01.Operator and contacts
Data controller: GFF Uzbekistan LLC. Address: 128 Mustaqillik Ave., Mirzo Ulugbek district, Tashkent. Contact: info@gulfflavour.uz, +998 97 570 77 60.
| Responsible person | General Director |
|---|---|
| For requests | info@gulfflavour.uz |
02.What data is collected
We process only the data you provide yourself and a minimal amount collected automatically out of technical necessity.
- Contact details: full name, position, phone number, e-mail, Telegram.
- Company data: name, tax ID (INN), business type, region, website.
- Request content: products of interest, volume, frequency, notes, SKU list (sample box).
- Technical data: IP address, browser and device type, UTM tags, request timestamp.
03.Purposes and legal basis
Data is used solely for the following purposes:
- Responding to your request, preparing a quotation and contacting you (based on consent).
- Concluding and performing a contract: invoices, delivery, documents (based on the contract).
- Arranging delivery of samples (test boxes).
- Meeting legal requirements (tax, accounting, archiving) — based on a legal obligation.
- Site security and spam protection (limited analysis of IPs and requests).
04.Consent and withdrawal
Before submitting the form you consent to the processing of your personal data. Consent is voluntary, but without it we cannot respond to your request.
You may withdraw consent at any time: e-mail info@gulfflavour.uz with the subject "consent withdrawal" or call +998 97 570 77 60. Requests are fulfilled within 15 business days.
Withdrawing consent does not affect data retained under a contract or by law (for example, invoices).
05.Retention period and location
Requests (leads) are stored in protected logs on our server and are accessible only to authorised staff.
| Requests (answered) | 36 months |
|---|---|
| Requests (unanswered) | 12 months |
| Contracts and accounting records | 5 years (legal requirement) |
| Records flagged as spam | 30 days |
06.Who receives the data
We do not sell data or share it with third parties for advertising. In limited cases it may be shared with:
- Gulf Flavours & Fragrances FZE (Dubai, UAE) — the manufacturer, only on your request for technical or pricing matters.
- Delivery services — the minimum data needed to ship a sample or order (name, phone, address).
- Accounting and legal services — within contractual obligations.
- State authorities — only where required by the legislation of Uzbekistan.
07.Security measures
The following technical and organisational measures protect the data:
- HTTPS (TLS) — all transfers encrypted; security headers (HSTS, CSP, X-Content-Type-Options).
- Form protection against automated submissions: honeypot fields, rate limiting, a spam-scoring system and optional Cloudflare Turnstile.
- Admin panel access — via an HMAC-signed session, a password and login attempt limits.
- Staff access is granted strictly on a need-to-know basis.
08.Cookies and local storage
The site uses only technically necessary cookies and browser storage. Advertising tracking is not used.
| Language preference | cookie — remembers your chosen language |
|---|---|
| Sample box | localStorage — your list of selected samples |
| Admin session | httpOnly cookie — panel authentication |
| Analytics | aggregate, non-personalised events only |
09.Your rights
Under the Law of the Republic of Uzbekistan "On Personal Data" (ZRU-547) you have the following rights:
- To know what data about you is held and to receive a copy of it.
- To request correction of inaccurate or outdated data.
- To request erasure ("right to be forgotten") where no legal basis for retention remains.
- To restrict or object to processing.
- To lodge a complaint with the competent state authority.
10.Changes
We may update this policy when legislation or processes change. The current version is always published on this page with an update date. Current version: 15.01.2026.