Legal information
Privacy Policy
Updated: 22.07.2026
This Policy describes what personal data the HL 309 Hotel website collects, for what purpose, on what legal basis and how we handle it. The data controller is HOTELS LEVEL LLC (HL309 Hotel), taxpayer ID (INN) 310153191, address: 3A Rakatboshi St, Yakkasaray district, Tashkent 100100. By using the site you agree to the terms of this Policy.
1. What data we collect
When you register an account: your name, email address, phone number (if provided), your password stored as an irreversible cryptographic hash — we do not store the password itself and cannot recover it — along with your browser language and the dates of registration and last sign-in. When you submit a booking request: check-in and check-out dates, number of guests, children's ages, room category and quantity, country of residence, contact name, phone and email, any special requests, promo code, total amount and currency. When you use the chat: the text of your messages and any files you attach (images and documents). When you pay: the payment identifier, amount, currency, status and whether the payment was a test. Technical data: your IP address (used to protect against automated requests and password guessing), the country code derived from your network address, and your device type and language.
2. What we do not collect
We neither receive, process nor store bank card details: the card number, expiry date and security code are entered on the acquiring bank's secure page and never reach us. We do not request passport details through the website — your document is presented only at the reception desk on arrival. We do not collect health data, religious beliefs or other special categories of personal data.
3. Purposes and legal basis
Data provided when booking is processed in order to conclude and perform the accommodation contract: confirming the request, calculating the price and tourist tax, taking payment, contacting you and checking you in. Account data is processed to give you access to your personal account, your request history and your correspondence, and to allow password recovery. Technical data is processed on the basis of our legitimate interest in keeping the site secure. Web analytics data is processed on the basis of the consent you give through the cookie consent banner.
4. Cookies
Strictly necessary cookies keep the site working: your sign-in session, your chosen language and currency, the "remember me" function and your choice in the consent banner. They are set without separate consent because the site cannot function without them. Analytics cookies are set only after you click "Accept" in the banner. If you decline, you can still use the site in full — the analytics scripts simply are not loaded. You may delete cookies at any time through your browser settings.
5. Analytics and third-party services
The site may use Google Analytics and Yandex.Metrica to collect anonymised visit statistics: pages viewed, referral source, device type and approximate region. These scripts load only after you have given consent. A Google Maps frame is embedded at the foot of our pages; when it is displayed, Google may receive your network address and browser details. These services process data in accordance with their own privacy policies.
6. Who receives your data
Oktobank JSC (the Octo payment service) — the request identifier, amount and currency are transmitted in order to process payments and refunds. Our hosting provider — for hosting the website and its database. Our email provider — for delivering confirmation messages and password recovery links. Authorised state bodies — in the cases and to the extent expressly required by the legislation of the Republic of Uzbekistan. We do not sell personal data and do not pass it to third parties for advertising purposes.
7. Where data is processed
The website and its database are hosted on servers located outside the Republic of Uzbekistan (in the Federal Republic of Germany), a jurisdiction providing an adequate level of personal data protection. Transfers take place over a secure channel. By submitting a booking request you consent to the cross-border transfer of the data described in this Policy.
8. Retention periods
Account data and request history are kept for as long as your personal account exists. Records of payments made and services provided are kept for the periods required by accounting and tax legislation. Password recovery tokens are valid for one hour and are deleted after use. Technical logs containing network addresses are kept for a limited period and are used solely for security purposes.
9. Data security
The connection to the site is secured by HTTPS. Passwords are stored as irreversible hashes. All database queries use prepared statements, which prevents the injection of foreign code. Forms are protected against cross-site request forgery and rate-limited. Uploaded files are validated by their actual content rather than their file extension and cannot be executed on the server. Internal files and the database are not reachable from the internet. Guest data is accessible only to hotel staff who need it for their work, under individual accounts.
10. Your rights
You have the right to obtain information about the data we process, to request its correction, restriction or deletion, and to withdraw consent previously given. Some of this data you can view yourself in your personal account. For any other request, write to us at info@hlgroup.uz — we reply within the period set by law. Please note that data required to perform a confirmed booking, or retained under a legal obligation, can only be deleted once the relevant periods have expired.
11. Minors
The site is not intended for independent use by anyone under 18. Bookings are made by an adult; details of children are provided by their legal representative and are used solely to calculate the cost of the stay and prepare the accommodation.
12. Changes to this Policy
We may amend this Policy. The current version, with its update date, is always published on this page. Material changes take effect upon publication.
13. Contacts
For any question relating to the processing of personal data, write to info@hlgroup.uz or call +998 99 889 77 76. Postal address: 3A Rakatboshi St, Yakkasaray district, Tashkent 100100.