Privacy Policy | Boostlock

1. General provisions

1.1. This Personal Data Processing Policy (the “Policy”) has been drawn up by ИП Вадим Карданов Андреевич (Tax ID 770475704764, the “Operator”) in accordance with Russian Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (“FZ-152”) and sets out how personal data of the users of https://boostlock.ru (the “Site”) is processed and protected.

1.2. The Policy follows the requirements of Article 18.1 of FZ-152 and applies to every category of personal data processed by the Operator.

1.3. The Operator undertakes to keep personal data confidential and secure in accordance with the applicable law of the Russian Federation.

2. Operator details

Name: ИП Вадим Карданов Андреевич
Tax ID (INN): 770475704764
Registration no. (OGRNIP): 326774600301544
Registered address: 105120, г. Москва, ул. Нижняя Сыромятническая, д. с25, кв. 11
Contact email: boostlock@inbox.ru
Person responsible for data processing: Вадим Карданов Андреевич, contact — boostlock@inbox.ru

3. Legal grounds for processing

The Operator processes personal data on the following legal grounds:

consent of the data subject (Article 6(1)(1) of FZ-152) — given by the user on registration, when placing an order and in other actions on the Site;
performance of a contract to which the data subject is a party (Article 6(1)(5) of FZ-152) — to provide the ordered Services;
exercise of the Operator's rights and legitimate interests (Article 6(1)(7) of FZ-152) — in particular, fraud prevention and Site security;
compliance with duties imposed by Russian law (Article 6(1)(2) of FZ-152) — accounting and tax records.

4. Purposes of processing

The Operator processes personal data solely for the following purposes:

registration and authentication of users on the Site;
conclusion and performance of the Services contract (see the Public Offer);
calculating and processing payments;
informing users about order status and how the service works;
technical support and correspondence;
handling claims and enquiries, issuing refunds;
information security and fraud prevention;
compliance with Russian law (accounting and tax records).

5. Categories of personal data processed

Depending on which features of the service you use, the following categories of data are processed:

5.1. Identification and contact data (always):

email address;
hashed password (the password itself is never stored);
Telegram ID and Telegram username — when signing in with Telegram;
IP address, session identifier, browser and operating system type — for technical operation and security.

5.2. Data collected when ordering match support services:

in-game parameters (current and target rank, selected heroes, number of games);
Steam game account credentials (login, password) — passed to the Coach in encrypted form for the duration of the Order only and deleted once it is completed;
the Steam game account identifier (account_id) and details of matches played while the Order is being performed: match id and time, mode, hero, result, in-game statistics and rank. The sources are the Operator's service Steam account and the Game's public statistics service (see clause 5.6 of the Offer). This information is shown in your account and in the Telegram bot and is stored together with the Order.

5.3. Data collected when ordering group support or coaching (Discord):

Discord user ID and username — obtained through the official Discord OAuth 2.0 mechanism (scopes identify, guilds.join) after the user explicitly grants permission on the Discord authorisation page;
messages sent by the user in the Order's Discord channel — stored on Discord Inc. servers under its own policy.

5.4. Data collected at payment:

amount, currency, invoice identifier and payment method — passed to the payment provider to process the payment;
the user's bank card details are never stored by the Operator — payment goes directly over a secure connection to the acquiring bank;
when paying with cryptocurrency, the user's wallet identifier is not passed to the Operator.

5.5. Data collected when applying to be a Coach:

full name — for identification;
a screenshot of the game profile — to confirm skill level;
a photo of the face together with an identity document — to verify age and identity;
game account data (profile) — to assess experience.

6. Methods and retention periods

6.1. The Operator processes personal data in the following ways: collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer (provision, access), anonymisation, blocking, deletion and destruction.

6.2. Processing is carried out both by automated means and without them.

6.3. Retention periods:

identification and contact data — until the user deletes their account or requests deletion;
Steam credentials — for the duration of the Order only; deleted automatically once it is completed;
payment records — 5 years (as required for accounting and tax purposes);
sign-in and activity logs — up to 6 months, for security purposes;
documents verifying Coaches — for the term of the relationship with the Coach plus 3 years.

6.4. Data is stored on servers located in the Russian Federation, in accordance with Article 18(5) of FZ-152.

7. Disclosure of personal data to third parties

Personal data may be disclosed to the following categories of recipients, to the extent required to provide the Services:

Coaches engaged by the Operator — Steam credentials (during performance of the Order only) and the Discord ID for coordination;
Payment providers and acquiring banks — the data required to process the payment. The Operator passes only the Order identifier and the amount; card and wallet details are never passed to the Operator;
Discord Inc. — within the use of Discord features (group support, coaching). Such processing is governed by Discord's own policy;
Telecom operators and hosting providers — to the extent of the technical infrastructure that delivers the service;
State authorities — in the cases and in the manner expressly provided for by the law of the Russian Federation.

Disclosure for any other purpose, including third-party marketing mailings, does not take place.

The Operator does not transfer personal data across borders to states that do not provide adequate protection of data subjects' rights without a separate consent from the data subject.

8. Data protection measures

The Operator takes the following measures to protect personal data:

data between the user and the Site travels over HTTPS (TLS 1.2 or higher);
user passwords are stored as cryptographic hashes (PBKDF2);
Steam credentials are encrypted with AES-256-GCM;
Coaches' identity documents are stored encrypted and are accessible only to authorised administrators;
technical countermeasures are in place: rate limiting, CSRF protection, a Content Security Policy, and account lockout after repeated wrong passwords;
backups and security audits are performed regularly.

9. Use of cookies

The Site uses cookies and similar technologies to make sign-in, sessions, CSRF protection and usage analysis work. Details are in the Cookie Policy.

10. Rights of the data subject

The data subject has the right:

to obtain information about the processing of their personal data in the manner, form and scope established by FZ-152;
to demand that personal data be corrected, blocked or destroyed where it is incomplete, outdated, inaccurate, unlawfully obtained or no longer necessary for the stated purpose;
to withdraw consent to the processing of personal data;
to demand that processing be stopped;
to delete their account in the account settings or by contacting support;
to appeal against the Operator's acts or omissions to the authority for the protection of data subjects' rights (Roskomnadzor) or to a court.

Requests and enquiries should be sent to boostlock@inbox.ru. They are handled within 30 (thirty) days of receipt.

11. Consent to processing

By registering on the Site, submitting the order form or applying to be a Coach, the user confirms that they have read this Policy and gives explicit consent to the processing of personal data for the purposes stated in it. The full wording of the consent is in these documents:

12. Changes to this Policy

The Operator may amend this Policy. The current revision is always available at https://boostlock.ru/Home/Privacy. Material changes are additionally announced on the Site home page.

13. Contacts

For any questions about the processing of personal data:

Email: boostlock@inbox.ru
Telegram: @boostlock_supp
Postal address: 105120, г. Москва, ул. Нижняя Сыромятническая, д. с25, кв. 11