Edition 1.0 of 15 November 2026. Effective 15 November 2026. Original language: Russian. This is the English version; in case of discrepancy the Russian version prevails.
1. Who is responsible for your data
1.1 The personal data operator (the “controller” in GDPR terms) is Mezon Central, Inc., a Delaware corporation, USA (file no. 10745320), registered office: 16192 Coastal Highway, Lewes, Delaware 19958, USA; mailing address: 300 New Jersey Avenue NW, Suite 300, Washington, DC 20001, USA. Email for personal data matters: [email protected]. The Operator designates a person responsible for the processing and protection of personal data; requests to that person are sent to this address.
1.2 This Policy explains what data about you we receive when you use the website https://www.mezon.media (the “Website”), why and on what basis we use it, to whom we disclose it, how long we keep it and how you can exercise your rights. It applies to all readers regardless of their country of residence.
1.3 We aim to comply with the personal data protection laws of the countries where our readers live, in particular Uzbekistan, Kazakhstan and Kyrgyzstan, and with generally accepted data protection principles: lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality. Provisions specific to readers in particular countries are set out in section 9.
2. What data we receive
2.1 When you visit the Website. Technical data transmitted by your browser: IP address, type and version of browser and operating system, language, address of the requested page, date and time of the request, and the address of the page you came from. It is recorded in the hosting provider’s server logs and passes through Cloudflare’s global network, including outside the EU; the Website’s protection tools (Wordfence) may process IP addresses and request details to detect attacks.
2.2 When you use search. The search query is transmitted in the page address and may be stored in server logs. We have no reader profiles and do not link queries to a specific person.
2.3 Forms. The Website has a contact form and a correction request form. We receive your name (if you give it), email address and message text. The forms do not accept attachments. Form submissions are sent to the editorial team’s email and are not stored in the Website database.
2.4 Email. If you write to addresses in the mezon.media domain, we receive your email address, the content of your message and attachments. Email is hosted in Google Workspace.
2.5 Analytics and ad measurement (only with your consent). Google Analytics 4 and Google Tag Manager show us visit statistics; Meta Pixel measures the effectiveness of promoting the publication on Meta. They collect IP address, device and browser details, pages viewed, referral source and on-page actions, and cookie identifiers. Without your consent these services are not loaded and their cookies are not set. Google Search Console shows us aggregated search query data and does not set cookies on the Website.
2.6 Embedded elements (only with your consent). Some Materials contain elements of third-party services (Flourish, YouTube). After you consent, these services receive your IP address and device details and may set their own cookies.
2.6a Newsletter (from 15 November 2026). If you subscribe to the newsletter, we receive your email address and details of the subscription confirmation (date, IP address, time). The newsletter is operated by beehiiv (USA): the Website contains a link to the subscription page, you enter your address on the beehiiv site, and the subscriber database is held by beehiiv, not on the Website. A subscription takes effect after you confirm it via a link in an email; every email contains an unsubscribe link. The service may record email opens and link clicks for newsletter statistics.
2.7 Social networks and messengers. If you write to us or interact with our pages on third-party platforms, that data is processed by the platform owners under their rules, and we receive what you send us.
2.8 Information about people in the Materials. In connection with our journalistic activity we may process information about people mentioned in publications, from open sources, documents, interviews and enquiries. This processing is described in section 8.
2.9 What we do not do. The Website has no accounts, comments or payments. We do not sell personal data and do not require registration to read. We do not process special categories of readers’ personal data and do not ask you to provide them. If you volunteer such information in an email or form, we use it only to reply to you. If we launch new features (comments, paid subscription), we will update this Policy and ask for consent where required.
3. Purposes and legal bases
| Purpose | Data | Basis |
|---|---|---|
| Operation and security of the Website, protection against attacks, fixing failures | Technical data (2.1, 2.2) | Legitimate interest in the secure and stable operation of the Website; compliance with the duty to protect information |
| Replying to enquiries, corrections, verification of information | Form and email data (2.3, 2.4) | Your consent, given by sending the enquiry; legitimate interest in journalistic verification and replying |
| Newsletter | Email address and subscription data (2.6a) | Your consent (subscription confirmation) |
| Visit statistics | Analytics data (2.5) | Your consent |
| Measuring the effectiveness of promoting the publication | Meta Pixel data (2.5) | Your consent |
| Loading embedded graphics and video | Embedded element data (2.6) | Your consent |
| Journalistic activity | Information about people in the Materials (2.8) | Purposes of public significance and legitimate interest in informing the public within the limits permitted by law; in some cases, your consent |
| Compliance with law, defence against claims and exercise of the Operator’s rights | Any data from section 2 to the extent necessary | Compliance with legal obligations; legitimate interest |
3.1 We use data only for the stated purposes. If we wish to use data for a new purpose, we will ask for your consent or otherwise meet the requirements of the law.
4. Consent
4.1 You give consent to the processing of optional data by an active step: clicking a button in the cookie banner, ticking a box in a form or sending an enquiry. We record the fact, date and content of consent so that we can demonstrate it on request.
4.2 Consent is voluntary, specific and informed. Refusing optional cookies does not restrict access to the Materials. You can withdraw consent at any time in the same way it was given (the “Cookie settings” button at the bottom of every page) or in writing, including by email to [email protected]. Withdrawal does not affect the lawfulness of processing before withdrawal.
4.3 If you submit a form, you also agree that your data will be transferred outside your country on the terms of section 6.
5. To whom we disclose data
5.1 Data is processed by the Operator and by providers acting on our instructions and only for the stated purposes. Data processing agreements have been concluded or accepted with providers. We do not sell data and do not disclose it to advertising brokers.
| Provider | Purpose | Data | Where processed |
|---|---|---|---|
| Cloudways (DigitalOcean, LLC, USA) | Website hosting | Technical data | Servers in Frankfurt am Main (Germany, EU); group company in the USA |
| Cloudflare, Inc. (USA) | Protection against attacks, content delivery (CDN) | Technical data | Cloudflare’s global network, including outside the EU |
| Wordfence (Defiant Inc., USA) | Protection of the Website against attacks | IP addresses, request details | USA |
| Google (Workspace) | Messages and attachments | USA, EU and other countries | |
| Google (Analytics 4, Tag Manager) — only with consent | Visit statistics | Analytics data | USA, EU and other countries |
| Meta Platforms (Meta Pixel) — only with consent | Ad measurement | Pixel data | USA, EU and other countries |
| Flourish; Google (YouTube) — only with consent | Embedded graphics and video | IP address, device data | Countries where these services are hosted |
| beehiiv (USA) | Newsletter | Email address, subscription data | USA |
5.2 We may disclose data to public authorities, courts and other persons only where required by law or necessary to protect rights and safety. We assess the lawfulness and proportionality of each request, refuse unfounded requests and seek to protect the confidentiality of journalistic sources.
5.3 In a reorganisation or transfer of the Operator’s assets, data may pass to the successor on the same terms; we will announce this on the Website.
6. Transfer of data abroad
6.1 The Website’s files and database are hosted on a server in Germany. Some data is processed by providers outside Germany and the European Union, including in the USA. The Operator is located in the USA.
6.2 Readers in Uzbekistan. We do not process biometric or genetic data or data of users of local telecom operators’ services that the law requires to be stored in Uzbekistan. Other data is transferred abroad on the grounds established by the legislation of Uzbekistan. Germany is included in the list of foreign states ensuring adequate protection of personal data (Resolution of the Cabinet of Ministers of 29 July 2026 No. 415); the USA is included for companies participating in the EU-US Data Privacy Framework. Subscribing to the newsletter involves transfer of your address to beehiiv in the USA on the basis of your consent given when you subscribe. Data is transferred to states not on the list only if the conditions established by law are met (including on the basis of your consent and information about the transfer) and measures are taken to prevent data leakage.
6.3 Readers in Kazakhstan and Kyrgyzstan. We do not host databases in Kazakhstan or Kyrgyzstan. Data is transferred abroad with your consent and for the purposes stated in this Policy, and in other cases permitted by law.
6.4 Readers in Tajikistan, Turkmenistan and other countries. Data is transferred abroad with your consent and for the purposes stated in this Policy, or in other cases permitted by law.
6.5 Readers in the European Union, the European Economic Area and the United Kingdom. Data is transferred outside them to companies participating in the EU-US Data Privacy Framework (European Commission adequacy decision) and in other cases on the basis of the European Commission’s standard contractual clauses or other mechanisms provided for by the GDPR. You may request a copy of the safeguards at [email protected].
6.6 We take measures to ensure that data is protected in transit (encryption, access restriction, contractual obligations of recipients).
7. Retention periods
| Data | Retention period |
|---|---|
| Server (operational) logs | 30 days |
| Website backups | 28 days |
| Website management system audit log | 365 days |
| Form enquiries and email (they arrive in the editorial team’s mailbox) | 12 months from the date of the last message |
| Correspondence on corrections, complaints and legal claims | 3 years from the date the matter is closed — for the limitation period and to defend against claims |
| Newsletter subscribers | Until unsubscription; unconfirmed subscriptions are deleted after 30 days |
| Google Analytics 4 data | 2 months |
| Cookies | Periods are stated in the Cookie Policy |
| Records of your consents and withdrawals | 24 months from the date of the record — to demonstrate the lawfulness of processing |
| Materials of journalistic investigations and information used for verification | For as long as necessary for verification, defence against claims and compliance with law |
7.1 When the period expires, data is deleted or anonymised unless the law requires it to be kept longer. Backups are overwritten within the stated period.
8. Journalism and sources
8.1 The editorial team may process information about people without their consent where necessary for journalistic activity and to inform the public about events of public significance, subject to respect for the right to private life. We do not publish information about a person’s private life without their consent except where justified by the public interest or permitted by law. We minimise personal data from leaks and closed databases and do not reproduce it unnecessarily.
8.2 We do not disclose the identities of minors who are victims of unlawful acts or suspected of offences, except in cases expressly permitted by law.
8.3 Information that sources give to the editorial team is protected as journalistic confidential information to the extent the law permits. We do not promise absolute protection: if you are providing information the disclosure of which could harm you or others, write to [email protected] with the subject “Secure channel”, and we will tell you a safe way to communicate. The contact form and ordinary email are not secure or anonymous channels.
8.4 If you believe a publication contains inaccurate information about you or violates your rights, use the procedure described in “Editorial Standards, Corrections and Right of Reply” ([email protected]). Rights in respect of published materials are exercised with regard to freedom of expression and the public interest.
9. Your rights
9.1 Depending on the law that applies to you, you have the right to: know whether we process your data and obtain confirmation; obtain information on the grounds and purposes of processing, the methods used, the composition of the data and its source, the persons with access to it, the periods of processing and storage, our name and mailing address, the procedure for exercising your rights and cross-border transfer; obtain a copy of the data; require specification, completion and correction of the data; require temporary suspension of processing if the data is incomplete, outdated, inaccurate, unlawfully obtained or not needed for the purposes of processing; require deletion or destruction of the data; object to processing based on legitimate interest; restrict processing; receive the data in a portable form; withdraw consent; not be subject to a decision based solely on automated processing that produces legal effects for you (we take no such decisions); and lodge a complaint with the personal data protection authority of your country or with a court.
9.2 To exercise your rights, write to [email protected] in Russian, Uzbek or English. We may ask you to confirm your identity so as not to disclose data to a stranger. We will reply without undue delay and no later than 30 days from receipt of the request, or sooner if the law sets a shorter period. If the request is complex, we may extend the period where the law permits and will tell you the reasons. Handling requests is free, except for manifestly unfounded and repetitive requests.
9.3 We will notify you in writing of changes to or destruction of data and restriction of access to it, and of disclosure of your data to a third party, in cases where the law requires such notification.
9.4 Special rules for certain countries. Readers in Uzbekistan may apply to the authorised state body of Uzbekistan for personal data or to a court; readers in the EU, EEA and the United Kingdom may apply to the data protection supervisory authority of their place of residence or work or the place of the alleged violation; readers in other countries may apply to the competent authority of their country. This does not deprive you of the right to contact us directly.
10. Security and incidents
10.1 We apply reasonable organisational and technical safeguards: connection encryption (HTTPS), Cloudflare protection, two-factor authentication for staff, daily backups, restricted and logged access, and regular software updates. No transmission of data over the internet is completely secure.
10.2 If a data breach affecting your rights occurs, we will notify you and the competent authorities without undue delay and within the periods established by applicable law. If an incident occurs during cross-border transfer of data of readers in Uzbekistan, we will notify the authorised body within 24 hours of discovery and within 72 hours provide detailed information on the causes and the measures taken.
11. Children
11.1 The Website is intended for readers aged 16 and over. We knowingly do not collect children’s data. If you are under 18, do not send us personal data without the consent of your parents or legal representatives, as the law of several countries requires. If you believe a child has sent us personal data, write to [email protected] and we will delete it.
12. Third-party resources
12.1 The “Share” buttons (Telegram, WhatsApp, Facebook) are ordinary links without tracking scripts. Data is transferred to these services only after you follow the link. Data processing on third-party resources is governed by their own policies.
13. Changes to this Policy
13.1 We publish a new edition with its number and effective date and announce material changes on the home page. If changes require your consent, we will ask for it again. We keep previous editions and provide them on request.
14. Contacts
| Subject | Address |
|---|---|
| Personal data, exercising rights | [email protected] |
| Corrections and right of reply | [email protected] |
| Legal questions | [email protected] |
| Mailing address | Mezon Central, Inc., 300 New Jersey Avenue NW, Suite 300, Washington, DC 20001, USA |
| Registered office | Mezon Central, Inc., 16192 Coastal Highway, Lewes, Delaware 19958, USA |