Privacy Policy

1. Purpose of this Policy and data operator

1.1. This Privacy Policy (the “Policy”) explains how BELLUS LABS LLC (“Bellus”, “we”) collects, processes, stores, provides and protects personal data when people use the Bellus Client App, Bellus Dashboard for businesses, bellus.uz and related functionality (together, the “Platform”).

1.2. For Platform data where Bellus determines the purposes and methods of processing, Bellus may act as an owner and/or operator of a personal-data database under the Law of the Republic of Uzbekistan “On Personal Data”.

1.3. This Policy applies to Clients, Business representatives and staff, specialists, Platform account users, website visitors and other individuals who interact with Bellus.

2. Roles of Bellus and Businesses

2.1. Bellus is not the provider of the beauty service. To fulfill a booking, certain Client information is provided to the selected salon, individual entrepreneur or other Business that provides the service.

2.2. After receiving Client data to provide its own service, communicate with the Client, or satisfy fiscal, tax and other legal obligations, the Business may act as an independent owner/operator with respect to its own copy and use of that information and is independently responsible for that processing.

2.3. Where a Business supplies Bellus with information about its representatives or staff, the Business must ensure that it has an appropriate legal basis to provide that information and, where applicable, to make the staff profile visible through the Platform.

3. Information we may process

Depending on the Platform feature used, Bellus may process the following categories.

Client account and identification data: name, surname (where requested), phone number, email (where used), language, profile photo, account identifier, OTP/login verification records and account settings.

Booking and service data: selected Business/branch, service, specialist, date and time, service price, add-ons, tip, booking status, rescheduling, cancellation, no-show status, service completion and other technical records relating to the booking.

Communications and content: chat messages between the Client and Business, files or content sent through the Platform where available, ratings, reviews, Bellus support requests and feedback.

Payment information: a payment token issued by Payme or another provider, masked card number, expiry information, token/card technical status, Payme/Kassa or other payment identifiers, payment/receipt/transaction IDs, amount, tip, payment status, timestamps and technical refund/cancellation records. Bellus does not persistently store a full unencrypted card number, CVV/CVC or bank/SMS OTP code.

Business and Dashboard data: Business representative name, phone/email, role and authority; staff/specialist name, photo, position, services, prices, schedules and profile information displayed through the Platform; branch contact information; Payme Kassa/Merchant or other business payment identifiers; subscription plan, billing and electronic invoice/service-act information.

Technical information: IP address, device and operating-system type, application/browser version, device or push-notification identifier, session and security records, error/crash diagnostics, API/audit logs and technical feature-usage events.

Location: where a user grants device permission and the feature is available, Bellus may process approximate or precise location to show nearby Businesses or provide map functionality. The permission can be disabled through device settings.

4. Special or sensitive information

4.1. Bellus does not require a Client to provide biometric, genetic or medical information to Bellus for an ordinary beauty-service booking.

4.2. If a Client voluntarily communicates allergy, health or other sensitive information through chat, Bellus may technically store that message to transmit it to the Business and operate the Platform lawfully and technically. Users should provide such information only where genuinely necessary for the service.

4.3. If Bellus later introduces a feature that processes special, biometric or other regulated information requiring separate consent or a special procedure, Bellus will provide the required separate notice and consent mechanism.

5. Payme, tokenization and saved cards

5.1. Bellus may provide Payme payment functionality inside the Platform, through a Payme interface, in a browser, in the Payme mobile application, or through another method supported by Payme.

5.2. Where the Client chooses to save a card, Payme may tokenize it. Bellus may store the reusable Payme-issued token and limited information required to display and manage the card in the Platform, such as the masked number, expiry information and verify/recurrent status.

5.3. The token is not the full card number; however, because it can be used to initiate a payment, Bellus protects it as a restricted payment credential.

5.4. Where supported by Payme, a Client's saved token may be used for payments to different participating Businesses. Each relevant Business maintains its own arrangement with Payme and supplies Bellus with its Kassa/Merchant or other required payment identifier. The Business does not receive direct access to the Client's saved token.

5.5. Saving a card by itself does not authorize automatic, recurring or otherwise unauthorized future charges. Each service payment must be separately initiated or expressly confirmed by the Client unless separately disclosed recurring/automatic-payment terms have been accepted.

5.6. The Client may remove a saved card through the applicable Platform function. Within the available technical capabilities, Bellus will request Payme to remove/invalidate the token or will stop its further use.

6. Purposes and lawful grounds for processing

Depending on the situation, Bellus may process data to perform a contract with a Client/Business, take requested steps before entering a contract, act on the subject's consent, comply with a legal obligation, or rely on another basis allowed by applicable law. Purposes may include:

• creating accounts, authentication and secure access;
• displaying salons, branches, specialists, services and availability;
• creating, confirming, changing, cancelling and completing bookings;
• providing chat and necessary communications between Clients and Businesses;
• initiating Payme and other supported payments, tokenization, displaying payment status, technically transmitting refund requests, and identifying errors/fraud;
• operating the Business Dashboard, branch/staff/service/schedule management, reports and analytics;
• managing Business subscriptions, billing and legally required documents;
• sending transactional SMS, push, email and booking notices;
• technical support and feedback handling;
• Platform security, abuse prevention and fraud control;
• error analysis, Platform improvement and aggregated/de-identified statistics;
• legal claims and compliance with lawful governmental requests.

7. Recipients and service providers

Bellus may provide data to, or use, the following recipients to the extent necessary for the relevant purpose:

• the selected Business, for booking fulfillment, Client communication and service/payment verification;
• Payme, banks and payment infrastructure, for tokenization, payment authorization, transactions, fiscal and refund processes;
• hosting, cloud/storage, SMS/email/push, maps/geolocation, monitoring, crash/analytics, support and security providers, to perform the relevant technical service for Bellus;
• electronic-document and accounting providers, for Business subscription and legally required documents;
• a court, competent authority, law-enforcement body or other lawful recipient where there is a legal basis;
• participants in a corporate reorganization or business-asset transaction, subject to applicable law, confidentiality and purpose limitations.

Bellus does not sell personal data to third parties for their independent advertising purposes.

8. Information shared with Businesses

8.1. When a booking is created, the selected Business may receive the Client profile/contact details, booking information, chat and relevant payment status necessary to fulfill the booking.

8.2. Bellus does not permit one Business to access another Business's Client data, except for lawful and technically necessary shared Platform functionality.

8.3. If a Business exports or copies Client data into its own CRM, fiscal, accounting or other lawful system, further processing of that copy is the Business's responsibility.

9. Chat, support, reviews and moderation

9.1. Bellus may technically store and transmit chat as a direct communication channel between the Client and Business. Bellus does not ordinarily intervene to decide which party is correct in the underlying service dispute.

9.2. Bellus may allow authorized access to chat or other content only for technical support, security, fraud/abuse investigation, unlawful use, enforcement of Platform rules or legal obligations.

9.3. Ratings and reviews may be visible to other Platform users. Users should not include personal information in a review that they do not want to make publicly visible.

10. Device permissions, cookies and similar technologies

10.1. The mobile application may request device permissions such as camera/photos (for profile or content upload), notifications or location only for the relevant feature. Permissions can be managed through device settings.

10.2. Bellus web interfaces may use cookies, local storage and similar technologies for sessions, authentication, security, language/preferences and functional operation. Where optional analytics/marketing technologies require a separate notice or consent, Bellus will implement the applicable mechanism.

11. Notifications and marketing

11.1. Bellus may send necessary transactional communications relating to bookings, account security, payments, subscriptions and Platform operation.

11.2. Advertising, promotional or marketing communications are sent only where permitted by law and, where required, with the appropriate consent. A user may opt out of marketing; this may not stop necessary service or security messages.

12. Automated processing and recommendations

Bellus may use automated tools to rank search results, show nearby/relevant services, identify security or fraud signals, perform analytics or improve the Platform. If Bellus later introduces a significant automated decision for which the law requires separate notice, consent or human involvement, Bellus will implement those requirements.

13. Storage in Uzbekistan and cross-border processing

13.1. Bellus complies with applicable Uzbekistan requirements governing storage, protection and cross-border transfer of personal data.

13.2. Categories of personal data that applicable law requires to be stored in the Republic of Uzbekistan will be stored in Uzbekistan, and the relevant database will be registered in the State Register where registration is required by law.

13.3. Personal data outside mandatory local-storage categories may be stored or processed outside Uzbekistan only when applicable cross-border transfer/storage conditions are satisfied. These may include an adequate-protection country, an approved contractual/corporate safeguard, a recognized standard, or another basis permitted by law.

13.4. If Bellus changes infrastructure or service providers, Bellus will reassess the lawful basis and safeguards for cross-border processing.

14. Retention

Bellus follows the principle that personal data should not be kept longer than necessary for its processing purpose. The actual period depends on the category and legal obligations:

• account data - while the account is active and after closure for the period required for law, security or disputes;
• booking, payment and refund records - for the period required for service operations, disputes, anti-fraud and mandatory accounting/fiscal requirements;
• saved Payme token - until the Client removes the card, the token is invalidated/expires, or it is removed for account/security reasons;
• chat/support and moderation records - a justified period for Platform operation, safety, disputes and legal requirements;
• Business subscription and accounting documents - for applicable tax, accounting and other mandatory retention periods;
• technical/security logs - a reasonably limited period for diagnostics and security.

When the purpose has ended and no other legal basis requires retention, information is deleted, destroyed or de-identified so that the individual can no longer reasonably be identified.

15. Data security

15.1. Bellus applies legal, organizational and technical measures required by law to protect personal data against unauthorized access, alteration, loss, disclosure and unlawful processing.

15.2. Depending on the risk and need, measures may include role-based access controls, authentication, protected transmission channels, restricted handling of secret tokens/credentials, audit/logging, backups, security monitoring and limitation of employee access.

15.3. No internet or information system can be guaranteed absolutely secure. Bellus applies reasonable safeguards and will take legally required actions in connection with personal-data security incidents.

15.4. Users should protect OTPs, passwords, devices and account access and notify Bellus of suspicious activity.

16. Rights of personal-data subjects

Subject to applicable law, an individual may have the right to:

• know whether Bellus holds personal data concerning them and its composition;
• request information concerning processing and access to their data;
• request correction/completion of inaccurate, outdated or incomplete data;
• where provided by law, request temporary suspension of processing or destruction/deletion of data;
• withdraw consent for processing based on consent;
• withdraw relevant consent for public-profile/content publication or request its removal;
• apply to the competent state authority or a court.

Requests may be sent to privacy@bellus.uz or through an available privacy/account function in the Platform. Bellus may reasonably verify the requester's identity. Withdrawal of consent does not invalidate processing already lawfully carried out and does not stop processing where another lawful basis continues to apply.

17. Account deletion and payment-token removal

17.1. A Client may request account deletion through available Platform functionality. Deletion ends active Platform use, but certain records may be retained where required for law, security, a payment/booking dispute or a legal claim.

17.2. Removing a saved card may be separate from account deletion. Bellus will stop further use of the token and will use the supported Payme API process to request token invalidation/removal.

18. Minors

Where a minor uses the Platform, parental or legal-representative consent/supervision must be provided where required by applicable law. If Bellus learns that a minor's data is being processed without the required lawful basis, Bellus may take appropriate restriction or deletion measures.

19. Changes to this Policy

19.1. Bellus may update this Policy to reflect changes in the Platform, law, payment functionality or data infrastructure.

19.2. Bellus will provide notice through the Platform or electronic communication before material changes affecting core data-subject rights or the purposes of data use take effect, unless applicable law or an urgent security measure requires a different process.

19.3. Where a new processing activity requires separate consent under law, Bellus will obtain the required consent before commencing that processing.

20. Contact and requests

BELLUS LABS LLC
TIN: 313059883
Legal address: город Ташкент, Мирзо-Улугбекский район, Оққўрғон маҳалласи, Улугбек, Oqqo'rg'on MFY, Oqqo'rg'on 1-tor ko'chasi, 20-uy, 16-xonadon
Privacy / personal-data requests: privacy@bellus.uz
Technical support: support@bellus.uz
Telephone: +998950853090
Website: https://bellus.uz

This Policy has been prepared taking into account the Law of the Republic of Uzbekistan No. ZRU-547 “On Personal Data”, as amended, and other laws applicable to Bellus activities.