Internal Personal Data Processing Policy

Document status: working legal template. Before publication, fill in the details, verify the actual service architecture, and have the text reviewed by a lawyer practicing in the Republic of Uzbekistan.

Service owner: [LEGAL ENTITY NAME], TIN [TIN], address: [ADDRESS].
Service: Belgi.ai, [DOMAIN].
Version: [VERSION NUMBER] dated [DATE].
Contacts: [EMAIL], [PHONE].

Purpose and responsibility

This Policy sets a uniform procedure for data processing in Belgi.ai. Responsible person: [TITLE]. Process owners maintain a register of systems, data categories, subjects, purposes, bases, recipients and retention periods. New processing is launched after a necessity and minimization review.

Lifecycle

Data are collected only from approved sources, labeled by criticality level, used for stated purposes, transferred under contract and deleted on schedule. Production data are not copied into test environments without anonymization. Exports are limited, logged and protected.

Data subject rights

A request is registered, the requester’s identity is verified in a proportionate manner, then the responsible person identifies the systems and prepares a response within the statutory period. Rectification and deletion are performed in all applicable systems and backup environments under the approved procedure.

Control

Annually and after material changes, an inventory and review of access, contractors, retention periods and public texts are conducted. Violations are recorded and remediated under a plan.