ISF ad measurement update — 18 September 2026
This update replaces earlier ISF ad measurement wording. When the service is enabled, ISF ad measurement is allowed automatically for verified students entering ISF who have not already chosen No thanks. Existing No thanks choices remain off. SAMI sends Meta one confirmation of ISF entry, a hashed version of the verified phone number and browser information to measure ISF advertising. Hashes are matching identifiers, not anonymous data. The automatic default is recorded separately from a student's explicit choice. Students can choose No thanks using Change ad measurement choice in ISF. This stops unsent reports but cannot recall a report Meta has already received. Portal access is the same either way. General visitor and page-view analytics remain disabled. No advertising cookies or Meta browser pixel are installed; names, documents and study details are not shared. SAMI removes queued matching data after delivery, final failure or expiry and retains the setting and delivery record.
Published version: 10 September 2026.
1. Who is responsible
SAMI-SM MCHJ operates SAMI's websites and portals and is responsible for the personal information it collects and uses for its own services. Contact info@sami.uz, +998 71 208 3222, or Niyozbek Passage 3, 6a, Tashkent 100000, Uzbekistan. Mark a request “Privacy” so it can be routed appropriately.
This notice covers visitors, prospective and registered students, parents and sponsors, event attendees, agents, institutional partners, job applicants, and users of Staff and Admin functions. Employment and institutional arrangements may require additional notices. A university, government body, payment provider or other organisation may separately be responsible for information it receives under its own notice.
2. Information we receive
The information depends on what you do. We do not need every category for every visitor.
- Enquiries and consultations: your contact details, location, preferred language, the help requested, study preferences, booking details and correspondence. If you submit an official SAMI social-media lead form, we receive the answers and campaign/source details through that platform.
- Accounts and verification: name, date of birth where requested, phone, email, country, role, linked organisations or representatives, password verification data, sign-in records and confirmation evidence. Google or Telegram may provide identifiers and profile information when you choose those sign-in methods. A Telegram contact share can provide your confirmed phone number.
- Study and visa cases: education history, qualifications, language results, nationality, passport or identity details, immigration history, sponsor and financial evidence, application choices, offers, decisions, documents, tasks and relevant communications. Only provide health, disability, criminal-record or similarly sensitive information when relevant and specifically requested through an appropriate process.
- Parents and sponsors: identity, relationship or authority, contact details, financial evidence when needed, application approvals and phone-verification evidence. Providing a contact does not give that person general access to your account.
- Orders and payments: service descriptions, accepted quotes, invoices, payee details, transaction references, settlement status, payment evidence, refund requests and correspondence. Payment providers process payment credentials through their own systems. Do not put card security codes or online-banking credentials into SAMI messages or document fields.
- Events and QR workflows: registration details, attendee category, event preferences, eligibility, QR identifier, attendance, scan time, scanner/operator context and authorised sharing requests. Certificates, prize claims or exhibitor participation may need additional details described for that activity.
- Partner and agent work: organisation details, representatives, permissions, linked students, authorised lead information, applications, invoices, commissions and payment details relevant to the relationship.
- Recruitment and employment: CVs, qualifications, recruitment communications and assessments; for staff, relevant contractual, payroll, bank, tax, attendance, leave and employment-administration records. Sensitive employment documents are for the relevant authorised workflow, not the public student catalogue.
- Security and acceptance evidence: IP address, browser or device information, relevant action, time, consent version and language, account and technical records needed to protect and evidence use of the service. Terms acceptance currently records more detailed browser and device metadata than a simple checkbox.
We receive information directly from you and, where authorised or necessary for your case, from a parent, sponsor, agent, institution, payment provider, event operator, employer or other service provider. Tell us if information supplied about you is incorrect or if a representative is no longer authorised.
3. Why we use it
We use relevant information to respond to enquiries, administer accounts, verify contact details, prepare and manage requested applications, provide agreed support, organise events, manage authorised relationships, process payments and refunds, communicate about your case, investigate complaints, and protect the service. Staff information supports recruitment and employment administration.
The basis for processing depends on the activity and applicable law: the permissions requested from you or your authorised representative, steps necessary for a requested or agreed service, and applicable legal duties or other lawful grounds. Registration is not permission to collect any information for any future purpose. Where a particular written or electronic consent is required, we must obtain it in the required form.
If a requested item is necessary for verification, an application or a legal requirement and you do not provide it, the affected action may not be possible. We will explain the relevant dependency. Optional marketing subscriptions are separate from service updates.
4. Profile photos and automated checks
When you upload a profile photo, SAMI sends the image to Amazon Web Services' Rekognition face-detection service to check that it contains a suitable single face. The implemented check detects faces and suitability; it does not compare your face against a facial identity database or decide university or visa eligibility. Staff may review a result, replace an unsuitable image, or help with a correction.
Authorised staff may use a portrait from a passport supplied for your case as your profile photo and may temporarily lock a staff-selected image. Contact us if the image is wrong or you need a review. Your photo may be visible in authorised account, application and attendance workflows. Public use has the separate purpose and scope described below.
Automated validation can be wrong or unavailable. Ask for staff assistance if it prevents an appropriate submission. File checks, role routing, workflow rules and estimates do not replace a university's decision, a visa decision or a person's legal authority. We do not describe these checks as proof that a document or identity is genuine.
5. Who can receive information
Access is limited by purpose and authority, including the following recipients where relevant:
- SAMI staff and authorised administrators who need information for assigned work, support, security, finance, management or legal obligations.
- Your chosen institutions and necessary admissions, pathway or service partners for an authorised application, including overseas recipients.
- A linked parent, agent, partner or organisation member within their approved permissions. Paying a fee or scanning a QR code does not automatically create unrestricted access.
- Event staff and authorised exhibitors for the attendance or sharing purpose explained to you. Partner profile access uses the approved fields and sharing workflow; do not treat a general fair registration as consent to all exhibitors' unrelated marketing.
- Hosting, storage, communication, verification, payment and other technology providers needed to operate the relevant service, described in the Third-Party Services Notice.
- Professional advisers, competent authorities or other recipients where disclosure is required or otherwise lawfully justified, including handling a dispute or security incident.
We do not authorise recipients to use confidential case information merely because they are called a “partner”. Where a recipient acts independently, its own privacy terms and legal duties also apply. Ask us which organisation received your information for a particular application or event.
6. Telegram and managed application email
The Telegram mini-app uses Telegram's signed launch information and, when you agree to share it, verified contact information. SAMI links this to the correct existing role or a new student registration after validation. It does not give an unknown user another person's account simply because they type a matching number. Telegram also handles information under its own terms as the platform through which you connect.
Where enabled for your case, a SAMI-managed application mailbox is administered by authorised SAMI staff. They can read and send relevant messages and attachments; it is not a private personal mailbox. Relevant correspondence may be made available through your portal after staff handling. Do not use it for unrelated personal accounts or private financial communications.
Email, SMS, Telegram and portal notifications may carry registration confirmations, verification steps, payment information, deadlines or service updates. Stopping a marketing subscription does not stop essential messages about work or transactions you requested.
7. Permission for public student material
SAMI uses registration as the point for requesting permission to use your name, profile photograph, accurate study outcome or student story, and a testimonial you provide for public use on SAMI's websites, social-media channels, and promotional or event materials. This permission applies only where the scope is expressly shown and validly accepted, with evidence of the wording and action retained. Until that permission is established, registration alone does not authorise the new public-use scope. A new policy does not create permission retrospectively for an existing account.
This permission does not cover publication of your passport, identity numbers, date of birth, private contact details, application or visa files, financial evidence, payment records, private messages, or a private offer letter. If a public story needs information outside the stated scope, we will seek further permission. We must not invent an endorsement or misleadingly alter your experience.
For a minor, the necessary parent or legal guardian must authorise public use before publication. An application approval or a fair attendance record is not, by itself, permission for a publicity use that was not described.
You may withdraw publication permission by contacting us and identifying the material. We will stop new promotional use and remove material from online channels we control where the withdrawal applies. We will explain any existing printed distribution, independently shared copies, necessary evidence record, or other limit on removal. Withdrawal does not retroactively make an earlier lawful use unlawful, and does not cancel your application or agreed service.
8. Cookies, analytics and external content
Optional website and portal usage analytics are disabled. Accepting service terms does not activate page-view, visitor-profile, click or section-view tracking. Necessary security, consent, application, attendance and transaction records still operate. Hosting and external services may keep their own operational logs.
The Cookie Policy lists necessary login, verification and preference storage and explains removal of old SAMI analytics identifiers. Opening a map, provider page, embedded service or social platform can send connection information to that provider. Its own notice applies to its service; using an external link does not give it access to your entire SAMI record.
9. International processing
Study abroad applications commonly require information to be sent to the destination institution and relevant organisations outside Uzbekistan. Some technology providers also operate internationally. The recipient, purpose, data needed and applicable safeguards must be assessed for the actual service; an application instruction is not unrestricted permission for unrelated overseas storage.
The detailed notice about overseas hosting, storage, backups and AWS profile-photo processing remains pending a data-protection review. SAMI has not yet completed verification of the production locations, provider arrangements and applicable local-storage or overseas-processing requirements. This notice does not represent that those arrangements have been approved or that accepting these terms resolves those requirements. Contact info@sami.uz for information about a particular processing activity or to raise a concern. We will update these details when the review is completed.
10. How long information is kept
Retention depends on why a record is needed, the service status, any applicable recordkeeping duty, and an actual dispute or legal hold. A legal hold should cover the relevant records rather than justify retaining unrelated files indefinitely. Closing an account is different from deleting every linked transaction, application, consent, recipient copy or backup.
We review passports and financial uploads for deletion 12 months after the relevant case closes. We retain a file beyond that review only where it remains needed for another active service, an identified legal duty or an actual dispute, and document the reason. We then delete files no longer needed through the applicable retention process. The 12-month point is a review requirement, not a promise that every file is automatically erased on that date. Minimal payment and acceptance evidence follows a separate retention schedule.
Short-lived verification tokens expire. The current Telegram phone-confirmation proof is valid for up to 24 hours, and a mini-app registration draft is reusable in that browser session for up to one hour. These are technical limits for those particular records, not the retention period for the resulting account or application.
For enquiries, account metadata, accounting and acceptance evidence, event attendance and leads, publication permissions, recruitment and staff records, historic analytics and backups, SAMI is finalising a category-by-category retention schedule. Until a specific period is confirmed, retention is assessed against the purposes and obligations described above; this is not permission for indefinite retention. Contact us for the retention basis of a particular record or to request deletion. The 12-month file review requires case-by-case handling and does not automatically delete records or recipient copies.
11. Your requests and choices
Contact us to ask what information we hold and how it is used; request a copy, correction, restriction or deletion as applicable; question an automated check; withdraw a relevant permission; or report an unauthorised representative or disclosure. We will assess the request under the law that applies, verify identity proportionately, explain any lawful limitation, and meet applicable response requirements.
We may need to retain a limited record despite a deletion request, for example to account for a payment or address an actual legal obligation or claim. We will explain which category and purpose remains. Where consent is the basis for a use, withdrawal stops that use subject to applicable law; a separate lawful basis may still support another necessary activity.
Use only the information needed to identify the account and request. Do not email a full passport or confidential documents unless we have arranged an appropriate verification method. A parent or representative must establish the authority to make a request for another person.
12. Security, complaints and changes
SAMI uses access controls and protected service workflows, but no system can promise absolute security. Tell us immediately about a suspected compromised account, misdirected document or improper access. We will assess and respond to incidents and provide notifications where required.
Use the Complaints Procedure if a privacy concern remains unresolved. You can contact the competent data-protection authority or court without first exhausting SAMI's process. Applicable additional rights are not removed because they are not individually listed here.
We will identify material changes to this notice and seek new permission when the change requires it. The notice is not a means to expand a past consent silently.