Privacy Policy

1.1. The owner and operator of the personal data is the owner of the NSB.uz online store (“we”). Its name, taxpayer number (STIR) and address are shown in the “Company details” block on this page.

1.2. This policy applies to the website https://nsb.uz, its Telegram bot, the NSB mobile app and phone conversations with our operators. Links to other websites are governed by their own policies.

1.3. By registering, placing an order or sending a request, you consent to the processing of your data under this policy. On registration, consent is confirmed by a separate checkbox, and its date and the document version are stored.

Website visitors

• Settings in browser storage: cart, wishlist, theme (light/dark), language, catalogue view and your cookie choice.
• Search queries — anonymously, not linked to a user or IP address (to understand which products people look for).
• With your consent — analytics data and the advertising source (UTM tags, ad click identifiers, the previous site's address).
• Technical data when your browser sends requests to our server (IP address, browser type) — briefly (no longer than 90 days), for security and abuse prevention.

Customers

• Name, phone number (and an additional number), email (optional), region and delivery address, order comment.
• Order contents, total, status, payment status and the offer version in force when the order was placed.
• With your consent — the advertising source that led to the order (UTM tags).

Registered users

• Name, email, phone number, password (only as a one-way hash), profile photo.
• Telegram chat identifier (for account confirmation, password recovery and notifications), two-factor authentication settings.
• Order history, notifications, reviews, and the date and version of your consent to the offer and the privacy policy.

People who send requests

• Contact form: name, phone, message text.
• Repair, courier and B2B requests: name, phone, device and fault description, address, comment, the page the request was sent from.
• Solar energy requests: name, phone, email, city, address, monthly consumption and calculator results.
• “Notify me when in stock”: phone, email or Telegram contact and the product.

Lobby, tournament and support users

• Chat messages and images, game ID, team name and membership, tournament registration details, support conversations.

2.1. We do not ask for passport details, biometric data, health data or other special categories of data. Please do not send them in comments or chats.

3.1. We do not use data for purposes incompatible with those listed and do not make automated decisions about you that have legal effects.

4.1. The website mainly uses browser storage (localStorage). This data stays on your device and is sent to the server only when needed (for example, when you place an order).

4.2. Google Analytics 4, Google Tag Manager, Yandex Metrica and Meta Pixel load only after you click “Accept” in the cookie banner. Yandex Metrica uses session replay (Webvisor) and click maps. Password fields are not recorded. We do not send your name or phone number to analytics services.

4.3. You can withdraw consent at any time. To do so, click “Change cookie choice” on this page or clear the site data in your browser. The banner will then ask for your choice again. Cookies set by analytics services can be deleted in your browser settings.

4.4. The NSB mobile app uses Google Firebase Analytics for app usage statistics.

5.1. We share data only to the extent needed for the following services:

5.2. Data may also be disclosed at the justified request of authorised state bodies in cases provided for by law.

5.3. We do not sell or rent personal data or share it with other companies for their own advertising.

6.1. Some of the services listed (Telegram, Google, Yandex, Meta, Cloudflare, MoySklad, Sentry) have servers outside the Republic of Uzbekistan. When these services are used, data is transferred abroad.

6.2. Cross-border transfer is carried out in line with the Law “On Personal Data”, based on your consent and only to the extent needed for the stated purposes. You give or refuse consent to analytics and advertising services in the cookie banner.

7.1. The operator fulfils its obligation, in line with legal requirements, to store personal data of citizens of the Republic of Uzbekistan on technical means physically located in the Republic of Uzbekistan and to register personal databases in the state register.

7.2. Data is kept until the purpose of processing is achieved or for the period required by law:

7.3. When the period expires, or at your justified request, data is deleted or anonymised. Data we are required by law to keep is the exception.

8.1. To protect data we take the following measures:

• All communication with the website is encrypted with HTTPS.
• Passwords are stored as a one-way hash.
• Accounts are confirmed via Telegram, and two-factor authentication can be enabled.
• Sign-in attempts and requests are rate-limited, and forms are protected from spam.
• Staff can access only the sections they need for their work. Actions in the admin panel are logged.
• Database backups are made regularly.

8.2. No transmission over the internet is completely secure. Never share your password. If you notice unauthorised access to your account, change your password immediately and contact us. In the event of a data breach we will take action as required by law and notify you where necessary.

9.1. You have the right to:

• know whether your data is processed, for what purposes and who receives it;
• access your data and receive a copy;
• have inaccurate or outdated data corrected;
• have your data blocked or deleted;
• withdraw your consent to processing;
• complain about our actions to the authorised state body or a court.

9.2. How to exercise your rights:

• In your account you can change your name, phone and profile photo, change your password, enable two-factor authentication and unlink Telegram.
• You can delete your account yourself: your account page → “Security” → “Delete account” (with your current password and, if two-factor authentication is on, a confirmation code). The account is closed immediately, sessions on all devices are ended, and personal data is deleted or anonymised, usually the following night (no later than 30 days); orders are kept for the period required by law (see section 7). To get a copy of your data or make other requests, write to the email or Telegram shown below. To verify your identity, we may ask an additional question via the phone or email in your account.
• You can withdraw analytics consent with the “Change cookie choice” button on this page.

9.3. We reply to requests within 10 working days of receipt. Where the law sets a shorter period, that period applies.

9.4. Withdrawing consent does not affect the lawfulness of processing before withdrawal. Without the data needed to fulfil an order, we may be unable to fulfil it.

10.1. The website is not intended for children under 16. We do not knowingly collect their personal data. If a person under 16 places an order, registers or takes part in the Lobby and tournaments, this must be done with the consent of a parent or legal guardian.

10.2. If you learn that your child has sent us data without such consent, contact us and we will delete it.

11.1. We may update this policy. Each version number and the “Last updated” date are shown at the top of the page.

11.2. We announce significant changes in advance on the website or via Telegram. If a change involves using data for a new purpose, we will ask for your consent again.

12.1. For questions and requests about personal data, use the phone, Telegram or email in the “Have a question?” block below. The operator's full details are in the “Company details” block.

12.2. Please also read the Public Offer.