(Personal Data Processing Policy)
Version dated 1 August 2026
1.1. This Privacy Policy (hereinafter the “Policy”) sets out the procedure and conditions for the processing of personal data by “CENTRUM HOLIDAYS” Limited Liability Company (hereinafter the “Company”, the “Operator”) in connection with the use of the website https://centrum-holidays.com, its subdomains and the Company’s mobile application (hereinafter jointly the “Platform”), contact with the Company’s sales offices and contact centre, and the purchase of the Company’s services through its agents and partners — in respect of the data received by the Company.
1.2. The Policy has been developed in accordance with the Constitution of the Republic of Uzbekistan, the Law of the Republic of Uzbekistan “On Personal Data” No. ZRU-547 dated 2 July 2019 (as amended, including by Law No. ZRU-1125 dated 26 March 2026; hereinafter the “Law”), the Laws of the Republic of Uzbekistan “On Tourism”, “On Electronic Commerce” and “On Informatisation”, and other legislative acts. When serving clients located in the European Economic Area, the Company additionally takes into account the applicable requirements of the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).
1.3. By providing personal data to the Company in any manner (when placing an order on the Platform, registering, contacting support or subscribing to newsletters), the data subject confirms familiarity with this Policy and consents to the processing of their personal data on the terms set out herein. Consent to the processing of personal data is a necessary condition for the provision of services; if the data subject does not agree with the terms of the Policy, the Company asks them to refrain from using the Platform and the Company’s services.
1.4. A Client who provides the Company with personal data of third parties (travellers, companions, next of kin for emergency contact) warrants that they have notified such persons and obtained their consent to the processing of their data by the Company for the purposes set out in the Policy.
2.1. “Personal data” means information recorded on electronic, paper and/or other tangible media relating to a specific individual or enabling that individual to be identified.
2.2. “Processing of personal data” means one or a combination of actions involving the collection, systematisation, storage, modification, supplementation, use, provision, dissemination, transfer, depersonalisation, blocking and destruction of personal data.
2.3. “Data subject” (the “Subject”) means the individual to whom the personal data relates: a Client, a traveller or a user of the Platform.
2.4. “Personal data operator” means a legal entity or individual, a state body or another entity which, independently or jointly with others, organises and/or carries out the processing of personal data and determines the purposes of processing, the composition of the personal data processed and the actions (operations) performed with the personal data.
2.5. “Automated processing of personal data” means the processing of personal data using computing equipment, information systems, software and other automated means.
2.6. “Dissemination of personal data” means actions aimed at disclosing personal data to an indefinite range of persons, including by publication in the mass media, posting in information and telecommunications networks, including the Internet, or otherwise providing access to it.
2.7. “Provision of personal data” means actions aimed at disclosing personal data to a specific person or a specific range of persons in order to achieve the purposes provided for by law or by contract.
2.8. “Cross-border transfer of personal data” means the transfer of personal data to the territory of a foreign state to a foreign state body or a foreign individual or legal entity for purposes connected with the performance of a contract, the provision of services, compliance with legal requirements or on other lawful grounds.
2.9. “Destruction of personal data” means actions as a result of which it becomes impossible to restore the content of personal data in personal data information systems and/or as a result of which the tangible media containing personal data are destroyed without the possibility of further restoration or use.
2.10. Other terms are used in the meanings defined by the Law and by the Company’s Public Offer.
3.1. The Company processes the following categories of personal data, the scope of which is limited to what is necessary for the purposes set out in Section 4 of the Policy:
(a) identification data: surname, given name, patronymic, date of birth, gender, citizenship, country of residence;
(b) data of identity and travel documents: type, series and number of the document (passport, ID card), validity period, issuing country and authority, as well as visa data — to the extent required by Carriers, accommodation facilities, insurance companies and the state authorities of the countries on the route;
(c) contact data: telephone number, e-mail address, details of emergency contact persons;
(d) order and travel data: routes, dates, composition of travellers, selected accommodation facilities and fares, preferences (meal type, seating, etc.), history of orders and enquiries;
(e) data of loyalty programmes of the Company and its partners, including frequent flyer programme membership numbers;
(f) payment data: information on payment transactions, masked card number, payment statuses. Full bank card details are not collected or stored by the Company: they are processed by payment organisations and banks certified under the applicable security standards (including PCI DSS);
(g) special categories of data: health information — solely where the Client requests special assistance (accompaniment, special meals, medical restrictions) and on the basis of separate consent; such data is transferred only to Suppliers providing the requested assistance;
(h) technical data: IP address, device and browser identifiers, cookies, data on activity on the Platform, log files.
3.2. The Company may receive personal data of Subjects from third parties: from the Client placing an order for the benefit of travellers; from agents and partners selling the Company’s services; from Suppliers involved in performing the agreement (Carriers, accommodation facilities, reservation systems); and from state authorities in the cases established by law.
4.1. Personal data is processed for the following purposes:
(a) conclusion and performance of the agreement: placing and managing orders and bookings, issuing air tickets, vouchers and insurance policies, making changes, processing exchanges and refunds, registration and identification on the Platform;
(b) communications on performance of the agreement: notifications of order status, changes to flight schedules and to the conditions of service provision;
(c) compliance with legal requirements: transfer of passenger data to Carriers and to the authorised state bodies of the countries of departure, destination and transit (including border, customs, immigration and aviation security services), maintenance of accounting and tax records, anti-money laundering compliance;
(d) customer support: handling enquiries, claims and requests, conducting satisfaction surveys;
(e) security: prevention and detection of fraudulent transactions, protection of the Platform and of data;
(f) marketing: sending the Company’s offers and newsletters — only where the Subject has given consent, with the ability to unsubscribe in each message and in the personal account;
(g) analytics and improvement of the Platform, personalisation of the user experience;
(h) loyalty programme: accrual and accounting of bonuses, provision of benefits (where the Subject participates in the programme).
4.2. The legal bases for processing are: the Subject’s consent; the necessity of performing an agreement to which the Subject is a party or which is concluded for the Subject’s benefit; and compliance with obligations imposed on the Company by law.
5.1. The Platform uses cookies and similar technologies to distinguish the user from other users, ensure the operation of the Platform, analyse its use and improve the service.
5.2. The categories used are: “strictly necessary” cookies — essential for the operation of the Platform, placing orders and making payments; “functional” cookies — which store user settings (language, region, incomplete bookings) and allow a returning user to be recognised; and “analytical/statistical” cookies — which help assess the quality and effectiveness of the Platform without individually identifying the user.
5.3. Cookies may be session-based (valid until the end of the session) or persistent (stored until their expiry or deletion by the user).
5.4. The user may restrict or disable cookies in the browser or device settings. Disabling strictly necessary cookies may result in partial or complete inability to use the Platform.
6.1. In order to perform the agreement and for the other purposes set out in Section 4, the Company provides personal data to the following categories of recipients, to the extent necessary for the relevant purpose:
(a) Carriers (including “MY FREIGHTER” LLC — the airline Centrum Air — and other carriers), airports and ground handling organisations;
(b) accommodation facilities and receiving parties (tour operators and partners in the destination country);
(b-1) companies of the Centrum group involved in fulfilling the order, including tour operators that formed the tourist product purchased and the pilgrimage tourism operator of the Centrum group — when processing “Umrah” pilgrimage tours. Such companies act as independent personal data operators in respect of the agreements they conclude with the Subject and process data in accordance with their own policies;
(b-2) when processing “Umrah” pilgrimage tours — the partner organisation in the Kingdom of Saudi Arabia, the authorised bodies and state information systems of the Kingdom of Saudi Arabia (including the Ministry of Hajj and Umrah and the Nusuk platform — for the issuance of the “Umrah” visa and pilgrimage permits), and the Muslim Board of Uzbekistan — in respect of arranging the accompaniment of pilgrim groups;
(c) reservation systems and technology partners enabling the issuance of carriage and accommodation bookings;
(d) insurance companies — when issuing insurance policies;
(e) payment organisations and banks — to process and confirm payments, handle refunds and prevent fraud;
(f) visa centres and consular institutions — when providing visa support services;
(g) authorised state and law enforcement authorities of the Republic of Uzbekistan and of foreign states — upon their lawful requests and in the cases provided for by the legislation of the relevant states, including transfer of passenger data for border and immigration control and aviation security purposes;
(h) the Company’s contractors (IT services, hosting, communications, audit, legal services) — under agreements providing for obligations to ensure the confidentiality and protection of personal data.
6.2. The Company does not sell personal data and does not provide it to third parties for their own marketing purposes.
6.3. Where a user follows external links to third-party websites and services (including the resources of payment systems and Suppliers), data processing is governed by the policies of the relevant third parties; the Company does not control such websites and recommends reviewing their terms.
7.1. In accordance with Article 27-1 of the Law (as set out in Law No. ZRU-1125 dated 26 March 2026), biometric and genetic data of individuals, as well as data of users of telecommunications operators’ services, are subject to mandatory storage in the territory of the Republic of Uzbekistan. Other personal data may be stored and processed outside the Republic of Uzbekistan subject to one of the conditions established by the Law: recognition of the foreign state as providing adequate protection of personal data; the Operator’s use of standard contractual clauses or binding corporate rules meeting the requirements of the authorised state body; or the Operator’s compliance with international standards for the management and storage of personal data from the list approved by the authorised state body.
7.2. Transfer of personal data outside the Republic of Uzbekistan is carried out by the Company to the extent necessary to perform the agreement on international carriage, accommodation and the provision of other services abroad (data is transferred to Carriers, accommodation facilities, receiving parties, reservation systems and the state authorities of the countries on the route), as well as when using infrastructure and services ensuring the level of protection required by the Law. The processing of personal data transferred to a foreign state is also governed by the legislation of that state.
7.3. Where the Company uses biometric identification (including through state identification systems), the relevant biometric data is stored in the territory of the Republic of Uzbekistan, and databases of such data are subject to registration in the State Register of Personal Data Bases in the established manner.
7.4. Processing is carried out both by automated means and without them. Employees of the Company are granted access to personal data to the extent necessary to perform their job duties, in accordance with the Company’s internal regulations.
8.1. Personal data is processed for the term of the agreement and retained after its performance for the periods established by law (including for accounting, tax and archival purposes), for limitation periods, and for the periods provided for by the regulations of the automated systems used and by international standards for the issuance and retention of carriage documentation.
8.2. Data processed on the basis of consent (including for marketing communications) is processed until the purposes of processing are achieved or until the Subject withdraws consent, whichever occurs first.
8.3. Upon expiry of the retention periods, personal data is destroyed or depersonalised.
9.1. The Subject has the right to: obtain information on the processing of their personal data; require the clarification (correction), blocking or destruction of data where it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing; withdraw consent to processing; opt out of receiving marketing communications; and appeal against the Company’s acts (omissions) to the authorised state body in the field of personal data or to a court.
9.2. Requests are to be sent to info@centrum-holidays.com or to the Company’s registered address. The Company reviews requests and responds within the periods established by law. In order to protect the data, the Company may request confirmation of the applicant’s identity.
9.3. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal and does not terminate processing carried out on other lawful grounds (performance of the agreement, statutory requirements).
9.4. The data subject is responsible for the accuracy, completeness and currency of the personal data provided. When providing the personal data of third parties (including family members, accompanying persons, minor children and other travellers named in the application or in the agreement for the provision of tourist services), the Subject confirms that the necessary lawful grounds exist and that the consent of such persons to the processing of their personal data has been obtained.
The Company is not liable where the Subject provides information about third parties without obtaining the relevant consent or without other grounds provided for by law.
9.5. The Subject confirms awareness that the quality, procedure and conditions of the services provided by third parties (hotels, carriers, insurance companies, foreign partners) are governed by the rules and conditions of the respective service providers.
10.1. The Company takes legal, organisational and technical measures to protect personal data against unlawful access, destruction, modification, blocking, copying, provision and dissemination, including: encryption of data in transit, access control and logging, backup, internal regulations and staff training, and contractual obligations of processors and partners to ensure a comparable level of protection.
10.2. Where incidents involving personal data are identified, the Company takes timely measures to contain them and remedy their consequences and makes notifications in the cases and in the manner provided for by law.
10.3. The Company is not liable for:
— the acts of third parties to whom personal data was transferred on lawful grounds for the provision of tourist services;
— the acts of state authorities, consular institutions, carriers, hotels, insurance companies and other service providers;
— the consequences of the Subject providing inaccurate, incomplete or erroneous personal data;
— the impossibility of providing certain tourist services as a result of the Subject’s refusal to provide the necessary personal data.
11.1. Orders for the benefit of minors are placed by their legal representatives (parents, adoptive parents, guardians) or with their consent. The Company processes the data of minors solely to the extent necessary to provide the services, on the basis of the legal representative’s consent.
12.1. This version of the Policy is effective from the moment it is published on the Platform. The Company may review and update this Policy. A new version is published on the Platform. Where material changes are made, the Company notifies users by posting a general notice on the Platform before the changes take effect and takes such other actions as are required by law.
For matters relating to the processing of personal data: “CENTRUM HOLIDAYS” LLC, 38 Oybek Street, Mirabad district, Tashkent, Republic of Uzbekistan. E-mail: info@centrum-holidays.com. Phone: +998 77 391 08 80. Website: https://centrum-holidays.com.