Privacy Policy

Personal data collection, use, sharing, retention and User rights

Last updated: 26 August 2026

Version: 2.3

Effective date: upon publication on toybayram.az

TOYBAYRAM - event search platform

Email: [email protected]

Website: toybayram.az

This Privacy Policy sets out how personal data is processed within TOYBAYRAM. It covers Customer and Performer data, Search, Requests, Messages, Booking, Reviews, Verification, Support, technical logs and other Platform functions. TOYBAYRAM does not sell personal data and, under the current model, does not process bank-card payment data.

Core principles

Only data reasonably necessary for disclosed and lawful purposes is collected.

Public Performer information is separated from private contact, Verification and internal data.

Private Messages are not public and are accessed only as necessary for the feature, support, safety and law.

TOYBAYRAM does not sell personal data or provide advertisers with private communications.

Cross-border transfers are made only in accordance with Azerbaijani legal requirements.

Users have rights of access and correction and, where provided by law, destruction, cessation of processing and objection.

Contents

General Provisions1-8

Personal Data We Collect9-23

How and Why We Use Data24-37

Who May Receive or See Data38-47

Retention and Security48-54

User Rights55-61

Additional Provisions62-67

I. GENERAL PROVISIONS

1.Purpose of this Policy

This Privacy Policy explains what personal data TOYBAYRAM may collect and process, the purposes for which it is used, who may receive it, how it is protected and what rights a personal data subject has.

2.Owner/operator and contact details

For purposes of this Policy, TOYBAYRAM acts as the owner and/or operator of personal data to the extent it determines the purposes and methods of processing the relevant information. Privacy contact: [email protected]. Website: toybayram.az.

3.Scope

This Policy applies to toybayram.az, its mobile web experience, Customer and Performer accounts, Search, Requests, Messages, Booking workflow, Reviews, Verification, Notifications, Support and other TOYBAYRAM features.

4.Relationship with other documents

This Policy applies together with the Terms of Use, Customer Terms & Booking Conditions, Performer Terms & Service Provider Agreement, Booking Agreement, Cancellation Policy, Verification Policy, Reviews & Community Policy and Cookie Policy.

5.Core processing principles

TOYBAYRAM seeks to collect only data reasonably necessary for specified and lawful purposes, maintain accuracy, restrict access, provide reasonable security and stop retaining data when the processing purpose and lawful need for retention no longer exist.

6.Legal Basis and Separate Data-subject Consent

TOYBAYRAM processes personal data only where a basis permitted by the laws of the Republic of Azerbaijan exists. Where the law requires data-subject consent, the Privacy Policy is an information document and does not replace the separate consent form.

Separate consent is obtained before the relevant processing in a written or electronic form meeting legal requirements and must contain at least: information identifying the data subject; information identifying the owner/operator; the collection and processing purpose; the list of personal data; the processing operations; the consent term and withdrawal conditions; deletion or archiving conditions after the retention period; and other mandatory information.

TOYBAYRAM retains evidence of consent including User identifier, date and time, IP address, consent-text version and selected actions/categories. Personal-data consent and marketing consent, where required, are obtained separately.

Where applicable law expressly permits processing without consent in a specific case, TOYBAYRAM may rely on that lawful exception only within its statutory scope.

7.No sale of personal data

TOYBAYRAM does not sell Users' personal data to advertisers, data brokers or other third parties for their independent commercial use.

8.Current no-payment model

TOYBAYRAM does not process bank card data, CVV, full payment credentials or payments between Customers and Performers under the current Platform model. If integrated payment functionality is introduced in the future, the relevant processing will be separately disclosed before launch.

II. PERSONAL DATA WE COLLECT

9.Registration and account data

When an account is created, TOYBAYRAM may collect name, surname, email, phone number, a securely stored password representation or external login-provider identifier, selected language, account settings and other necessary registration information.

10.Customer profile data

For Customers, TOYBAYRAM may process name or display name, profile image, contact information, language, favorites, Requests, Events, Messages, Reviews, Notifications and settings.

11.Performer profile data

For Performers, TOYBAYRAM may process name or stage name, profile image, bio, category, experience, languages, Base Location, Travel / Service Area, services, prices, duration, equipment, media, Availability, rating, Reviews and other information a Performer publishes to present services.

12.Search data

TOYBAYRAM may process selected Event date, city, Event type, categories, budget, filters, time range, search queries, saved profiles and interactions with search results.

13.Event, Request and Booking data

For a Request and Booking, TOYBAYRAM may process Event type, date, time, venue, city, guest count, selected service, technical requirements, additional notes, agreed price, Travel terms, statuses, Change Requests, confirmations and Agreement version history.

14.Messages and communications

Messages between a Customer and Performer form part of Platform functionality and may be stored by TOYBAYRAM to deliver messages, preserve Booking history, maintain safety, review complaints and comply with lawful requirements. Access to message content is limited to the participants and authorized persons or providers where access is justified by support, safety, moderation or law.

15.Reviews and Community Content

TOYBAYRAM may process rating, Review text, Performer Responses, publication date, the link to a Completed Booking, content reports and moderation outcomes.

16.Verification data

Depending on the Verification level, TOYBAYRAM may process name, date of birth, age confirmation, contact information, identity-document details, a copy or image of an identity document, photograph or selfie, verification results and audit trail.

17.Biometric and Special-category Data

TOYBAYRAM does not seek to collect special-category or biometric data without objective necessity.

Automated face matching, a liveness check or another process creating or using a biometric identifier is not introduced before a separate risk assessment, identification of a lawful basis, documentation of security controls and obtaining separate explicit consent where required by law.

General acceptance of the Platform, Privacy Policy or ordinary Identity Verification is not treated as consent to biometric processing where a special legal regime applies. If biometric functionality has not actually been implemented, TOYBAYRAM does not represent it as active.

18.Google or other external sign-in

If a User chooses Google sign-in or another supported provider, TOYBAYRAM may receive, within the permissions granted, the provider account identifier, name, email, profile image and other expressly authorized data. TOYBAYRAM does not receive the User's password for that external account.

19.Technical data

When the Platform is used, TOYBAYRAM may automatically collect IP address, browser type, device type, operating system, language settings, access date and time, pages and features used, technical errors, session identifiers and security logs.

20.Cookies and similar technologies

TOYBAYRAM may use cookies, local storage and similar technologies for authentication, security, preference storage, analytics and site improvement. Detailed rules, including management of non-essential cookies, are set out in the separate Cookie Policy.

21.Support and complaints

When a User contacts Support or submits a complaint, TOYBAYRAM may process the content of the request, contact information, attachments, Booking connection, technical information and case history.

22.Data from other Users

TOYBAYRAM may receive information about a User from the other party to a Booking, for example through a Request, Message, complaint, Review or No-Show report. That information is used only for the relevant feature, safety, moderation and other disclosed purposes.

23.Public sources

For Verification or profile-accuracy review, TOYBAYRAM may consider publicly available professional pages, websites, social links and open sources to the extent necessary for the relevant purpose.

III. HOW AND WHY WE USE DATA

24.Account creation and management

Data is used for registration, login, account recovery, Customer or Performer role setup, profile management, language and other User settings.

25.Search and matching

Event and Performer profile data is used to produce Search results and filter by date, city, category, Availability, Base Location, Travel / Service Area and other selected parameters.

26.Requests, Booking and Agreement

Data is used to send Requests, discuss terms, generate the Booking Agreement, record mutual confirmation, process Change Requests, preserve status history and display Events in the relevant accounts.

27.Communications

Contact and communication data is used for Messages and notifications relating to Requests, Meetings, Agreements, Bookings, Changes, Cancellations, Reviews and other service events.

28.Verification and trust

Verification data is used to confirm selected information, reduce fraud and impersonation, grant or remove Verified status and protect Platform integrity.

29.Reviews and ratings

Completed Booking data is used to determine eligibility to submit a Review, calculate ratings, publish compliant content and prevent fake reviews and rating manipulation.

30.Security and fraud prevention

TOYBAYRAM may use account data, logs, verification signals, complaints, Booking history and other available information to detect unauthorized access, fraud, impersonation, spam, abuse, No-Show patterns and sanction evasion.

31.Support and troubleshooting

Data is used to respond to requests, restore access, investigate errors, diagnose problems and provide User support.

32.Moderation and rule enforcement

TOYBAYRAM may use User Content, Messages to the extent necessary, complaints, Booking records and technical data to assess compliance with Terms, Community Rules and Verification Policy and to apply account measures.

33.Service notifications

TOYBAYRAM may send necessary notifications regarding accounts, security, Requests, Messages, Meetings, Bookings, Change Requests, Cancellations, Verification and other Platform functions.

34.Marketing Communications and Separate Opt-in

Marketing communications are sent only after separate prior User consent where such consent is required by applicable law. A separate unticked checkbox or another explicit affirmative action is used; marketing consent is not a condition of registration, Booking or use of core functions.

Each electronic marketing message provides a simple and accessible opt-out mechanism. Withdrawal of marketing consent operates prospectively and does not stop mandatory service notices.

35.Analytics and product development

TOYBAYRAM may analyze feature usage, search journeys, errors and aggregated metrics to improve interface, Search, reliability and Platform development. Data may be anonymized for statistical research where possible and required.

36.Legal compliance and protection of rights

Data may be used to respond to lawful government requirements, maintain required audit records, protect security, prevent violations, establish, exercise or defend legal claims and comply with mandatory legal obligations.

37.Automated sorting and ranking

TOYBAYRAM may automatically sort or rank Search results using Event relevance, Availability, Base Location, Travel / Service Area, rating, profile completeness and other product factors. Such ranking does not itself create a Booking, contract or legal obligation between Users.

IV. WHO MAY RECEIVE OR SEE DATA

38.Sharing between Customers and Performers

To arrange an Event, TOYBAYRAM makes necessary information about the parties and Booking available to the Customer and Performer. The amount of visible information depends on the interaction stage and should be limited to what is reasonably necessary for Search, Request, communication and performance of the direct Booking Agreement.

39.Public Performer profile

A public Performer profile may be visible to registered and unregistered visitors and, where technically enabled, indexed by search engines. Public information may include stage name or name, image, bio, category, services, Base Location, Travel / Service Area, prices, media, rating and Reviews. Private contact details, Verification data and internal data are not publicly displayed unless the User separately makes them public.

40.Public Reviews

A published Review and compliant Performer Response may be visible to other visitors together with the display name or other author identifier provided by the interface. TOYBAYRAM should not publicly disclose Review information that violates the Community Policy.

41.Service Providers and Processor Register

TOYBAYRAM may use hosting, cloud, email, notification, analytics, security, customer support, verification, authentication and other technical providers only to the extent necessary for the relevant function and subject to applicable contractual and legal requirements.

Before commercial use of each external provider, TOYBAYRAM must include it in an up-to-date Processor & Cross-Border Transfer Register stating the provider, function, data categories, country/location of processing to the extent available, and legal basis for transfer. A provider must not be used for an undisclosed purpose.

At the current stage, known external services include Google sign-in and the Google/Gmail email service used by TOYBAYRAM; any hosting, analytics, verification, notification or other providers must be added to the register before actual use.

42.External sign-in providers

When Google sign-in or another external login is used, certain information is exchanged between TOYBAYRAM and the provider to the extent necessary for authentication and according to permissions selected by the User.

43.Public authorities and lawful requests

TOYBAYRAM may provide data to a court, law-enforcement, regulatory or other competent authority where disclosure is required by applicable law, a binding decision or a valid lawful request.

44.Protection of life, safety and rights

Where permitted by law, data may be disclosed where necessary to protect life and health, prevent serious harm, investigate fraud or protect the lawful rights of TOYBAYRAM, Users or third parties.

45.Business reorganization

In a reorganization, merger, transfer of business or assets, personal data may be transferred to a successor to the extent permitted by law, subject to continuing applicable confidentiality obligations and notice where required.

46.No advertiser access to private messages

TOYBAYRAM does not provide advertisers access to private Customer-Performer Messages for their independent advertising targeting and does not sell the content of private communications.

47.Cross-border Transfer and Register

Cross-border transfer of personal data takes place only in compliance with the laws of the Republic of Azerbaijan. Where transfer to a jurisdiction requires an additional lawful basis, TOYBAYRAM obtains required consent or uses another basis expressly permitted by law before transfer.

TOYBAYRAM maintains an up-to-date Processor & Cross-Border Transfer Register containing provider, function, data categories, available country/location information and transfer basis. The register must be updated before a new provider affecting cross-border processing is connected.

Organizational and contractual safeguards supplement but do not replace consent or another mandatory legal basis where the law expressly requires it.

V. RETENTION AND SECURITY

48.General retention principle

TOYBAYRAM retains personal data no longer than reasonably necessary for the disclosed purpose, security, fraud prevention, dispute handling, contractual obligations and legal requirements. When the purpose and need for retention end, data is deleted, destroyed or anonymized in accordance with applicable requirements.

49.Indicative retention periods

Unless a longer period is required by law, a dispute or security need, TOYBAYRAM generally uses the following periods: active account and profile data - while the account remains active and up to 3 years after closure; Booking Agreements, Change Requests and key audit records - up to 5 years after completion or cancellation of the Booking; Booking-related Messages - up to 3 years after the last relevant activity; security logs - generally up to 12 months; Verification documents - only for the period necessary to complete the check and generally no more than 90 days after completion unless a longer period is justified; Verification result and audit trail - up to 3 years after account closure; Support and complaints - up to 3 years after the matter is closed.

50.Account deletion

A User may request account deletion. TOYBAYRAM will delete or anonymize data that is no longer needed, but certain records may be retained for the applicable period for fraud prevention, safety, existing Bookings, claims, audit trail and legal compliance.

51.Backups

Data deleted from active systems may remain temporarily in protected backup copies until scheduled overwrite or deletion. Backups are not used for ordinary operational purposes except recovery following a technical incident.

52.Security measures

TOYBAYRAM applies reasonable technical and organizational measures designed to protect against unauthorized access, accidental destruction, loss, alteration and unlawful disclosure, including access management, security logging, account protection and other measures appropriate to risk and technical capabilities.

53.Restricted staff and provider access

Access to personal data is provided only to authorized persons and providers who need it to perform the relevant function and are subject to confidentiality and security obligations.

54.Security incidents

When an incident is identified, TOYBAYRAM takes reasonable measures to contain, investigate and mitigate it and provides notice to Users or competent authorities where and in the manner required by applicable law.

VI. USER RIGHTS

55.Right to information and access

A User may request information about the existence of the User's personal data, purposes and duration of processing, sources, persons or systems to which data may be disclosed, and may access data relating to that User to the extent provided by law.

56.Correction

A User may request clarification or correction of inaccurate, incomplete or outdated personal data. Some information may be changed directly in Profile or Settings.

57.Deletion and cessation of processing

Where provided by law, a User may request destruction of personal data or cessation of collection and processing. A request may be limited where retention or processing is legally required or necessary for an existing Booking, security, handling a lawful claim or another purpose permitted by law.

58.Objection and withdrawal of consent

Where processing is based on consent or applicable law provides a right to object, a User may withdraw consent or request that the relevant processing stop. Withdrawal operates prospectively and does not make prior processing unlawful where it was carried out on a valid basis.

59.How to submit a request

A personal-data request may be sent to [email protected]. To protect data, TOYBAYRAM may request identity confirmation and information necessary to identify the relevant account and request.

60.Response time

Requests are handled within the periods required by the laws of the Republic of Azerbaijan. Where the Law on Personal Data applies, a response to a data-subject request is provided no later than 7 business days after receipt; where consultation with a third party is necessary, the period may be extended by up to a further 7 business days. Where a request is lawfully refused, a reasoned response is provided within the period required by law.

61.Complaint

If a User believes personal-data rights have been violated, the User may contact TOYBAYRAM and may also exercise any right to complain to the competent public authority or court in accordance with applicable law.

VII. ADDITIONAL PROVISIONS

62.Users under 18

TOYBAYRAM is not intended for independent creation of a Customer or Performer account by persons under 18. If the Platform receives reliable information about such an account, it may restrict the account and take steps to delete or otherwise lawfully process the relevant data.

63.Third-party websites and services

The Platform may contain links to third-party websites or use external services. Their independent data processing is governed by their own privacy policies; TOYBAYRAM does not control the independent acts of such third parties.

64.State Registration of the Personal-data System and Other Mandatory Procedures

TOYBAYRAM must determine whether the personal-data information system in use is subject to state registration or another mandatory procedure under the laws of the Republic of Azerbaijan.

Where registration is mandatory, it must be completed before processing at a scale or in circumstances for which the law requires a registered system, and the assigned registration number must be inserted in applicable public documents and the internal register. Where a lawful exemption applies, TOYBAYRAM retains documented grounds for that exemption.

This clause is not a substitute for state registration and must not be read as a statement that a registration number has been assigned before it is actually obtained.

65.Changes to this Policy and Renewed Consent

TOYBAYRAM may update this Policy when features, data categories, providers, security requirements or law change.

Where a change materially affects the purpose, data list, processing operations, duration or another element of previously obtained consent, TOYBAYRAM obtains renewed consent before processing under the new conditions where required by law. Material changes are published and communicated to Users in a reasonable manner.

66.Language Versions

This Policy is published in Azerbaijani, Russian and English. In the event of any discrepancy between language versions, the Azerbaijani version has prevailing legal force.

This provision does not restrict data-subject or consumer rights that cannot lawfully be limited by agreement under mandatory law.

67.Privacy Contact, Requests and Pre-action Claims

TOYBAYRAM — event search platform. Email: [email protected]. Website: toybayram.az.

Data-subject requests are sent to the stated email and handled within the periods set out in this Policy and applicable law. TOYBAYRAM may reasonably verify the identity of the requester to protect personal data.

Where a claim concerns TOYBAYRAM's own conduct and is not an ordinary data-subject request, a User may send a written pre-action claim to the same address; TOYBAYRAM aims to respond within 15 business days. Any right to contact a competent public authority or court remains unaffected.