PRIVACY POLICY
Last Updated: October 2026
Privacy Policy and Cookie Policy
1. Terms and Definitions
Policy – this Personal Data Processing Policy.
You, Your, and Data Subject – our counterparty under the Public Offer Agreement, who may be an individual using the Website to receive Service Top-Up services.
GDPR or Regulation – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC, as amended, supplemented, and periodically updated, and incorporated into the national legislation of the Member States.
Personal Data – any information relating to an identified or identifiable natural person. An identifiable person is someone who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity.
Processing of Personal Data – any operation or set of operations performed on Personal Data, whether by automated means or otherwise, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure (by transmission, dissemination, or otherwise making available), anonymization, restriction, erasure, or destruction of Personal Data. Personal Data is processed using a mixed method, including automated processing.
Automated Processing of Personal Data – the processing of Personal Data using computer equipment.
Confidentiality of Personal Data – an obligation imposed on Us or any other person who has access to Personal Data not to disclose such data without the consent of the Data Subject or another lawful basis.
Anonymization of Personal Data – actions that make it impossible to identify the Data Subject to whom Personal Data relates without using additional information.
Transfer – a payment transaction carried out by the User on the Website.
Website – Our website: https://www.buyhack.pro/
Cookies – small text files placed by the Website on Your computer or device when You visit certain sections of the Website and/or use certain Website features.
2. Subject Matter and Legal Basis for Personal Data Processing
Subject Matter of the Policy. The provisions of this Policy apply to the relationship between Us and You concerning the Processing of Personal Data in connection with Your use of the Website and the provision of services by the Company, arising from Your acceptance of the terms of the Public Offer Agreement.
Legal Basis for Processing. The legal basis for Processing Your Personal Data is always Your consent. Without accepting the terms of this Policy, we will not be able to fully fulfill our obligations under the agreements concluded with You. Therefore, we have made acceptance of this Policy a mandatory condition for entering into such agreements.
3. Policy Term and Personal Data Processing Period
Policy Term. Once You accept the terms of this Policy, it remains in effect indefinitely. However, this does not affect the period during which Your Personal Data is processed, which is determined by this Policy.
Personal Data Processing Period. As a general rule, We process Your Personal Data throughout the entire period during which Your Personal Account exists and for five (5) years after its deletion (or from the date We receive a duly completed written withdrawal of Your consent to the processing of Personal Data), unless a different retention period is established by applicable law, the Public Offer Agreement, or any other agreement related to Your use of the Website to which You are a party.
In all other cases, We will cease processing Your Personal Data if You object to such processing or withdraw Your previously given consent in accordance with this Policy. However, doing so may prevent Us from fulfilling Our contractual obligations to You.
Amendments. We may amend this Policy at any time. Such amendments may be made due to changes in Our business processes, external factors, or other reasons. Once amendments have been made, We will promptly publish the revised Policy on the Website so that You can review its updated version. We will notify You of any changes by sending a notification to Your Personal Account and/or publishing the revised Policy on the Website. If You continue using the Website after the amendments take effect, We will consider this as Your acceptance of the revised Policy.
4. Basis for Development, Objectives, and Principles of the Policy
Legal Basis. This Policy has been developed in accordance with the requirements of:
a) GDPR;
b) CalOPPA;
c) CCPA;
d) PECR;
e) Federal Law No. 152-FZ;
f) other applicable laws and regulations governing the circumstances and specifics of processing Personal Data of Data Subjects.
Objectives. This Policy aims to:
(1) Ensure compliance with requirements protecting human and civil rights and freedoms in the processing of Personal Data, including the right to privacy and the confidentiality of personal and family matters.
(2) Prevent unauthorized actions by third parties, including unlawful or accidental access to Your Personal Data, as well as its destruction, modification, blocking, copying, or disclosure.
(3) Establish a legal and regulatory framework for maintaining the confidentiality of and control over Your Personal Data.
(4) Protect individuals' constitutional rights to privacy and the confidentiality of Personal Data, and prevent potential threats to Your security.
The primary objective of this Policy is to provide You with a complete and transparent understanding of:
The legal basis for collecting and processing Your Personal Data;
The categories of Personal Data We may collect about You;
What happens to the Personal Data We collect;
Where Your Personal Data is processed;
How long We retain Your Personal Data;
To whom We may disclose Your Personal Data;
Your rights as a Data Subject.
Principles. We adhere to the following principles when Processing Personal Data:
(1) Personal Data must be processed lawfully and fairly.
(2) Personal Data must be collected for specific, explicit, and legitimate purposes and must not be further processed in a manner incompatible with those purposes.
(3) The content and scope of processed Personal Data must correspond to the stated purposes of processing. Personal Data must not be excessive in relation to those purposes.
(4) Personal Data must be accurate, sufficient, and up to date in relation to the purposes of processing.
(5) Personal Data must not be stored for longer than necessary to achieve the purposes of processing, unless a different retention period or retention procedure is provided for in this Policy.
5. Categories of Personal Data Collected
Website Registration. In accordance with the Public Offer Agreement, when You register on the Website, We collect the following Personal Data:
(1) Name (if You provide Your real name);
(2) Email address.
Service Data. After registration, You will be able to use the Service Top-Up services. To do so, You will need to enter Your personal account identifier for the relevant Service, which may contain Personal Data. By providing such information, You are deemed to have consented to its processing by Us.
Payment Data. When making a payment, the following information may be required:
(1) Bank card number;
(2) Bank card expiration date (Month/Year);
(3) Bank card security code (CVC2/CVV2).
Please note that such payment information is stored by Our payment partners. We do NOT collect or store payment card details as part of the relationship established between Us under the Public Offer Agreement.
Technical Data. While You use the Website, We automatically collect certain Personal Data, including technical information such as Your Internet Protocol (IP) address used to connect Your computer to the Internet, login information, browser type and version, time zone settings, browser plug-in types and versions, operating system and platform, information about Your visits to websites, and other similar data.
Other Data. In exceptional circumstances, We may ask You to provide additional Personal Data. We will notify You in advance and request Your separate consent to the Processing of such additional Personal Data.
Personal Data of Third Parties. If You provide Us with Personal Data relating to third parties, You warrant that You have obtained all necessary consents from such individuals (including consent to the transfer of their Personal Data) and any other documents required to fully comply with this Policy. Such consents and documents must be properly executed in accordance with the applicable laws governing those individuals.
If You act as the data controller or operator of such individuals' Personal Data, You also warrant that You ensure the proper transfer and protection of their Personal Data to a standard no lower than that established by this Policy.
The consent of third parties must be provided in writing, and You must submit the original document within seven (7) calendar days from the date the relevant request is sent by the Operator.
Providing Personal Data of third parties without complying with these requirements is prohibited, and You assume full responsibility for any breach of this obligation.
6. Rights of the Data Subject
Right to Information. You have the right to obtain information about Us, Our place of business, whether We hold Your Personal Data, and to access such Personal Data.
Right to Rectification and Erasure. You have the right to request that We correct, restrict the processing of, or delete Your Personal Data if it is incomplete, outdated, inaccurate, unlawfully obtained, or no longer necessary for the stated purpose of processing. You may also take any other legal measures to protect Your rights.
Form of Information. Information regarding the Personal Data We hold about You will be provided in an accessible format and will not contain Personal Data relating to other Data Subjects.
Access Procedure. You or Your legal representative may access Your Personal Data by submitting a request in person or in writing. The request must include the number of the primary identity document belonging to You or Your legal representative, the date of issue of that document, the issuing authority, and a handwritten signature.
The request may also be submitted electronically.
We are required to respond to Your request within thirty (30) days of receiving it. Depending on the complexity and number of requests, this period may be extended by up to sixty (60) days.
Scope of the Response. In a request for access to Your Personal Data, You may ask Us to provide information concerning its Processing, including:
(1) Confirmation of whether Your Personal Data is being processed and the purposes of such processing;
(2) Methods of Personal Data processing;
(3) The name and location of the Data Controller, as well as information about individuals who have access to Your Personal Data or may be granted such access;
(4) A list of the Personal Data being processed and the sources from which it was obtained;
(5) Processing periods, including data retention periods;
(6) Information about the legal consequences that the Processing of Your Personal Data may have for You as the Data Subject.
Right to Withdraw Consent. You have the right to withdraw Your consent to the Processing of Personal Data, restrict the methods and forms of its processing, and prohibit the disclosure of Your Personal Data without Your consent.
Right to Lodge a Complaint. You have the right to file a complaint regarding Our actions or omissions with the competent authority responsible for protecting the rights of Data Subjects or through the courts.
Right to Legal Protection. You have the right to protect Your rights and legitimate interests, including seeking compensation for damages and non-material harm through the courts.
7. Disclosure of Personal Data
Disclosure of Personal Data. To achieve the purposes of Personal Data Processing, We may need to disclose Your Personal Data to:
(1) Our payment partners and credit institutions involved in processing Transfers, for the purpose of ensuring an appropriate level of security for online payments made using electronic payment instruments through authorization pages. The relevant list is determined by the security protocols of payment systems, acquiring banks, and issuers of electronic payment instruments, in accordance with the Public Offer Agreement;
(2) Anti-fraud organizations, including organizations dealing with fraudulent activities, financial fraud, and financial fraud prevention bureaus;
(3) Government authorities, including executive authorities.
Mandatory and Optional Disclosure. The disclosure of information may be mandatory, for example, in relation to information about the User's device, including IP address, operating system, geographical data, device ID/type, access channel (browser/application), payment authorization, identification, and verification.
Disclosure may also be optional, for example, in relation to address-matching indicators, account information, and other similar data.
8. Storage of Personal Data
Data Localization. If You are a citizen of a Member State of the European Economic Area or the United Kingdom, Your Personal Data is collected and processed within the European Economic Area.
If You are a citizen of the Russian Federation, We store Your data on servers located within the territory of the Russian Federation.
9. Cookies
Use of Cookies. The Website uses Cookies. When You visit the Website, Your web browser transmits certain information to Our server, including:
(1) Date and time of Your visit;
(2) Browser type;
(3) Language settings;
(4) Operating system.
This information is stored in connection logs for a limited period, ranging from the duration of a session to one year, to ensure the security and proper functioning of the Website and to collect statistical information.
Cookie Functions. The Website uses different categories of Cookies.
The first category consists of Functional and Technical Cookies. Their primary purpose is to allow the Website's server to obtain information about Your session, preferred language, browser, and other technical details, as well as to ensure the proper functioning of the Website.
These Cookies are necessary to recognize You when You return to the Website. This allows Us to personalize Website content according to Your needs and remember Your preferences.
The second category consists of Analytical Cookies, which allow Us to estimate and count the number of visitors and understand how they navigate and interact with the Website. This information helps Us improve the Website's functionality, for example, by making it easier and more efficient to find the required sections.
You have the right to refuse the use of Analytical Cookies by changing the relevant settings in Your web browser.
Cookie Retention Period. Based on their storage duration on users' devices, Cookies are divided into Persistent Cookies and Session Cookies:
Session Cookies – files stored on Your device until You close Your web browser.
Persistent Cookies – files stored on Your device until they expire or You delete them.
Disabling Cookies. You can accept or reject all Cookies on the websites You visit by changing the settings of Your web browser.
10. Final Provisions
Severability Clause. If one or more provisions of this Policy are declared invalid, unenforceable, or otherwise legally ineffective, such provisions shall be replaced with valid provisions that most closely reflect their original meaning and intent.
Under no circumstances shall this result in the invalidation of the entire Policy.