Privacy Policy
This Privacy Policy explains how Olbilet ("Olbilet", "we", "us") collects, uses, stores and protects personal data when you use the Olbilet mobile application (the "App"). The App lets you browse events held in the Republic of Uzbekistan, choose seats, pay for tickets and present them at the venue.
By installing or using the App you confirm that you have read this Policy. If you do not agree with it, please do not use the App. Purchases are additionally governed by the purchase terms shown at checkout.
In short
- You can browse events and choose seats without an account.
- To buy tickets we ask for your phone number or e-mail, and a name and e-mail for the order.
- Card details are entered on the bank's secure payment page. The App never sees or stores your card number.
- The App contains no advertising SDKs, analytics trackers or social-media pixels.
- We do not access your location, contacts, camera, microphone, photos or files.
- You can delete your account and data at any time by contacting us (see Your rights).
Contents
- Who is responsible for your data
- What data we collect
- Why we use your data
- Payments
- Data stored on your device
- Who we share data with
- How long we keep data
- How we protect data
- Your rights
- Children
- Where data is processed
- Changes to this Policy
- Contact us
1. Who is responsible for your data
The data controller is OL Bilet (Uzbekistan, Tashkent, Amir Temur shoh ko‘chasi 64 A), operator of the ticketing platform olbilet.uz
and of the App (package uz.olbilet.mobile). Contact details are given in section 13.
2. What data we collect
2.1 Data you give us
| Data | When | Required? |
|---|---|---|
| Phone number or e-mail address | When you sign in. We send a one-time code (SMS or e-mail) to confirm it is yours. | Yes, to buy tickets and see orders |
| First name, last name | When you edit your profile or place an order. | Name is required for an order |
| Order e-mail | At checkout, so we can send the receipt and tickets. | Yes |
| Promo code | If you apply one at checkout. | No |
| Telegram account identifier | Only if you choose to sign in with Telegram. | No |
2.2 Data created while you use the App
- Orders and tickets — event, performance, seat or zone, price, order status, payment status, ticket QR codes and PDF receipts.
- Cart and seat holds — the seats you temporarily reserve (holds expire after 15 minutes) and the contents of your cart.
- Anonymous session identifier — a random identifier generated on your device on first launch. It links your guest cart and seat holds to you before you sign in and is not derived from any hardware identifier.
- Language preference — Russian, Uzbek or English, so that the App and our servers reply in your language.
- Ticket check-in events — when your ticket is scanned at the venue.
2.3 Technical data received by our servers
Like any online service, our servers receive standard connection data when the App makes a request: your IP address, request time, App version and operating system version. This data is kept in server logs for security and troubleshooting.
2.4 What we do not collect
- Precise or approximate location.
- Contacts, calendar, photos, camera, microphone or files on your device.
- Advertising identifiers (IDFA / GAID) or any cross-app tracking data.
- Behavioural analytics — the App does not include Google Analytics, Firebase Analytics, Facebook SDK or similar tools.
- Payment card numbers, CVV or expiry dates — see section 4.
3. Why we use your data
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and secure your account; sign you in with a one-time code | Phone / e-mail, one-time code, session identifier | Performance of the contract; your consent when you request a code |
| Reserve seats, sell tickets, issue e-tickets and receipts | Name, e-mail, order and ticket data | Performance of the contract |
| Process your payment and confirm its status | Order number, amount, payment status | Performance of the contract |
| Let venue staff verify your ticket at the entrance | Ticket QR code, check-in status | Performance of the contract |
| Send transactional messages (codes, order confirmations, refunds, event changes) | Phone / e-mail | Performance of the contract; legal obligation |
| Provide customer support and handle refund requests | Contact details, order history | Performance of the contract; legitimate interest |
| Prevent fraud, abuse and duplicate ticket use; keep the service secure | Session identifier, IP address, server logs, check-in events | Legitimate interest; legal obligation |
| Accounting and tax reporting | Order and payment records | Legal obligation |
We do not use your data for profiling, automated decision-making with legal effect, or targeted advertising. We do not send marketing messages unless you separately opt in.
4. Payments
Payments are processed by Ipak Yuli Bank (JSCIB "Ipak Yuli", Uzbekistan) through its e-commerce payment gateway. When you tap "Pay", the App opens the bank's secure hosted payment page inside a protected in-app browser. You enter your card details (HUMO, UZCARD, Visa or Mastercard) directly on that page.
- Your card number, expiry date, CVV and SMS confirmation code are transmitted only to the bank and are never received, processed or stored by Olbilet.
- The bank returns to us only the payment result (success / failure), the order number and the amount.
- The bank processes your card data under its own privacy policy and the PCI DSS security standard.
5. Data stored on your device
The App stores a small amount of data locally so it can work quickly and keep you signed in:
| Item | Where | Removed when |
|---|---|---|
| Access and refresh tokens (keep you signed in) | Encrypted secure storage (iOS Keychain / Android Keystore) | You sign out or delete the App |
| Anonymous session identifier | Encrypted secure storage | You sign out (a new one is generated) or delete the App |
| Cached profile, orders and tickets | App storage | You sign out or delete the App |
| Language and theme preference | App storage | You delete the App |
| Event images (cache) | App cache | Automatically, or when you clear the cache / delete the App |
| Ticket PDF you chose to save or share | Temporary App folder | You delete the App, or the system clears temporary files |
Signing out wipes all cached account data from the device. The App does not use third-party cookies. To protect your tickets, screenshots and screen recording are disabled on the ticket QR screen.
6. Who we share data with
We share personal data only where it is necessary to provide the service, and only the minimum required:
- Event organisers and venues — receive ticket data (ticket number, seat, check-in status) needed to admit you. For some events the organiser may also receive the buyer's name for guest lists or age-restricted entry.
- Ipak Yuli Bank — order number and amount for payment processing (see section 4).
- SMS and e-mail delivery providers — your phone number or e-mail address, solely to deliver one-time codes, receipts and tickets.
- Telegram — only if you choose Telegram sign-in; Telegram shares your account identifier and display name with us under its own terms.
- Hosting and infrastructure providers — who store our servers and backups under confidentiality obligations.
- Public authorities — where required by the law of the Republic of Uzbekistan or a lawful request.
We do not sell personal data and do not share it with advertising networks or data brokers.
7. How long we keep data
- Account data (phone / e-mail, name) — while your account exists, then deleted within 30 days of your deletion request.
- Orders, tickets and payment records — for the period required by Uzbek accounting and tax law (generally 5 years), after which they are deleted or anonymised.
- Seat holds and guest carts — 15 minutes for holds; guest carts are cleared after they expire or when migrated to your account.
- One-time codes — 5 minutes (SMS) or 10 minutes (e-mail), then invalidated.
- Server logs — up to 12 months, for security and troubleshooting.
8. How we protect data
- All traffic between the App and our servers is encrypted with TLS (HTTPS / WSS).
- Authentication tokens are stored in the operating system's encrypted secure storage, never in plain files.
- Sign-in uses short-lived one-time codes; passwords are not used and therefore cannot leak.
- Access to personal data inside Olbilet is restricted to staff who need it for support, finance or operations.
- Ticket QR codes are cryptographically signed, and for selected events rotate every 30 seconds, so a copied ticket cannot be reused.
No system is perfectly secure. If we learn of a breach affecting your data we will notify you and the relevant authority as required by law.
9. Your rights
Under the Law of the Republic of Uzbekistan "On Personal Data" (No. ZRU-547) and, where applicable, other data-protection laws, you have the right to:
- Access the personal data we hold about you and receive a copy.
- Correct inaccurate data — you can edit your name and e-mail in the App under Profile.
- Delete your account and personal data. Data we must keep by law (e.g. records of paid orders) is retained for the statutory period only.
- Withdraw consent where processing is based on consent, without affecting processing that already took place.
- Object to processing based on our legitimate interests.
- Lodge a complaint with the authorised body for personal-data protection in Uzbekistan or your local supervisory authority.
To delete your account, send a request from the phone number or e-mail linked to the account to the contact in section 13. We will confirm your identity, delete the account and respond within 30 days. Deleting the App from your device does not by itself delete your account.
10. Children
The App is intended for users aged 16 or older. Tickets for children's events must be purchased by an adult. We do not knowingly collect personal data from children under 16; if you believe a child has provided us data, contact us and we will delete it.
11. Where data is processed
Our servers are located in the Republic of Uzbekistan, and personal data of Uzbek citizens is stored there in accordance with local law. Some service providers (for example e-mail delivery or Telegram) may process limited data outside Uzbekistan; where this happens we ensure appropriate contractual safeguards.
12. Changes to this Policy
We may update this Policy when the App or the law changes. The current version is always available at the address where you are reading this and inside the App. For material changes we will notify you in the App or by e-mail before they take effect. The effective date at the top shows when the Policy was last revised.
13. Contact us
For any privacy question, access or deletion request:
- E-mail: support@olbilet.uz
- Telegram: @olbiletuzbekistan
- Postal address: OL Bilet, Uzbekistan, Tashkent, Amir Temur shoh ko‘chasi 64 A
- Website: olbilet.uz