Legal Information
Privacy Policy
Updated: 22.07.2026
This Policy describes what personal data the HL 309 Hotel website collects, for what purpose, on what legal basis, and how we handle it. The data controller is HOTELS LEVEL LLC (the "HL 309 Hotel"), Tax ID (INN) 310153191, address: 100100, Tashkent, Yakkasaray district, Rakatboshi St., 3A. By using the website, you agree to the terms of this Policy.
1. What Data We Collect
When you register a personal account: your name, e-mail address, phone number (if provided), password stored as an irreversible cryptographic hash — we do not store the password itself and cannot recover it — as well as your browser language and the dates of registration and last login. When you submit a booking request: check-in and check-out dates, number of guests, children's ages, room category and quantity, country of residence, contact name, phone number and e-mail, your check-in preferences, promo code, total amount, and currency. When chatting with us: the text of your messages and any files you attach (images and documents). When making a payment: payment ID, amount, currency, status, and a test-payment flag. Technical data: IP address (to protect against automated requests and password guessing), country code determined from your network address, and device type and language.
2. What We Don't Collect
We do not receive, process, or store bank card details: the card number, expiry date, and security code are entered on the acquiring bank's secure page and never reach us. We do not request passport details through the website — identification is only presented at the front desk during check-in. We do not collect data about health status, religion, or other special categories of personal data.
3. Purposes and Legal Basis for Processing
Data provided during booking is processed to conclude and perform the hotel services agreement: confirming your request, calculating the price and tourist fee, accepting payment, communicating with you, and check-in. Account data is processed to provide access to your personal account, your request history and chat, and to reset your password. Technical data is processed on the basis of our legitimate interest in ensuring the security of the website. Web analytics data is processed on the basis of your consent, given through the cookie consent banner.
4. Cookies
Strictly necessary cookies keep the website running: your login session, chosen language and currency, the "remember me" feature, and your choice in the consent banner. These are set without separate consent, since the website cannot function without them. Analytics cookies are only set after you click "Accept" in the banner. If you decline consent, you can still use the website in full — analytics scripts simply won't load. You can delete cookies at any time through your browser settings.
5. Analytics and Third-Party Services
The website may use Google Analytics and Yandex.Metrica to collect anonymized visit statistics: pages viewed, referral source, device type, and approximate region. These scripts only load after you give consent. A Google Maps widget is embedded at the bottom of the pages; when it loads, Google may receive your network address and browser data. These services process data in accordance with their own privacy policies.
6. Who We Share Data With
Octobank JSC (the Octo payment service) — the request ID, amount, and currency are shared for processing payments and refunds. Our hosting provider — for hosting the website and database. Our e-mail service provider — for delivering confirmation e-mails and password reset links. Authorized government bodies — in the cases and to the extent expressly required by the legislation of the Republic of Uzbekistan. We do not sell personal data or share it with third parties for advertising purposes.
7. Where Data Is Processed
The website and database are hosted on servers located outside the Republic of Uzbekistan (Federal Republic of Germany) — a country that provides an adequate level of personal data protection. Data is transferred over a secure channel. By submitting a booking request, you consent to the cross-border transfer of the data described in this Policy.
8. Retention Periods
Account data and request history are stored for as long as your personal account exists. Data on completed payments and services rendered is stored for the periods required by accounting and tax legislation. Password reset tokens are valid for one hour and are deleted after use. Technical logs containing network addresses are stored for a limited period and used solely for security purposes.
9. Data Protection
The connection to the website is protected by the HTTPS protocol. Passwords are stored as irreversible hashes. All database queries use prepared statements, which prevents code injection. Forms are protected against cross-site request forgery and are rate-limited. Uploaded files are validated by their actual content, not their extension, and cannot be executed on the server. System files and the database are not accessible from the internet. Only hotel staff who need it for their work have access to guest data, under personal accounts.
10. Your Rights
You have the right to obtain information about the data we process, request its correction, blocking, or deletion, and to withdraw previously given consent. You can view some of your data yourself in your personal account. For all other requests, write to us at sharqhotel2023@gmail.com — we will respond within the period set by law. Please note: data required to fulfil a confirmed booking, or retained under legal requirements, can only be deleted once the relevant retention period has expired.
11. Minors
The website is not intended for independent use by persons under 18. Bookings must be made by an adult; information about children is provided by their legal representative and used solely to calculate the cost of accommodation and prepare the room.
12. Changes to This Policy
We may amend this Policy. The current version, together with its update date, is always posted on this page. Material changes take effect upon publication.
13. Contacts
For any questions about the processing of personal data, write to sharqhotel2023@gmail.com or call +998 99 889 77 76. Postal address: 100100, Tashkent, Yakkasaray district, Rakatboshi St., 3A.