x-pay
Documents
Exchange rulesAML / KYCPrivacy PolicyOur partners
Privacy Policy

General Provisions

This document defines the policy of the X-Pay.com website (hereinafter referred to as the Operator) regarding the processing of personal data of the website users and sets out a system of basic principles applied to the processing of personal data. The policy regarding the processing of personal data of the website users (hereinafter referred to as the Policy) has been developed in order to comply with the requirements of the legislation of the Russian Federation containing personal data and identification of users located on the website. The Policy applies to all personal data, which are subject to processing by the Operator. The Policy has been developed in accordance with the Constitution of the Russian Federation, the Civil Code of the Russian Federation, Federal Law of July 27, 2006 No. 152-FZ "On Personal Data" and other current legislation of the Russian Federation in the field of protection of personal data. The policy establishes the procedure for processing personal data of website users: actions for collecting, systematizing, accumulating, storing, clarifying (updating, changing), and destroying personal data. The policy establishes mandatory general requirements and rules for working with all types of information carriers containing personal data of website users for the Operator's employees involved in servicing the website. The Policy does not address issues of ensuring the security of personal data classified in accordance with the established procedure as information constituting a state secret of the Russian Federation.

Terms and Definitions

  • Personal data - any information relating directly or indirectly to a specific or determinable individual (subject of personal data).
  • Operator - a state body, municipal body, legal entity or individual, independently or jointly with other persons organizing and (or) carrying out the processing of personal data, as well as determining the purposes of processing personal data, the composition of personal data subject to processing, actions (operations) performed with personal data.
  • Processing of personal data - any action (operation) or set of actions (operations) performed with the use of automation tools or without the use of such tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.
  • User - a user of the Internet and, in particular, the X-Pay.com website.
  • Automated processing of personal data - processing of personal data using computing equipment.
  • Provision of personal data - actions aimed at disclosing personal data to a specific person or a specific group of persons.
  • Blocking of personal data - temporary cessation of processing of personal data (except for cases where processing is necessary to clarify personal data).
  • Destruction of personal data - actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and/or as a result of which the tangible media of personal data are destroyed.
  • Depersonalization personal data - actions as a result of which it becomes impossible to determine the affiliation of personal data to a specific personal data subject without the use of additional information.
  • receive personal data from personal data subjects and from third parties (persons who are not personal data subjects), while the Operator fulfills the obligations stipulated by Federal Law No. 152-FZ of July 27, 2006 "On Personal Data";
  • independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of the obligations stipulated by the Law on Personal Data and regulatory legal acts adopted in accordance with it, unless otherwise provided by the Law on Personal Data or other federal laws;
  • in the event of withdrawal by the subject of personal data of consent to the processing of personal data, the Operator has the right to continue processing personal data without the consent of the subject of personal data if there are grounds specified in the Law on Personal data.
  • organize the processing of personal data in accordance with the requirements of the Law on Personal Data;
  • respond to requests and inquiries of personal data subjects and their legal representatives in accordance with the requirements of the Law on Personal Data.
  • receive information concerning the processing of his personal data, with the exception of cases provided for by federal laws. Information is provided to the subject of personal data by the Operator in an accessible form, and they should not contain personal data related to other subjects of personal data, except in cases where there are legal grounds for disclosure of such personal data. The list of information and the procedure for obtaining it are established by the Law on Personal Data;
  • require the operator to clarify his personal data, block or destroy them if the personal data are incomplete, outdated, inaccurate, illegally obtained or are not necessary for the stated purpose of processing;
  • other rights provided for in Chapter 3 of the Federal Law of July 27, 2006 No. 152-FZ "On Personal Data".

Basic rights and obligations of the Operator and the Subject of personal data

The Operator has the right to:

  • receive personal data from subjects of personal data and from third parties (persons who are not subjects of personal data), while the Operator performs the duties stipulated by the Federal Law of July 27, 2006 No. 152-FZ "On Personal Data";
  • independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of the duties stipulated by the Law on Personal Data and regulatory legal acts adopted in accordance with it, unless otherwise provided by the Law on Personal Data or other federal laws;
  • in the event of the withdrawal of consent to the processing of personal data by the subject of personal data, the Operator has the right to continue processing personal data without the consent of the subject of personal data if there are grounds specified in the Law on Personal Data.

The Operator is obliged to:

  • organize the processing of personal data in accordance with the requirements of the Law on Personal Data;
  • respond to requests and inquiries of personal data subjects and their legal representatives in accordance with the requirements of the Law on Personal Data.

The personal data subject has the right:

  • to receive information concerning the processing of his personal data, except for cases stipulated by federal laws. Information is provided to the personal data subject by the Operator in an accessible form, and it should not contain personal data related to other personal data subjects, except for cases where there are legal grounds for disclosing such personal data. The list of information and the procedure for obtaining it are established by the Law on Personal Data;
  • require the operator to clarify his personal data, block or destroy it if the personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing;
  • other rights provided for in Chapter 3 of the Federal Law of July 27, 2006 No. 152-FZ "On Personal Data".

Purposes of collecting personal data

The processing of personal data is limited to achieving specific, predetermined and legitimate purposes. Processing of personal data incompatible with the purposes of collecting personal data is not allowed. Only personal data that meets the purposes of their processing are subject to processing. The processing of personal data of website users is carried out solely for the purpose of providing the user with the opportunity to interact with the website. Information constituting personal data on the website is any information related to a specific or determinable individual (personal data subject) on the basis of such information.

Volume of personal data processed

The content and volume of personal data of website users processed corresponds to the declared purposes of processing, provided in the section "Purposes of collecting personal data" of this Policy. The personal data processed must not be excessive in relation to the stated purposes of their processing.

The Operator may process the following personal data of users:

  • source of entry to the site (sites) and information about the search or advertising request;
  • data about the user device (including resolution, version and other attributes characterizing the user device);
  • user clicks, page views, filling in fields, banner and video impressions and views;
  • data characterizing audience segments;
  • session parameters;
  • data about the time of visit;
  • user identifier, stored in cookie;
  • last name;
  • first name;
  • patronymic;
  • contact phone number;
  • e-mail address
    • mail.
  • race and nationality;
  • political views;
  • religious or philosophical beliefs;
  • health status;

The Operator does not process special categories of personal data related to:

intimate life;

  • except for cases provided for by the legislation of the Russian Federation.
  • processing of biometric personal data;
  • cross-border transfer of personal data.

The Operator does not:

Procedure and conditions for processing personal data

The processing of personal data is carried out by the Operator in accordance with the requirements of the legislation of the Russian Federation. The processing of personal data is carried out with the consent of the subjects of personal data to the processing of their personal data, as well as without such consent in cases stipulated by the legislation of the Russian Federation. The Operator carries out both automated and non-automated processing of personal data. The processing of personal data is allowed to the employees of the Operator, whose job responsibilities include the processing of personal data. Disclosure and provision to third parties and dissemination of personal data without the consent of the subject of personal data is not permitted, unless otherwise provided by federal law. Transfer of personal data to inquiry and investigation bodies, the Federal Tax Service, the Pension Fund of the Russian Federation, the Social Insurance Fund and other authorized executive bodies and organizations is carried out in accordance with the requirements of the legislation of the Russian Federation.

The Operator takes the necessary legal, organizational and technical measures to protect personal data from unauthorized or accidental access to them, destruction, modification, blocking, distribution and other unauthorized actions, including:

  • determines threats to the security of personal data during their processing;
  • adopts local regulatory acts and other documents governing relations in the field of processing and protection of personal data;
  • creates the necessary conditions for working with personal data;
  • organizes the accounting of documents containing personal data;
  • organizes work with information systems in which personal data is processed;
  • stores personal data in conditions that ensure their safety and exclude unauthorized access to them.

Procedure and terms of storage of personal data

The Operator only stores the personal data of Users on the Site. The storage period for the personal data of users begins from the moment of consent to the processing of personal data, obtained by accepting an offer that does not require bilateral signature and is valid in electronic form, and is valid until the user declares his desire to delete his personal data from the site. In case of deletion of data from the site at the initiative of one of the parties, namely, termination of use of the site, the user's personal data is stored in the Operator's databases for five years in accordance with the legislation of the Russian Federation. Upon expiration of the above-mentioned storage period for the user's personal data, the user's personal data is deleted automatically by the specified algorithm set by the Operator. The Operator does not process the personal data of Users on paper media.

Removal and destruction of personal data

Upon achieving the goals of processing personal data, as well as in the event of withdrawal of consent to their processing by the subject of personal data, personal data are subject to destruction if:

  • otherwise not provided by the agreement to which the subject of personal data is a party, beneficiary or guarantor;
  • the operator does not have the right to process without the consent of the subject of personal data on the grounds provided for by the Law on Personal Data or other federal laws;
  • otherwise not provided by another agreement between the Operator and the subject of personal data.

The subject of personal data has the right to demand in writing the destruction of his personal data if the personal data are incomplete, outdated, unreliable, illegally obtained or are not necessary for the stated purpose of processing. In the absence of the possibility of destroying personal data, the Operator blocks such personal data. Destruction of personal data is carried out by erasing information using certified software guaranteed destruction (in accordance with the specified characteristics for the installed software with guaranteed destruction).