Privacy Policy and Consent to the Processing of Personal Data

Terms and definitions#

The following terms are used in this consent:

• personal data — any information relating to a directly or indirectly identifiable natural person;
• personal data operator — a legal entity that organises and carries out the processing of personal data and determines its purposes and composition;
• processing of personal data — any actions performed with data: collection, recording, systematisation, accumulation, storage, updating, use, transfer, depersonalisation, blocking, deletion and destruction;
• automated processing — processing carried out by means of computing equipment;
• dissemination — disclosure of data to an indefinite range of persons;
• provision — disclosure of data to a specific person or a specific range of persons;
• blocking — temporary suspension of the processing of personal data;
• destruction — actions that make it impossible to restore personal data;
• depersonalisation — a state in which, without additional information, it is impossible to determine that data belong to a specific data subject.

By this document I state and warrant that:

• I am a person with full legal capacity and have all the rights and powers necessary to accept this consent;
• I undertake not to disseminate, copy or transfer to third parties, in any form (oral, written or electronic), the materials made available to me through the Platform (content, video, audio, texts, images and other digital materials).

1. Consent to the collection and processing of personal data#

In accordance with Law of the Republic of Uzbekistan No. ZRU-547 "On Personal Data" dated 02.07.2019, I give my consent to the database owner MENTA TECH LLC (the "Platform") and to SERVERCORE CIS Foreign Enterprise LLC (TIN: 306843624, address: office 326, 12A Turkiston Street, Mirobod District, Tashkent, 100015, Republic of Uzbekistan) (the "Operator") for the following purposes:

• use of the MENTA Platform;
• receiving information about the Platform's materials, content and services;
• building the user database;
• communication with the support service;
• participation in the Platform's programmes, activities and surveys;
• receiving information about the Platform's events and participating in them;
• submitting feedback and requests (if applicable).

Personal data for which I give consent: surname, first name, patronymic; date of birth; telephone number; email address.

Actions performed with my personal data: collection, systematisation, storage, modification, supplementation, use, provision, transfer (including cross-border transfer), depersonalisation and destruction.

Processing is carried out in a mixed manner — both non-automated and automated — via the Internet.

2. Principles and procedure of processing#

My personal data are processed only where my prior consent exists and in order to achieve specific, lawful purposes. Only data that correspond to these purposes and are not excessive are processed.

Purposes and categories of data:

• conclusion and performance of contracts, consideration of requests: full name, address, telephone number, email, Telegram username — automated and mixed processing;
• showing content that matches the user's interests: full name, telephone, email, cookies (traffic source, device data, clicks, views, session parameters, user identifier) — automated processing;
• sending information about the Platform's content and services: full name, telephone, email, Telegram username — automated processing.

Retention periods:

• data obtained for the performance of a contract — until the contractual obligations have been fulfilled;
• data obtained for targeting and notification — from the moment consent is given until it is withdrawn.

The Platform does not process biometric or special categories of personal data. Cookies are processed on the basis of the user's informed consent; they can be refused through the browser settings.

3. Transfer to third parties#

I consent to the transfer of my personal data to:

• SERVERCORE CIS Foreign Enterprise LLC — for the purpose of ensuring the technical support and operation of the MENTA platform.
• Zoom Video Communications, Inc. (USA) — only for schools that have enabled the Zoom integration: when the student joins a live lesson, their display name and, if one is on file, their email address are transferred so that the student appears in the meeting and their attendance can be recorded. This transfer is cross-border.

In other cases, data are transferred to third parties only on the basis of legislation, requests of state authorities or court acts.

4. Protection of personal data#

The Operator takes the following measures to protect personal data:

• appointing a person responsible for the processing and protection of data;
• granting employees access to data only within the scope of their job duties;
• using the HTTPS protocol and other technical means of protection;
• taking joint measures to prevent damage that may result from the loss or disclosure of data.

5. Notification of loss or disclosure of data#

In the event of loss or disclosure of my personal data, the Operator shall notify me without delay. The Operator shall not be liable if the data had become publicly available or were disclosed with my consent.

6. Storage and deletion of data#

My personal data are stored until I refuse the Platform's services or withdraw this consent. When the services are refused, the account is deleted and the data are destroyed; restoration is not possible.

7. Term of consent#

This consent is valid for 10 (ten) years from the moment of acceptance, unless it is withdrawn earlier.

8. Procedure for withdrawing consent#

I am aware that I have the right to withdraw this consent at any time by sending a personally signed written application to the Platform's address.

9. Rights of the personal data subject#

I am aware that my personal data have been included in the database, of the purposes of their processing, and of my rights set out in Article 30 of Law No. ZRU-547 "On Personal Data" dated 02.07.2019, including the right to:

• know what personal data about me are held by the owner and (or) the operator, as well as by a third party, and their composition;
• receive, upon request, information about the processing of personal data;
• receive information about the conditions of access;
• apply to the authorised body or to a court to protect my rights;
• give consent to the processing of personal data and withdraw it;
• give consent to the dissemination of data;
• demand the temporary suspension of processing if the data are incomplete, outdated, inaccurate or were obtained unlawfully.

10. Procedure for requests and time limits for their consideration#

I have the right at any time to contact the Platform to obtain information about the processing of my personal data, and to demand that they be clarified, blocked or destroyed.

Methods of contact:

• by email: from the address specified when registering on the Platform;
• by post: to the Platform's address.

Time limits for considering requests:

• response to a request — within 10 (ten) working days of its receipt;
• blocking of personal data — on the day the relevant demand is received;
• clarification of personal data — within 7 (seven) working days;
• cessation of unlawful processing — within 3 (three) working days of the day it is detected; if this is not possible, the data are deleted within 10 (ten) working days;
• cessation of processing when consent is withdrawn — within 30 (thirty) calendar days of receipt of the withdrawal;
• destruction of data once the purposes of processing have been achieved — within 30 (thirty) calendar days.

Procedure for destroying personal data:

• data on electronic media are destroyed by erasing or formatting the media;
• data in information systems are deleted from the system and/or the database;
• the fact of destruction is confirmed by a corresponding certificate.

The Platform does not disclose or disseminate my personal data to third parties without my consent, except in cases provided for by the legislation of the Republic of Uzbekistan.

Zoom Integration#

Menta offers an optional integration with Zoom that allows schools to run live lessons for their students inside Menta. This section explains what data we receive from Zoom, how we use it, and how it is deleted.

Who uses the integration#

A school's teacher or administrator may connect their own Zoom account to Menta. Students do not connect Zoom accounts; they join lessons from inside Menta.

Data we receive from Zoom#

When a school connects a Zoom account, we receive and store:

• OAuth access and refresh tokens, used to act on behalf of the connected Zoom user;
• the Zoom user ID, the name and email address of the Zoom user, and the account plan (Basic or Licensed).

When a live lesson is started in Menta, we create a meeting in the connected Zoom account and store:

• the meeting ID and meeting passcode;
• the meeting status and its start and end times.

When the teacher ends a lesson in Menta with "End for everyone", we ask Zoom to end the meeting for all participants.

If the connected Zoom account is on a paid Zoom plan and the school's Menta plan includes minute-by-minute attendance, then after a lesson has ended we request the participant report for that meeting from Zoom when the attendance report is opened. For each participant it contains the name, the email address (if one was provided), the Zoom participant ID and the join and leave times. We use it only to match participants to the students invited to the lesson and to show how long each student stayed in the call. The participant report is not stored: it is requested again each time the attendance report is opened, and entries that do not match an invited student are discarded.

To let the teacher start the meeting as host from inside Menta, we request the host's Zoom Access Key (ZAK) for each session. ZAK tokens are not stored.

We do not access, record or store meeting audio, video, chat, transcripts or any other meeting content.

Data we send to Zoom#

When a student joins a lesson, their display name from their Menta profile and, if one is on file, their email address are passed to Zoom, so that the student appears in the meeting under their name and their attendance can be matched in the participant report.

How we use this data#

We use this data only to create live lessons, let teachers start and end them, let enrolled students join them, show students whether a lesson is live, and show the school who attended a lesson and for how long. We do not sell this data or use it for advertising or for training AI models. Apart from the transfer to Zoom described above, we do not share it with third parties.

Storage and security#

OAuth access and refresh tokens and meeting passcodes are encrypted at rest on our servers. OAuth tokens are never sent to the browser or the mobile app. To let a teacher start a lesson as host, a short-lived Zoom Access Key (ZAK) is passed to that teacher's browser or app for that session only; it is not stored.

Disconnecting and data deletion#

A school can disconnect Zoom at any time in Menta in the Integrations section, or by removing the Menta app from their Zoom account. When the integration is disconnected or the app is removed, we promptly delete the stored OAuth tokens and Zoom user data, and remove Zoom meeting identifiers and passcodes from our records, no later than 10 days after disconnection.

Contact#

For questions about the Zoom integration or your data, contact us at support@menta.uz.

Electronic acceptance#

By clicking the "I agree" / "Accept" / "Sign up" button, I confirm that:

• I have read all the terms of this Consent and accept them in full;
• I am a person with full legal capacity and give my consent of my own free will;
• this acceptance is equivalent to a handwritten signature under the legislation of the Republic of Uzbekistan.

The date of acceptance and the IP address are recorded automatically in the Platform's system and constitute evidence that consent was given.