Legal documentsChoose another document
§ 1–18Contents
- 1.Subject
- 2.Definitions
- 3.Scope of use
- 4.Issuing a Key
- 5.Scopes and tiers
- 6.Expiry and renewal
- 7.Protecting the Key — the Seller's duty
- 8.An action through a Key is the Seller's own act
- 9.The Integrator acts as the Seller's agent
- 10.Recording a third-party data recipient
- 11.Buyers' personal data
- 12.The Operator's right to set limits
- 13.The Operator's right to suspend
- 14.The Operator's right to revoke and to review
- 15.Availability
- 16.Changes to the API and versioning
- 17.Liability
- 18.Term, amendment, and subordination to the Agreement
This annex (Annex 2) forms an integral part of Dona's Seller Services Agreement (the Offer) and governs a Seller's use of automated access to the Platform through the API and the MCP door. This Annex applies only to Sellers who create or use at least one Key.
1. Subject
This Annex governs a Seller's management of its shop through the application programming interface (API) and the MCP door (an automated access channel for AI agents) provided by the Operator, including the issuance of Keys, their use, and liability for actions performed through them.
2. Definitions
API means the programmatic interface published by the Operator (api.dona.im/seller-api); MCP door means a separate access channel for AI agents that uses the same Keys; Key means a unique digital credential created in the Seller Dashboard that grants access to the API or the MCP door; scope means a specific set of permissions assigned to one Key; Integrator means a third party or software engaged or chosen by the Seller that acts on the Seller's behalf using a Key.
3. Scope of use
The API and the MCP door are for managing the product catalogue, prices and stock, processing orders, and retrieving reporting data. Withdrawing funds, refunding payments, accepting the Agreement or its annexes, and changing KYC or bank details are not performed through a Key and remain acts the Seller performs itself in the Seller Dashboard.
4. Issuing a Key
A Key may be created only by the shop's owner; a staff member or a person acting under a delegated (act-as) session may not create one. Each Key is limited to specific scopes and operates under the conditions stated in the Operator's technical documentation.
5. Scopes and tiers
A Key's authority is limited to the scopes assigned to it. The full list of scopes, their meaning, and the conditions attached to them (including which actions require a given level of Seller verification — KYC and documents status) are published in the Operator's technical documentation (dona.uz/developers) and may be updated without amending this Annex, as they are technical detail and do not change the substance of the Agreement's terms.
6. Expiry and renewal
Every Key has its own expiry date, after which it automatically stops working. The Seller may renew (rotate) or revoke a Key at any time; a new Key carries the same scopes as the one it replaces.
7. Protecting the Key — the Seller's duty
A Key is confidential and is treated as equivalent to the Seller's password. The Seller must keep a Key secret from third parties (other than an Integrator, under clause 9), must not place it in a public repository, a shared channel, or an unsecured system, and must not use a Key issued for one shop in another shop. If the Seller suspects a Key has leaked, it must revoke or renew it immediately.
8. An action through a Key is the Seller's own act
Any request or action performed using a Key — whoever in fact carried it out, whether the Seller itself, its staff, or its Integrator — is recognised as the Seller's own act and carries the corresponding legal consequences for the Operator. The Operator is under no duty to verify the identity of whoever actually used the Key.
9. The Integrator acts as the Seller's agent
A Seller may choose to use a third-party service (an Integrator) to use the API or the MCP door. In that case the Integrator is treated as the Seller's agent, and the Seller remains fully responsible for ensuring the Integrator complies with this Annex and the Agreement. Any act or omission of the Integrator is deemed to be the Seller's own.
10. Recording a third-party data recipient
If a Seller issues an Integrator a Key with a scope that grants access to a Buyer's personal data (name, phone, address), the Seller must record that Integrator in the Seller Dashboard as a third-party data recipient. This record allows the Operator to meet its statutory obligations, including reporting to the competent government authorities.
11. Buyers' personal data
A Buyer's personal data is provided only through the scope specifically designated for that purpose (pii), and only for the purpose of fulfilling the order. At present this scope is available only on Keys issued directly to the Seller; it is not available on Keys created for an agent or a third-party application. From the moment the data is provided to the Seller through the API, full and sole responsibility for it passes to the Seller: the Seller must use the data solely to fulfil the order, must store, protect, transfer and delete it in accordance with the law of the Republic of Uzbekistan on personal data (ЗРУ-547), and, when transferring it outside the Republic of Uzbekistan, must comply with that law's requirements on cross-border transfer. The Seller processes the data it has received as an independent operator of personal data within the meaning of the law and answers for every person and every system (including its Integrator) to which it passes the data. The Operator has no technical means to see or control how the Seller uses the data once it has been provided and bears no liability for the Seller's processing; the Seller holds the Operator harmless against any claim of a Buyer or a competent government authority arising from that processing.
12. The Operator's right to set limits
The Operator may limit the number of requests, write operations, and concurrent connections for each Key, shop, or the system as a whole. The specific numeric limits are published in the Operator's technical documentation and, being technical detail, may be updated without amending this Annex.
13. The Operator's right to suspend
The Operator may temporarily suspend a Key, or a shop's access to the API/MCP, where: (a) there are reasonable grounds to suspect misuse of a Key (for example, a sharp rise in errors or refusals — an "error storm"); (b) it receives a report that a Key has leaked, or a similar suspicion arises; or (c) the Seller breaches this Annex or the Agreement. The Seller is notified of a suspension through the Dashboard and/or by email.
14. The Operator's right to revoke and to review
The Operator may revoke a Key entirely, temporarily place it in read-only mode, or hold specific write operations for review before they take effect — in particular where it detects an abrupt change capable of damaging the catalogue or pricing. A held write is reviewed by the Seller itself or by Operator staff and is either approved or rejected; it is never applied automatically.
15. Availability
The Operator maintains the API and the MCP door on a reasonable commercial-efforts basis but does not guarantee any specific percentage of uptime. The current state of the service is published on the Operator's status page.
16. Changes to the API and versioning
The API is versioned (for example, v1, v2). When a new version is released, the prior version continues to run in parallel for at least twelve (12) months, unless security or legal requirements dictate otherwise. Advance notice of a retiring capability (Deprecation) and its retirement date (Sunset) are given in the technical documentation and in response headers. Every change is recorded in a public changelog.
17. Liability
The Seller is fully liable for every action performed using any of its Keys, regardless of who in fact carried it out, including actions of its Integrator. The Operator is not liable for loss arising from the Seller's failure to protect a Key or from its misuse. The Operator's liability under this Annex does not exceed the limits set out in the Agreement's general liability section.
18. Term, amendment, and subordination to the Agreement
This Annex remains in effect for as long as the Agreement is in effect. Any amendment to this Annex is announced on the platform at least thirty (30) days before it takes effect (ЗРУ-792, article 13); an amendment does not require re-acceptance of the Agreement's main text. This Annex is an integral part of the Agreement and is subordinate to it: if this Annex conflicts with the main text of the Agreement, the main text of the Agreement prevails.