Consent to the Processing of Personal Data of IziMarket Users

The Consent is given by ticking a separate checkbox “I consent to the processing of personal data on the terms of the Consent” next to a link to the text of the Consent. The checkbox is shown at registration, at the first sign-in through a third-party service and when paying for a Product without registration. It is not ticked by default. Until the checkbox is ticked, data whose processing requires the Consent is not processed.

The Consent is executed separately from the Rules, the Policy, the Agreements and other consents (clause 1.3 of the Rules, clause 1.6 of the Policy). Acceptance of the Rules (clause 1.2 of the Rules) is not the Consent, and the Consent does not replace acceptance. The Consent to Receive Advertising and Informational Messages and the consent to the dissemination of personal data are given by their own checkboxes, and consent to the processing of personal data using analytics cookies is given by clicking the “Accept all” button in the cookie notice (clause 4.1 of the Cookie Policy). The Consent does not cover them.

I confirm that I have reached 18 years of age. The Operator does not accept the Consent from persons under 18 years of age (clause 4.1 of the Rules, clause 2.3 of the Policy).

The Operator records the date and time the Consent was obtained, the version of its text, the identifier of my Account or the email address provided when paying without registration, the IP address and the browser identifier. This information confirms that the Consent was obtained (Part 3 of Article 9 of the Law).

I have the right not to give the Consent, in which case I can browse the Platform without registration. The Operator processes the data without which an Agreement cannot be concluded and performed even without the Consent, on the basis of that Agreement (clause 5 of Part 1 of Article 6 of the Law). The Consent is required for processing that cannot be carried out on that basis: entrusting processing to third parties (Part 3 of Article 6 of the Law), transfer of data outside Russia and the application of the security measures referred to in clause 2.1. If the Operator cannot provide services without such processing, and the applicable law does not permit it without consent, the Operator may suspend them until the Consent is obtained. By giving the Consent, I permit the processing of my data for the purposes, to the extent and by the methods specified in the Consent, and I may withdraw it at any time in the manner set out in Section 7.

I give the Consent to the processing of my personal data for the following purposes:

• registration, identification and authentication, maintenance of the Account, including sign-in through a third-party service;
• conclusion and performance of Deals: conducting the Safe Deal, recording the Balance and Top-ups, payouts and returns of funds, transfer of data to the other party to the Deal and to the Payment Partner;
• ensuring the security of Accounts and settlements: preventing fraud, detecting linked Accounts, circumvention of blocking and settlements outside the Platform, verifying the ownership of a means of payment.

For other purposes (consideration of disputes, verification of Sellers and payouts to them, service notifications, compliance with legal requirements), the Operator acts on the grounds specified in Section 3 of the Policy. The Consent neither cancels nor narrows these grounds.

I give the Consent to the processing of the following personal data (for details, see Section 4 of the Policy):

• at registration and sign-in: email address, username on the Platform, profile picture (if I have added one), Account access credentials (password, if set, authenticator app data and recovery codes) as hash values or in encrypted form; when signing in through Google, Discord, Telegram or Lolzteam, also the identifier, username, first name and last name (if any), email address and profile picture, to the extent I have permitted in that service (clause 4.1.1 of the Policy);
• when paying, making Top-ups and performing Deals: email address (when paying without registration), data for receiving the Product, including the identifier in a game or service, the Product data on the Deal page to the extent that it relates to me, information on payments, Top-ups, returns of funds and payouts (payment method, bank, masked card or phone number, transaction identifiers, information about the payer provided by the Payment Partner), payment details for returns and payouts (clauses 4.1.2 and 4.1.4 of the Policy);
• if I am a Seller, the information I have provided at the Operator's request or in cases provided for by law: last name, first name, patronymic (if any), status, taxpayer identification number (INN), primary state registration number of an individual entrepreneur (OGRNIP) or registration number in a foreign country, country of residence or registration, location (address) and business hours of an individual entrepreneur, as well as information on completion of identification through the Unified Identification and Authentication System, if I have completed it (clause 4.1.4 of the Policy);
• information and documents confirming that the means of payment or the payout details belong to me, including the information in the identity document and an image of it, if the Operator has requested them for verification (clause 4.1.3 of the Policy);
• messages in Platform chats and Deal Log entries that the Operator's employees review when considering a dispute or a complaint or when fraud is suspected; each such case is recorded (clause 12.2 of the Rules, clause 18.5 of the Buyer Agreement);
• technical data: IP address and the approximate location determined from it, information about the browser, device and operating system, date and time of access, addresses of the pages visited, information on sign-ins to the Account, results of checks for automated actions (CAPTCHA), the device tag and the browser fingerprint (clauses 4.2.1 and 4.2.2 of the Policy);
• information about my actions on the Platform: Deals and their statuses, the number of completed Deals, rating, measures applied to me, links between Accounts (clause 4.2.4 of the Policy).

The Operator does not process special categories of personal data or biometric personal data under the Consent. The image of a document is used only to verify the information it contains and is not used to establish identity.

I give the Consent to the following actions with my data: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), depersonalization, blocking, deletion and destruction. Processing is carried out in a mixed manner, with and without the use of automation tools, with transmission over the Internet. Automated fraud detection tools may suspend a transaction pending a review, and the decision following the review is made by an employee of the Operator. Decisions that give rise to legal consequences for me are not made solely on the basis of automated processing (clause 5.1.3 of the Policy).

I agree that my personal data may be transferred to the territory of Hong Kong (the Operator's location) and of the countries in whose territory the persons entrusted with processing by the Operator process personal data, and, if I am a citizen of the Russian Federation, only after it has been recorded in databases located in the territory of the Russian Federation (clause 5.1.3 of the Policy). I have been informed that in some of these countries the level of protection of the rights of personal data subjects may be lower than in the country of my residence, which may make it more difficult to protect my rights; the Operator applies the protective measures specified in clause 5.1.4 of the Policy.

The Operator may entrust processing to third parties on the basis of agreements with them. These persons are obliged to comply with the principles and rules of processing and to ensure the confidentiality and security of the data (Part 3 of Article 6 of the Law, clause 5.1.4 of the Policy). I agree to processing being entrusted to these persons to the extent necessary for their function.

Before starting a cross-border transfer, the Operator notifies the authorized body for the protection of the rights of personal data subjects and obtains from the foreign recipients information on the protective measures they take. Transfer to countries that do not ensure adequate protection of the rights of personal data subjects begins no earlier than the expiry of the period for consideration of the notification established by law (clause 5.1.4 of the Policy).

In addition to the persons entrusted with processing, I agree to the transfer of my data, to the extent necessary for the purposes set out in clause 2.1:

• to the other party to the Deal: the username on the Platform and the data necessary to perform the Deal; in the event of a dispute or a claim (to the Buyer at the Buyer's request, to the Seller in the event of a cancellation of the Buyer's payment under clause 9.3 of the Seller Agreement), also an extract from the Deal Log, the correspondence in the Deal chat, the Arbitrator's decision and the information available to the Operator that is necessary for the claim, including the last name, first name, patronymic, status, taxpayer identification number (INN) and address of the Seller, the Buyer's email address and information about the payer provided by the Payment Partner (clause 5.1.4 of the Policy);
• to the Payment Partner, banks and payment systems: information for payments, payouts and returns of funds and for considering disputes over cancelled payments, including evidence of the delivery of the Product;
• to the operator of the Lolzteam service: the identifier of my Lolzteam account and information about the payment or payout, if I have chosen payment through LolzTeam Market or a payout to that account (clause 8.2 of the Rules);
• to third-party sign-in services and the push notification service of my browser (Google, Apple, Mozilla or Microsoft): if I have chosen to sign in through such a service or have enabled push notifications;
• to the provider of the service for protection against automated actions (CAPTCHA): the technical data necessary for the check;
• to the Operator's advisers (lawyers, auditors): to the extent necessary to protect the Operator's rights, provided that they maintain confidentiality;
• to the Operator's legal successor or to a person to whom the Operator's rights and obligations under the Agreements pass: for processing for the purposes specified in the Policy.

A party to a Deal that has received my data may use it only to perform the Deal and to make claims under it (clause 18.3 of the Buyer Agreement, clause 5.9 of the Seller Agreement).

I have been notified that the Operator receives my data not only from me, but also from third-party sign-in services, the Payment Partner and other Users (messages in chats, evidence in disputes). I agree to its processing on the terms of the Consent (clause 5.1.2 of the Policy).

If I transfer personal data of other persons to the Operator, I confirm that I have lawful grounds for doing so (clause 2.1 of the Policy).

The Consent is valid from the moment it is given until it is withdrawn. If it is not withdrawn, processing under the Consent ends when the purposes have been achieved and the retention periods specified in Section 3 of the Policy have expired. The main periods:

• Account data: for as long as the Account exists and for three years after its deletion;
• information on Deals, the Deal Log and correspondence in the Deal chat: for the term of the Agreements and for three years after completion of the Deal;
• information on payments, Top-ups, returns of funds and payouts: seven years after completion of the transaction;
• the device tag and the browser fingerprint: for as long as the Account exists; they are destroyed when it is deleted;
• information and documents on the ownership of a means of payment: one year after the check is completed;
• technical data of visitors who have no Account and have not made any Deals: six months;
• if there is an unresolved dispute, claim or court proceedings: until they are finally resolved.

Deletion of the Account (clause 5.10 of the Rules) does not in itself constitute withdrawal of the Consent. The data is destroyed in the manner set out in clause 5.1.5 of the Policy.

I may withdraw the Consent at any time, in free form, in one of the following ways:

• by an email to admin@lolz.team sent from the address linked to the Account, or by a message to the support service chat in the Account (clause 17.2 of the Rules);
• by a written application sent to the Operator's address specified at the beginning of the Consent;
• by an electronic document signed with an electronic signature in accordance with the legislation of the Russian Federation.

Upon receiving the withdrawal, the Operator stops the processing, unless it has other grounds for it, and destroys the data within 15 days if its storage is no longer required for the purposes of processing, or, if destruction is technically impossible, blocks it; the Operator notifies me of this within the same period. The periods for considering requests are specified in Section 9 of the Policy.

The Operator may continue processing without the Consent where there are grounds provided for by clauses 2–11 of Part 1 of Article 6 of the Law: for example, to perform an Agreement and open Deals, to keep records of payments, to participate in a court dispute or to comply with legal requirements (Part 2 of Article 9 of the Law). Withdrawal does not affect the lawfulness of processing before it was received and does not release me from my obligations under open Deals.

If the Operator cannot provide services without the processing for which I have withdrawn the Consent, and the applicable law does not permit it without consent, the Operator may suspend them. I may delete the Account under clause 5.10 of the Rules after completing open Deals and withdrawing the available funds.

Withdrawal of the Consent does not withdraw my other consents listed in clause 1.2. Each of them is withdrawn separately.

I have the right to receive information about the processing of my data, to demand that it be clarified, blocked or destroyed, to demand that processing be stopped, to object to a decision made solely on the basis of automated processing, and to appeal against the Operator's actions to the authorized body for the protection of the rights of personal data subjects, including in the country of my residence, or in court (clause 6.1 of the Policy).

Requests and demands, including a withdrawal, are sent by the methods set out in clause 7.1. The Operator considers a request received from the support service chat in the Account or from the email address linked to the Account even without information about my identity document, if it follows from the request that it comes from me. The content of other requests and the response periods are specified in Section 9 of the Policy.

Requests to the person responsible for organizing the processing of personal data are sent to admin@lolz.team with the subject line “Персональные данные” (“Personal data”).

The Operator publishes a new version of the Consent on the Platform with its date, keeps previous versions and provides them on request. The Operator notifies me of material changes in the Account and/or by email no later than 15 days before they take effect (clause 1.4 of the Policy). The Consent I have given is valid in the version for which it was obtained.

A new version that broadens the purposes of processing, the list of data, the actions with it, the range of recipients, the persons entrusted with processing or the countries of transfer applies to me only after I give a new Consent. The Operator requests it by a separate checkbox at my next sign-in. Continued use of the Platform is not deemed a new Consent. Until a new Consent is obtained, the Operator processes my data to the extent of the previous Consent and on other grounds provided for by law.

The processing of personal data under the Consent is governed by the legislation of the Russian Federation on personal data, regardless of the law applicable to the Agreements.

The Consent is drawn up in Russian. The Operator publishes a translation of the Consent into English. In the event of any discrepancy between the texts, the Russian text prevails.

In the event of a conflict between the Policy and the Consent, the terms of the Consent apply (clause 1.5 of the Policy). The Policy is not a consent to the processing of personal data.