Privacy Policy

Version dated 1 September 2026. Effective from the date of publication.

This Privacy Policy (the "Policy") sets out what personal data BLOOMSHOP LLC ("Bloom", "we") collects and processes, for what purposes and on what legal basis, to whom it is disclosed and for how long it is retained. The Policy applies to the use of the website https://bloombeauty.uz (the "Website"), the Bloom mobile application for Android (Google Play — https://play.google.com/store/apps/details?id=uz.bloom.app), iOS (App Store — https://apps.apple.com/uz/app/bloom-beauty-shop/id6445943128) and Huawei (AppGallery) (the "Application"), and to participation in the Bloom loyalty programme in our stores.

The Policy has been drawn up in accordance with the Law of the Republic of Uzbekistan "On Personal Data" No. ZRU-547 of 2 July 2019 (as amended, including by Law No. ZRU-1125 of 26 March 2026), the Law "On Informatisation", the Law "On Electronic Commerce", the Law "On the Protection of Consumer Rights" and other legislation of the Republic of Uzbekistan.

The Policy is a standalone document. The terms of purchase of goods are governed by the Public Offer: https://bloombeauty.uz/pages/public-offer.

1. Who processes your data

The owner and operator of the personal data database is BLOOMSHOP LLC.

  • Taxpayer ID (INN): 308170528
  • Registered address: 1V Abdulla Qodiriy Street, Tashkent, Republic of Uzbekistan
  • Telephone: +998 55 517 77 88, +998 99 610 77 88
  • E-mail for personal data enquiries: privet@bloombeauty.uz

2. What data we collect

2.1. Data you provide yourself: - mobile telephone number (used to sign in via SMS code); - first name and surname; - date of birth and gender (optional; used for personal greetings and offers); - delivery addresses and order comments; - the recipient's name and telephone number if you place an order for another person (you confirm that you have obtained that person's consent to share their data with us); - details of the gift cards and promo codes you use; - customer support enquiries, reviews and ratings.

2.2. Data generated when you use our services: - order and purchase history (online and in Bloom stores via the loyalty card), basket contents, favourites; - cashback accrued and redeemed, loyalty programme tier; - electronic receipts.

2.3. Technical data: - device model, operating system and Application version, language, IP address; - push notification identifier (token) and device advertising identifiers (Android Advertising ID; IDFA — on iOS only with your permission via the App Tracking Transparency prompt); - Application crash data and anonymised usage statistics (which screens were opened, which actions were performed); - cookies and similar technologies on the Website.

2.4. Data accessed only with your permission: - location — only while the Application is open, to determine the delivery address and show the nearest stores. Location is not tracked in the background; - camera — to scan barcodes and QR codes. Photos and videos are not stored or transmitted to us; - photo library — only to select an image containing a QR code or barcode.

You may revoke these permissions at any time in your device settings. The remaining functions of the Application will continue to work.

2.5. What we do not collect. We do not receive or store your full bank card details: the card number, expiry date and CVV are entered on the side of the payment services (Payme, Click). We do not collect special categories of personal data: biometric and genetic data, or information about health, political or religious beliefs.

3. What we use the data for

  • registration and signing in to your account, telephone number verification;
  • placing, paying for, assembling and delivering orders, and informing you of order status;
  • running the loyalty programme: accruing and redeeming cashback, personal discounts;
  • issuing and sending electronic receipts;
  • responding to enquiries, handling complaints and returns;
  • informing you about promotions and new products (SMS, push notifications, e-mail) — only with your separate consent. You may opt out in the Application or device settings, via the link in the message or through customer support;
  • improving the Website and Application, fixing errors, analytics;
  • showing more relevant Bloom advertising (with your permission);
  • fraud prevention and security;
  • compliance with legal requirements, including tax and accounting legislation.

4. Legal basis for processing

We process personal data (Article 18 of the Law "On Personal Data"): - on the basis of your consent. You give consent when registering, placing an order or granting a permission in the Application, confirming it by the corresponding action (ticking a box, pressing a button, entering an SMS code). The fact and time of consent are recorded in our system; - for the conclusion and performance of the sale agreement (Public Offer) and participation in the loyalty programme; - for compliance with obligations imposed by the legislation of the Republic of Uzbekistan (including tax, accounting and consumer protection legislation).

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal and does not stop processing that is necessary for the performance of the agreement or for compliance with legal requirements.

5. Who we share data with

We do not sell personal data. Data is shared only to the extent necessary for a specific purpose: - payment services and banks (Payme, Click) — to process and refund payments; - courier services and delivery partners (including Fargo for regional delivery) — the recipient's name, telephone number and address; - SMS messaging providers — telephone number for sending codes and notifications; - fiscal data operators and tax authorities — to the extent required by law; - technical service providers: Google Firebase (push notifications, crash reports, analytics), AppMetrica (analytics and push notifications), Meta (Facebook) App Events (measuring advertising effectiveness — only with your tracking permission), Yandex Maps (selecting an address on the map). These services receive technical and anonymised data (device identifiers, usage events), not your name, telephone number or address; - public authorities — upon their lawful request in the cases provided for by law.

All partners are required to maintain the confidentiality and security of the data and to use it only for the stated purposes.

6. Where data is stored. Cross-border transfer

The personal data databases of Bloom users are stored and processed on servers physically located in the Republic of Uzbekistan (UZTELECOM data centre).

Technical and anonymised data transmitted to the services listed in Section 5 (Firebase, AppMetrica, Meta, Yandex Maps) may be processed on servers outside the Republic of Uzbekistan. Cross-border transfer is carried out in accordance with Article 15 of the Law "On Personal Data": to states that ensure adequate protection of personal data (the list is approved by the Cabinet of Ministers of the Republic of Uzbekistan), and to other states on the basis of your consent given when accepting this Policy and granting the relevant permissions in the Application.

7. How long we keep data

  • account data (profile, addresses, favourites, settings) — for as long as the account is active. After the account is deleted, this data is deleted or anonymised within 30 days;
  • records of orders, payments, refunds and electronic receipts — for at least 5 years after the end of the reporting year in which the transaction took place (Article 29 of the Law "On Accounting"; Tax Code of the Republic of Uzbekistan). These records are kept with restricted access and are used only for compliance with legal requirements, accounting and tax purposes, and handling complaints;
  • customer support enquiries and complaints — 3 years from the closure of the enquiry (general limitation period);
  • technical and analytics data — no longer than necessary for the processing purposes, generally up to 14 months;
  • logs of consents to data processing and to marketing communications — for the duration of processing and 3 years thereafter.

On expiry of these periods the data is destroyed or anonymised.

8. Your rights

Under the Law "On Personal Data" (Article 30) you have the right: - to know whether we hold your personal data and to receive information about its processing (purposes, categories, recipients, retention periods); - to require the correction, updating, blocking or destruction of data that is incomplete, inaccurate, out of date or unlawfully obtained; - to withdraw your consent to the processing of personal data (in the same form in which it was given, or in writing); - to opt out of marketing communications; - to lodge a complaint about our actions or omissions with the authorised state body for personal data — the State Personalisation Centre under the Cabinet of Ministers of the Republic of Uzbekistan — or with a court.

You can change your profile data in the "Profile" section. To exercise your other rights, write to us at privet@bloombeauty.uz or call +998 55 517 77 88. We will respond within 10 business days of receiving your request. To confirm that the request has been sent by the account holder, we may ask you to verify your telephone number with an SMS code.

9. How to delete your account

In the Application: "Profile" → "Delete account" → confirm deletion with the SMS code.

Without the Application: send a request stating the telephone number linked to the account to privet@bloombeauty.uz, or use the form at https://bloombeauty.uz/pages/delete-account.

Before deleting your account, please note: - any unused cashback will be cancelled; - unused electronic gift cards remain valid until their expiry date: keep their numbers — they can be used without an account or transferred to a new account by contacting customer support; - incomplete orders will be fulfilled or cancelled with a refund.

After the account is deleted, your profile, addresses, favourites, browsing history and push tokens will be deleted. Records of completed purchases, payments and receipts are retained only to the extent and for the periods required by law (Section 7) and are not used for marketing. Re-registering with the same telephone number creates a new account without restoring the previous history.

10. How we protect data

We apply organisational and technical security measures: - encryption in transit (HTTPS/TLS); - role-based restriction of staff access; - secure storage of passwords and keys; - access logging; - regular backups.

Only those employees and partners who need it to perform their duties have access to personal data. In the event of a personal data breach that poses a risk to your rights, we will notify the authorised body and the affected users within the time limits set by law.

11. Age of users

The Website and the Application are intended for persons aged 18 or over. Persons aged 14 to 18 may use the Website and the Application and place orders only with the consent of their parents (adoptive parents, guardians); consent to the processing of a minor's personal data is given by a parent (guardian, custodian). We do not knowingly collect data from children under 14. If you become aware that a child has provided us with their data without parental consent, please contact us and we will delete it.

12. Cookies and similar technologies on the Website

The Website uses essential cookies (basket operation, authentication) and, with your consent, analytics and advertising cookies. You can manage them in your browser settings; disabling essential cookies may impair the operation of the Website.

13. Changes to the Policy

We may update the Policy. A new version is published on this page, stating its date, at least 3 calendar days before it takes effect. We will additionally notify you of material changes (new purposes, new categories of recipients) in the Application, by SMS or by e-mail, and will request fresh consent where necessary.

14. Contact details

BLOOMSHOP LLC

  • Main