Privacy Policy for ioka travel

User Agreement

Approved by Order No. 2P dated December 4, 2024 of the Director of JV LLC PII "IOKA TRAVEL" Zhumash Magzhan. Version 1.0, Tashkent, 2024.

1. Purpose

This Regulation establishes general requirements for the procedure for processing and protecting the personal data of personal data subjects processed by the Company.

The requirements of this Regulation apply to all employees of the Company.

2. Terms, definitions, abbreviations and designations

Automated processing of personal data – the processing of personal data using computer technology.

Website – one or several logically interconnected web pages (in this Regulation, the Website means the pages located at and associated with https://ioka.uz).

Personal data information system – a combination of personal data contained in databases and the information technologies and technical means ensuring their processing.

Company – Joint Venture Limited Liability Company with Foreign Investments "IOKA TRAVEL" (TIN 310792355).

Counterparty – a legal entity or individual that has assumed, or intends to assume, any obligations under an agreement.

Processing of personal data – any action (operation) or combination of actions (operations) performed on personal data, with or without the use of automation tools, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion, and destruction of personal data.

Personal data – any information relating to a directly or indirectly identified, or identifiable, natural person (personal data subject), including their last name, first name, patronymic, year, month, date and place of birth, address, marital, social and property status, education, profession, income, and other information.

Employee – a natural person who has entered into an employment relationship with the employer.

Personal data subject – a natural person to whom personal data directly or indirectly identifying them relates.

Cross-border transfer of personal data – the transfer of personal data to the territory of a foreign state to a foreign government authority, a foreign natural person, or a foreign legal entity.

3. General provisions

This Regulation establishes the procedure and conditions for the collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion, and destruction of documents containing information classified as personal data of subjects whose personal data is processed by the Company, as well as the rules for protecting personal data.

4. Goals and objectives

The purposes of establishing this Regulation are to ensure that the procedure for processing personal data in the Company complies with the legislation of the Republic of Uzbekistan on personal data, as well as to develop a set of measures aimed at ensuring the protection of personal data processed by the Company.

The objectives of this Regulation are to define the principles of personal data processing, the conditions for their processing, methods of protection, as well as the rights of personal data subjects and the rights and obligations of the Company when processing personal data.

5. Concept and composition of personal data

The Company processes the personal data of the following categories of subjects: Company employees, including former employees; counterparties (representatives of client companies, representatives of companies with which the Company has contractual obligations, individual entrepreneurs, natural persons); job applicants; visitors and registered users of the Website.

The personal data subject independently decides to transfer their personal data to the Company.

6. Responsible persons

The person responsible for organizing the processing of personal data in the Company is a person appointed by order of the Director. In the absence of, or failure to appoint, such a person, their functions are performed by the Director on the basis of an order.

The person responsible for ensuring the security of personal data is the Head of the Information Technology Department.

7. Purposes of personal data processing

The purposes of processing the personal data of Company employees are: carrying out personnel, accounting and financial-economic activities; fulfilling the requirements of labor and pension legislation; keeping records of labor resources; optimizing communication between employees; managing employee performance; recruitment and personnel selection; preparing commercial proposals and reports; interaction under concluded agreements.

The purposes of processing counterparties' personal data are: monitoring current projects and sales plans; sending information to clients; conducting electronic auctions; interaction under concluded agreements.

The purposes of processing the personal data of job applicants are recruitment and personnel selection, and obtaining hiring approval.

The purposes of processing the personal data of visitors and registered users of the Website are: identification of parties within the scope of service provision; provision of personalized services; improvement of service quality; conducting statistical research based on depersonalized data; efficient execution of orders and agreements; registration of users for events.

8. Grounds for processing personal data

The processing of employees' personal data is carried out on the basis of the Labor Code of the Republic of Uzbekistan and written consent. The processing of counterparties' data is necessary for exercising the Company's rights and legitimate interests. The processing of the data of applicants and Website users is carried out on the basis of written or electronic consent.

9. Principles of personal data processing

The processing of personal data is carried out on a lawful and fair basis, is limited to the achievement of specific, predetermined purposes, does not permit the combination of databases with incompatible processing purposes, ensures the accuracy and relevance of data, and the data is subject to destruction or depersonalization upon achievement of the processing purposes.

10. Obtaining (collecting) personal data

Personal data is obtained and processed after the subject has signed a consent form or provided consent electronically on the Website. It is prohibited to collect data in a greater volume than provided for by law, as well as to request information about health status, political, religious, or other beliefs, except in cases provided for by the legislation of the Republic of Uzbekistan.

11. Regulation of access to and use of subjects' personal data

The Company has the right to entrust the processing of personal data to a third party, subject to compliance with the principles and rules of their processing. Government bodies are granted access rights only within the scope of their competence. Personal data is confidential information; all employees with access to it are required to sign a non-disclosure undertaking. An employee's access to personal data may be terminated upon transfer to another department, termination of the employment contract, or violation of non-disclosure obligations.

12. Specifics of processing the personal data of Company employees

An employee's personal data is submitted to the Human Resources Department and is supplemented throughout the entire period of employment. It is processed and stored in the Human Resources Department and the Finance Department for no longer than is necessary for the purposes of its collection. The personal data of former employees is subject to destruction after 75 years of storage, unless otherwise determined by the legislation of the Republic of Uzbekistan.

13. Rights of subjects to protect their personal data

The personal data subject has the right to complete information about their personal data, free access to it, the right to demand the destruction or correction of inaccurate data, the right to appeal unlawful actions of the Company in court, as well as other rights provided for by the legislation of the Republic of Uzbekistan.

14. Cross-border transfer of personal data

The cross-border transfer of employees' personal data is carried out in accordance with the legislation of the Republic of Uzbekistan and may be restricted. The transfer of the data of counterparties, applicants, and Website users abroad is not carried out, except in cases expressly provided for by law or by the subject's written consent.

15. Storage and destruction of personal data

Personal data is stored in a manner that excludes access by third parties and its loss. Personal data is destroyed upon expiration of the processing period, achievement of the processing purpose, upon the subject's request or withdrawal of consent, or by court decision. The destruction of documents and data is confirmed by the relevant acts.

16. Processing of personal data without the use of automation tools

Personal data processed without the use of automation tools is recorded on separate tangible media, taking into account the purposes of processing and the categories of data, ensuring separate and controlled processing.

17. Protection of personal data

The protection of personal data is ensured by a set of organizational and technical measures: the personal responsibility of employees, a permission-based access system, procedures for the storage and destruction of information, as well as non-disclosure agreements when interacting with third parties.

18. Obligations of persons authorized to process personal data

Employees authorized to process personal data undertake to know and comply with the requirements of this Regulation, to process data only for the established purposes and to the established extent, to maintain confidentiality, and to inform their supervisor of any violations or attempts at unauthorized access.

19. Liability for disclosure of personal data

Officials with access to personal data bear personal liability for violations of the regime for their protection in accordance with the legislation of the Republic of Uzbekistan, including disciplinary, material, civil, and administrative liability.

Public Offer

1. Definitions

1.1. LLC "IOKA TRAVEL" is a legal entity holding the exclusive rights to the online platform "ioka.uz".

1.2. Website — www.ioka.uz, for online booking and the sale and purchase of air tickets.

1.3. Client — any legally capable individual or legal entity purchasing the Contractor's services for themselves or in favor of a third party through the website.

1.4. Service Providers — legal entities directly providing services for: passenger transportation, insurance, booking and sale of air tickets.

1.5. Services — booking and sale/purchase of air tickets services.

1.6. Personal data — any information that the Client provides about themselves and third parties, independently upon registration on the Site, as well as in the course of further use of the Site. Such information includes, in particular: last name, first name, patronymic, year, month, date and place of birth, address, email, mobile phone number, as well as other information, including a range of technical data: IP address, browser browsing history and others.

1.7. Processing of personal data — the performance of one or a combination of actions related to the collection, systematization, storage, modification, supplementation, use, provision, dissemination, transfer, depersonalization and destruction of personal data, carried out with or without the use of automation tools.

1.8. Personal account — a section of the site through which the Client can use the website's functionality, accessible only after registration and/or authorization on the site by entering unique login credentials (a combination of login and password). The personal account is intended for storing the Client's personal data (personal information and documents), placing Orders, viewing information about placed Orders, their processing stage, the current status of issued invoices, and receiving notifications.

1.9. Order — a duly completed Client's Request for services selected via the website.

1.10. Service fee — payment for additional services of the Contractor and/or the Service Provider.

1.11. GDS — Global Distribution Systems for air tickets used by most airlines.

2. Subject of the agreement

2.1. The subject of this offer is the provision to the Client of remote online booking and air ticket purchase and sale services on the terms contained in this Offer, including all Appendices.

2.2. Unconditional acceptance of the terms of this public offer is the booking, partial or full payment for services under an invoice generated by the Client on the website https://ioka.uz, with a mark on the item: "I accept the terms of the Public Offer, the User Agreement and consent to the processing of my personal data." Acceptance of this offer on terms other than those specified herein, or conditional acceptance, is not permitted.

3. Terms and procedure for the provision of services

3.1. To receive the Contractor's service, the Client registers on the website https://ioka.uz.

3.2. The Client independently submits a Request for the booking and purchase of air tickets. Booking procedure: a booking held for more than 30 minutes, prior to payment and ticket issuance, may be changed or cancelled unilaterally by the airline with notice to the Contractor via the GDS, as a result of which the Contractor is not liable for changes in the cost of booked air tickets; the Contractor nevertheless undertakes to make every effort to notify the Client of such changes by notifying the Client via the email or mobile phone specified by the Client at the time the Booking was created.

3.3. Procedure for editing and cancelling Requests. Cancellation/editing of previously placed/paid Services is carried out by the Client through the website ioka.uz by independently making the corresponding changes to the Request, without the involvement of a personal manager. The Client has the right to edit/cancel a request in accordance with the terms and conditions specified by the Service Provider on the website ioka.uz. If a Request is cancelled/edited beyond the periods specified by the Service Provider, penalties are payable in accordance with the Service Provider's terms and conditions. Funds remaining after all deductions/cancellation/editing are, at the Client's choice, either returned to the Client's account within 5 (five) banking days from the date the Client's request is received, or credited as an advance payment for future Requests.

3.4. Orders placed by the Client on the website ioka.uz are final and are subject to automated processing in the data processing system, following which emails with the Order status are sent to the Client's email address. If an Order was placed with errors made by the Client when filling out the booking form on the website, the Contractor and the Service Provider have the right to refuse to make changes to the Order and will not be liable for an Order incorrectly placed by the Client. In such cases, funds will be returned to the Client in accordance with the rules of the Contractor and the Service Provider.

3.5. The Contractor is not liable for the actual performance/non-performance of obligations by the Service Provider towards Clients.

3.6. Tickets are considered purchased by the Client upon the Agent sending an email with the Ticket (itinerary receipt) to the Client's email address specified at the time of booking.

3.7. By purchasing (paying for) tickets on the website ioka.uz, the Client confirms that they have independently studied, understood and accept the Fare Rules applicable to the ticket, sent to the email address specified by the Client in Russian and English, and/or confirms that the Contractor has informed them (the Client), in the Public Offer, of the right to obtain clarification of the Fare Rules in Russian prior to purchasing (paying for) the ticket, by contacting the support service. After payment for the ticket, all procedures related to the exchange or refund of the ticket are carried out by the Contractor strictly in accordance with the Fare Rules.

4. Cost of services and payment procedure

4.1. The cost of the Services is indicated on the website ioka.uz in the national currency — sum, by the Contractor itself, in accordance with the Agency/Sub-agency agreement with the Providers. The act of submitting a Request through the website ioka.uz constitutes the Client's agreement with the cost of the Contractor's Services and the rules for the provision of services by the Contractor and the Provider.

4.2. 100% payment of the cost of the Services specified in the Request is made at the time the Request is placed through the website ioka.uz.

4.3. Payment is made by the Client in the national currency — sum. All settlements under this Agreement may be made through payment systems, as well as by transferring funds to the Contractor's settlement account. Payment for services by non-residents may be made in freely convertible currency by credit/debit cards, as well as by transferring funds to the Contractor's foreign currency account on the basis of a foreign trade contract.

4.4. The obligation to pay for the Contractor's Services is deemed fulfilled at the moment funds are credited to the Contractor's bank account in the amount calculated in accordance with its tariffs and fixed on the website ioka.uz. The costs of making payments related to the transfer of foreign currency funds, including correspondent bank fees, are borne by the Client.

4.5. The Contractor has the right to charge the Client a service fee for its services and the services of the Service Provider. The service fee is generated and paid by the Client at the time of payment for the Services.

4.6. The Contractor does not control the hardware and software complex of the payment systems and is not liable for errors in such a hardware and technical complex. If, as a result of such errors, funds were debited from the Client but the payment was not authorized by the system, the obligation to refund the funds to the Client lies with the electronic payment system provider.

4.7. Payment for Services by bank cards on the website ioka.uz is made through the internet acquiring system of the acquiring bank. Bank cards of national and international payment systems are accepted for payment: UZCARD, HUMO, VISA, Mastercard.

4.8. All transactions paid by bank card are carried out with the mandatory application of the 3-D Secure secure cardholder authentication technology (Verified by Visa, Mastercard Identity Check, as well as similar transaction confirmation protocols of the national payment systems UZCARD and HUMO). To confirm the transaction, the cardholder is sent a one-time code, which must be entered on the acquiring bank's payment page.

4.9. The bank card details are entered by the Client on the secure payment page of the acquiring bank. Data is transmitted via a secure communication channel using an encryption protocol (TLS/SSL); payment processing complies with the requirements of the Payment Card Industry Data Security Standard (PCI DSS). The Contractor does not gain access to and does not store the Client's full bank card details.

4.10.–4.13. In order to protect the rights and funds of Clients, the Contractor, together with the acquiring bank, implements a set of measures to identify, limit and control the risks of fraudulent transactions (mandatory 3-D Secure authentication, transaction monitoring, limits, temporary blocking of suspicious transactions). The Contractor has the right to refuse the Client's payment, suspend, or cancel an Order upon detecting signs of a fraudulent transaction. The Client undertakes to make payments exclusively using bank cards of which they are the lawful holder, and to provide accurate data.

5. Terms for the exchange and refund of air tickets

5.1. Air ticket exchange and refunds are carried out from 9:00 am to 6:00 pm daily, in accordance with the fare rules established by the airline, which are attached to the email sent to the Client's email address after the Booking is created.

5.2. In the event of air ticket cancellation, refunds are made strictly in accordance with the Fare Rules of the relevant airline.

5.3. The air ticket refund service is a paid service.

5.4. Air tickets for low-cost carrier flights are not subject to exchange or refund.

6. Liability of the parties

6.1. For failure to perform or improper performance of obligations under this Agreement, the Parties shall be liable in accordance with the applicable legislation of the Republic of Uzbekistan.

6.2. The Contractor shall not be liable: in the event of the impossibility of fulfilling the obligations assumed due to inaccuracy, insufficiency and untimeliness of information and documents provided by the Client, or the Client's violation of the terms of this offer; for the quality of services provided by the Service Providers; for negative consequences and losses arising from events and circumstances beyond its control, as well as for the acts/omissions of third parties; for the Client's inability to place an Order due to communication line failures, malfunction of the Client's equipment, etc.

6.3. If the Client has claims related to the provision/non-provision/improper provision of Services by the Contractor, the Client shall apply to the Contractor to resolve the dispute.

6.4. Under no circumstances shall the Contractor's liability exceed an amount equal to 2 BCU of the Republic of Uzbekistan.

6.5. The measure of the Parties' liability not stipulated by the terms of this Agreement is governed by the applicable legislation of the Republic of Uzbekistan.

7. Dispute resolution procedure

7.1. All disputes that may arise between the parties in connection with the performance of this agreement, or other disputes related to the agreement, disputes regarding the invalidity of this agreement and/or its provisions, shall be subject to consideration in the relevant court at the location of the Contractor.

8. Confidentiality and protection of personal data

8.1. The Contractor guarantees the Client that all necessary measures will be taken to ensure the confidentiality of the Client's personal data in accordance with the requirements of the applicable legislation of the Republic of Uzbekistan. The Client's consent to the processing (including transfer to third parties) of their personal data is indefinite, provided that consent to the processing of personal data may be withdrawn by the Client at any time by sending an email to: support@ioka.uz

8.2. By accepting this Agreement, the Client grants the Contractor indefinite consent to the processing of their personal data (account details, mobile phone number, full name, registration data, location and others), including the collection, recording, systematization, accumulation, storage, clarification, retrieval, use, transfer, depersonalization, blocking, deletion, and destruction of personal data, for the purpose of performing this Agreement. The Client also consents to the transfer of their personal data to third parties for the purpose of performing this Agreement.

8.3. The Contractor processes personal data in strict accordance with the Law of the Republic of Uzbekistan "On Personal Data".

9. Grounds for exemption from liability (Force Majeure)

9.1. The Parties shall not be liable for delays in performance or non-performance of their obligations under this Agreement if such delays or non-performance resulted from circumstances of force majeure: war (including civil war), riots, strikes, fires, explosions, floods or other natural disasters, as well as failures in the operation of hosting companies. Immediately upon receiving information about the occurrence of such circumstances, the Parties shall notify each other in writing.

9.2. Similarly, circumstances exempting the Parties from liability include the declaration of an embargo, or other acts or omissions of the authorities and administration of Uzbekistan or other countries that directly affect the performance by the Parties of their obligations.

9.3. Any claim by either Party for compensation for damages caused by force majeure circumstances shall be void.

9.4. If force majeure circumstances continue to apply after the expiration of 30 days from their occurrence, and this causes a material violation of the rights and interests of either Party, that Party has the right to notify the other Party in writing of its intention to terminate the Agreement. The Agreement shall be deemed terminated upon the expiration of 30 days after such notice is sent.

10. Special terms of the agreement

10.1. The Client is responsible for the accuracy of the entered data, including the correspondence of the passengers' entered data with their passport details. Any changes to passengers' personal data require reissuing tickets at the fares available at the time of reissue.

10.2. The Client must independently verify information on the permitted weight, dimensions and number of pieces of baggage and hand luggage, as well as familiarize themselves with the online check-in rules established by the carriers, the rules for the carriage of dangerous goods, and the list of items prohibited for carriage.

10.3. The Client must independently verify information on which document is required for the flight, and on the necessary visas, entry permits, vaccinations, insurance policies and other permitting documents for the destination country or transit point.

10.4. The Client's personal information provided is confidential and shall not be disclosed to third parties, except in cases provided for by the legislation of the Republic of Uzbekistan.

10.5. Price information published on the site prior to preliminary booking, as well as in informational mailing letters, does not constitute an offer. The current price appears after entering passport data and receiving confirmation that the tickets have been successfully booked.

10.6. The Contractor has the right to send the Client informational messages by email and/or SMS related to air travel.

10.7. The results of ticket price searches displayed on the Contractor's website are not final; final prices are indicated only when the page for filling in booking details appears, whereby clicking the "Book" button fixes the Ticket price in the GDS, subject to seat availability.

10.8. If the Client creates two or more bookings for the same passengers on the same flight, airlines may unilaterally cancel duplicate bookings with the lower cost.

10.9. The SMS notification service for flight cancellations and delays is provided based on data supplied to the Contractor by airlines through automated notification channels. The Contractor is not liable for the timeliness and completeness of this information.

11. Informational notice

11.1. The Client consents to receiving updated information about the activities of Ioka Travel, informational messages with advertising and promotional offers and sales announcements, as well as information about news and offers from Ioka Travel's partners via SMS and email.

11.2. The Client consents to the recording of telephone conversations to improve service quality and confirm the Client's verbal statements, and to the retention of passengers' passport details solely for the convenience of subsequent purchases.

11.3. The Client agrees that use of the online service entails going through the registration procedure on the website, including in automatic mode, and that emails and messages, including of an advertising nature, will be sent to their email address.

11.4. The Client hereby gives the Contractor consent to collect and process the Client's personal data, including its accumulation, storage and use, for the purpose of providing the Client with the services offered on the website, including the provision of services by third parties.

11.5. The Client hereby gives the Contractor separate consent to the dissemination of the Client's personal data, including its cross-border transfer and the provision of access to the Client's personal data to third parties, including in cases beyond the purposes of collecting the Client's personal data declared by the Agent.

12. Term of the agreement

12.1. This Agreement enters into force from the moment of its acceptance by the Client.

12.2. For matters related to the performance of the Agreement, please contact the location address of LLC "IOKA TRAVEL": Tashkent, Mirzo Ulugbek district, Okibat MFY, 7 Mustaqillik Avenue.

Measures to limit and control risks of fraudulent transactions

The Enterprise hereby informs clients and partners about measures aimed at preventing and limiting risks of fraudulent transactions in accordance with the legislation of the Republic of Uzbekistan and the Bank's requirements.

The Enterprise monitors and restricts suspicious transactions in the following ways:

• checking payments and transactions for signs of fraud;
• restricting transactions that raise suspicion in the Bank's security system;
• using secure data transmission channels and modern information security tools;
• identifying and verifying clients when payments are made;
• temporarily suspending transactions when a risk of fraudulent activity is detected;
• cooperating with the Bank to prevent unauthorized transactions;
• complying with the requirements of the Internet acquiring agreement and internal security rules.

The client undertakes to:

• not transfer personal data, passwords, or confirmation codes to third parties;
• immediately report suspicious transactions;
• follow safe use rules for electronic payment systems.

The Enterprise reserves the right to restrict or reject a transaction if signs of fraud or violations of security requirements are identified.