C-Connect — Privacy Policy

Last updated: 27.10.2026

1. General provisions

1.1. This Policy sets out the purposes for which C-Space (hereinafter "C-Space" or "we") processes the personal data of users of the C-Connect application (the mobile app and the website, hereinafter "the App"), the procedure for collecting, using, protecting and transferring such data, and the rights of data subjects.

1.2. The Policy has been developed taking into account the requirements of the Law of the Republic of Uzbekistan "On Personal Data" and the General Data Protection Regulation (GDPR), and is publicly available within the App and on the /maxfiylik page of the C-Connect website.

1.3. C-Connect is a service app for residents of the C-Space coworking. It provides meeting room booking, a credit balance, locations and a map, and a personal profile. The App does not accept payments and has no advertising, chat or feed.

1.4. Locations, meeting rooms, the room schedule (occupied time slots, without showing who made the booking) and the map can be viewed without logging in. Logging in with an email code is required only to make a booking and to open the "Bookings" and "Account" sections.

1.5. An account is opened in one of two ways: a C-Space staff member adds it in the admin panel, or you submit an access request and the location's reception approves it. There is no self-registration without approval.

1.6. By using the App, you consent to this Policy and the Terms of Use.

2. Purposes of processing personal data

2.1. Your data is processed for the following purposes:

1. to log you in to your account and protect it from unauthorised access;
2. to identify you as a C-Space resident and enable interaction with the location's reception;
3. to review your access request and, once it is approved, open your account;
4. to book meeting rooms, display booking history and manage room occupancy;
5. to calculate the credit balance, deduct the booking price and ensure the transparency of settlements;
6. to send service emails: the login code, booking reminders, credit changes, and notifications that an access request has been approved or rejected;
7. to protect against abuse and automated requests;
8. to clarify disputed situations (for example, "who cancelled the booking?") using the history of actions;
9. to display the App in the language you have chosen and to avoid sending unnecessary emails.

2.2. Data is not used for advertising and is not sold. No advertising or marketing notifications are sent through the App.

3. Legal grounds for processing

3.1. C-Space collects and uses personal data only when one or more of the following conditions are met:

1. you have given consent to the processing of your data;
2. processing is necessary for the performance of the coworking services contract concluded with you or in order to take steps at your request prior to entering into a contract (for example, reviewing an access request);
3. processing is necessary for compliance with legal requirements to which C-Space is subject (for example, accounting and tax records);
4. processing is necessary for the legitimate interests of C-Space — service security, prevention of abuse and resolution of disputes.

4. What data is collected

4.1. Account (profile) data

This data is entered by a C-Space staff member in the admin panel or taken from your approved access request. You can edit part of it yourself in the App:

• first name and last name;
• email address — for logging in to the App (the code is sent to this address);
• phone number — if a staff member entered it or you provided it in your request;
• "about me" text — if you write it;
• your main (home) location;
• account status (active / guest / blocked);
• company — if you use the service on behalf of a company: the company name, its TIN (taxpayer identification number) and your role in the company (manager or member);
• App language (Uzbek, Russian, English) and your notification settings.

4.2. Access request

If your email is not registered in C-Connect, after confirming the email code you fill in a short access request. The request stores: first name and last name, email address (confirmed with the code), phone number, location (the location whose reception will review the request), company name (optional), request status (pending / approved / rejected), the staff member who reviewed it, the time of the decision and, if it was rejected, the reason.

4.3. Bookings

Which room, which location, the date and time slot; the booking title and note (written by you, may be left blank); the booking price, the part paid with credits and the balance payable at reception; the payment method (personal credits / company credits / reception); who created and who cancelled the booking, and the time of cancellation.

4.4. Credit and payment records

• credit ledger: the amount added and spent, the reason (payment at reception, booking, refund, adjustment), a note and the credit validity period;
• cash records: the amount received at C-Space reception, the payment method (cash, Payme, Click, Uzum, terminal, bank transfer), the receipt or external number of the payment and the staff member who accepted the payment.

The App does not accept payments. Card numbers, card expiry dates, CVV codes or bank account details are not entered into the App and are not stored in the C-Connect database.

4.5. Login and security-related data

• when a login code is requested: the address to which the code was sent, the hash of the code (not the code itself), its validity period, the number of failed attempts and the IP address from which the request came;
• sessions: the hash of the session key, its validity period and a technical string about the device (User-Agent: app and operating system version);
• action log (audit): actions such as login, booking and credits — who, when and at which location;
• error reports: if an unexpected technical error occurs in the App or on the website, the error text, the page (without the query part), the app version and the platform (iOS, Android or website) are sent to the C-Connect server so that it can be fixed. The report is not linked to your account (no name, email, phone number or session key is sent); emails, phone numbers and codes in the text are removed on the server before it is written. Reports stay in the server log and are not shared with third parties.

4.6. What is not collected

• the identity of a guest browsing without logging in — no name, email or phone number is requested; the server only limits the number of requests per IP address to prevent abuse;
• your location — it is not stored. If you grant permission, the App uses your phone's location only while it is open, to order the "Locations" list from the nearest location by road. To calculate the distance, the coordinates are sent to the C-Connect server (section 7) and used only for that calculation at the time of the request — they are not saved, not written to logs and not shared with third parties (no background tracking). You can turn the permission off in your phone settings at any time — the App keeps working in the usual order;
• contacts, camera, microphone, files and calendar — the App does not request any of these permissions;
• advertising identifiers — the App has no advertising, tracking or third-party analytics systems (including Google Analytics and Yandex.Metrica);
• push notifications — messages are sent by email only.

5. Rights and obligations of the data subject

5.1. You have the following rights:

1. to obtain a list of your data processed by C-Space, information on where it was obtained from, the period of its processing and storage, and other information about the processing;
2. to demand that your data be updated, corrected, blocked or destroyed. You can change your first name, last name, "about me" text and language yourself in the "Profile" section of the App;
3. to delete your account — in the App itself: Account → Delete account (takes effect immediately) or by the methods described on the Deleting your account page;
4. to withdraw the consent you have given to the processing of your data;
5. to opt out of email notifications (except login code emails — without them it is impossible to log in to the App);
6. to file a complaint against unlawful action or inaction in the processing of your data with the competent state authority or a court, in the manner prescribed by law.

5.2. The data subject must provide only accurate information about themselves.

5.3. Requests are sent to info@cspace.uz from the email address you use to log in to the App, or are accepted at the reception of any C-Space location. We respond to requests within 30 days.

5.4. When an account is deleted, the name, email, phone number and "about me" text are deleted, sessions are revoked, upcoming bookings are cancelled and unused personal credits are forfeited. Financial records are retained, as required by law, with an internal number in place of your name.

6. Rights and obligations of C-Space. Transfer of data

6.1. When processing personal data, C-Space may perform the following actions: collection, recording, systematisation, accumulation, storage, updating, use, anonymisation, blocking, deletion and destruction.

6.2. Who sees your data:

• you — your own profile, bookings, balance and history;
• C-Space staff — in the admin panel, according to their role: reception staff see the residents, bookings and access requests of their own location; a super admin sees all locations;
• your company's manager — if you are a member of a company, the credit transactions in the company wallet;
• other residents do not see your name, bookings or balance: they see only the times when a room is occupied.

6.3. C-Space does not disclose your data for commercial purposes without your consent, does not sell it and does not provide it to advertising networks.

6.4. C-Space may transfer personal data only to:

1. officials of state authorities — within the scope of their powers established by law;
2. service providers that process data on behalf of C-Space (clause 6.5);
3. the legal successors of C-Space in the event of its reorganisation;
4. other persons — with the consent of the data subject.

6.5. The following services are used for the App to function:

6.6. C-Space notifies data recipients that the data may be used only for the relevant purpose. Persons who receive the data must keep it secret (confidential).

7. Where data is stored

7.1. The database is located on a server of Contabo GmbH in Germany.

7.2. Encrypted database backups are stored in Backblaze's cloud storage in the USA. They are encrypted with a key held by C-Space; the service provider cannot open them.

7.3. Communication between the App and the server takes place over an encrypted channel (HTTPS).

8. Cookies and data stored on the device

8.1. A cookie is a small piece of data that a website stores in your browser. The C-Connect website uses only cookies that are necessary for it to function:

• cc_access, cc_refresh — session keys (for staff: cc_admin_access, cc_admin_refresh);
• cc_request — a key that links your access request to your browser while you are waiting for it to be approved;
• cc_lang — the selected language (1 year).

Key cookies are httpOnly — scripts on the page cannot read them. Analytics and advertising cookies are not used.

8.2. The browser storage (localStorage) holds the selected language and a copy of the most recently viewed data (locations, rooms, your bookings, your balance) so that pages open quickly.

8.3. The mobile app stores on your phone the session keys in protected storage (iOS Keychain, Android Keystore), the selected language and a copy of the most recently viewed data — when there is no internet, the App opens with this copy (marked "No internet"; booking requires an internet connection). When the "Log out" button is pressed, the keys and the data copy are deleted from the device.

8.4. The website installs a "service worker" in the browser — only to show a "No internet" page instead of the browser's error page when there is no connection. It does not store any data.

9. Security of personal data

9.1. C-Space applies appropriate technical and organisational measures to protect the data provided by App users against unauthorised access, disclosure, alteration, blocking or destruction:

• no passwords — login is by means of a one-time code; the code itself is not stored on the server (only its hash);
• communication with the server is over HTTPS, and session keys are kept in the phone's protected storage;
• backups are stored in encrypted form;
• staff permissions are restricted by role (reception sees only its own location);
• important actions are recorded in the audit log.

9.2. Only authorised C-Space staff who have undertaken to keep personal data confidential have access to it.

9.3. If you suspect that someone else has accessed your account, notify info@cspace.uz immediately.

10. Retention of personal data

10.1. Technical periods:

• login code — 5 minutes (a maximum of 5 attempts);
• session: short-lived key — 15 minutes, refresh key — 30 days; revoked immediately when "Log out" is pressed or if the key is suspected of having been stolen;
• credits — a validity period is recorded when they are issued (usually 1 month); expired credits are forfeited, and the record remains in the history.

10.2. C-Space retains your personal data for as long as is necessary to perform the contract and the obligations arising from it. If you ask us to delete it earlier, we will do so, except where the law requires us to retain it (clause 10.3).

10.3. Financial records are retained for the period established by the accounting and tax legislation of the Republic of Uzbekistan, with an internal number in place of the name.

10.4. Backups: copies on the server are kept for 14 days and encrypted cloud copies for no more than 12 months, after which they are deleted automatically. Data of a deleted account may remain in backups until this period expires; backups are used only to restore the system after a failure.

10.5. Once the purposes of processing have been achieved or the retention period has expired, personal data is destroyed or anonymised.

11. Children

The App is a work app for clients of the C-Space coworking and is not intended for children. The App is used by persons aged 18 and over. If it is found that a child's data has been entered by mistake, it will be deleted — write to info@cspace.uz.

12. Final provisions

12.1. The Policy may be amended at any time by decision of C-Space. The current version is always publicly available in the App and on the /maxfiylik page of the C-Connect website, and the "Last updated" date above is updated. Material changes are notified in the App or by email. Continued use of the App after changes are made constitutes consent to them.

12.2. Compliance with the requirements of this Policy is supervised by the person responsible for organising the processing of personal data, as designated in the internal documents of C-Space.

12.3. Contact: info@cspace.uz · website: cspace.uz