Legal

Privacy Notice

Draft v0.1 · Effective date pending legal review

DRAFTThis document is a working draft prepared by the platform team. It must be reviewed and approved by ITPU's legal counsel before publication.

1. Who we are

ITPU Community is operated by IT Park University ("ITPU", "we", "us"), located in Tashkent, Uzbekistan. This Privacy Notice explains how we collect, use, store and share personal data when you use our workshop platform at events.itpu.uz.

2. Data we collect

From Telegram on sign-in: Telegram ID, first name, last name (if you set it), username, profile photo URL, language.
From you directly: phone number (shared via Telegram bot), GDPR consent timestamp.
Automatically: registration timestamps, workshop attendance, materials delivery confirmations, certificate issuance, IP address and user-agent for security logs.

3. How we use it

To register you for workshops and reserve your spot.
To send you reminders, workshop materials and certificates via Telegram.
To produce aggregate, non-identifying metrics for ITPU's educational planning.
To synchronise registrations with our CRM (Bitrix24) for operational coordination.
To generate and deliver certificates of attendance via the ITPU certificate service.

4. Legal basis

We process your data on the basis of (a) your explicit consent given at registration; (b) the contractual relationship of attending a workshop; and (c) our legitimate interest in running the platform securely and improving it.

5. Third parties we share with

Telegram — for delivering messages to you and verifying your identity.
Microsoft Azure — our hosting provider (data centres in the EU region).
Bitrix24 — our CRM, for organisational and reporting purposes.
ITPU certificate system — to generate and store your certificates.

We do not sell your data, and we do not use it for third-party advertising.

6. How long we keep it

Account profile — for as long as your account is active.
Registration history — 3 years after the event, then anonymised.
Telegram message logs — 90 days.
Audit logs of operator actions — 365 days.

7. Your rights

You have the right to:

Access the personal data we hold about you;
Correct inaccuracies;
Request deletion (subject to retention obligations);
Withdraw consent at any time;
Lodge a complaint with a supervisory authority.

To exercise any of these rights, message the ITPU Community bot or email privacy@itpu.uz (placeholder).

8. Security

Secrets are stored in Azure Key Vault. Access to your data is restricted to whitelisted ITPU operators (see Acceptable Use Policy §4). All traffic is over HTTPS. Database backups run continuously and are kept for 7 days.

9. Changes to this notice

If we make material changes to this notice, we will ask you to re-confirm your consent on your next sign-in.

10. Contact

Data controller: IT Park University · Tashkent, Uzbekistan · privacy@itpu.uz (placeholder — to be confirmed by legal).