Personal Data Processing Policy

1. General

1.1. This Policy sets out how personal data of users of prostocard.online (the "Website") and the ProstoCard service (the "Service") is processed and protected. It is drafted under Russian Federal Law No. 152-FZ "On Personal Data" of 27.07.2006 (the "Law").

1.2. The data controller is [Operator legal name] (the "Operator"). Details are given in section 11.

2. Definitions

Terms such as "personal data", "processing", "operator", "data subject" and "cross-border transfer" have the meanings given in the Law. A User is an individual aged 18 or over using the Website or the Service.

3. Data we process

• Contact form: name, email address or Telegram username, message text.
• Card issuing and servicing: email, phone number, full name and other data required by the issuing bank.
• Technical data: cookies and browser local storage, IP address, browser and device information, on-site activity. Analytics data (Yandex Metrica) is processed only with separate consent given in the cookie banner.

The Operator does not store full payment card details and does not process special categories or biometric data.

4. Purposes

• replying to user enquiries;
• entering into and performing the user agreement: card issuing, account access, support;
• analysing Website usage to improve it (with consent only);
• complying with legal obligations.

5. Legal grounds

• the data subject's consent (Art. 6(1)(1) of the Law), given as a separate document: Data processing consent;
• performance of a contract with the data subject (Art. 6(1)(5));
• compliance with legal obligations (Art. 6(1)(2)).

6. Processing and retention

6.1. Processing includes collection, recording, systematisation, accumulation, storage, clarification, retrieval, use, transfer, depersonalisation, blocking, deletion and destruction, with or without automation.

6.2. Personal data of Russian citizens is recorded and stored in databases located in the Russian Federation (Art. 18(5) of the Law).

6.3. Retention: enquiries — 1 year after the last reply; contract data — for the term of the contract plus 5 years unless the law requires longer; analytics — up to 12 months.

7. Transfers

7.1. Data may be shared with the card issuing bank (to the extent needed to issue and service the card), the hosting provider in Russia, and Yandex LLC for Yandex Metrica (with consent only).

7.2. If the issuing bank is located outside Russia, the transfer is cross-border and is carried out under Art. 12 of the Law after notifying the regulator, limited to what is needed to issue the card.

7.3. We never sell personal data or share it for advertising.

8. Your rights

You may request information about processing, ask to correct, block or delete your data, withdraw consent, and complain to Roskomnadzor or a court. Send requests to product@prostocard.online; we reply within 10 business days (extendable by 5 with notice).

9. Security

The Operator applies legal, organisational and technical measures under Art. 18.1 and 19 of the Law, including access control, HTTPS encryption, role separation and backups.

10. Cookies

See the Cookie policy. You can change your choice at any time via "Cookie settings" at the bottom of each page.

11. Changes and details

The Operator may update this Policy; the new version takes effect on publication.