Privacy Policy

1. General Provisions

1.1. This Policy applies to all data that the Operator receives from users of the Site, as well as during communication through channels connected by the user (email, Telegram, WhatsApp). 1.2. By using the Site, the user confirms that they have read this Policy. Data is processed during registration and placement of orders on the basis of the user’s consent, which the user gives by ticking the relevant box during registration (the text is on the “Consent to Personal Data Processing” page), and for the performance of an agreement to which the user is a party. 1.3. The Operator does not verify the accuracy of the data provided by the user and assumes that it is accurate and up to date.

2. What Data We Process

2.1. When an individual registers: surname and first name, email address, password (stored only as an irreversible hash), and phone number — when signing in with a phone number. 2.2. When a company registers: the name of the organization, TIN, name of the contact person, email address, and password. For employees invited to the company account — name, email address, and role. 2.3. When signing in with Google: the name, email address, and profile picture that Google provides with the user’s permission. 2.4. When placing orders: delivery addresses and map point coordinates, delivery comment, order contents and amount, payment method and status. 2.5. For notifications: information on the connection of a phone number to Telegram or WhatsApp and the chat identifier, and the selected notification channels. 2.6. When verifying a company by payment (if this feature is available): the payer’s TIN, payment amount, and date. 2.7. Contents of the cart, favorites, and comparison list — for synchronization across devices after sign-in. 2.8. Technical data: IP address, browser and device information, and request times — in server logs and systems protecting against automated requests; the hash of the session token. 2.9. The content of requests to customer support. 2.10. The Operator does not collect bank card details, passport details, or special categories of personal data (concerning health, beliefs, etc.).

3. Purposes of Processing

3.1. Registration, identification, and authentication of the user, including by one-time codes. 3.2. Conclusion and performance of sale and purchase agreements: receiving, confirming, delivering, and processing payment for orders, issuing invoices and accounting documents, and returning goods and funds. 3.3. Sending service notifications about orders and the account via the channels selected by the user. 3.4. Verifying the ownership of a company account. 3.5. Handling requests and claims. 3.6. Ensuring the security of the Site: protection against bots, fraud prevention, and error diagnostics. 3.7. Compliance with the requirements of the legislation of the Republic of Tajikistan, including tax and accounting requirements. 3.8. The Operator does not use personal data for advertising mailings. If such mailings are introduced, they will be sent only with the user’s separate consent.

4. Processing Procedure and Protection

4.1. Processing includes the collection, recording, systematization, accumulation, storage, clarification, use, transfer, anonymization, blocking, deletion, and destruction of personal data — with or without the use of automation tools. 4.2. The Operator applies legal, organizational, and technical protection measures: data is transmitted over the secure HTTPS protocol; passwords are stored only as a hash; the session token is stored in a secure cookie inaccessible to page scripts, and only its hash is stored in the database; access to data is limited to employees who need it for their work; backups are kept for a limited period. 4.3. In error reports that the Site sends to the monitoring system, the transfer of personal data is disabled and known personal fields are masked.

5. Disclosure to Third Parties

5.1. The Operator does not sell personal data or transfer it for advertising purposes. Data is transferred only to the extent necessary for the stated purposes: — to delivery services and couriers — the recipient’s name, phone number, and delivery address; — to banks — the information necessary to process and identify payments; — to Cloudflare, Inc. — the IP address and technical browser data for the Cloudflare Turnstile check that protects the sign-in and registration forms against bots; — to Google LLC — when signing in with Google and when selecting an address on Google Maps; — to Telegram — the phone number and the text of the one-time code when signing in via Telegram, as well as notifications if the user has connected Telegram; — to WhatsApp — the phone number and messages with codes and notifications if the user has selected WhatsApp; — to Functional Software, Inc. (Sentry) — technical error reports without personal data; — to hosting and email delivery service providers — to the extent necessary for the operation of the Site and the delivery of emails; — to public authorities — in the cases and in the manner provided for by the legislation of the Republic of Tajikistan. 5.2. Persons receiving data on behalf of the Operator are obliged to maintain its confidentiality and ensure its security.

6. Cross-Border Transfer

6.1. Some of the services listed in Section 5 (Cloudflare, Google, Telegram, WhatsApp, Sentry) host their servers outside the Republic of Tajikistan. The transfer of data to these services is cross-border and is carried out only to the extent necessary for the operation of the relevant feature. 6.2. By consenting to the processing of personal data, the user also consents to its cross-border transfer. The user may choose not to sign in with Google, Telegram, or WhatsApp and may disable messenger notifications — in that case, no data is transferred to these services.

7. Retention Periods

7.1. Account data, addresses, and settings are kept until the account is deleted. 7.2. Order information (contents, amounts, as well as the buyer’s name, email address, phone number, organization name, and TIN) is kept after the account is deleted — for the periods established by the tax and accounting legislation of the Republic of Tajikistan. 7.3. The session token is valid for 7 days; expired tokens are deleted daily. One-time codes are valid for 10 minutes, the password reset link for 1 hour, and the email confirmation link for 24 hours. 7.4. Server logs are kept for 14 days, the payment transaction log for 90 days, and payment event records for 180 days. Database backups are kept for 14 days. 7.5. Data in browser storage (cart, favorites, search history) is kept on the user’s device until it is cleared. 7.6. Once the purposes of processing have been achieved or the retention periods have expired, the data is deleted or anonymized.

8. User Rights

8.1. The user has the right to obtain information about the processing of their personal data, to demand its clarification, blocking, or destruction if it is incomplete, outdated, inaccurate, or not necessary for the stated purpose, and to withdraw consent to processing. 8.2. The user can change most of their data independently in the Personal Account, where they can also enable or disable notifications for each channel. 8.3. The user can delete their account independently in the Personal Account by confirming the action with a one-time code. Deletion is not possible while the user has uncompleted orders. After deletion, the account data is destroyed, while order information is retained in accordance with clause 7.2. 8.4. Withdrawal of consent means deletion of the account, as services cannot be provided without processing data. 8.5. Requests shall be sent to the Operator using the contact details set out in the last section. The Operator responds within the period established by law, but no later than 30 days from the date of receipt of the request. 8.6. The user has the right to appeal against the Operator’s actions to the authorized state body for the protection of the rights of personal data subjects or to a court.

9. Cookies

9.1. The Site uses only strictly necessary cookies and browser storage: for signing in to the account and remembering the language, cart, favorites, and comparison list. Advertising and analytics cookies are not used. For details, see the Cookie Policy.

10. Minors

10.1. The Site is intended for persons aged 18 or over and for organizations. The Operator does not knowingly collect data of minors. If such data has been received, it will be deleted upon request of a legal representative.

11. Changes to this Policy

11.1. The Operator may amend this Policy. A new version takes effect upon its publication on the Site; the version date is stated at the beginning of the document. In the event of material changes, the Operator notifies users by email or on the Site.

12. Seller’s Details and Contacts

Website

officesupply.tj

Email

info@officesupply.tj

Phone

+992 90 055 8856