1. General provisions
1.1 This Personal Data Processing Policy (hereinafter, the “Policy”) is aimed at protecting the rights and freedoms of individuals whose personal data are processed by the Site Administration (hereinafter, the “Operator”).
1.2 The Policy has been developed in accordance with Clause 2, Part 1, Article 18.1 of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (hereinafter, the Federal Law “On Personal Data”).
1.3 The Policy contains information subject to disclosure in accordance with Part 1, Article 14 of the Federal Law “On Personal Data” and is a publicly available document posted on the Operator’s website: https://steampay.com/privacy.
1.4 Operator’s contact details:
- Email: [email protected]
- Website: steampay.com
1.5 This Policy applies to all information posted on the website at steampay.com (hereinafter, the “Site”), to information about the User, and to the personal data of the Operator’s employees, its counterparties and other personal data subjects whose information is processed by the Operator.
1.6 Any use of the Site constitutes the User’s unconditional Consent to this Policy and to the terms of processing of the User’s personal data set out herein.
1.7 If the User does not agree with these terms, the User must refrain from using the Site and must under no circumstances provide personal data to the Operator.
2. Terms and definitions
2.1 Personal data - any information relating directly or indirectly to an identified or identifiable individual (personal data subject).
2.2 Operator - an individual who, alone or jointly with other persons, organizes and/or carries out the processing of personal data and determines the purposes of processing personal data, the personal data to be processed and the actions (operations) performed with personal data.
2.3 Processing of personal data - any action (operation) or set of actions (operations) performed with personal data, with or without the use of automation tools, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion and destruction of personal data.
2.4 Provision of personal data - actions aimed at disclosing personal data to a specific person or a specific group of persons.
2.5 Destruction of personal data - actions that make it impossible to restore the content of personal data in a personal data information system and/or that result in the destruction of tangible media containing personal data.
2.6 Blocking of personal data - temporary suspension of the processing of personal data (except where processing is necessary to clarify personal data).
2.7 User – any individual who visits the Site and performs any actions on it, including buying goods or receiving services, filling in the feedback form, or otherwise entering into relations with the Operator (by email, etc.). The User is a personal data subject.
3. Purposes of personal data processing
3.1 The Operator processes personal data for the following purposes:
3.1.1 to perform a contract to which the personal data subject is a party, beneficiary or guarantor;
3.1.2 to conclude a contract at the initiative of the personal data subject or a contract under which the personal data subject will be a beneficiary or guarantor;
3.1.3 to achieve the purposes provided for by an international treaty of the Russian Federation or by law, and to exercise and perform the functions, powers and duties imposed on the Operator by the legislation of the Russian Federation.
4. Legal basis for personal data processing
4.1 The legal basis for the processing of personal data is:
4.1.1 The legislation of the Russian Federation on personal data, based on the Constitution of the Russian Federation and the international treaties of the Russian Federation and consisting of the Federal Law “On Personal Data” and other federal laws that define the cases and specifics of personal data processing;
4.1.2 The consent to the processing of personal data that the User gives by accepting this Policy or by signing it in writing when concluding contracts with the Operator;
4.1.3 This Policy;
4.1.4 The User Agreement of the Site.
5. Categories of personal data subjects and personal data processed
5.1 The categories of personal data subjects whose personal data are processed by the Operator include:
5.1.1 individuals in employment or civil law relations with the Operator;
5.1.2 individuals in employment or civil law relations with the Operator’s counterparties;
5.1.3 personal data subjects who buy goods or receive services on the Site.
5.2 For all categories of personal data subjects, personal data are processed by the Operator within the framework of legal relations with the Operator governed by the Civil Code of the Russian Federation, the Labor Code of the Russian Federation and other legislation of the Russian Federation.
5.3 For all categories of personal data subjects, personal data are processed by the Operator with the consent of the personal data subjects, given either in writing or by conclusive actions on the Site, including requesting a callback and/or sending a message to the Operator’s email address specified in Clause 1.4 of the Policy.
5.4 When payment is made using Mastercard, Visa or another payment system, the Operator uses a service that carries out the payment to process the payment data. The Operator does not collect, process or store payment information, such as bank account details or credit card data, in its own systems.
5.5 The Operator processes the following personal data of personal data subjects:
5.5.1 Surname, first name, patronymic;
5.5.2 Email address;
5.5.3 Other information provided by the personal data subject on the Site;
5.5.4 Data automatically transmitted to the Operator while the Site is visited and used, by means of the software installed on the User’s device, including: IP address, cookie data, information about the User’s browser (or other program used to access the Site), access time, the address of the requested page and other data.
5.6 The Operator may process other personal data that are directly necessary for the purposes of personal data processing and provided by the User.
6. Periods of processing and storage of personal data
6.1 The Operator processes and stores personal data until the purposes of personal data processing are achieved or until the need to achieve these purposes ceases.
7. Information on personal data processing
7.1 The Operator processes personal data on a lawful and fair basis in order to perform the functions, powers and duties imposed by law and to exercise the rights and legitimate interests of the Operator, the Operator’s employees and third parties.
7.2 The Operator obtains personal data directly from personal data subjects.
7.3 The Operator processes personal data by automated and non-automated means, with and without the use of computer equipment.
7.4 Personal data processing operations include collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion and destruction.
7.5 Databases containing personal data of citizens of the Russian Federation are located in the territory of the Russian Federation.
8. Information on ensuring the security of personal data
8.1 The Operator appoints a person responsible for organizing the processing of personal data to perform the duties provided for by the Federal Law “On Personal Data” and the regulations adopted in accordance with it.
8.2 The Operator applies a set of legal, organizational and technical measures to ensure the security of personal data, in order to keep personal data confidential and protect them from unlawful actions. In particular, the Operator:
8.2.1 provides unrestricted access to the Policy, a copy of which is posted on the Site;
8.2.2 develops internal regulations to implement the Policy;
8.2.3 familiarizes its employees with the provisions of the legislation on personal data, as well as with the Policy and other internal regulations adopted to implement it;
8.2.4 grants employees access to personal data processed in the Operator’s information system, and to their tangible media, only for the performance of their job duties;
8.2.5 establishes rules for access to personal data processed in the Operator’s information system and ensures the registration and recording of all actions performed with them;
8.2.6 assesses the harm that may be caused to personal data subjects in the event of a violation of the Federal Law “On Personal Data”, and the relationship between such harm and the measures taken by the Operator to ensure the performance of the duties provided for by that federal law;
8.2.7 identifies threats to the security of personal data during their processing in the Operator’s information system;
8.2.8 applies organizational and technical measures and uses information security tools necessary to achieve the established level of personal data protection;
8.2.9 detects unauthorized access to personal data and takes response measures, including the recovery of personal data modified or destroyed as a result of unauthorized access to them;
8.2.10 assesses the effectiveness of the measures taken to ensure the security of personal data before the Operator’s information system is put into operation;
8.2.11 carries out internal control over the compliance of personal data processing with the Federal Law “On Personal Data”, other regulations adopted in accordance with it, the requirements for personal data protection, the Policy and other internal regulations, including control over the measures taken to ensure the security of personal data and their level of protection during processing in the Operator’s information system.
9. Rights of personal data subjects
9.1 A personal data subject has the right:
9.1.1 to receive the personal data relating to that subject and information concerning their processing;
9.1.2 to have his or her personal data clarified, blocked or destroyed if they are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing;
9.1.3 to withdraw his or her consent to the processing of personal data;
9.1.4 to protect his or her rights and legitimate interests, including the right to compensation for losses and moral harm through the courts;
9.1.5 to appeal against the actions or omissions of the Operator to the authorized body for the protection of the rights of personal data subjects or in court.
9.2 To exercise their rights and legitimate interests, personal data subjects may contact the Operator or send a request in person or through a representative, including by email.
9.3 The request must contain the information specified in Parts 3 and 7 of Article 14 of the Federal Law “On Personal Data” and must be sent to the email address specified in Clause 1.4 of the Policy.
10. Final provisions
10.1 The Operator may amend this Policy without the User’s consent.
10.2 A new version of the Policy comes into force upon its publication on the Site, unless otherwise provided by the new version of the Policy.
10.3 All suggestions or questions regarding this Policy should be sent to the email address specified in Clause 1.4 of the Policy.
10.4 The current Policy is posted on the Site at: https://steampay.com/privacy.
10.5 The Consent to the Processing of Personal Data posted on the Site is an integral part of this Policy.
10.6 This Policy applies directly and in conjunction with the User Agreement posted on the Site.
