Personal Data Processing Policy
Website: xbit.kg Operator (data holder): Exbit LLC (XBIT LLC), TIN 01711202510020 Address: Kyrgyz Republic, Bishkek, 140/3 Bakaeva St. (Sky Plaza Business Center), office 607 Email for personal data matters: ceo@xbit.kg Revision: 1.1 of 11.09.2026
1. General provisions
1.1. This Policy sets out how personal data of users of the website xbit.kg (the "Website") is processed and protected. It is drafted in accordance with the Digital Code of the Kyrgyz Republic (in force since 6 February 2026) and other regulatory acts of the Kyrgyz Republic on personal data.
1.2. By using the Website and submitting data through its forms, the user (data subject) confirms that they have read this Policy.
1.3. The Operator processes personal data on the principles of lawfulness, purpose limitation, data minimisation, accuracy, storage limitation and security.
2. What data we process
2.1. Data the user provides themselves — through the request form on the Website or by email:
- name;
- phone number and/or email address;
- company name (optional);
- message content (task description).
2.2. Technical data collected automatically when visiting the Website:
- IP address;
- browser, device and operating system information;
- date and time of requests, addresses of requested pages;
- cookies (see the Cookie Policy).
2.3. The Operator does not collect special categories of personal data (health, political views, religion, etc.) through the Website and asks users not to include them in the form.
3. Purposes of processing
- receiving and handling requests, communicating with the user;
- concluding and performing service contracts;
- ensuring the Website's operation and security (protection against attacks, fault detection);
- analysing Website traffic in anonymised form (only if analytics is enabled — see section 7);
- complying with the legislation of the Kyrgyz Republic.
The Operator does not use personal data for mailings or advertising without the user's separate consent and does not share it with advertising platforms.
4. Legal grounds
- the data subject's consent — expressed by an active action: ticking the box in the form before sending a request;
- the necessity to conclude and perform a contract to which the data subject is a party;
- the Operator's legitimate interest in securing the Website (for technical data and log files);
- requirements of the legislation of the Kyrgyz Republic.
5. Retention periods
| Data | Period |
|---|---|
| Form requests (name, contact, message) | until the purpose is achieved, but no longer than 3 years from the last contact, or until consent is withdrawn |
| Data under concluded contracts | for the term of the contract and the periods set by accounting legislation |
| Server log files (IP address, requests) | no longer than 30 days |
| Cookies | according to the Cookie Policy |
After the period expires, data is deleted or anonymised.
6. Disclosure and cross-border transfer
6.1. The Operator discloses personal data to third parties only to the extent necessary for the purposes and only:
- to contractors and partners involved in providing services — under a contract with a confidentiality obligation;
- to state authorities of the Kyrgyz Republic — upon lawful requests.
6.2. Processing outside the Kyrgyz Republic. The Website is hosted on servers of Hetzner Online GmbH (Germany). Form requests are delivered to the Operator's email and to the Operator's internal request-handling system located in the Russian Federation. By submitting a request the user gives separate consent to the cross-border transfer of their data to the countries indicated. The Operator applies technical and contractual safeguards for such transfers (encrypted communication channels, access restriction, contractual terms with providers).
7. Analytics and cookies
The Website does not use web analytics services and does not set analytics or advertising cookies. Only technical server log files are collected automatically (section 2.2); they are not shared with third parties.
See the Cookie Policy for details on cookies.
8. Protection of personal data
The Operator takes organisational and technical measures to protect data from unauthorised access, alteration, disclosure and destruction: encrypted connection (HTTPS), access restriction and segregation, server protection (firewall, security updates, brute-force protection), backups, security event logging. The Operator keeps records of processing operations in accordance with the Digital Code of the Kyrgyz Republic.
9. Rights of the data subject
The user has the right to:
- obtain information about which of their data is processed, for what purposes and to whom it is disclosed;
- request correction of inaccurate or incomplete data;
- request deletion of data if it is processed unlawfully or is no longer needed for the purposes;
- withdraw consent at any time (this does not affect the lawfulness of processing before withdrawal);
- object to processing, including for marketing purposes;
- lodge a complaint with the supervisory authority — the State Agency for Personal Data Protection under the Cabinet of Ministers of the Kyrgyz Republic (dpa.gov.kg) — or with a court.
To exercise these rights, send a request to ceo@xbit.kg stating the name and contact you used. The Operator responds within the period set by the Digital Code of the Kyrgyz Republic and no later than 30 calendar days.
10. Changes to the Policy
The Operator may amend this Policy. A new revision is published on the Website with its revision number and effective date. In case of material changes affecting users' rights, the Operator notifies users whose data is processed via the contact they provided.
11. Contacts
For all matters related to personal data processing: ceo@xbit.kg, Exbit LLC (XBIT LLC), Kyrgyz Republic, Bishkek, 140/3 Bakaeva St. (Sky Plaza Business Center), office 607.