Personal Data Processing Terms

These Personal Data Processing Terms (hereinafter — the 'Terms') are drafted in accordance with the Russian Federal Law No. 152-FZ of 27 July 2006 'On Personal Data' and the General Data Protection Regulation (Regulation (EU) 2016/679, hereinafter — 'GDPR'). The Terms define what user data of the GetCheats.io website (hereinafter — the 'Site') is processed, for what purposes, on what legal basis, and what safeguards are applied.

1. Terms and definitions

1.1 'Operator' (Controller) — the entity carrying out the processing of personal data, namely the administrator of GetCheats.io.

1.2 'Data Subject' (hereinafter — the 'Subject') — a user of the Site whose data is being processed.

1.3 'Personal Data' — any information relating directly or indirectly to an identified or identifiable Subject. Within the Site, this is exclusively the Subject's email address.

1.4 'Processing' — any operation performed on Personal Data: collection, recording, structuring, storage, adaptation, use, transmission, erasure.

2. Categories of data processed

2.1 The Operator processes a single category of personal data of the Subject — the email address, which the Subject provides voluntarily upon registration or authentication on the Site.

2.2 The Operator does not collect or request: full name, passport or government-ID details, phone number, postal address, date of birth, biometric data, health information, financial credentials, or any other category not listed in clause 2.1.

2.3 Technical data (IP address, browser type, User-Agent, session metadata) is collected automatically and used solely for ensuring the security and operation of the Site. The Operator does not link such data to the Subject's identity and does not use it as an identifier.

3. Purposes of processing

3.1 The email address is processed strictly for the following purposes:

• Identification of the Subject upon login.
• Account access recovery (password reset).
• Service notifications related to the use of the Site (e.g., operation confirmations, changes to terms of service).
• Performance of the Operator's contractual obligations towards the Subject under the public offer published on the Site.

3.2 Email is not used for marketing communications without separate, explicitly expressed consent of the Subject. Marketing subscription is opt-in: disabled by default and activated only upon the Subject's deliberate selection.

4. Legal basis for processing

4.1 The legal basis for processing the email depends on the Subject's applicable jurisdiction:

• For Subjects in the Russian Federation — Article 6 of Federal Law No. 152-FZ: processing is based on the consent of the Subject and on the performance of a contract to which the Subject is a party.
• For Subjects in the EU/EEA — GDPR Article 6(1)(a) (consent) and GDPR Article 6(1)(b) (performance of a contract).

4.2 Consent of the Subject to email processing is given freely, specifically, in an informed manner, and unambiguously through an active action: checking the corresponding box or completing registration after reviewing these Terms.

5. Principles of processing

5.1 The Operator adheres to the principles established by GDPR Article 5 and Article 5 of Federal Law No. 152-FZ:

• Lawfulness, fairness, and transparency of processing.
• Purpose limitation — data is processed only for the purposes declared in clause 3.
• Data minimisation — only the email address is collected; no excessive categories.
• Accuracy — the Subject may correct the email at any time.
• Storage limitation — data is retained no longer than necessary for the declared purposes (see clause 7).
• Integrity and confidentiality — data is protected by technical and organisational measures applied by the Operator.
• Accountability — the Operator is able to demonstrate compliance with these principles.

6. Withdrawal of consent

6.1 The Subject is entitled to withdraw consent to email processing at any time. To do so, the Subject must submit a request through the support service or delete the account through the personal cabinet.

6.2 Upon withdrawal of consent, the Operator stops processing the email and erases it from active systems within no more than 30 calendar days, except where further retention is mandatory under applicable law (e.g., tax records for transactions, see clause 7.2).

7. Storage periods and locations

7.1 The email is retained for the entire duration of the active account and for 90 days after account deletion — to allow recovery in case of accidental deletion.

7.2 Data associated with financial transactions (as part of the payment record) may be retained longer — for the period established by accounting and tax legislation, without the right of erasure on request until such period expires.

7.3 Databases containing emails of Subjects who are citizens of the Russian Federation are hosted on servers located within the Russian Federation, in compliance with Article 18 of Federal Law No. 152-FZ (data localisation requirement).

8. Transfer to third parties

8.1 The Operator does not transfer the Subject's email to third parties for purposes other than those listed in clause 3 of these Terms.

8.2 The email may be transferred only: (a) to payment systems servicing the Subject's transactions, in the volume strictly necessary to process the payment; (b) to authorised state authorities — upon their lawful request in the established procedure.

8.3 The Operator does not perform cross-border transfer of emails outside the Russian Federation.

9. Rights of the Subject

9.1 The Subject has the following rights with respect to personal data (Article 14 of Law No. 152-FZ; GDPR Articles 15-22):

• Right of access — to obtain confirmation that the email is being processed and a copy of the data.
• Right to rectification — to change the email at any time through the personal cabinet.
• Right to erasure (right to be forgotten) — to request deletion of the email, subject to clauses 6.2 and 7.2.
• Right to restriction of processing — to suspend processing on legal grounds.
• Right to object to processing based on the Operator's legitimate interests.
• Right to withdraw consent at any time (see clause 6).
• Right to lodge a complaint with a supervisory authority — Roskomnadzor (for the Russian Federation) or the relevant supervisory authority (for the EU/EEA).

9.2 Requests for the exercise of rights are submitted by the Subject to the Site’s support service. The Operator is obliged to respond to a request within 30 calendar days of receipt.

10. Cookies

10.1 The Site uses strictly necessary (technical) cookies to maintain the Subject's authenticated session and to store user interface preferences.

10.2 Analytical and marketing cookies (if applied) are activated only after the Subject provides separate consent through the cookie banner.

11. Changes to the Terms

11.1 The Operator reserves the right to amend these Terms. Material changes that affect the Subject's rights are additionally communicated to the Subject through a service notification by email.

11.2 The date of the last update is shown at the top of the page. Continued use of the Site after the publication of changes signifies the Subject's agreement to the new version.

12. Contacts

12.1 On matters of personal data processing, the exercise of the Subject's rights, and any other questions related to these Terms, the Subject may contact the Site's support service through the feedback form or the channels listed on the 'Contacts' page.