Privacy and Personal Data Processing Policy

The operator of personal data is «ATB RECRUITING» MCHJ XBA (TIN: 303389960; address: Республика Узбекистан, г. Ташкент, Мирабадский район, ул. Тараса Шевченко, 21; the "Operator").

Registration number in the State Register of personal data databases: в процессе регистрации.

Requests concerning personal data are accepted at info@nxtop.uz; responses are provided within ten business days unless the law provides otherwise.

Personal data — information recorded on any medium relating to an identified natural person or allowing such person to be identified (Article 4 of the PD Law).

Processing — any operation or set of operations with personal data: collection, systematisation, storage, alteration, use, provision, distribution, transfer, depersonalisation and destruction.

Data subject (the "User") — the natural person to whom personal data relates. Job seeker — a User seeking employment; Employer — a User acting on behalf of a legal entity or individual entrepreneur for recruitment purposes.

The subject's consent, given at registration and by conclusive actions when using the Service (Articles 15–16 of the PD Law); consent is given freely and may be withdrawn at any time.

Necessity of processing for the conclusion and performance of a contract to which the subject is a party (User Agreement, Public Offer).

Compliance with obligations imposed on the Operator by the legislation of the Republic of Uzbekistan.

Account data: name, e-mail and/or mobile phone number, role (job seeker/employer), password (stored only as an irreversible cryptographic hash). Sign-in via Google or Apple provides the Operator with an identifier, name and e-mail from the provider.

Job seeker CV data provided voluntarily: desired position, work experience (employers, positions, periods), education, skills, languages, city, expected salary, photo, year of birth, gender, citizenship, driving licence, links to messenger/social profiles, video presentation and other information included in the CV.

Employer data: company name, TIN, industry, address, logo, and documents confirming legal capacity (processed in a private storage segment and never published).

Location data: device coordinates — only with your explicit permission, used for radius-based vacancy search; permission can be revoked in the device settings at any time.

Payment information: orders, amounts and payment statuses. Bank card details are neither transferred to nor stored by the Operator: payments are processed by the Payme payment system certified under PCI DSS.

Technical data: IP address, device, browser and OS information, push-notification identifiers, cookies, activity logs.

Special categories of data (health, beliefs, etc.) are not requested by the Operator; please do not include them in your CV.

Registration, authentication and operation of the account.

Provision of the Service functionality: posting and searching vacancies and CVs, applications, recommendations, messaging between job seekers and employers.

Providing Employers with access to CVs and contact details — within the visibility settings chosen by the job seeker.

Service notifications (e-mail, SMS, push); marketing messages only with separate consent and with an opt-out available at any time.

Employer verification, content moderation, fraud prevention and security.

Payment processing, balance management and fiscal receipts as required by law.

Analysis of depersonalised statistics to improve the Service (including aggregated salary statistics).

The Service uses strictly necessary cookies (session, interface language, preferences). Disabling cookies may limit the functionality of the Service.

Analytics tools, where used, rely on depersonalised data and do not identify a specific User.

A job seeker's CV is available to Employers according to the visibility mode chosen by the job seeker. Contact details are disclosed to an Employer when the job seeker applies to its vacancy or when contacts are lawfully unlocked from the CV database. An Employer that obtains personal data must process it solely for recruitment purposes and bears independent responsibility as an operator of such data.

The Operator engages a limited number of infrastructure providers to the minimum extent necessary: the hosting provider (servers located in the Republic of Uzbekistan), the Payme payment system, an SMS gateway, an e-mail service, and Apple (APNs) / Google (FCM) push delivery services, all subject to confidentiality.

Personal data may be provided to competent state authorities only on the grounds and in the manner prescribed by the legislation of the Republic of Uzbekistan.

The Operator does not sell personal data and does not share it with third parties for marketing purposes.

The primary database of personal data of citizens of Uzbekistan is created and stored on servers physically located in the Republic of Uzbekistan (Tashkent), which ensures compliance with Article 27¹ of the PD Law.

Certain technical operations (push delivery via Apple/Google infrastructure, e-mail delivery) may involve cross-border transfer of the minimum necessary data. Such transfer complies with Article 15 of the PD Law — to states ensuring adequate protection of personal data or based on the subject's consent expressed by using the relevant features.

Personal data is processed until the purposes of processing are achieved: while the account is active and, after its deletion, for the periods required by law for particular categories (e.g. payment records are kept for the periods established by accounting and tax legislation).

The User may delete the account at any time in the Account section; the CV, applications, messages and related data are then deleted, except for data whose retention is required by law.

Before deletion the User may export their data in a machine-readable format (the export feature in the Account section).

Upon expiry of retention periods the data is destroyed or depersonalised.

Under Articles 30–31 of the PD Law the subject may: obtain information on the processing of their data and access it; demand rectification; demand blocking or destruction of data processed unlawfully or no longer necessary; withdraw consent; and appeal against the Operator's actions to the competent state authority for personal data protection or to court.

Most rights can be exercised directly in the personal account: editing the CV and profile, visibility settings, data export, account deletion.

For other requests, contact info@nxtop.uz; the Operator may ask for identity verification.

Withdrawal of consent does not affect the lawfulness of prior processing and may make further use of the Service impossible.

The Operator applies the legal, organisational and technical measures required by Articles 27–29 of the PD Law: TLS encryption, password hashing, access control, private storage of verification documents with time-limited links, activity logging, regular backups and restricted access to the server infrastructure.

Employees and contractors access personal data only to the extent necessary for their duties and under confidentiality obligations.

The Service is intended for persons aged sixteen and over — the general age of employment under the legislation of Uzbekistan. By registering, the User confirms reaching that age. Accounts created in breach of this condition are deleted upon request of legal representatives or at the Operator's initiative.

The Operator may amend the Policy. The new version is published in the Service with the update date and takes effect upon publication unless stated otherwise. Material changes are additionally notified to Users. Continued use of the Service constitutes acceptance of the new version.