Terms and definitions
Policy: this personal data Processing policy.
User (personal data subject): our counterparty under the public offer, who may be an individual using the website, personal account or Telegram bot to access Envy VPN services.
GDPR or Regulation: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of their personal data and on the free movement of such data, repealing Directive 95/46/EC, as amended, supplemented and periodically applied and incorporated into the national legislation of member countries.
Personal data: any information relating to an identified or identifiable individual. An identifiable individual is a person who can be identified directly or indirectly, particularly by reference to identifiers such as a name, identification number, location data, online identifier, or one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity.
Personal data Processing: any action or set of actions performed on personal data, with or without automated tools, including collection, recording, organisation, accumulation, storage, clarification (updating or modification), retrieval, use, transfer (distribution, provision or access), anonymisation, blocking, deletion and destruction. Personal data is processed using mixed methods, including automated processing.
Automated personal data Processing: processing personal data using computing equipment.
Personal data Confidentiality: a requirement binding on us or any other person with access to personal data not to disclose it without the personal data Subject’s consent or another lawful ground.
Personal data Anonymisation: actions that make it impossible to determine which particular personal data subject the data relates to without additional information.
Payment: a payment transaction performed by the user on the website.
Website: the official Envy VPN website, web.envy0xc0.com; personal account: app.envy0xc0.com.
Cookies: a small text file placed by the website on your computer or device when, for example, you visit certain website sections or use certain website functions.
Subject and grounds of personal data Processing
Subject of the policy. This policy applies to relations between us and you involving personal data Processing in connection with using the website, personal account, Telegram bot and the service’s provision of services, arising from your acceptance of the public offer.
Processing grounds. The ground for processing your personal data is always your consent. Without agreement to this policy, we cannot fully perform obligations under contracts with you; we have therefore made agreement to this policy a mandatory condition of entering into those contracts.
Duration of the policy and personal data Processing
Policy duration. After acceptance, the policy remains in force indefinitely. This does not affect the duration of your personal data processing, which is established by this policy.
Personal data processing period. Generally, we process your personal data throughout the existence of your personal account and for 5 years after its deletion, or after receipt of a duly completed written withdrawal of your consent, unless a retention period is established by applicable law, the public offer or another contract concerning website use to which you are a party. In other cases, we stop processing if you object or withdraw previously given consent under this policy. We may then be unable to perform obligations under contracts with you.
Changes. We may change the policy at any time, including because of changes to our business processes, external factors or other reasons. We immediately publish the revised policy on the website so that you can read it. We notify you of changes through your personal account and/or publication on the website. If you continue using the website after changes, we unconditionally consider that you agree to the revised policy.
Development grounds, purposes and principles of the policy
Development grounds. The policy was developed to meet the requirements of: GDPR, CalOPPA, CCPA, PECR, Federal Law No. 152-FZ and other laws and subordinate legislation determining cases and features of the personal data Subject’s personal data processing.
Purposes. The policy seeks to:
- Protect human and civil rights and freedoms during personal data processing, including privacy, personal and family confidentiality
- Prevent unauthorised actions, unlawful or accidental access by third parties, and destruction, modification, blocking, copying or distribution of your personal data
- Ensure the legal and regulatory framework of confidentiality and control over your personal data; and
- Protect constitutional rights to personal confidentiality, confidentiality of personal data and prevent potential threats to your security.
The policy’s main purpose is to give you a complete and transparent understanding of the legal basis for collecting and processing your personal data; the categories we may collect; what happens to collected data; where we process it; how long we retain it; whom we may share it with; and your rights as a personal data Subject.
Principles. We follow these principles:
- Processing must be lawful and fair
- Processing must be limited to specific, predetermined and lawful purposes, with no processing incompatible with collection purposes
- The content and amount of data must match stated purposes and must not be excessive
- Data accuracy, sufficiency and relevance to processing purposes must be ensured; and
- Data must not be stored longer than required by processing purposes unless another retention period or method of determining it is provided by this policy.
personal data collected
Website registration. Under the public offer, when you register we collect:
- Your name, if you provide your personal name; and
- Your email address.
Service data. After registration, Envy VPN services are available to you. You must enter the personal account identifier in Envy VPN, which may contain personal data. In that case, you are considered to have consented to processing that data.
Payment data. Payment requires:
- Card number
- Expiry date (month/year); and
- Card security code (PPK2/CVC2/CVV2). These entered details are stored by our payment partners. We do not collect or store payment data within relations arising under the public offer.
Technical data. While you use the website, we automatically collect some personal data. This includes technical information such as the Internet Protocol (IP) address connecting your computer to the Internet, login data, browser type and version, time zone settings, browser plug-in types and versions, operating system and platform, information about your website visits and other data.
Other data. In exceptional cases we may ask for additional personal data. We will notify you beforehand and request additional consent to its processing.
Third-party personal data. If you provide third parties’ personal data, you warrant that you have obtained all necessary consents, including consent to transfer data, and other documents needed to implement this policy, in the form and under each person’s applicable law (Third-party Consent). If you act as their data controller, you also warrant a transfer and protection procedure at least equivalent to this policy. Third-party Consent must be in writing, and you must provide the original within 7 calendar days of a request from the Controller. Providing third-party personal data without these guarantees is prohibited, and you accept full liability for breaching them.
Rights of the personal data Subject
Information. You may obtain information about us, our location and whether we hold your personal data, and inspect that data.
Correction. You may require correction, blocking or destruction if data is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated processing purpose, and take measures provided by law to protect your rights.
Form of disclosure. Information about personal data held by us is provided in an accessible form and does not contain other subjects’ personal data.
Access procedure. You or your legal representative may access your data by appearing in person or submitting a written request. The request must include the number of your or your representative’s principal identity document, its issue date and issuing authority, and a handwritten signature. Requests may be sent electronically. We must reply within 30 days of receipt; this may be extended to 60 days depending on request complexity and volume.
Response content. You may request:
- Confirmation of processing and its purpose
- Processing methods
- The Controller’s name and location and information about persons with access or to whom access may be provided
- The data processed and its source
- Processing and retention periods; and
- The legal consequences that processing may have for the personal data Subject.
Withdrawing consent. You may withdraw consent, restrict processing methods and forms, and prohibit disclosure without your consent.
Right to appeal. You may challenge our actions or omissions before the competent data protection authority or in court.
Right to protection. You have the right to protect your rights and legitimate interests, including claiming damages and compensation for non-material harm through a court.
personal data transfer
Personal data transfer. For processing purposes we may need to provide data to:
- The payment partner and credit institutions participating in payments to maintain online payment security through the authorisation page, as defined by payment system security protocols, acquiring banks and electronic payment issuers under the public offer
- Fraud prevention bodies, including activity and financial fraud prevention organisations; and
- Public authorities, particularly executive authorities.
Mandatory and optional transfer. Transfer may be mandatory for device information such as IP address, operating system, geographic data, device ID/type, browser/app channel, payment authorisation and identification/verification. It may be optional for address-matching indicators, account information and other data.
personal data storage
Personal data localisation. If you are a citizen of an EEA member state or the United Kingdom, your personal data is collected and processed in the EEA. If you are a citizen of the Russian Federation, we store your data on servers located in the Russian Federation.
Final provisions
Severability. If one or more policy provisions are found invalid or inapplicable, they are considered replaced by valid provisions as close as possible in meaning. The policy cannot be held invalid in full under any circumstances.