistan.

By using the App, you confirm that you have read this Policy and consent to the processing of your personal data as described below.

If you do not agree with the Policy, please stop using the App.

Personal data — any information that directly or indirectly identifies an individual (data subject).

Processing of personal data — any action (operation) involving personal data: collection, recording, systematization, accumulation, storage, clarification, modification, extraction, use, transfer, anonymization, blocking, deletion, or destruction.

User — an individual who installs and uses the App.

Operator — LLC “ORZU HAVAS INVESTMENT”, which processes personal data.

App — the “Point Coffee” mobile application for iOS and Android providing access to ordering drinks via coffee vending machines and the “Loyal Coffee” loyalty program.

When using the App, the Operator may collect the following categories of data:

3.1. Data provided by the user

• Mobile phone number (when registering via SMS verification);
• First and last name (when completing the profile);
• Date of birth (when completing the profile, for birthday bonuses);
• Referral code (when using the “Refer a friend” program).

3.2. Data collected automatically

• Device data: model, OS version, unique device identifiers, system language;
• FCM token for push notifications;
• Location data — only with explicit user permission — to show nearby coffee machines on the map (Yandex.Maps integration);
• Error logs and technical logs for diagnostics and improvement;
• IP address and network connection parameters.

3.3. Transaction and loyalty data

• Order history: items, price, time, vending machine ID;
• Payment method (Click, Payme, Uzum Bank) — the Operator does not store full card details; payments are processed by certified payment systems;
• Bonus coin balance, accrual and redemption history;
• Referral data: who invited whom (not disclosed to third parties).

3.4. Data the Operator does NOT collect

• Full bank card numbers, CVC codes;
• Biometric data;
• Contacts or data from other apps on the device;
• Data about minors (the App is intended for users over 18).

The Operator processes personal data solely for the following purposes:

• Registration and authentication in the App;
• Fulfilling orders via vending machines and issuing receipts;
• Accrual, accounting, and redemption of bonus coins under “Loyal Coffee”;
• Push notifications about order status, promotions, and offers (only with user consent);
• Displaying nearby coffee machines on the map;
• User support;
• Improving the App: error analysis and feature testing;
• Compliance with the laws of the Republic of Uzbekistan;
• Fraud prevention and unauthorized access prevention.

Processing is based on:

• User consent — upon registration, the user accepts this Policy;
• Performance of a contract — processing necessary to provide ordered services;
• Legitimate interests of the Operator — security, fraud prevention, service quality analysis;
• Legal obligations — retention of transaction data under tax and accounting law of Uzbekistan.

The Operator does not sell personal data. Sharing is limited to:

6.1. Payment partners

Click, Payme, and Uzum Bank receive the minimum data necessary to authorize transactions. Each has its own privacy policy.

6.2. Mapping service

Yandex.Maps is used to display machines; location may be processed under Yandex’s policy.

6.3. Push notifications

Firebase Cloud Messaging (Google FCM) delivers pushes; FCM tokens are processed by Google as needed for the service.

6.4. Public authorities

The Operator may disclose data when required by authorized bodies of Uzbekistan under law.

6.5. Successors

In case of reorganization or merger, data may be transferred to a successor subject to the same protection obligations.

Data is stored on servers in Uzbekistan or in jurisdictions with adequate protection.

Retention periods:

• Account data (phone, name, DOB): for the lifetime of the account + 3 years after deletion;
• Orders and transactions: 5 years (tax law of Uzbekistan);
• Bonus history: while the account is active; unused coins may expire after 6 months from the last purchase (with prior notice);
• Technical logs: 90 days;
• Push tokens: until permission is revoked or the account is deleted.

The Operator applies technical and organizational measures including:

• HTTPS/TLS encryption in transit;
• Hashed storage of passwords and tokens;
• Role-based access (RBAC) to the admin panel;
• Regular database backups;
• Monitoring and audit of suspicious activity;
• Restricted physical access to infrastructure.

Under Uzbek law, you may:

• Obtain information about your data processed by the Operator;
• Request correction of inaccurate data;
• Request deletion of your data;
• Withdraw consent;
• Opt out of push notifications (App or device settings);
• Revoke location permission (device settings).

You may exercise rights by:

• Email: info@orzuhavas.uz;
• App: Settings → Privacy;
• Deleting your account in profile settings.

The Operator responds within 30 calendar days of receiving a request.

You may delete your account at any time:

• Profile → Settings → Delete account;
• Confirm via SMS code.

After confirmation:

• The account is deactivated immediately;
• Personal data (name, DOB, FCM token, location) is deleted within 30 days;
• Transaction history may be kept in anonymized form as required by tax law;
• Unused bonus coins are forfeited without refund if you delete the account voluntarily.

You may also request deletion at info@orzuhavas.uz.

The App is for users over 18 only. The Operator does not knowingly collect data from minors.

If you believe a child registered, contact info@orzuhavas.uz — we will delete the account within 72 hours.

Local storage is used only for:

• Encrypted storage of the auth token (JWT);
• Caching preferences (language, last selected machine).

Aggregated, anonymized analytics may be used to improve the App.

Cloud services (Firebase/Google, Yandex) may process data outside Uzbekistan. The Operator takes steps to ensure appropriate safeguards.

The Operator may update this Policy. Material changes will be communicated via:

• Push notification in the App;
• In-app notice on next launch requiring renewed acceptance.

The current version is available in the App and on the Operator’s website. The update date is shown in the document header.

For personal data matters, contact:

• Operator: LLC «ORZU HAVAS INVESTMENT»
• TIN: 311 943 355
• Director: Ruzikulova K.A.
• Address: Uzbekistan, Tashkent, Yunusabad district, Abdulla Kadiri 39
• Phone: +998 90 991 90 00
• Email: info@orzuhavas.uz
• Hours: Mon–Fri, 09:00–18:00 (UTC+5)

The Operator will review requests within 30 calendar days and provide a reasoned response.

This Privacy Policy takes effect from the date of publication on the App Store and Google Play.