EasyTun
For business Registration
Back

Personal Data Processing Policy

1. General Provisions

1.1 This Policy on the processing of personal data (hereinafter — the «Policy») defines the procedure and conditions for the processing of personal data by IE Slonimskiy Grigory Aleksandrovich (TIN: 770971796064, address: 109147, Russia, Moscow, Marxistskaya St., 9, apt. 6) in relation to users of the website: https://easytun.io.

1.2 Terms are used in the meaning established by the legislation of the Russian Federation on personal data.

1.3 The Operator processes personal data based on the principles of legality, fairness, minimisation, and limiting processing to the achievement of specific, predetermined, and lawful purposes.

1.4 The Operator ensures the confidentiality of personal data (Art. 7 of the Personal Data Law) and takes the necessary measures to fulfil the obligations established by Part 2 of Article 18.1 and Part 1 of Article 19 of the said law (organisational and technical protection measures).

1.5 Contacts for inquiries from data subjects: e-mail: info@easytun.xyz; postal address: 109147, Russia, Moscow, Marxistskaya St., 9, apt. 6. The Policy is effective from 2026-05-13 and is publicly available on the website.

2. Key terms

  • Automated personal data processing — processing of personal data using computing equipment.
  • Blocking of personal data — temporary suspension of personal data processing (except in cases where processing is necessary to clarify the personal data).
  • Website — the set of graphic and information materials, as well as computer programs and databases, ensuring their availability on the Internet at the network address https://easytun.io.
  • Personal data information system — the set of personal data contained in databases and the information technologies and technical means ensuring their processing.
  • Depersonalisation of personal data — actions as a result of which it becomes impossible, without the use of additional information, to determine whether personal data belong to a specific User or other data subject.
  • Personal data processing — any action (operation) or set of actions performed with personal data, with or without the use of automation tools, including collection, recording, systematisation, accumulation, storage, clarification, extraction, use, transfer, depersonalisation, blocking, deletion, destruction.
  • Operator — a state body, municipal body, legal or natural person, independently or jointly with other persons organising and/or carrying out the processing of personal data.
  • Personal data — any information relating directly or indirectly to a specified or identifiable User of the website.
  • User — any visitor of the website https://easytun.io.
  • Provision of personal data — actions aimed at disclosing personal data to a specific person or a group of persons.
  • Dissemination of personal data — any actions aimed at disclosing personal data to an indefinite number of persons.
  • Cross-border transfer — the transfer of personal data to the territory of a foreign state, to a public authority, natural or legal person.
  • Destruction of personal data — any actions as a result of which personal data are irretrievably destroyed with no possibility of recovery.

3. Key rights and obligations of the Operator

3.1 The Operator has the right to:

  • obtain from the data subject reliable information and/or documents containing personal data;
  • continue processing personal data without the subject's consent when grounds specified in the Personal Data Law are present;
  • independently determine the composition and list of measures necessary to ensure compliance with the obligations provided for by the Personal Data Law.

3.2 The Operator must:

  • provide the data subject, upon request, with information regarding the processing of their personal data;
  • organise the processing of personal data in the manner established by the legislation of the Russian Federation;
  • respond to inquiries and requests from data subjects in accordance with the requirements of the Law;
  • provide the authorised body with the necessary information within 10 days from the date of receiving a request;
  • ensure unrestricted access to this Policy;
  • take legal, organisational, and technical measures to protect personal data;
  • stop the transfer and processing of personal data and destroy it in the manner provided for by the Law;
  • fulfil other obligations provided for by the Personal Data Law.

4. Key rights and obligations of data subjects

4.1 Data subjects have the right to:

  • obtain information regarding the processing of personal data;
  • demand clarification, blocking, or destruction of incomplete, outdated, inaccurate, or unlawfully obtained data;
  • make prior consent a condition for processing data for the purposes of promoting goods and services;
  • withdraw consent to the processing of personal data;
  • appeal against unlawful actions of the Operator with the authorised body or in court.

4.2 Data subjects must:

  • provide the Operator with accurate data about themselves;
  • notify the Operator of any clarifications (updates, changes) to their personal data.

4.3 Persons who provided the Operator with false information about themselves or information about another data subject without their consent are liable under the legislation of the Russian Federation.

5. Purposes of collection and processing

  • Registration and authentication of website/app users.
  • Ensuring the functioning and security of the website/app.
  • User support and handling of inquiries.
  • Holding events, webinars, and mailings.
  • Loyalty program, bonuses, and referral programs.
  • Payment operations and billing.
  • Maintaining HR and accounting records.
  • Ensuring compliance with the tax legislation of the Russian Federation.
  • Performing statistical accounting.

6. Legal grounds for processing

  • Registration and authentication: contract (offer/user agreement); 126-FZ «On Communications»; consent.
  • Functioning and security: legitimate interest of the Operator; 149-FZ; local regulations; consent (for cookies/analytics).
  • User support: contract/offer; 126-FZ; consent.
  • Events and mailings: contract; consent for mailing; 38-FZ «On Advertising»; 126-FZ.
  • Loyalty program: contract; consent (for marketing/profiling).
  • Payment operations: 161-FZ «On the National Payment System»; 54-FZ; contract; consent.
  • HR and accounting records: Labour Code of the RF; 402-FZ; Tax Code of the RF; 27-FZ; 167-FZ; contract.
  • Tax legislation: Tax Code of the RF; 402-FZ; contract.
  • Statistical accounting: 282-FZ; depersonalisation.

Federal Law No. 152-FZ «On Personal Data» establishes general requirements and is not, by itself, a legal basis for processing.

7. Scope and categories of data processed

  • Registration: full name, login, e-mail, phone, account identifiers, passwords/hashes, 2FA codes, IP addresses, cookies/session tokens.
  • Security: IP addresses, date/time, URL, headers, cookies/SDK, device data, error and access logs.
  • Support: full name, contacts, content of inquiries/chats, call recordings, ticket metadata.
  • Events: full name, contacts, position/organisation, registration forms, attendance.
  • Loyalty: full name, contacts, member identifiers, purchase/bonus history, referral links.
  • Payments: full name, contacts, masked payment details, payment amounts and statuses, receipts.
  • HR records: full name, date of birth, passport details, SNILS, TIN, address, employment and salary information.
  • Tax records: full name, TIN, income and payments, tax payment details.
  • Statistics: depersonalised and aggregated data.

Data subjects may include website visitors, clients, counterparties, representatives of legal entities, employees, candidates for vacant positions, and other persons.

8. Procedure and conditions of processing

8.1 Processing is carried out on the basis of the User's consent, unless otherwise provided by the legislation of the Russian Federation.

8.2 Consent is expressed through actions by the User clearly aimed at providing their personal data: filling in form fields, submitting an application, and confirming agreement to the Policy by ticking the corresponding box.

8.3 The User may withdraw consent at any time by sending a request to info@easytun.xyz. After withdrawal, the Operator stops processing, except where processing is permitted without consent by law.

8.4–8.12 For all stated purposes, the following actions are performed with personal data: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), depersonalisation, blocking, deletion, destruction.

8.13 Processing may be carried out using automation tools and/or without them.

8.14 Transfer of personal data to third parties: Yandex Metrika, Telegram API (under agency contracts; in compliance with personal data protection requirements).

8.15 When storing personal data, the Operator uses databases located within the territory of the Russian Federation (Part 5 of Art. 18 of the Personal Data Law).

8.16 Storage periods: logs — 12 months, inquiries — 3 years.

8.17 The website may use cookies to ensure the proper operation of services and to improve user experience.

8.18 Visit analytics may be carried out (including using counters/pixels/SDKs). The use of marketing identifiers requires consent.

8.19 The Operator may transfer personal data to authorised bodies on the grounds provided for by the legislation of the Russian Federation.

9. Protection measures

The Operator takes the necessary legal, organisational, and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision, or dissemination.

Such measures include: appointment of responsible persons; adoption of local regulations; limitation of personnel with access to personal data; use of antivirus tools, firewalls, and other technical protection means; storing data under conditions that exclude unauthorised access; performing internal monitoring and audits; familiarising employees with legislation and local regulations.

10. Updating, correction, deletion

10.1 Upon confirmation of inaccuracy or unlawful processing, the Operator updates the data and/or stops processing.

10.2 Personal data is subject to destruction upon achievement of the processing purposes, withdrawal of consent, expiration of storage periods, or detection of unlawful processing.

10.3 The data subject may send a request to info@easytun.xyz or to the postal address: 109147, Russia, Moscow, Marxistskaya St., 9, apt. 6.

10.4 The Operator's response period for a request is no more than 30 calendar days.

10.5 Conditions for terminating processing: achievement of purposes; withdrawal of consent; detection of unlawful processing; other grounds provided for by legislation.

11. Policy updates

11.1 This Policy is subject to review and update in the event of changes in the legislation of the Russian Federation, as well as by decision of the Operator.

11.2 The current version is always available on the Operator's website.

11.3 The new version takes effect from the moment it is posted on the website.