Data processing agreement (template)
DRAFT — not reviewed by a lawyer. This text is a draft prepared by the URLY team. A lawyer in Uzbekistan has not reviewed it yet, and it is not legal advice. Until reviewed it creates no obligations beyond those that follow directly from the law. The final version will be published before the commercial launch. In case of discrepancies, the Uzbek and Russian versions prevail.
Draft version of 14.10.2026. The operator's details will be given in the final version. Questions passed to the lawyer: L-01, L-12, L-13, L-16, L-18
Roles
The customer (operator / data owner) instructs URLY (the processor) to process data about visits to the customer's links. The agreement is part of the offer for paid plans and is signed in writing on request.
Subject and categories
Visit events are processed: time, source domain, device class, OS and browser family, country code, UTM tags, bot flag. Data subjects are visitors of the customer's short links. IP addresses and full User-Agents are not stored.
Purposes
Data is processed only to run redirects, compute statistics for the customer, protect against abuse and meet legal requirements. Profiling visitors and selling data are not allowed.
Instructions and confidentiality
URLY acts only on the customer's documented instructions, including service settings. Staff access is restricted and staff are bound by confidentiality.
Security
Encrypted connections (TLS), access separation between workspaces, hashed secrets, an audit log and encrypted backups are used.
Subprocessors
The list of subprocessors (hosting, backup storage) will be attached to the agreement. The customer is notified 30 days before a subprocessor changes and may object.
Assistance and incidents
URLY helps the customer answer data subject requests. URLY reports an incident to the customer without undue delay so that the customer can meet the legal deadlines (24 hours to notify and 72 hours to report under Resolution No. 415).
Term, deletion and audit
When the agreement ends, data is deleted within 30 days and backups when their retention ends. On request URLY provides the information needed to verify compliance with the agreement.
Questions about these documents: legal@urly.uz. Complaints about links: Report abuse