Privacy Policy

Edition of 22 September 2026

This translation is provided for convenience. The Russian version is the legally binding one.

This personal data processing policy has been drawn up in accordance with the requirements of Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” (the Personal Data Law) and sets out the procedure for processing personal data and the measures taken by GetBonus (the Operator) to ensure the security of personal data.

1.1. The Operator sets as its most important aim and as a condition of carrying on its activity the observance of human and civil rights and freedoms in the processing of personal data, including the protection of the rights to privacy and to personal and family secrets.

1.2. This policy of the Operator regarding the processing of personal data (the Policy) applies to all information that the Operator may obtain about visitors to the websites https://app.getbonus.red, https://t.me/getbonus, https://t.me/getbonusapp, https://t.me/getbonus/app.

2.1. Automated processing of personal data — processing of personal data by means of computing equipment.

2.2. Blocking of personal data — temporary suspension of the processing of personal data (except where processing is necessary to update the personal data).

2.3. Website — the set of graphic and informational materials, computer programs and databases that make them available on the internet at the network addresses https://app.getbonus.red, https://t.me/getbonus, https://t.me/getbonusapp, https://t.me/getbonus/app.

2.4. Personal data information system — the set of personal data contained in databases together with the information technologies and technical means that process it.

2.5. Depersonalisation of personal data — actions after which it is impossible, without the use of additional information, to determine that personal data belongs to a particular User or other data subject.

2.6. Processing of personal data — any action (operation) or set of actions (operations) performed on personal data with or without the use of automation tools, including collection, recording, systematisation, accumulation, storage, updating (renewal, modification), extraction, use, transfer (distribution, provision, access), depersonalisation, blocking, deletion and destruction of personal data.

2.7. Operator — a state body, a municipal body, a legal entity or a natural person that, alone or jointly with others, organises and/or carries out the processing of personal data and determines the purposes of processing personal data, the composition of the personal data to be processed and the actions (operations) performed on personal data.

2.8. Personal data — any information relating directly or indirectly to a determined or determinable User of the websites https://app.getbonus.red, https://t.me/getbonus, https://t.me/getbonusapp, https://t.me/getbonus/app.

2.9. Personal data authorised by the data subject for distribution — personal data to which access by an unlimited number of persons has been granted by the data subject by giving consent to the processing of personal data authorised for distribution in the manner provided for by the Personal Data Law (personal data authorised for distribution).

2.10. User — any visitor to the websites https://app.getbonus.red, https://t.me/getbonus, https://t.me/getbonusapp, https://t.me/getbonus/app.

2.11. Provision of personal data — actions aimed at disclosing personal data to a particular person or a particular group of persons.

2.12. Distribution of personal data — any actions aimed at disclosing personal data to an indefinite group of persons (transfer of personal data) or at making personal data available to an unlimited number of persons, including publication of personal data in the mass media, placement in information and telecommunication networks, or provision of access to personal data by any other means.

2.13. Cross-border transfer of personal data — the transfer of personal data to the territory of a foreign state, to a foreign state authority, or to a foreign natural or legal person.

2.14. Destruction of personal data — any actions as a result of which personal data is destroyed irretrievably, with no possibility of further recovery of the content of the personal data in the personal data information system, and/or as a result of which the material carriers of the personal data are destroyed.

3.1. The Operator has the right:

• to receive from the data subject accurate information and/or documents containing personal data;
• where the data subject withdraws consent to the processing of personal data, or sends a demand that the processing of personal data cease, to continue processing the personal data without the data subject's consent where the grounds set out in the Personal Data Law are present;
• to determine independently the composition and list of measures necessary and sufficient to ensure that the obligations under the Personal Data Law and the regulations adopted pursuant to it are fulfilled in full, unless otherwise provided by the Personal Data Law or other federal laws.

3.2. The Operator is obliged:

• to provide the data subject, at their request, with information concerning the processing of their personal data;
• to organise the processing of personal data in the manner established by the applicable law of the Russian Federation;
• to respond to enquiries and requests from data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;
• to report to the authorised body for the protection of the rights of data subjects, at that body's request, the necessary information within 10 days of receiving such a request;
• to publish or otherwise provide unrestricted access to this Policy regarding the processing of personal data;
• to take legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, provision, distribution of personal data, and against other unlawful actions in respect of personal data;
• to cease the transfer (distribution, provision, access) of personal data, to cease processing and to destroy personal data in the manner and in the cases provided for by the Personal Data Law;
• to fulfil other obligations provided for by the Personal Data Law.

4.1. Data subjects have the right:

• to receive information concerning the processing of their personal data, save in the cases provided for by federal laws. The information is provided to the data subject by the Operator in an accessible form and must not contain personal data relating to other data subjects, except where there are lawful grounds for disclosing such personal data. The list of information and the procedure for obtaining it are established by the Personal Data Law;
• to require the operator to update their personal data, or to block or destroy it, where the personal data is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing, and to take the measures provided by law to protect their rights;
• to make prior consent a condition of the processing of personal data for the purposes of promoting goods, works and services on the market;
• to withdraw consent to the processing of personal data, and to send a demand that the processing of personal data cease;
• to appeal to the authorised body for the protection of the rights of data subjects, or to the courts, against unlawful actions or omissions of the Operator in the processing of their personal data;
• to exercise other rights provided for by the law of the Russian Federation.

4.2. Data subjects are obliged:

• to provide the Operator with accurate data about themselves;
• to inform the Operator of any update (renewal, change) to their personal data.

4.3. Persons who have provided the Operator with inaccurate information about themselves, or with information about another data subject without that subject's consent, bear liability in accordance with the law of the Russian Federation.

5.1. Personal data is processed on a lawful and fair basis.

5.2. The processing of personal data is limited to the achievement of specific, predetermined and lawful purposes. Processing of personal data that is incompatible with the purposes of collecting the personal data is not permitted.

5.3. Databases containing personal data processed for purposes that are incompatible with one another may not be combined.

5.4. Only personal data that corresponds to the purposes of its processing is processed.

5.5. The content and volume of the personal data processed correspond to the stated purposes of processing. The personal data processed must not be excessive in relation to the stated purposes of processing.

5.6. When processing personal data, its accuracy, sufficiency and, where necessary, its currency in relation to the purposes of processing are ensured. The Operator takes the necessary measures, and/or ensures that they are taken, to delete or update incomplete or inaccurate data.

5.7. Personal data is stored in a form that allows the data subject to be identified for no longer than the purposes of processing require, unless the storage period for the personal data is established by federal law or by a contract to which the data subject is a party, beneficiary or guarantor. The personal data processed is destroyed or depersonalised once the purposes of processing have been achieved, or where the need to achieve those purposes has been lost, unless otherwise provided by federal law.

Purpose of processing: informing the User by sending emails.

Personal data: surname, first name, patronymic, email address, telephone numbers.

Legal grounds: the Operator's constitutive (founding) documents.

Types of personal data processing: collection, recording, systematisation, accumulation, storage, destruction and depersonalisation of personal data; sending informational emails to the email address.

7.1. Personal data is processed with the data subject's consent to the processing of their personal data.

7.2. The processing of personal data is necessary to achieve the purposes provided for by an international treaty of the Russian Federation or by law, and to carry out the functions, powers and duties imposed on the operator by the law of the Russian Federation.

7.3. The processing of personal data is necessary for the administration of justice, for the enforcement of a judicial act or of an act of another body or official that is subject to enforcement in accordance with the law of the Russian Federation on enforcement proceedings.

7.4. The processing of personal data is necessary for the performance of a contract to which the data subject is a party, beneficiary or guarantor, and for the conclusion of a contract at the data subject's initiative or of a contract under which the data subject will be the beneficiary or guarantor.

7.5. The processing of personal data is necessary to exercise the rights and legitimate interests of the operator or of third parties, or to achieve socially significant purposes, provided that the rights and freedoms of the data subject are not thereby infringed.

7.6. Processing is carried out of personal data to which access by an unlimited number of persons has been granted by the data subject or at their request (publicly available personal data).

7.7. Processing is carried out of personal data subject to publication or mandatory disclosure in accordance with federal law.

The security of the personal data processed by the Operator is ensured by implementing the legal, organisational and technical measures necessary to comply in full with the requirements of the applicable law on the protection of personal data.

8.1. The Operator ensures the safekeeping of personal data and takes all possible measures to prevent unauthorised persons from accessing personal data.

8.2. The User's personal data will never, under any circumstances, be transferred to third parties, except in cases connected with compliance with applicable law, or where the data subject has given the Operator consent to transfer data to a third party for the performance of obligations under a civil law contract.

8.3. If inaccuracies in the personal data are identified, the User may update it themselves by sending the Operator a notice to the Operator's email address marked “Updating of personal data”.

8.4. The period of processing of personal data is determined by the achievement of the purposes for which the personal data was collected, unless a different period is provided for by contract or by applicable law. The User may at any time withdraw their consent to the processing of personal data by sending the Operator a notice by email to the Operator's email address info@getbonus.red marked “Withdrawal of consent to the processing of personal data”.

8.5. All information collected by third-party services, including payment systems, communication tools and other service providers, is stored and processed by those persons (Operators) in accordance with their Terms of Service and Privacy Policy. The data subject and/or with the said documents. The Operator bears no liability for the actions of third parties, including the service providers referred to in this clause.

8.6. Prohibitions established by the data subject on the transfer (other than the provision of access), and on the processing or conditions of processing (other than obtaining access), of personal data authorised for distribution do not apply where personal data is processed in state, public and other public interests defined by the law of the Russian Federation.

8.7. When processing personal data, the Operator ensures the confidentiality of the personal data.

8.8. The Operator stores personal data in a form that allows the data subject to be identified for no longer than the purposes of processing require, unless the storage period for the personal data is established by federal law or by a contract to which the data subject is a party, beneficiary or guarantor.

8.9. The processing of personal data may cease upon the achievement of the purposes of processing, the expiry of the data subject's consent, the withdrawal of consent by the data subject or a demand that processing cease, and upon the discovery of unlawful processing of personal data.

9.1. The Operator carries out the collection, recording, systematisation, accumulation, storage, updating (renewal, modification), extraction, use, transfer (distribution, provision, access), depersonalisation, blocking, deletion and destruction of personal data.

9.2. The Operator carries out automated processing of personal data with or without the receipt and/or transfer of the information obtained over information and telecommunication networks.

10.1. Before beginning any activity involving the cross-border transfer of personal data, the Operator must notify the authorised body for the protection of the rights of data subjects of its intention to carry out a cross-border transfer of personal data (such notification is sent separately from the notification of the intention to process personal data).

10.2. Before submitting the above notification, the Operator must obtain the relevant information from the foreign state authorities, foreign natural persons and foreign legal entities to which the cross-border transfer of personal data is planned.

The Operator and other persons who have obtained access to personal data are obliged not to disclose it to third parties and not to distribute personal data without the data subject's consent, unless otherwise provided by federal law.

12.1. The User may obtain any clarification on questions of interest concerning the processing of their personal data by contacting the Operator by email.

12.2. Any changes to the Operator's personal data processing policy will be reflected in this document. The Policy is valid indefinitely until replaced by a new version.

12.3. The current version of the Policy is freely available on the internet at https://getbonus.red/privacy-policy.