Data processing annex

In short

• Roles. You (the Customer) own the data: you decide why and how it is used. We process it only on your instructions.
• Purpose. Only to provide the Service, support and security. We do not sell your data or use it for our own purposes.
• Where. On Contabo GmbH servers in Germany (European Union). Backups are kept on the server for 7 days, encrypted off-site copies for up to 35 days.
• Who is involved. Contabo GmbH, [off-site backup provider] and [email delivery provider] (section 5). Fast AI is off by default; if you turn it on, you choose the AI provider yourself and connect it with your own key.
• Biometric data. Face recognition is switched off in the cloud. It works only in the on-premise edition, on your servers.
• Children's data. Parental consent and a legal basis for data about minors are your responsibility.
• If an incident happens. We tell you within 24 hours about a breach affecting your data.
• Leaving. After the Agreement ends, the data is deleted within 30 days; you can export it until then. It disappears from the backups within a further 35 days.

This is a summary. The full, legally binding text is below. If they differ, the full text prevails.

This English text is a translation for convenience. If it differs from the Uzbek text, the Uzbek text prevails.

This Annex is an integral part of the Agreement concluded between [company name] (the "Provider") and the Customer under the Public offer. It sets how personal data (data about a specific person) within Customer Data is processed in the Fast-CRM Cloud service. Terms have the meaning given in the offer and in Law of the Republic of Uzbekistan No. ZRU-547 "On personal data" of 2 July 2019 (the "Law").

1. Roles of the Parties

1.1. The Customer is the owner and operator of the personal data database kept in the Service: it determines the purposes and means of processing.

1.2. The Provider processes personal data within Customer Data only on the Customer's assignment, on its behalf and under its documented instructions.

1.3. The Customer's documented instructions are:

• the offer and this Annex;
• the settings and actions of the Customer and its Users on the Platform (entering data, connecting channels, export, deletion and the like);
• written requests the Customer sends to info@fastcrm.uz.

1.4. If the Provider believes an instruction breaks the law, it tells the Customer and may suspend carrying it out.

1.5. The Customer is responsible for the lawfulness of processing: having a legal basis (consent, notice) towards its own clients and other people, registering the database where the law requires it, and answering requests of data subjects (the people the data relates to).

2. Subject, duration, nature and purpose

2.1. Subject — processing of personal data within Customer Data while providing the Service under the offer.

2.2. Duration — the term of the Agreement, the period after it until the data is deleted (up to 30 (thirty) days under section 11 of the offer), and the backup periods: 7 (seven) days on the server and up to 35 (thirty-five) days for off-site copies.

2.3. Nature — collection (entry into the Service and receipt from connected channels), systematisation, storage, alteration, supplementing, use, transfer on the Customer's instruction, export, depersonalisation (anonymisation — making data impossible to link to a specific person), destruction and making backups.

2.4. Purpose — providing the Service (CRM functions) to the Customer, support at the Customer's request, security of the Service and data recovery after a disaster.

3. Categories of data and data subjects

3.1. Data subjects: the Customer's clients and prospective clients (leads), contact persons of counterparties, the Customer's employees and Users, students and their parents (for example, if the Customer is a training centre), and other people whose data the Customer enters into the Service or who write to the Customer through connected channels.

3.2. Categories of data:

• identification and contact data (name, phone, email, address);
• data on deals, orders and payments;
• correspondence and messages from connected channels;
• if telephony is enabled — call records and call audio recordings;
• files and documents;
• other data the Customer enters into fields it creates.

3.3. The Customer puts special personal data (for example, health data) into the Service only if it has a legal basis.

3.4. For data about minors (persons under 18), the legal basis, including the consent of a parent or other legal representative where the law requires it, is the Customer's responsibility. The Provider processes such data, too, only on the Customer's instructions.

3.5. Biometric data is not processed in Fast-CRM Cloud. Biometric data must be stored in Uzbekistan (ZRU-1125, to be verified), so face recognition and face-based attendance are switched off in the cloud edition. These functions are offered only in the on-premise edition, where the data stays on the Customer's own servers. The Customer does not put biometric data for identifying people into the cloud Service.

4. Provider's obligations

4.1. The Provider:

• processes personal data only on the Customer's documented instructions and for the purposes in clause 2.4, does not use it for its own purposes and does not sell it;
• gives access to the data only to staff who need it for their work and are bound by confidentiality;
• applies the organisational and technical security measures described in the Privacy policy: encryption in transit (HTTPS/TLS), role-based access, storing passwords only as hashes (an irreversible one-way code), two-factor authentication, encrypted storage of integration keys and tokens, the action log, daily backups and encryption of off-site copies;
• gives the Customer reasonable help with people's requests through the Service's tools (search, edit, delete, export); forwards requests it receives directly to the Customer without delay;
• unless the law forbids it, tells the Customer about requests from state bodies concerning Customer Data;
• gives the Customer reasonable help, by providing the necessary information, in meeting its obligations under the Law.

4.2. The Provider notifies the Customer of a security breach affecting Customer Data without undue delay and no later than 24 (twenty-four) hours after the breach is discovered. The notice gives what is known: what happened, which data and roughly how many people are affected, likely consequences and the measures taken. The rest is sent as it becomes known.

4.3. Notifying the authorised state body and data subjects is the Customer's duty as operator (legal deadlines: 24 and 72 hours under ZRU-1125, to be verified). The Provider helps the Customer by providing the necessary information and performs the notification duties the law imposes on the Provider itself.

4.4. When the Agreement ends, the Provider lets the Customer export the data within the period in section 11 of the offer and then destroys it. Destroyed data disappears from the backups on the server within 7 (seven) days and from off-site copies within 35 (thirty-five) days. Data that must be kept by law is excepted.

5. Sub-processors

5.1. The Customer gives the Provider general authorisation to engage sub-processors (other companies that the Provider engages and that process Customer Data).

5.2. Sub-processors of the cloud Service:

• Contabo GmbH (Federal Republic of Germany) — servers (hosting) and the backups on the server;
• [off-site backup provider] — storage of off-site backups; the copies are encrypted before they leave the server, and the provider cannot read their content;
• [email delivery provider] — sending system emails (confirmation codes, password reset): the User's email address and the email text.

5.3. An artificial intelligence (AI) provider is used only if the Customer itself turns on the Fast AI assistant. Fast AI is off by default. The Customer chooses the provider itself and connects it with its own API key (an access key issued by the provider): for example, Anthropic or any OpenAI-compatible service. This provider works under its contract with the Customer and, like the services in clause 5.4, is the Customer's processor; the Provider transfers data to it only on the Customer's instructions. The Customer is responsible for choosing a provider to whose country the law allows data to be transferred, and for informing data subjects about processing with AI and, where the law requires it, obtaining their consent (ZRU-1115, to be verified). The Provider recommends choosing providers located in states on the list in clause 6.2.

5.4. SMS, Telegram, Instagram, WhatsApp, Payme, Click, the Customer's own mail server (SMTP) and other connections are the Customer's own accounts. These services work under contracts with the Customer and are the Customer's processors, not the Provider's sub-processors. The Provider transfers data to them only on the Customer's instructions.

5.5. The list in clause 5.2 is the current list. It is also available on request at info@fastcrm.uz.

5.6. The Provider notifies the Customer by email or on the Platform at least 14 (fourteen) calendar days before engaging a new sub-processor. The Customer may raise a reasoned objection within that period. If no agreement is reached, the Customer may terminate the Agreement; the fee for the unused part of the Paid Period is then refunded.

5.7. The Provider imposes data protection obligations on sub-processors (including through their standard terms) and is responsible for their actions within the limits of the offer.

6. Cross-border transfer

6.1. Customer Data is stored on servers of Contabo GmbH in the Federal Republic of Germany. This is a transfer outside Uzbekistan (cross-border transfer). By accepting the offer, the Customer instructs the Provider to store the data on those servers.

6.2. The transfer is carried out on grounds provided by law. Germany is on the list of states that adequately protect the rights of data subjects, approved by Cabinet of Ministers Resolution No. 415 of 29 July 2026 (to be verified). The providers of off-site backups and of system emails are also chosen only from states on this list.

6.3. Transfers to Third-Party Services the Customer turns on, including services in other countries, are made on the Customer's instructions. The Customer ensures their legal basis (where necessary, data subjects' consent).

7. Audit

7.1. On the Customer's request the Provider provides information confirming compliance with this Annex: a description of its security measures and written answers to the Customer's reasonable questions.

7.2. If these documents are not sufficient, the Customer may carry out an audit at its own cost no more than once a year, on at least 30 (thirty) calendar days' written notice. The audit is carried out during business hours, without disrupting the Service and without access to other customers' data, by the Customer or by an independent auditor bound by confidentiality.

7.3. An additional check may be carried out after a security breach or at the request of an authorised state body.

7.4. Audits at sub-processors' facilities are governed by their own rules.

8. Liability and final provisions

8.1. The Parties' liability under this Annex is determined by section 12 of the offer, including its limitations.

8.2. This Annex applies for the term of the Agreement and for as long as the Provider continues to process Customer Data.

8.3. In matters of personal data processing, this Annex prevails over the offer if they conflict.

8.4. This Annex applies from [date].