AroundCA LLC

PRIVACY POLICY

www.AroundCA.uz | www.AroundCA.com

Revision dated 16 April 2026

1. General Provisions

AroundCA LLC (the “Company”) respects the privacy of its clients and partners. This Privacy Policy explains how the Company collects, uses, stores and protects the personal data of travellers and partners in accordance with the Law of the Republic of Uzbekistan No. ZRU-547 of 2 July 2019 “On Personal Data” (the “Law”), as amended, including the amendments introduced by Law No. ZRU-1125 of 26 March 2026.

By using the Company’s services, submitting information through the websites www.AroundCA.uz and www.AroundCA.com, or contacting the Company via WhatsApp, Telegram, email or other channels, you acknowledge that you have read this Policy. Where the Law requires consent for a specific processing activity — in particular for special categories of personal data and for cross-border transfers — the Company will request your separate, informed and explicit consent and will not rely on your mere use of the website as consent for those activities.

2. What Data We Collect

The Company collects the following categories of personal data:

• Identification data: surname, first name, patronymic, date of birth, sex, passport number, document series and number, issuing authority, and date of issue;
• Contact information: mobile phone number, email address, and address (registered and actual place of residence);
• Financial data: payment method details, bank details (where applicable), and payment history;
• Trip information: selected routes, travel dates, preferences, and special requirements;
• Visa and immigration information: data required to arrange visas and entry to destination countries;
• Health data (special category): information required to arrange medical and travel insurance, processed only with your separate explicit consent (see Section 9);
• Technical information: IP address, browser type, time of visit, and page navigation data;
• Interaction data: messenger correspondence, support request history, and reviews.

3. Purposes of Processing

Your personal data is used solely for the following purposes:

• Booking, arranging and delivering travel services;
• Arranging visas, passport and other documents required for travel;
• Arranging medical insurance and other required insurance policies;
• Informing you about booking status, changes to the programme, and special offers;
• Processing payments and financial transactions;
• Ensuring security and preventing fraud;
• Complying with legal and regulatory requirements;
• Sending informational materials and marketing offers (only with your consent, which you may withdraw at any time);
• Improving service quality and analysing feedback.

4. Disclosure to Third Parties and Cross-Border Transfer

The Company discloses your personal data to third parties only to the extent necessary to deliver the travel service, namely to:

• Airlines and carriers (to issue tickets and enable boarding);
• Hotels and accommodation providers (to book rooms);
• Partner tour operators (to organise the tour);
• Insurance companies (to arrange medical and travel insurance);
• Consular and visa authorities (to arrange visas);
• Banks and payment systems (to process payments);
• Customs and immigration authorities (where required);
• Government bodies and courts (where required by law).

Legal basis for cross-border transfer

Delivering travel services necessarily involves transferring your data to recipients located outside the Republic of Uzbekistan (for example, foreign airlines, hotels, consulates and insurers). The Company carries out such cross-border transfers only where at least one of the legal bases set out in the Law is met: (a) the destination country is recognised as providing an adequate level of personal-data protection; (b) the Company applies standard contractual clauses or binding corporate rules with the recipient; (c) the transfer is necessary to perform the contract with you and is carried out with your explicit consent; or (d) another ground provided by the Law applies. Recipients are contractually required to protect your data to a standard no lower than that required by the Law.

5. Data Localisation

In accordance with the personal-data localisation requirements of the Republic of Uzbekistan, the personal data of citizens of Uzbekistan is collected, stored and processed using technical means physically located within the territory of Uzbekistan. Where data is subsequently transferred abroad to deliver a travel service, such transfer takes place only on the legal bases described in Section 4. The Company maintains the registrations of its personal-data databases and technical means required by law.

6. Data Security

The Company applies the following measures to protect your personal data:

• Access control — only authorised personnel may access personal data, on a need-to-know basis;
• Encryption — sensitive information is transmitted over secure channels (HTTPS/TLS);
• Physical security — servers and documents are held in secured facilities;
• Backups — data is backed up regularly to prevent loss;
• Staff training — employees are trained in handling confidential information.

No system can be guaranteed to be completely secure. The Company applies commercially reasonable measures appropriate to the risk and, in the event of a personal-data breach that is likely to affect your rights, will act in accordance with the notification requirements of the Law.

7. Retention Periods

Personal data is retained only for as long as necessary for the relevant purpose:

• Contract performance: for the entire period during which services are provided;
• Accounting and tax records: for the period prescribed by the tax and accounting legislation of Uzbekistan;
• Dispute resolution and claims: for the limitation period applicable to the relevant claim;
• Marketing communications: until you withdraw your consent.

Once the applicable period expires, data is deleted or anonymised.

8. Your Rights

Under the personal-data legislation of Uzbekistan you have the right to:

• Access — obtain information about which of your data is being processed;
• Rectification — correct inaccurate or incomplete data;
• Erasure — request deletion of your data, unless this conflicts with a legal or contractual obligation;
• Withdrawal of consent — withdraw consent to processing at any time;
• Objection to marketing — opt out of receiving promotional messages;
• Complaint — lodge a complaint if you believe your data has been processed improperly, including with the competent authority.

To exercise any of these rights, contact us using the details in Section 12. We will verify your identity and respond within the period prescribed by the Law. Exercising these rights is free of charge unless a request is manifestly unfounded or excessive.

9. Special Categories of Data and Consent

Certain data we process — in particular health data used to arrange medical and travel insurance, and some visa and immigration information — constitutes a special category of personal data under the Law. We process such data only where you have given separate, explicit consent for that specific purpose. A general acceptance of this Policy does not by itself authorise the processing of special categories of data. You may withdraw this consent at any time, although doing so may prevent us from arranging the affected services (for example, an insurance policy).

10. Minors

Where a booking involves a minor, the personal data of that minor is provided and processed on the basis of the consent of a parent or legal guardian. The Company processes minors’ data only to the extent necessary to deliver the requested travel service and does not knowingly use it for marketing purposes.

11. Cookies and Tracking Technologies

Our websites may use cookies to improve the user experience. Cookies are small files stored on your device that record information about your activity on the site. Where required, we request your consent before placing non-essential cookies, and you can manage cookies through your browser settings. Some analytics and tracking technologies may transmit technical information to providers located abroad; such transfers are subject to Section 4. Declining cookies may limit some site functions.

12. Contact Us and Data Protection Contact

If you have questions about this Policy or about how we process your data, or if you wish to exercise your rights, contact us:

• Phone: +998 50 330 24 32
• Email: hello@aroundca.com
• Address: 29 Surkhon St., Inokobod MFU, Tashkent, Uzbekistan

13. Changes to This Policy

The Company may amend this Policy. Changes will be announced by publishing the updated version on www.AroundCA.uz and www.AroundCA.com. The date of the latest update appears at the top of this document. By continuing to use the Company’s services after changes are published, you agree to the updated terms.

14. Governing Law

This Policy is governed by the legislation of the Republic of Uzbekistan, in particular:

• Law No. ZRU-547 of 2 July 2019 “On Personal Data”, as amended (including Law No. ZRU-1125 of 26 March 2026);
• the Law of the Republic of Uzbekistan “On Tourism”;
• other regulations of Uzbekistan on data protection and consumer rights.

AroundCA LLC | TIN: 312 176 122 | www.AroundCA.uz | www.AroundCA.com