Privacy Policy

Maydon Rent App

Version dated 3 november 2026

This Privacy Policy (the "Policy") sets out how the personal data of individuals are processed and protected when the Maydon Rent app is used. The Policy explains which data are necessary for the operation of the app, for what purposes they are used, to whom they may be provided, and how the User may exercise their rights.

1. GENERAL PROVISIONS

1.1. Personal data in connection with the provision of the Maydon Rent app are processed by MAYDON PARTNERS LLC, TIN 312567545 (the "Operator"). Within the scope of the processing it carries out, the Operator acts as the owner and/or operator of a personal data database in accordance with the Law of the Republic of Uzbekistan "On Personal Data". The Operator's contact details are set out in Section 10 of the Policy.

1.2. The App means the Maydon Rent mobile application and the user interfaces associated with it. For the purposes of the Policy, a User is an individual who uses the App, including a representative of an organisation, of a Landlord or of a Tenant. Personal data means information relating to an identified individual or enabling such individual to be identified. A Property is real estate offered for lease. The provisions of the Policy also apply to individuals whose data have been lawfully provided to the Operator for the stated purposes by other persons, regardless of whether they have an account.

1.3. The Policy applies to the Operator's processing of data for the provision of the App. The Landlord, the Tenant and the independent third-party services chosen by them are responsible for their own processing of data in accordance with the law and their actual role. Engaging contractors to operate the App does not relieve the Operator of its own data protection obligations.

1.4. The Policy is an informational document. Reading it, or installing or using the App, does not in itself constitute consent to any data processing. Where consent is required, the Operator obtains a separate, verifiable expression of will. Such expression of will does not replace the negotiation of the lease agreement.

1.5. When the User goes to another person's independent website or application, that person's own privacy terms govern its processing of data. The User is given the opportunity to read them before transferring any data. The Operator remains responsible for the processing it carries out.

2. CATEGORIES OF PERSONAL DATA

2.1. The Operator processes data to the extent necessary for the functions selected by and available to the User. The inclusion of a category in the Policy does not mean that all information in that category will be requested from every User. The fields required for the selected function, and the purpose of requesting them, are indicated when the data are collected.

2.2. Account and contact details: first name, surname, patronymic, username, telephone number, email address, date of birth, address and profile photograph, if provided for the selected function; account identifier and status, registration date, settings and the User's role.

2.3. Identification and authority: PINFL (personal identification number of an individual), individual TIN, passport number and documents relating to the selected function; full name and position of a representative, the basis for and confirmation of authority. These data are necessary to confirm identity or authority or to state a party's details in the selected document function, and are not intended to be generally accessible.

2.4. Acting on behalf of an organisation: the User's connection with the organisation, their role and access rights, information about representatives and invited participants. The Policy applies to information about an organisation to the extent that it relates to an identified individual or enables such individual to be identified.

2.5. Properties and listings: the address, cadastral information, characteristics, photographs, floor plans and coordinates of real estate, the content and status of a listing; applications, preferences, saved offers, views and selected settings. The coordinates of a Property describe the real estate and do not constitute permission to track the User's movements.

2.6. Lease and documents: information about the parties and representatives, the Property, the term and other lease terms under negotiation, the content of drafts, documents and attachments, and the negotiation history. Details and amounts included by Users in such materials are processed as part of their content. The Operator does not accept or transfer rent payments.

2.7. Information on the execution of documents: signatory data, the image of the signature, information about the signature and its certificate, the status of execution and related confirmations, if the User provides them within an available function or instructs that they be obtained from an independent third-party service chosen by the User.

2.8. Messages and requests: correspondence, transferred files, information on sending, delivery and reading, support responses and the outcome of a request. Confirmations of consent: the text or version, date, method of provision and information on withdrawal. For paid functions of the App, if used, the amount, date, purpose and status of the Operator's own fee and of any refund of it are processed.

2.9. Necessary technical information: IP address, access and device identifiers, device type, operating system and browser, App version, time of access, actions and error information necessary for operation, security, the handling of requests and the confirmation of an expression of will.

2.10. Biometric identification, genetic data, health information and background location tracking are not among the purposes of the main consent. The profile photograph and the image of the signature are not used on the basis of this consent to recognise a person by biometric characteristics. The User must not send excessive information, passwords or other access credentials.

3. PURPOSES AND LEGAL BASES OF PROCESSING

3.1. Account and contact data are used to create and maintain an account, provide access, save settings and communicate on matters relating to the App. The legal basis is entering into and performing a contract, taking steps at the User's request before entering into it and, where required, separate consent.

3.2. Identification and authority information is used to verify the information provided and the right to act in the selected role, and to state a party's details in the selected document function. Data on Properties, listings, applications and preferences are used to post and search for offers and to interact about them. Information is made public only to the extent the User chooses.

3.3. Lease information, documents and correspondence are used to provide the selected functions for working with these materials and to communicate and exchange them with persons the User specifies. The terms of a lease are determined by its parties. The Operator processes these materials to provide the functions of the App; the services of an independent third-party service chosen by the User are provided by the relevant person.

3.4. To handle requests, correct errors and protect infringed rights, the necessary data from the request, the account and the relevant materials are used. If the App is subject to a fee, information about the fee is used to provide the Operator's own service and to meet the accounting obligations established by law.

3.5. The necessary technical information is used to keep the App operational and secure, prevent unauthorised access and investigate abuse. The legal bases are performance of a contract, legal requirements and the protection of legitimate interests, with due regard to the User's rights.

3.6. For each purpose the Operator determines a separate lawful basis. If a new purpose requires new consent, it is obtained before processing begins. Data are not used for purposes incompatible with those stated at collection. Refusal to provide optional data does not restrict functions for which they are not needed.

4. SOURCES OF DATA AND THEIR RECIPIENTS

4.1. The Operator obtains data from the User, from the User's actions in the App, from the other party to a lease under negotiation or an authorised representative, and from an independent third-party service chosen by the User where there is a lawful basis. Data received from a third party are limited to the selected function and the necessary scope.

4.2. A Landlord, Tenant or their representative specified by the User may be provided with contact details, messages, information about the Property and the materials necessary for negotiating a lease. Within an organisation, access is granted to participants within the limits of their authority. Such transfer does not permit unrelated use of the data or advertising without consent.

4.3. When a listing is published, only the information the User has included in its public part becomes available to other persons. Publication requires a separate, unambiguous action after the User has reviewed the information to be published. Passport data, PINFL, bank details, private contracts and correspondence do not become publicly available as a result of creating an account or publishing a listing.

4.4. Persons engaged by the Operator to operate the App, provide support and protect information are given access within the limits of their assigned tasks, on the basis of the law and a contract containing confidentiality and data protection obligations. An independent third-party service chosen by the User receives only the information needed for the requested function and only where there is a lawful basis. Membership of the same group of companies does not in itself provide a basis for transfer.

4.5. Data are provided to state bodies, courts and other authorised persons in the cases and to the extent provided for by law, after the basis of the request has been verified. The User is entitled to receive information about the recipients of their data and the grounds for transferring them.

4.6. When data are included in the database, the User is notified of the purposes of processing and of their rights. The Operator notifies the User in writing of a transfer of data to a third party within three days, except in cases of exemption from notification expressly provided for by law.

5. USER CHOICES AND NOTIFICATIONS

5.1. The User decides what optional information to include in their profile, which listings to publish and whom to send documents or messages to. When providing another person's data, the User must have a lawful basis and limit such data to what is necessary. The existence of such a basis does not relieve the Operator of its own obligations.

5.2. The Operator sends necessary messages concerning the account, selected functions, interaction between Users, security, requests and changes to terms. Such messages are limited to their service purpose. Having the User's contact details does not constitute consent to advertising mailings.

5.3. Advertising and personalised marketing offers are not among the purposes of the main consent. Consent to them is requested separately, and giving it is voluntary. Refusing or withdrawing it does not affect the main functions of the App or necessary service messages.

6. RETENTION PERIODS, PLACE OF STORAGE AND DESTRUCTION

6.1. Data are processed for no longer than is necessary for the specific lawful purpose. Account and contact information is used for as long as the account and the contract remain in effect. After the relationship ends, only those data are retained that remain subject to a statutory retention obligation or to a separate lawful basis for protecting rights in relation to a specific claim.

6.2. Listings, correspondence and documents provided are stored for as long as the relevant function requires. Accounting information on the Operator's own fee for the App is stored for the periods established for such documents. Request data are retained until the matter is resolved and, where necessary, for no longer than the applicable period for protecting the relevant right. Confirmations of consent and of its withdrawal are stored to the extent necessary to prove the lawfulness of processing.

6.3. Technical information is stored for as long as necessary to ensure security and fix specific errors, after which it is deleted or depersonalised unless there is another basis for keeping it. At the User's request, the Operator informs the User of the retention period for their data, or the criteria used to determine it, and of the applicable basis.

6.4. Once the purpose is achieved, the permitted period expires or consent is withdrawn, data that have no separate lawful basis for processing must be destroyed. Deleting an account does not override the legal obligation to retain certain information, nor does it automatically delete copies of documents held by the other party to the lease if that party has its own lawful basis for keeping them. The Operator limits the use of the data it retains to the relevant purpose.

6.5. Storage and processing are organised in compliance with the requirements of the legislation of the Republic of Uzbekistan. Categories of data for which the law establishes mandatory storage in the territory of the Republic of Uzbekistan are stored in its territory. Other data may be stored and processed outside the country only where the conditions provided for by law are met.

6.6. Cross-border transfer is permitted only where there is a lawful basis and the established requirements for the protection and storage of data are complied with. Information about the intended transfer, its purposes, the scope of data and the recipients is provided to the User; where separate consent is required, it is requested before the transfer. The main consent to the use of the App does not constitute unconditional permission to transfer data to any country.

7. CONFIDENTIALITY AND PROTECTION

7.1. The Operator takes the necessary legal, organisational and technical measures to protect personal data against unauthorised access, disclosure, alteration, loss and other unlawful processing. Access by employees and engaged contractors is limited to their tasks; persons granted access to the data are obliged to maintain confidentiality and comply with the established processing rules.

7.2. The User should keep their access credentials confidential, keep the contact details provided up to date and inform the Operator of any signs of unauthorised access to their account. These obligations do not relieve the Operator from its own obligations to protect data and to handle reports of breaches.

7.3. If the Operator detects unlawful processing, it takes steps to stop it, restrict access and remedy its consequences, fulfils the notification obligations provided for by legislation and bears the liability established by law.

8. USER RIGHTS AND WITHDRAWAL OF CONSENT

8.1. The User is entitled to receive information about the existence and scope of their data, the purposes, bases and methods of processing, the sources, the retention periods, the persons having access, and any cross-border transfer carried out or intended. The information is provided in an accessible form, subject to the rights of other persons and the restrictions provided for by law.

8.2. The User is entitled to require inaccurate data to be corrected or supplemented and, where there are lawful grounds, processing to be temporarily suspended or data to be destroyed. The Operator makes changes and additions upon request within three days, and corrects any established inaccuracy without delay. Whether the accuracy of new information needs to be confirmed depends on the nature of the change.

8.3. Consent may be withdrawn in full or in respect of a particular purpose by the method by which it was given, or by a written request, including in electronic form, using the contact details in Section 10. Withdrawal takes effect prospectively. The Operator stops processing based on the withdrawn consent; necessary processing on a separate lawful basis continues only within the limits of that basis.

8.4. If the selected function cannot be provided without certain data and there is no other lawful basis for processing, withdrawal of consent may make that function unavailable. The Operator explains this consequence. Refusal of optional processing must not restrict functions for which such data are not needed.

8.5. A request may be sent to the Operator by email, by post or through the support channel available in the App. It is enough to state a means of contact, details that allow the account or the affected operation to be found, and the substance of the demand. The Operator may request proportionate confirmation that the data belong to the applicant, without collecting excessive information.

8.6. Requests are handled within the time limits established by legislation for the relevant demand. A reasoned refusal to provide information about processing is sent in writing within ten days. If a decision with legal consequences is taken solely on the basis of automated processing, the User is entitled to receive the explanations provided for by law and to raise an objection; the outcome of the objection is communicated in writing within ten days.

8.7. The User is entitled to challenge the Operator's actions or inaction before the authorised state body or a court and to use other remedies provided for by the legislation of the Republic of Uzbekistan. Contacting support first does not restrict these rights.

9. CHANGES TO THE POLICY

9.1. The current version of the Policy is available in the App. When the processing terms change, the Operator posts the new version with its date and brings material changes to the User's attention before the relevant processing begins, observing the notification periods established by law. The User is entitled to request the version that was in effect when their consent was given.

9.2. Publication of a new version does not broaden the scope of consent previously given. If the purposes or other processing terms change in a way that requires new consent, the Operator obtains it separately. Continued use of the App does not replace such an expression of will and is not deemed consent to advertising or to new optional categories of data.

10. OPERATOR DETAILS

10.1. MAYDON PARTNERS LLC. TIN: 312567545. Address: Republic of Uzbekistan, Tashkent, Sergeli district, Kukhna Kumarik MFY, TKAD, building 1A.

10.2. Email for requests, including personal data matters and withdrawal of consent: info@maydongroup.com. Telephone: +998 99 288‑88‑88. Users are advised to state "Maydon Rent — personal data" in the subject line of an email request.