Privacy Policy

1. Introduction

1.1. This Privacy Policy (“Policy”) has been developed and approved by “MUXAYYO TRADE” LLC (hereinafter — “Magnit”, “we”, “us”) to ensure the safety and security of confidential data received from Participants of the Magnit Loyalty Program (the “Program”). Before registering for the Program or using the Magnit mobile application, the official Magnit Telegram bot, or a Magnit loyalty card, the Participant must review the Program Rules and the terms of this Policy.

1.2. Magnit is not responsible for the consequences of a Participant transferring personal data to a third party if such transfer was performed on a third party’s information resource.

1.3. Registration for and use of the Program constitutes the Participant’s unconditional agreement with this Policy and its terms for processing personal data obtained from the Participant’s mobile device, loyalty card, and other information resources.

1.4. This Privacy Policy is an integral part of the Magnit Loyalty Program Rules. By registering for the Program (or accepting the Program Rules), the Participant expresses their unconditional consent to the processing of all information defined below as Confidential Information in accordance with the terms of this Policy.

1.5. If the Participant does not agree with the terms of this Policy, they must refrain from registering for or using the Program.

2. Terms and Definitions

2.1. Automated Processing of Confidential Information — processing of confidential information using computing devices.

2.2. Personal Data Security — ensuring a secure environment for personal data from unauthorized and/or unlawful access, destruction, alteration, blocking, copying, provision, or distribution, as well as other unlawful actions.

2.3. Blocking of Confidential Information — temporary cessation of processing Confidential Information (except in cases where processing is necessary to clarify the Confidential Information).

2.4. Information System of Confidential Information — the set of data contained in databases of Confidential Information and the information technologies and technical means that process them.

2.5. Trade Secret — information that holds commercial value in scientific-technical, technological, production, financial-economic, and other spheres due to its being unknown to third parties.

2.6. Confidential Information — information, including personal data, that Magnit receives from Participants during registration and use of the Program.

2.7. Data De-identification — actions that render it impossible to determine, without additional information, that specific personal data belongs to a particular Participant.

2.8. Processing of Confidential Information — any action (or set of actions) performed with or without automation on Confidential Information, including collection, recording, systematization, accumulation, storage, updating (or modification), retrieval, use, transfer (distribution, provision, access), de-identification, blocking, deletion, or destruction of Confidential Information.

2.9. Personal Data — any information recorded on an electronic, paper, or other material medium that relates to a specific individual or allows for their identification.

2.10. Participant — a legally competent individual aged 18 or over who has registered for the Magnit Loyalty Program (or a minor acting with the consent of a legal representative, where permitted by applicable law).

2.11. Provision of Confidential Information — actions aimed at disclosing personal data to a specific person or a specific group of persons.

2.12. Distribution of Confidential Information — any actions aimed at disclosing Confidential Information to an indefinite group of persons (transferring Confidential Information) or making Confidential Information available to an unlimited group of persons, including publication in the media, placement in information and telecommunication networks, or granting access to Confidential Information in any other way.

2.13. Cross-Border Transfer of Confidential Information — the transfer of Confidential Information to the territory of a foreign state, to a foreign authority, a foreign individual, or a foreign legal entity.

2.14. Destruction of Confidential Information — actions as a result of which it becomes impossible to restore the content of Confidential Information in the information system and/or as a result of which the material carriers of Confidential Information are destroyed.

3. Scope of Regulation

3.1. This Privacy Policy applies to all Confidential Information that Magnit and/or its affiliated entities may receive from Participants during their registration for and use of the Program, as well as during the execution of any agreements concluded with the Participant in relation to or as a result of the Program.

4. Who Processes the Information

4.1. The Confidential Information obtained through the Program for each Participant is collected, processed, stored, and used by “MUXAYYO TRADE” LLC, a legal entity established under the laws of the Republic of Uzbekistan and registered at: Republic of Uzbekistan, Tashkent city, Mirabad district, A. Fitrat street, house 2, TIN 305 445 201, or its affiliated entities.

5. Purposes of this Policy

5.1. The processing of confidential information and personal data is carried out to administer the Program and provide Participants with access to the Magnit Service, including for the following purposes:

• Administering the Magnit Loyalty Program, including issuing and managing Loyalty Cards and accruing and redeeming bonus points;
• Identifying the Participant during registration and use of the Program;
• Improving the quality and convenience of the Program and the Magnit Service;
• Fulfilling the terms of the Program Rules;
• Providing access to the personal account for Participants;
• Processing purchases and transactions for the purpose of calculating bonuses, discounts, and offers;
• Complying with the norms established by the legislation of the Republic of Uzbekistan;
• Sending notifications about bonus balance, promotions, offers, and other Program-related communications;
• Creating new products, offers, and promotional campaigns;
• Collecting, processing, and analyzing statistical data regarding purchasing behavior and Program usage;
• Disseminating advertising and informational materials and conducting marketing actions tailored to Participant preferences;
• Studying the purchasing behavior of Participants to personalize offers;
• Protecting the rights of the Participant and Magnit;
• Considering claims and ensuring judicial proceedings.

Data may also be processed to prevent fraud, misuse of the Program, and to ensure the security of information, systems, networks, and related security measures.

5.2. In case additional purposes arise or as required by applicable legislation, Magnit may request separate consent for processing Confidential Information.

5.3. This Policy applies to Confidential Information obtained both before and after its enactment.

6. Information that Magnit Receives and Processes

6.1. In accordance with the functional purpose of the Program, the following data is processed:

• Personal data provided during registration: Full Name, mobile phone number, date of birth, and gender;
• Loyalty Card number and Program participation history;
• The date and time of access to the Magnit Service;
• Geolocation information, including the store branch (filial) visited;
• Electronic data (HTTP headers, IP address, cookies, mobile device information, mobile network data, information resource address, software details, browser identifier data, Wi-Fi network data);
• Telegram profile data (username, Telegram ID) where registration or authorization is performed via the official Magnit Telegram bot;
• Purchase history, transaction data, accrued and redeemed bonus points, and preferences relating to purchased goods;
• Payment-related information necessary to link a purchase to bonus accrual, provided via payment partners;
• Information received from Magnit branches (filials) and POS systems necessary for Program administration, including transaction identifiers and order composition;
• Any other information necessary for processing in accordance with the Program Rules.

The provisions of this Policy also include the cross-border transfer of Confidential Information. Such transfer is carried out to foreign states that provide adequate protection for the rights of personal data subjects.

6.2. Magnit also carries out de-identified processing of confidential information.

6.3. Magnit will make every effort to protect confidential information during its processing. It is recommended to regularly review this Privacy Policy, as it may be updated in accordance with changes in current legislation or in Magnit’s internal processes.

6.4. Magnit does not verify the provided Confidential Information except as stipulated by the Program Rules, and cannot judge its accuracy or whether the Participant has sufficient capacity to provide the Confidential Information. Magnit assumes that the Participant provides accurate and sufficient Confidential Information and updates it promptly.

6.5. The Participant provides Confidential Information voluntarily. Failure to provide certain Confidential Information, or withdrawal of consent for its processing, may result in the inability to register for or use the Program.

7. Registration and Verification

7.1. Registration for the Program may be performed via the Magnit mobile application, the official Magnit Telegram bot, or in person at a store branch (filial) at the point of Loyalty Card issuance.

7.2. Where registration is performed using a mobile phone number, a verification (SMS) code shall be sent to the number provided by the Participant; the Participant must enter this code in the corresponding field to confirm registration.

7.3. Where registration is performed via the official Magnit Telegram bot, the Participant’s phone number shall be verified through Telegram authorization without manual entry. Registration shall only be possible for a number linked to the Participant’s Telegram account.

8. Cross-Border Transfer of Personal Data

8.1. Magnit is entitled to carry out the cross-border transfer of personal data in accordance with the terms of this Policy and in compliance with the requirements of the legislation of the Republic of Uzbekistan.

9. Procedures for Collection, Storage, Transfer, and Other Types of Processing of Confidential Information

9.1. Magnit ensures the security of the confidential information it processes by taking the necessary legal, organizational, and technical measures to comply with the laws and regulations applicable to the protection of personal data.

9.2. Magnit will take all measures to protect confidential information and prevent unauthorized access. Confidential Information will be used by Magnit employees only to the extent necessary for the purposes set forth in Section 5 of this Policy.

9.3. Additionally, Magnit may transfer Confidential Information to its affiliated entities solely for the purposes specified in Section 5 of this Policy.

9.4. Magnit may engage third parties to provide certain services in connection with the Program (for example, SMS/communication providers, web and marketing analytics, payment processing). If such third parties require access to Confidential Information, Magnit undertakes to ensure that such access is limited to what is necessary for providing the relevant services. These external service providers must independently comply with all applicable data protection regulations.

9.5. The Confidential Information of the Participant will never be transferred to third parties, except in cases required by current legislation and/or for the purposes of processing Confidential Information in the interests of the Program.

9.6. The retention period for Confidential Information by Magnit is determined by the date on which the purpose for which it was collected and processed is fulfilled, or to comply with the requirements of the legislation of the Republic of Uzbekistan.

9.7. All Confidential Information received from Participants will be stored within the territory of the Republic of Uzbekistan.

9.8. Processing of Confidential Information is carried out both using automated tools and without them.

10. Rights of the Participant

Participants of the Magnit Loyalty Program have the right to:

• Independently make changes or additions to their information in their personal account on the Magnit Service;
• Delete their personal information provided in their personal account. Deleting the personal account and/or personal information may result in the inability to use the Program;
• Request deletion of their personal information or parts thereof, as well as withdraw consent for the processing of their personal data, except in cases provided by applicable legislation;
• Contact the authorized state body or court regarding the protection of their rights and legitimate interests concerning their personal data;
• Receive information about the conditions for accessing their Confidential Information from Magnit;
• Upon request, receive from Magnit information regarding the processing of their personal data;
• Be informed about the existence and extent of their Confidential Information held by Magnit;
• Withdraw consent for the processing of their personal data and request Magnit to temporarily suspend processing if the personal data is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the purposes of processing.

11. Final Provisions

11.1. This Policy, the relationships between Magnit and the Participant arising from its application, and issues not regulated by this Policy are governed by the current legislation of the Republic of Uzbekistan.

11.2. The Participant may obtain any clarifications regarding the processing of their Confidential Information by contacting Magnit using the details in Section 12 of this Policy.

11.3. In the event of unlawful use of Confidential Information, the Participant whose information is used unlawfully should send Magnit a written request for the deletion of such Confidential Information. The request must include identification documents proving the identity of the Participant, a description of the unlawfully used Confidential Information, and details of where and under what circumstances the Confidential Information is being used unlawfully.

11.4. Magnit reserves the right to make changes to this Policy without the Participant’s consent at its discretion, including but not limited to cases when such changes are necessitated by amendments in the legislation of the Republic of Uzbekistan governing the processing of personal data and the operation of the Program. Changes become effective three days after their posting on the Magnit Service, at which point the previous version of the Policy is no longer valid. If the Participant disagrees with the changes, they must cease any use of the Program.

11.5. This document will reflect any changes made by Magnit to the Policy. The Policy remains in effect indefinitely until it is replaced by a new version.

12. “MUXAYYO TRADE” LLC Details

• Company Name: “MUXAYYO TRADE” LLC
• Location: Republic of Uzbekistan, Tashkent city, Mirabad district, A. Fitrat street, house 2
• TIN: 305 445 201
• Phone: +998 (71) 291-69-99
• Email: hello@magnit.uz

For contacting Magnit regarding this Policy, please use the contact details above or the functionality provided by the Magnit Service.