Personal data processing policy

1. Operator and scope

This policy describes how SILA SVETA private enterprise (xususiy korxona), TIN 303213404, address: 85 Bodomzor yoʻli 1-tor koʻchasi, Yunusabad district, Tashkent 100052, phone +998 97 771 11 83, email info@silasveta.uz, processes the personal data of visitors to silasveta.uz.

The company is a personal data operator within the meaning of Article 4 of the Law of the Republic of Uzbekistan “On Personal Data” (No. ZRU-547); “operator” is the term the Law uses for what the GDPR calls a controller. The policy covers the data you enter into the site forms and the AI assistant window, and the technical data generated when they are sent.

Requests concerning personal data are handled by the company director at the phone number, email address and postal address above.

2. What data we receive

We receive only what you type into the request or calculation form: name, phone, a second contact (Telegram or email), company name, facility type, area, mounting height, a description of the existing lighting and your message. The form itself marks which fields are required.

The interface language and the address of the page you sent the form from travel with the request. If you arrived via an advertising link, the advertising tags from the page address travel with it too: gclid (Google Ads), yclid (Yandex Direct), utm_source, utm_medium and utm_campaign. During the “not a robot” check, Cloudflare Turnstile receives your IP address and technical characteristics of your browser.

Floor plan or technical specifications files selected in the calculation form (up to three files, 15 MB in total) are sent together with the request. Please attach only documents about the site: plans, drawings, technical specifications. If a file contains personal data of other people, you are responsible for the right to pass them on.

From the IP address, the Cloudflare server determines the country code (for example, UZ). Only this code enters the request records; the IP address itself is not stored.

We do not ask for special categories of personal data (health, beliefs and the like). Please do not enter them in the message field.

What the AI assistant receives, if you use it, is described in section 9.

3. Purposes and legal basis

The data from the forms serve one purpose: to contact you, clarify the task and prepare a lighting calculation or a quotation for your site.

Data from conversations with the AI assistant are processed for the purposes and on the basis set out in section 9.

The legal basis is your consent, given by ticking the checkbox or sending the form (Articles 18 and 21 of Law No. ZRU-547), and the need to take steps at your request before a contract is concluded (Article 18 of Law No. ZRU-547).

Advertising tags are needed to understand which advertisement led to the request. In future we may report the fact of a request to Google Ads or Yandex Direct as a conversion, without name, phone or message text; this section will be updated before such reporting begins. For now the tags are only stored.

Site visit statistics are kept in anonymised form (section 8): they are not linked to any individual, and no consent is required for them.

We run no mailing lists, do not sell the data and do not use it for advertising or profiling. If the purpose changes, we will ask for separate consent (Article 19 of Law No. ZRU-547).

4. How a request travels and who receives the data

The site has no user accounts or registration. The form is sent to the /api/lead handler, which runs on Cloudflare infrastructure (Cloudflare Workers).

The handler verifies the Turnstile response, limits field length and sends the request as a single message via the Telegram Bot API to the company's working chat. Attached files are saved to Cloudflare R2 storage and sent by the same bot to the working chat as a reply to the request message. Next to each file, the storage records the phone number from the request, the form type and the language: the manager uses them to find the file if the chat message did not link to it.

The contents of the request (name, phone, contact, company, message) are not stored on Cloudflare servers, except for the files and the phone number next to them; the error log receives technical codes, not form fields.

So that no request is lost, the company keeps track of its status. For each request, a service database (Cloudflare D1) stores the day and time of receipt, the form type, the language, the page path, the country code, the message number in the working chat, the status (new, contacted, quotation sent, won, lost, spam), the time of the last status change and a short working note without personal data. Name, phone, contact and message text do not enter this database. Advertising tags, if there were any, are stored as a separate row next to the day and form type, with no link to your contact details.

Statuses are set with buttons under the request message in the working chat. Reminders to staff about an unanswered request arrive in the same chat as a reply to its message and contain none of your data.

Only company staff who handle requests have access to the working chat and the service database. The data are not passed to anyone else except where the law expressly requires it (a request from the authorised state body or a court).

5. Cross-border transfer

The servers of both services are outside Uzbekistan, so sending a request is a cross-border transfer of personal data (Article 15 of Law No. ZRU-547).

Cloudflare, Inc. (USA) processes the request in its network, performs the Turnstile check and stores the attached files (R2), the request status records and the visit statistics (D1); the company is certified under the EU-US Data Privacy Framework. Telegram Messenger Inc. (a group of companies with an office in Dubai, UAE) stores the working chat message and the files attached to it on its servers outside Uzbekistan.

The transfer is based on your consent: Article 15 of Law No. ZRU-547 allows it as a basis for transfer to states not included in the list of countries with adequate protection (Cabinet of Ministers Resolution No. 415 of 29 July 2026). Consent to such transfer is part of the consent text under the form.

If you do not want your data to pass through these services, call us: we will take the request by phone.

The site does not collect data that the law requires to be stored only in Uzbekistan (Article 27-1 of Law No. ZRU-547: biometric and genetic data, data of telecom subscribers).

Cross-border transfer when you use the AI assistant is described in section 9.

6. Retention and deletion

Data are kept until the purpose of processing is achieved (Article 10 of Law No. ZRU-547). The request stays in the working chat while work on your enquiry continues.

If the enquiry does not lead to a contract, we delete the request message and the files attached to it from the working chat no later than 12 months from the date of receipt. Files in Cloudflare R2 storage are deleted automatically 12 months after upload. If a contract is concluded, the contact person's data are kept in the contract and accounting records for the periods set for such documents.

The advertising tags of a request are kept for no longer than 12 months. Request status records and visit statistics contain no personal data and are kept for 24 months so that figures can be compared year on year.

When consent is withdrawn, the data are destroyed (Article 17 of Law No. ZRU-547) unless we have another legal ground to keep them, such as a concluded contract.

Retention periods for AI assistant data are given in section 9.

7. Your rights and how to exercise them

Under Article 30 of Law No. ZRU-547 you may: know which of your data we hold; obtain information about their processing (Article 22); demand correction, suspension of processing or destruction of the data; withdraw consent.

Consent is withdrawn in the same form in which it was given, or in writing, including by email (Article 21 of Law No. ZRU-547).

Send your request by phone to +998 97 771 11 83, by email to info@silasveta.uz or by letter to the company address in section 1. We reply within ten days; if we refuse, we state the reason in writing, as Article 22 of Law No. ZRU-547 requires.

A complaint may be filed with the authorised state body, the State Personalisation Centre under the Cabinet of Ministers of the Republic of Uzbekistan, or with a court.

8. Cookies, browser storage and visit statistics

The site sets no cookies and connects no third-party visitor counters or advertising trackers.

We count visits with our own counter. The page sends to the /api/hit handler the page path, the language, the screen width, the domain of the site you came from, the utm tags from the address, a flag for the first page in the tab session and a flag for a return visit. The server adds these values to daily totals: how many views a page had that day, from which channel and from which device type. The IP address, the user agent, the full address of the referring page and any visitor identifier are not stored. These totals cannot identify a person or link two visits to each other, so the site does not count unique visitors. Clicks on the phone number and on download links, and visits by search engine crawlers, are counted separately.

If your browser sends a Do Not Track or Global Privacy Control signal, the counter does not run at all, and advertising tags are neither remembered nor added to the request.

Browser storage (localStorage) keeps two values: the colour theme you chose and the day of your first visit (key ss_seen, a date in YYYY-MM-DD form). From the second value the server receives only a yes-or-no flag, “already visited the site on another day”. It is not an identifier: it cannot identify a person or link visits together. Session storage (sessionStorage), which is cleared when the tab is closed, holds a flag that the first page has already been counted and, if you arrived via an advertisement, the advertising tags from the address. Of these values, only the return-visit flag reaches the server and, when a request is sent, the advertising tags. They can be cleared together with the site data in your browser settings.

The AI assistant sets no cookies. The conversation with it and the voice playback setting are kept in session storage (sessionStorage) and erased when the tab is closed (section 9).

According to Cloudflare, the Turnstile check sets no cookies. If third-party counters or other cookies appear on the site, we will update this section before they are switched on.

9. AI assistant

The site has an AI assistant: you ask a question by text or voice, and it answers from the site materials and shows the relevant pages. Using it is optional: you can ask the same questions by phone.

The assistant receives the text of your messages, the interface language and the address of the page you are writing from. Phone numbers and email addresses typed in the chat are replaced with a placeholder before they reach the model. Names are not detected automatically, so please do not type your name or other details about yourself in the chat.

Voice is recorded in your browser only after you press the microphone button. The recording is sent for speech recognition and is not stored: neither our server nor the conversation log keeps it. Only the recognised text remains and is handled as an ordinary message within the conversation. The recording is not used to identify you.

Your name and phone number are not passed to the model. You send a request yourself with the button on the request card, after ticking a separate consent box. It travels the same way as the site form (sections 4-6). The text of any request from the site, without the name, phone number, company and contact details and with phone numbers and email addresses in it replaced, is passed to the model to draft a reply for the engineer and kept in the service database for 1 month.

Purposes: to answer your question, show the relevant parts of the site and improve the assistant's answers. The legal basis is your consent (Articles 18 and 21 of Law No. ZRU-547), given by starting a conversation after the notice in the assistant window. The assistant makes no decisions that have legal consequences for you.

Conversation data are processed as follows. Our sila-api server is hosted by the provider u1host in the Netherlands. OpenRouter, Inc. (USA) acts as a gateway and passes the request to the model. Google LLC (USA) provides the Gemini model, which answers the question, recognises speech and voices the answer; requests reach it through OpenRouter.

Like the rest of the site, requests to the assistant pass through the Cloudflare network. A Cloudflare Turnstile check runs at the start of a conversation (section 5).

Sending messages to the assistant is a cross-border transfer of personal data (Article 15 of Law No. ZRU-547). The Netherlands is on the list of states ensuring adequate protection of personal data (Cabinet of Ministers Resolution No. 415 of 29 July 2026). The USA is on the list only for companies operating under the EU-US Data Privacy Framework. OpenRouter, Inc. does not declare participation in it, so the transfer to the USA is based on your consent (Article 15 of Law No. ZRU-547). The text of a request from the site forms takes the same route (our server, OpenRouter, Google): consent to this is part of the caption of the checkbox under the form.

To prevent abuse, the server keeps a salted hash of your IP address and daily message counters; the IP address itself is not stored. The conversation identifier is generated at random. The assistant sets no cookies (section 8).

To improve answers, the sila-api server keeps a conversation log. It holds the text of the messages with phone numbers and email addresses replaced, the language, the page, the time and technical metrics. The IP address, voice recordings, and the name and phone number from the request card do not enter the log.

The log is kept for 3 months and the rate-limit counters for 1 month. Summarised question topics are anonymised and kept in the service database (Cloudflare D1) with no time limit.

If you do not want your data to pass through these services, do not use the assistant: call us or send the request form. Consent can be withdrawn as described in section 7. Log entries are not linked to your contact details, so to find them, tell us the day and topic of the conversation.

10. Data protection, changes and contacts

We apply safeguards proportionate to the amount of data: transfer over HTTPS only, server-side validation and limits on fields, access to the working chat, the service database and the file storage only for staff who handle enquiries, service keys never stored in the site code.

The company director is responsible for organising the processing of personal data unless another officer is appointed by order (Article 31 of Law No. ZRU-547).

The policy may change together with the site. The current revision is always on this page, with its date at the top.

Questions about data processing: +998 97 771 11 83, info@silasveta.uz; the company's postal address is given in section 1.