Personal data processing policy

This is a courtesy translation. The Russian version of this document prevails.

1. General provisions

This policy explains what personal data the VEDmost website receives, why it is needed, on what legal basis we process it, who we share it with, how long we keep it and how you can manage your data.

This policy has been drawn up under Federal Law No. 152-FZ “On Personal Data” dated July 27, 2006 (the “Law”). It applies to all pages of the website, all forms on it and to inquiries received through the contact details published on the website.

VEDmost is an international settlements broker for companies and sole proprietors. For each payment we select an agent from our pool and a route, prepare the documents and support execution. We do not work with private individuals as clients, so the forms on the website are designed for representatives of companies and sole proprietors.

Personal data means any information that relates, directly or indirectly, to an identified or identifiable individual.

2. Operator

The personal data operator is VEDmost. The operator determines why and which data are processed and is responsible for the processing. In this policy, “VEDmost”, the “operator”, “we” and “us” refer to the same entity.

• Email: privacy@vedmost.ru.

3. Whose data we process

• representatives of companies and sole proprietors who request a payment quote or a rate comparison;
• sole proprietors who contact us on their own behalf;
• people whose data appear in documents attached for a rate comparison (for example, signatories);
• website visitors: technical data, and analytics data only with their consent.

4. What data we receive

We receive only what you enter in the forms or tell us yourself, and the technical data that a browser transmits when visiting any website.

“Request a quote” form:

• name;
• company name;
• contact details: phone number, email address or Telegram username;
• currency, approximate amount and the beneficiary's country;
• comment, if you leave one.

“Compare your rate” form: the same data, plus:

• documents of your current agent that you attach: payment order, agent's report or bill;
• the calculator result: rate, amount, currency and fee breakdown.

The documents may contain information about individuals, such as the full names and signatures of representatives. For the comparison we need the fee, the exchange rate or the method of calculating it, and the fixed charges. Everything else, including account numbers, signatures and full names, may be redacted before sending.

Inquiries through the contact details on the website. If you write to us, we receive your name, your contact details and the content of your message.

Technical data. When you visit the website, the server receives your IP address, the date and time of the request, the page address, and information about your browser and device. Without these data the website cannot load or protect itself against abuse.

Web analytics data. Only if you have agreed to analytics cookies. See section 9 for details.

We do not request passport details, special categories of personal data (such as data on health or beliefs) or biometric data through the website forms.

5. Why we process data

• Replying to your request. To contact you, clarify the task and answer your questions. Data: name, company, contact details, comment.
• Calculating payment terms. To calculate the fee and the exchange rate method for your currency, amount and country. Data: currency, amount, beneficiary's country, company.
• Selecting a route and an agent. To find an agent in the pool whose route to the destination currently works and whose terms are better, and to prepare an agreement with that agent. Data: payment parameters, company name, and the representative's name and contact details to the extent the agent needs them.
• Rate comparison. To compare your current agent's terms with the terms available in the pool and give you an answer with a calculation. Data: attached documents, calculator result, contact details.
• Operating and protecting the website. To display pages and filter out automated submissions and abuse. Technical data.
• Traffic analytics. To understand which pages are useful and improve the website. Web analytics data, only with your consent.

We do not use form data for advertising mailings, do not sell it and do not share it with third parties for advertising.

We do not make decisions that have legal consequences for you solely on the basis of automated processing. The calculators on the website show an indicative calculation and do not decide anything for you.

6. Legal grounds

• Your consent (Clause 1, Part 1, Article 6 of the Law). You give it when you tick the consent box in a form. For analytics: when you click “Accept” in the cookie banner. The text of the consent: Consent to personal data processing.
• Entering into and performing a contract (Clause 5, Part 1, Article 6 of the Law): when you contact us as a sole proprietor and, at your initiative, an agency agreement between you and a company of our network is prepared.
• Legal obligations (Clause 2, Part 1, Article 6 of the Law): replying to requests from public authorities, keeping documents for the required periods.
• The operator's legitimate interests (Clause 7, Part 1, Article 6 of the Law): protecting the website and forms against automated submissions and abuse, provided this does not violate your rights.

7. How we process data

We perform the following actions with personal data: collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), depersonalization, blocking, deletion and destruction.

Processing is carried out both with and without automation tools.

We do not disseminate personal data: we do not publish it or disclose it to an indefinite range of persons.

Form data are not stored on the website server. The form handler immediately passes the request to the CRM system and logs only the time, the form type and the result of the submission. To protect against automated submissions, we count the number of submissions from a single IP address and may use a “human or robot” verification service, which receives the IP address and technical information about the browser.

Recording, systematization, accumulation, storage, clarification and retrieval of personal data of Russian citizens are carried out using databases located in Russia (Part 5, Article 18 of the Law).

We take legal, organizational and technical protection measures under Article 19 of the Law: only employees who need the data for their work have access to it, data are transmitted over secure channels, and requests are not stored on the website server.

In the event of a data leak, we will notify Roskomnadzor in the manner and within the time limits set by Part 3.1, Article 21 of the Law.

8. Who we share data with

We share data only with those without whom the purpose of processing cannot be achieved, and only to the extent necessary.

• Agents from our pool. Only the data without which a route cannot be selected, terms calculated or an agreement prepared. As a rule, the payment parameters are enough for a calculation. The agent receives the company name and the representative's details when a client check or preparation of the agreement is needed. The agent must maintain confidentiality and comply with the Law.
• The CRM system. Requests from the website go into the CRM system in which we process them. The system provider processes data on our instructions (Part 3, Article 6 of the Law) and must maintain confidentiality and comply with the Law.
• Hosting and email providers. Form submissions and correspondence pass through their servers.
• The web analytics service. Only if you have agreed to analytics cookies.
• Public authorities. When the law expressly requires it.

If an agent is located outside Russia, the transfer of data to it is a cross-border transfer. We carry it out under the rules of Article 12 of the Law and only to the extent needed for the payment.

9. Cookies and web analytics

Cookies are small files that a website stores in your browser.

Analytics cookies are not needed for the website to work. Your choice in the cookie banner is remembered in your browser so that we do not ask again.

The web analytics service is enabled only if you click “Accept” in the banner at the bottom of the page. If you choose “Necessary only”, the counter is not loaded. If there is no banner on the website, web analytics is not enabled and no analytics cookies are set.

The analytics service receives information about the visit: which pages were opened, where the visitor came from, the device and browser type, and the approximate location based on the IP address. We look at this information in aggregate form.

You can change your mind at any time: clear the website data in your browser, the banner will appear again, and you can choose “Necessary only”. You can also block cookies in your browser settings.

10. How long we keep data

• We keep request data for as long as they are needed to reply, calculate terms and select a route. If no deal takes place, we destroy them within 30 days after the purpose is achieved or consent is withdrawn (Parts 4 and 5, Article 21 of the Law).
• If an agency agreement is concluded following a request, the deal documents are kept for the periods set by law for such documents.
• We keep technical data and website logs no longer than necessary to operate and protect the website.
• Analytics cookies are stored in your browser until you delete them or until the period set by the analytics service expires.

11. Your rights

You have the right to:

• obtain information about the processing of your data: what data we have, where they came from, why and how we process them, who we share them with and how long we keep them;
• demand that we clarify, block or destroy data if they are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose;
• withdraw your consent to processing;
• demand that we stop processing;
• object to a decision made solely on the basis of automated processing;
• appeal against our actions or inaction to Roskomnadzor (the authorized body for the protection of the rights of personal data subjects) or in court.

Response times are set by the Law:

• information about processing: within 10 business days of receiving the request. This period may be extended by no more than 5 business days if we send you a reasoned notice;
• clarification of incomplete, inaccurate or outdated data: within 7 business days after you confirm the inaccuracy;
• destruction of unlawfully obtained or unnecessary data: within 7 business days after confirmation;
• stopping processing at your request: within 10 business days; this period may be extended by no more than 5 business days;
• withdrawal of consent: we stop processing and destroy the data within 30 days if there is no other lawful basis for processing.

A request for information must contain the details of an identity document (yours or your representative's), information confirming that we process your data (for example, the date of the request and the company name), and a signature. An electronic request is signed with an electronic signature (Part 3, Article 14 of the Law).

12. How to withdraw consent

You can withdraw your consent at any time. Send us a withdrawal notice: state which consent you are withdrawing and give the contact details you left in your request so that we can find your data.

Email for withdrawal: privacy@vedmost.ru.

You can also send a withdrawal through the form on the Contact page: state in the comment that you are withdrawing your consent.

After receiving the withdrawal, we stop processing and destroy the data within 30 days unless we have another lawful basis to keep them, such as a legal obligation. Withdrawal does not affect the lawfulness of processing carried out before it was received.

You can opt out of web analytics separately, as described in section 9.

13. Operator contacts

For any questions about the processing of personal data, or to obtain information about, correct or delete your data, contact the operator.

• Email: privacy@vedmost.ru.

All contact details and the contact form are on the Contact page. In your message, tell us how to reach you with a reply.

14. Changes to this policy

We update this policy when the law, the data we process or the processing methods change. The new version takes effect when it is published on this page. The date of the version is shown at the top of the page.

The rules for using the website are set out in the Website terms of use.