IziMarket Privacy Policy

Registration on the Platform, identification and authentication of the User, maintenance of the Account

• categories of data subjects: registered Users;
• personal data: specified in clause 4.1.1, information on sign-ins to the Account (clause 4.2.1);
• legal grounds: performance of the Rules; the Consent as regards entrusting the processing to other persons;
• retention period: for as long as the Account exists and for three years after its deletion.

Conclusion and performance of Deals, conducting the Safe Deal, recording the Balance and Top-ups, payouts and returns of funds

• categories of data subjects: Buyers, including those paying for a Product without registration; Sellers;
• personal data: specified in clause 4.1.2, payout details (clause 4.1.4), correspondence in the Deal chat (clause 4.2.3);
• legal grounds: performance of the Agreements and Deals; the Consent;
• retention periods: information on Deals, the Deal Log and correspondence in the Deal chat are kept for the term of the Agreements and for three years after completion of the Deal (clause 18.4 of the Buyer Agreement); information on payments, Top-ups, returns of funds and payouts is kept for seven years after completion of the transaction, taking into account the requirements of Hong Kong law on the retention of accounting records.

Consideration of disputes over Deals, inquiries and claims, protection of the rights of the Operator and Users, including in court

• categories of data subjects: Buyers; Sellers; persons who have contacted the support service; other persons whose information is contained in evidence;
• personal data: specified in clause 4.1.5 and clauses 4.2.3–4.2.5;
• legal grounds: participation in legal proceedings; performance of the Agreements; exercise of the rights and legitimate interests of the Operator and Users;
• retention periods: within the periods specified in clause 3.2.2; inquiries to the support service and the correspondence on them are kept for three years after the inquiry has been considered; if there is an unresolved dispute, claim or court proceedings, personal data is kept until they are finally resolved.

Ensuring the security of Accounts and settlements, preventing fraud, detecting linked Accounts, circumvention of blocking and settlements outside the Platform

• categories of data subjects: Users;
• personal data: specified in clauses 4.2.1, 4.2.2 and 4.2.4; messages in Platform chats that the Operator's employees review when considering a dispute or a complaint or when fraud is suspected (clause 11.2 of the Rules, clause 4.2.3); information and documents on the ownership of a means of payment (clause 4.1.3);
• legal grounds: performance of the Agreements; exercise of the rights and legitimate interests of the Operator and Users; the Consent;
• retention periods: the device tag and the browser fingerprint are kept for as long as the Account exists and are deleted when it is deleted (Cookie Policy); information and documents on the ownership of a means of payment are kept for one year after the check is completed; technical data of visitors who have no Account and have not made any Deals (clause 4.2.1) is kept for 6 months; other data is kept for the periods specified in clauses 3.2.1 and 3.2.2.

Verification of information about the Seller, payout of funds, communication of information about the Seller to Buyers

• categories of data subjects: Sellers and representatives of Sellers;
• personal data: specified in clause 4.1.4; information and documents submitted at the Operator's request (clause 4.1.3);
• legal grounds: performance of the Seller Agreement; performance of the obligations of an aggregator owner and mandatory disclosure of information about the Seller; the Dissemination Consent as regards information whose disclosure is not required by law (the status and the state of a Seller who is an individual);
• retention periods: for as long as the Account exists and for three years after its deletion; documents submitted for verification are kept for one year after the verification is completed.

Sending service notifications and responses to inquiries

• categories of data subjects: Users; persons who have contacted the Operator;
• personal data: email address, push notification subscription identifier, username on the Platform, contact details provided in the inquiry;
• legal grounds: performance of the Agreements;
• retention periods: for as long as the Account exists and for three years after its deletion; inquiries are kept for three years after they have been considered.

Sending advertising and informational messages

• categories of data subjects: Users who have given the Messages Consent;
• personal data: specified in clause 4.1.6;
• legal ground: the Messages Consent obtained before the mailing starts;
• retention period: until the Messages Consent is withdrawn; after withdrawal, the mailing stops immediately, and the data processed solely for this purpose is destroyed within 30 days.

Publication of the User's profile page, the Seller page, Listings and reviews

• categories of data subjects: Users who have given the Dissemination Consent; Sellers whose information is disclosed by virtue of law;
• personal data: marked by the User in the Dissemination Consent; information about the Seller disclosed by virtue of law (clause 5.2);
• legal grounds: the Dissemination Consent; mandatory disclosure of information in accordance with federal law;
• period: until the Account is deleted or until the Operator receives a demand to stop the dissemination.

Web analytics

• categories of data subjects: visitors to the Platform who have consented to the use of analytics cookies;
• personal data: the information specified in clause 4.4 of the Cookie Policy;
• legal ground: consent to the use of analytics cookies;
• retention periods: determined by the Cookie Policy.

Preparation of aggregated statistics and improvement of the Platform

• categories of data subjects: Users;
• personal data: specified in clauses 4.2.1 and 4.2.4, in depersonalized form;
• legal ground: processing for statistical purposes, subject to mandatory depersonalization;
• retention period: personal data is depersonalized when the statistics are prepared. Aggregated information that does not allow a User to be identified is not personal data.

Performance of obligations imposed on the Operator by law, enforcement of court decisions and requests of competent authorities

• categories of data subjects: Users;
• personal data: to the extent determined by law, a court decision or a request of a competent authority;
• legal grounds: performance of obligations imposed on the Operator by law, enforcement of court decisions and acts of competent authorities;
• retention period: as established by law or by the relevant act.

data provided by the User during registration and sign-in and minimally necessary for them: email address; username on the Platform; profile picture (at the User's discretion); Account access credentials (password, if set, authenticator app data and recovery codes), stored as hash values or in encrypted form; when signing in through a third-party service (Google, Discord, Telegram, Lolzteam), also the identifier, username, first name and last name (if any), email address and profile picture, to the extent permitted by the User in that service (clause 4.1 of the Rules);

data provided during payment, Top-up and performance of Deals: the email address of a Buyer paying for a Product without registration; data provided for receiving the Product (including an identifier in a game or service); Product data transferred on the Deal page, insofar as it relates to the User; information on payments, Top-ups, returns of funds and payouts (payment method, bank, masked card or phone number, transaction identifiers, information about the payer provided by the Payment Partner); details for the return of funds;

data additionally provided at the Operator's request in order to perform the Agreements, prevent fraud and comply with legal requirements: information and documents confirming that the means of payment or the payout details belong to the User, the identity and status of the Seller, and the source of the Product (clause 2.5 of the Seller Agreement), including the details of an identity document and its image. The Operator requests only the information necessary for the check and does not request a photograph of the User for comparison with the document;

data provided by the Seller: last name, first name, patronymic (if any); status (individual, payer of the professional income tax, individual entrepreneur, representative of a legal entity); taxpayer identification number (INN); primary state registration number of an individual entrepreneur (OGRNIP) or registration number in a foreign country; country of residence or registration; location (address) and business hours of an individual entrepreneur; payout details (bank card number, cryptocurrency wallet address, Lolzteam account identifier); information on completion of identification through the Unified Identification and Authentication System;

data contained in inquiries and disputes: correspondence with the support service and the Arbitrator; evidence submitted by the User (screenshots, video recordings, files); Deal Log entries; decisions of the Arbitrator; contact details provided in the inquiry;

data processed where the Messages Consent has been given: email address, push notification subscription identifier, username on the Platform, information on Products viewed and purchased.

technical data obtained when the Platform is accessed: IP address and the approximate location determined from it (city, network), information about the browser, device and operating system, date and time of access, addresses of pages visited, information on sign-ins to the Account. Location by IP address is determined on the Platform's servers using the DB-IP database, and the IP address is not transferred to third parties in the process;

data obtained using cookies and similar technologies: for signed-in Users, the izi_dm device tag and a browser fingerprint calculated by the FingerprintJS library in the User's browser and transferred only to the Platform's servers; with the User's consent, also data from Yandex Metrica analytics cookies. The composition, purposes and retention periods of such data are determined by the Cookie Policy;

information created by the User on the Platform: Listings, reviews and ratings, messages in Platform chats, uploaded files;

information about the User's actions on the Platform: Deals and their statuses, the number of completed Deals, rating, measures applied to the User, information on links between Accounts;

information obtained as a result of other Users' actions: reviews of the User, messages addressed to the User, evidence submitted by the other party to a dispute.

Conditions and legal grounds for processing personal data

The Operator processes personal data on the following grounds:

• the User's consent: the Consent, the Messages Consent, the Dissemination Consent and consent to the use of analytics cookies;
• performance of obligations imposed on the Operator by law;
• participation in legal proceedings and enforcement of court decisions;
• conclusion and performance of the Agreements and Deals to which the User is a party;
• exercise of the rights and legitimate interests of the Operator and third parties, including other Users, provided that this does not violate the rights and freedoms of the User;
• processing for statistical purposes, subject to mandatory depersonalization;
• processing of personal data that is subject to publication or mandatory disclosure in accordance with federal law.

The Consent is required, in particular, to entrust the processing of personal data to the persons specified in clause 5.1.4. If consent is withdrawn, the Operator may continue processing where there are other grounds provided for by law.

Collection of personal data

Personal data is collected:

• during registration and sign-in on the Platform, payment for a Product, Top-up, placement of a Listing, and completion of the profile and the Account settings;
• when messages are sent in Platform chats, disputes are opened and the support service is contacted;
• when information and documents are submitted at the Operator's request;
• automatically when the Platform is used (clauses 4.2.1 and 4.2.2);
• from third parties: third-party sign-in services, the Payment Partner (information on payments and the payer) and other Users (messages in chats, evidence in disputes). The Consent serves as notice to the User of the processing of such data by the Operator.

The personal data specified in clause 4.1.1 is the minimum necessary for registration. The data specified in clause 4.1.2 is necessary for payment and performance of a Deal, and the data specified in clause 4.1.4 is necessary for placing Listings and for payouts. Other data is provided at the User's discretion or at the Operator's request in the cases provided for by the Agreements.

Storage and use of personal data

When personal data of citizens of the Russian Federation is collected, its recording, systematization, accumulation, storage, clarification (updating, modification) and retrieval are carried out using databases located in the territory of the Russian Federation.

Processing is carried out in a mixed manner: with and without the use of automation tools, with transmission over the Internet information and telecommunications network. Personal data is stored on electronic media. Only the Operator's employees and persons entrusted with processing have access to it, to the extent necessary to perform their functions.

Decisions that give rise to legal consequences for the User or otherwise affect the User's rights and legitimate interests are not made on the basis of solely automated processing of personal data. An automatic change of a Deal's status upon expiry of the periods established by the Agreements constitutes performance of the terms of the Agreements. Automated fraud detection tools may suspend a transaction pending a review, and the decision following the review is made by an employee of the Operator.

Personal data is kept for the periods specified in Section 3.

Transfer of personal data

Users' personal data is not transferred to third parties except in the cases provided for by the Policy, the Consent and the law.

Persons entrusted with processing are obliged to comply with the principles and rules of personal data processing, maintain the confidentiality of personal data, ensure its security and store personal data of citizens of the Russian Federation in databases located in the territory of the Russian Federation.

Personal data is provided to the following persons to the extent necessary for the relevant purpose:

• to the other party to a Deal: the username on the Platform and the data necessary to perform the Deal (clause 18.3 of the Buyer Agreement); to the Buyer, also the information about the Seller specified in clause 5.3 of the Buyer Agreement, within the limits of clause 5.2;
• to the other party to a Deal for considering a dispute and bringing claims: to the Buyer at the Buyer's request (clause 12.15 of the Buyer Agreement), to the Seller if the Buyer's payment is cancelled (clause 9.3 of the Seller Agreement): an extract from the Deal Log, the correspondence in the Deal chat, the Arbitrator's decision, and the information held by the Operator that is necessary to bring a claim, including the Seller's last name, first name, patronymic, status, INN and address, the Buyer's email address and information about the payer received from the Payment Partner;
• to the Payment Partner, banks and payment systems: information necessary to make payments, payouts and returns of funds and to consider disputes over cancelled payments, including evidence of the delivery of the Product;
• to the operator of the Lolzteam service: the Lolzteam account identifier and information about the payout, if the Seller has chosen a payout to that account;
• to third-party sign-in services: information necessary for authentication, if the User has chosen to sign in through such a service;
• to the Operator's advisers (lawyers, auditors) to the extent necessary to protect the Operator's rights, provided that they maintain confidentiality;
• to the Operator's legal successor or to a person to whom the Operator's rights and obligations under the Agreements pass, for processing for the purposes specified in the Policy;
• to government authorities and courts in the cases and in the manner provided for by applicable law.

A party to a Deal that has received personal data of the other party uses it only to perform the Deal and to bring claims under it (clause 5.9 of the Seller Agreement, clause 18.3 of the Buyer Agreement).

Personal data may be transferred to the territory of Hong Kong (the Operator's location) and of the countries in whose territory the persons entrusted with processing process personal data (clause 4.1 of the Consent). Before starting a cross-border transfer, the Operator notifies the authorized body for the protection of the rights of personal data subjects and obtains from the foreign recipients information on the measures they take to protect personal data. Transfer to countries that do not ensure adequate protection of the rights of personal data subjects begins no earlier than the expiry of the period established by law for considering the notification.

Destruction of personal data

Personal data is destroyed or depersonalized:

• upon achievement of the purposes of processing or upon expiry of the retention periods specified in Section 3, within 30 days;
• upon withdrawal of consent, if retention of the personal data is no longer required for the purposes of processing and there are no other grounds for processing, within 30 days of the date the withdrawal is received;
• upon detection of unlawful processing, if it is impossible to ensure its lawfulness, within 10 business days of the date of detection.

When an Account is deleted (clause 4.10 of the Rules), the username is replaced with a depersonalized one, Listings are unpublished, and device tags and browser fingerprints are deleted. Information on Deals, disputes and payments is kept for the periods specified in Section 3 in order to protect the rights of the other party to the Deal and to keep records (clause 4.10 of the Rules, clause 20.6 of the Buyer Agreement). When an Account is blocked, personal data is kept until open Deals and settlements have been completed (clause 13.3 of the Rules) and thereafter for the periods specified in Section 3.

If destruction within the established period is impossible, including with respect to backup copies, the personal data is blocked and destroyed within a period not exceeding six months. Destruction is confirmed in the manner established by the authorized body for the protection of the rights of personal data subjects.

receive the information on the processing of their personal data provided for by law, in the manner set out in Section 9;

change information about themselves in the Account settings on their own, provided that such information is accurate and up to date;

delete information they have posted within the functionality of the Platform and delete the Account in the manner set out in clause 4.10 of the Rules;

demand that their personal data be clarified, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing. This right does not depend on whether the User can change or delete the information on their own under clauses 6.1.2 and 6.1.3;

demand that the processing of their personal data be stopped;

withdraw the Consent (Section 7 of the Consent), the Messages Consent (clause 7 of the Messages Consent), the Dissemination Consent (clause 8 of the Dissemination Consent) and consent to the use of analytics cookies (clause 5.4 of the Cookie Policy);

set conditions of and prohibitions on the dissemination of their personal data in the manner set out in clause 6.3;

object to a decision made on the basis of solely automated processing of personal data;

appeal against the actions or inaction of the Operator to the authorized body for the protection of the rights of personal data subjects or in court.

to the other party to a Deal: the username on the Platform and the data necessary to perform the Deal (clause 18.3 of the Buyer Agreement);

to Buyers: information about the Seller disclosed by virtue of law (clause 5.2), and other information specified in clause 5.3 of the Buyer Agreement to the extent of the Dissemination Consent;

to the other party to a Deal when a dispute is considered and for bringing claims: to the extent specified in clause 5.1.4.

In the profile settings, the User marks each item of the list specified in the Dissemination Consent and chooses one of the options: no prohibitions or conditions are set, or prohibitions and conditions are set, including:

• a) a prohibition on the indexing by search engines of Platform pages containing the User's personal data;
• b) a prohibition on the copying, saving and further dissemination of the personal data by an unlimited number of persons;
• c) other prohibitions and conditions specified by the User.

The Operator may not refuse to set prohibitions and conditions. If the User has not chosen any of the options, their personal data is not disseminated.

The Operator publishes information on the processing conditions and on the existence of prohibitions and conditions set by the User on the User's profile page no later than three business days after receiving the Dissemination Consent.

Unticking a box in the profile settings is deemed to be a demand to stop the dissemination of the relevant personal data. The Dissemination Consent ceases to be effective in that part from the moment the demand is received. If the demand concerns information marked with “*” in the Dissemination Consent, the Seller's Listings are unpublished.

The User may demand that any person who processes the User's personal data previously permitted for dissemination in breach of the legal requirements for the dissemination of personal data stop transferring that data, or may apply to a court with such a demand.

When information is deleted from the Platform or the Account is deleted, information previously copied by other Users or third parties may remain with them.