Effective date: August 2026

This Privacy Policy explains how Foreign Enterprise Limited Liability Company "DATAPAC INVEST" (“we”, “us”, “our”, or the “Operator”) collects, uses, stores, and protects personal data when you use the POSYBE Toll Self-Service Portal (“Portal”) and related Android and iOS application, and toll road services.

The Portal is provided for users of toll roads in the Republic of Uzbekistan and enables customers to register, manage vehicles, top up credit, pay toll charges, review passages and transactions, download invoices and documents, and receive service notifications.

1. Data Controller

The controller of personal data processed through the Portal is:

Foreign Enterprise Limited Liability Company "DATAPAC INVEST"
Address: 1 Maxtumquli Street, Zafarobod MFY, Shaykhantakhur District, Tashkent city, Republic of Uzbekistan
TIN/STIR: 313114689

The POSYBE Toll Collection System is provided and technically supported by DATAPAC INVEST on behalf of the Operator.

2. Personal Data We Collect

Depending on how you use the Portal and toll road services, we may process the following categories of data:

Account and identification information

• first name and last name;

• telephone number;

• email address;

• address and billing information, where required;

• account identifier and authentication information.

Vehicle information

• vehicle registration number / license plate;

• country of registration;

• vehicle category;

• other vehicle information required for toll calculation or administration.

Toll-road usage information

• date and time of passage;

• toll road or road section used;

• entry, exit or control point;

• vehicle category determined during passage;

• license plate information obtained by ANPR systems;

• photographic or video evidence associated with the passage;

• calculated toll amount and payment status.

Payment and billing information

• credit balance;

• credit top-ups;

• toll payments;

• refunds and adjustments;

• outstanding amounts and debts;

• payment transaction identifiers;

• payment method and payment status;

• invoices, receipts and billing records.

Payment-card details are processed by the relevant payment service provider. The Portal is not intended to store full payment-card numbers, CVV codes or other sensitive card authentication data.

Communication information

• SMS and notification history;

• OTP authentication events;

• support requests, complaints and correspondence;

• information required to resolve disputes or requests for recalculation.

Technical information

When you use the Portal, we may automatically collect technical information such as:

• IP address;

• device and browser information;

• login and security events;

• timestamps;

• application and audit logs;

• information required to detect fraud, misuse or technical problems.

3. How We Use Personal Data

We process personal data for the following purposes:

• creating and managing your customer account;

• authenticating you, including through OTP;

• registering and managing vehicles;

• identifying vehicles using ANPR and other tolling technologies;

• recording toll-road passages;

• calculating applicable toll charges;

• managing prepaid credit and toll payments;

• processing payments, refunds and adjustments;

• issuing receipts, invoices and other billing documents;

• managing unpaid tolls and outstanding balances;

• notifying you about payments, passages, balance, debt, account events and service information;

• providing customer support;

• investigating complaints, disputes and incorrect toll calculations;

• preventing fraud, misuse and unauthorized access;

• maintaining system security and audit records;

• complying with legal, regulatory, accounting and reporting obligations;

• cooperating with competent public authorities where required by law.

4. Legal Basis for Processing

Personal data is processed where necessary:

• to provide the toll-road service and perform the applicable public or service contract;

• to comply with legal and regulatory obligations;

• to protect the legitimate interests of the Operator, including system security, fraud prevention, debt management and service operation;

• on the basis of your consent where consent is required by applicable law.

Personal-data processing is carried out in accordance with applicable legislation of the Republic of Uzbekistan, including applicable rules on personal data and information security. Official Uzbek public-sector privacy materials similarly distinguish account data, technical device information and service-related processing and require processing to follow Uzbekistan law.

5. Toll Passage and ANPR Data

Toll roads may use automatic number plate recognition (ANPR), cameras, sensors and other technical devices.

These systems may record:

• license plate number;

• country of registration;

• vehicle category;

• date, time and location of passage;

• photographs or video associated with the vehicle.

This information may be combined with information in the Toll Collection System in order to calculate and collect tolls, resolve disputes, maintain evidence and manage unpaid tolls.

6. Payments

Online payments and credit top-ups may be processed through third-party payment providers, including ATMOS and associated banks or payment systems.

Payment providers may independently process information required to authorize and settle payments.

We normally receive information such as:

• transaction identifier;

• amount;

• currency;

• payment status;

• payment method;

• masked payment information where applicable.

We do not intend to receive or store CVV codes or full payment-card authentication credentials.

7. SMS and OTP

We may use Playmobile or another communication provider to send:

• OTP login codes;

• account notifications;

• payment and credit notifications;

• debt notifications;

• service and operational messages.

For this purpose, your telephone number and the content or metadata necessary to deliver the message may be provided to the communication provider.

8. Sharing of Personal Data

We may disclose personal data where necessary to:

• payment providers and acquiring banks;

• SMS and communication providers;

• providers of the Measure-In-Motion, ANPR and enforcement systems;

• IT hosting, infrastructure and technical support providers;

• accounting, billing and audit providers;

• competent government bodies, courts, law-enforcement bodies and transport authorities where required by law;

• debt-collection or enforcement bodies where legally permitted;

• other contractors acting on behalf of the Operator.

Service providers may process personal data only to the extent necessary to provide their contracted services and subject to applicable confidentiality and data-protection requirements.

9. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy and to comply with applicable legal, accounting, evidentiary and regulatory requirements.

Retention periods may differ depending on the type of information.

For example:

• customer-account information may be retained while the account remains active and for the required period thereafter;

• financial and billing records may be retained for the period required by accounting and tax law;

• toll-passage evidence may be retained while needed for payment, debt collection, complaints, disputes or legal proceedings;

• security and audit logs may be retained for the period necessary for security, investigation and compliance purposes.

When data is no longer required, it will be deleted, anonymized or archived in accordance with applicable law.

10. Security

We apply organizational and technical measures designed to protect personal data against unauthorized access, loss, alteration, disclosure or destruction.

These measures may include:

• access-control and role-management mechanisms;

• encryption of communications;

• authentication and security controls;

• logging and audit trails;

• backup and disaster-recovery measures;

• system monitoring;

• vulnerability management and security testing.

No information system can guarantee absolute security, but we take reasonable measures appropriate to the nature and sensitivity of the processed data.

11. Your Rights

Subject to applicable law, you may have the right to:

• obtain information about the processing of your personal data;

• access your personal data;

• request correction of inaccurate or incomplete data;

• request deletion of data where legally permitted;

• withdraw consent where processing is based on consent;

• object to or challenge certain processing;

• submit a complaint or request regarding the use of your personal data.

Some data cannot be deleted immediately where retention is required by law, for accounting purposes, for toll enforcement, to resolve disputes or to establish or defend legal claims.

12. Account Deletion

You may request deletion or deactivation of your Portal account through the available account-management function or by contacting us.

Deleting the Portal account does not necessarily result in immediate deletion of all information. We may retain toll transactions, invoices, payment records, debts, evidence and other information where retention is required by law or necessary to protect legitimate legal interests.

13. Cookies and Similar Technologies

The Portal may use cookies or similar technologies required for:

• authentication;

• session management;

• security;

• language preferences;

• essential Portal functionality.

If non-essential analytics or marketing cookies are introduced, additional information and consent mechanisms will be provided where required.

14. International and Third-Party Processing

Certain service providers may process information through infrastructure operated by third parties.

Where personal data is transferred or processed outside the environment directly controlled by the Operator, appropriate legal, contractual and technical safeguards will be applied as required by the legislation of the Republic of Uzbekistan.

15. Changes to this Privacy Policy

We may update this Privacy Policy when the Portal, tolling services, applicable law or our processing activities change.

The current version will be published on the Portal together with its effective date.

For material changes, users may also be notified through the Portal, SMS, email or other appropriate channels.

16. Contact

For questions concerning this Privacy Policy or the processing of personal data, please contact:

Foreign Enterprise Limited Liability Company "DATAPAC INVEST"
Address: 1 Maxtumquli Street, Zafarobod MFY, Shaykhantakhur District, Tashkent city, Republic of Uzbekistan