Personal Data Processing Policy

1. General provisions

This Personal Data Processing Policy has been prepared in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (Russian) (the “Personal Data Law”). It sets out the procedures for processing personal data and the measures taken to protect personal data by D. A. Fesenko (the “Operator”).

1.1. The Operator considers respect for human and civil rights and freedoms when processing personal data, including the protection of privacy and personal and family confidentiality, to be a primary objective and a condition of conducting their activities.

1.2. This Personal Data Processing Policy (the “Policy”) applies to all information that the Operator may obtain about visitors to https://dafy.site (the “Website”).

1.3. This Policy explains how personal data is handled when you use the Website. Visiting the Website or continuing to browse does not, by itself, constitute consent to processing that requires consent. Mandatory rights under applicable law remain unaffected.

2. Definitions used in this Policy

2.1. Automated processing of personal data means processing personal data using computer technology.

2.2. Blocking personal data means temporarily suspending its processing, except where processing is necessary to clarify the data.

2.3. Website means the collection of graphic and informational materials, computer programs and databases that make them available online at https://dafy.site.

2.4. Personal data information system means the personal data contained in databases and the information technologies and technical resources used to process it.

2.5. Depersonalisation of personal data means actions that make it impossible, without additional information, to determine whether personal data belongs to a particular User or another data subject.

2.6. Processing of personal data means any action or set of actions performed on personal data, with or without automated tools, including collection, recording, organisation, accumulation, storage, clarification (updating or modification), retrieval, use, transfer (dissemination, provision or access), depersonalisation, blocking, deletion and destruction.

2.7. Operator means a public authority, municipal authority, legal entity or individual that, independently or jointly with others, organises and/or carries out personal data processing and determines its purposes, the personal data to be processed and the actions to be performed on that data.

2.8. Personal data means any information relating directly or indirectly to an identified or identifiable User of https://dafy.site.

2.9. Personal data authorised by the data subject for dissemination means personal data to which the data subject has granted access to an unlimited number of persons by consenting to its processing for dissemination in accordance with the Personal Data Law (“data authorised for dissemination”).

2.10. User means any visitor to https://dafy.site.

2.11. Provision of personal data means actions intended to disclose personal data to a specific person or a defined group of persons.

2.12. Dissemination of personal data means actions intended to disclose personal data to an undefined group of persons or make it available to an unlimited number of persons, including publication in the media, placement on information and telecommunications networks, or granting access by other means.

2.13. Cross-border transfer of personal data means transferring personal data to the territory of a foreign country, to a foreign public authority, individual or legal entity.

2.14. Destruction of personal data means actions that irreversibly destroy personal data so that its contents cannot be restored in a personal data information system and/or destroy physical media containing personal data.

3. The Operator’s principal rights and obligations

3.1. The Operator has the right to:

• Obtain accurate information and/or documents containing personal data from the data subject.
• Continue processing personal data without consent after consent is withdrawn or a request to stop processing is received, where grounds provided by the Personal Data Law permit this.
• Independently determine the measures necessary and sufficient to fulfil obligations under the Personal Data Law and regulations adopted under it, unless otherwise provided by that law or other federal laws.

3.2. The Operator must:

• Provide data subjects, on request, with information about the processing of their personal data.
• Organise personal data processing in accordance with applicable Russian legislation.
• Respond to enquiries and requests from data subjects and their legal representatives as required by the Personal Data Law.
• Provide the authorised authority for the protection of data subjects’ rights with the information it requests within 10 days of receiving the request.
• Publish this Policy or otherwise make it freely accessible.
• Take legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful actions.
• Stop transferring and processing personal data and destroy it in the circumstances and manner prescribed by the Personal Data Law.
• Fulfil other obligations established by the Personal Data Law.

4. Data subjects’ principal rights and obligations

4.1. Data subjects have the right to:

• Receive information about the processing of their personal data, except where federal law provides otherwise. The Operator must provide this information in an accessible form without disclosing other data subjects’ personal data unless lawful grounds exist. The information available and the procedure for obtaining it are established by the Personal Data Law.
• Require the Operator to correct, block or destroy personal data that is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose, and take measures provided by law to protect their rights.
• Require prior consent for processing personal data to market goods, work or services.
• Withdraw consent and request that personal data processing stop.
• Challenge the Operator’s unlawful actions or omissions before the authorised data protection authority or in court.
• Request data portability: transfer of data collected by the Operator to another organisation or directly to the data subject, subject to applicable conditions.
• Exercise other rights provided by Russian legislation.

4.2. Data subjects must provide accurate information about themselves and notify the Operator of corrections, updates or changes to their personal data.

4.3. Persons who provide false information about themselves, or information about another data subject without that person’s consent, are liable in accordance with Russian legislation.

5. Principles of personal data processing

5.1. Personal data is processed lawfully and fairly.

5.2. Processing is limited to specific, predetermined and lawful purposes. Processing incompatible with the purposes for which personal data was collected is not permitted.

5.3. Databases containing personal data processed for incompatible purposes must not be combined.

5.4. Only personal data relevant to the purposes of processing may be processed.

5.5. The content and volume of personal data processed must correspond to the stated purposes and must not be excessive.

5.6. Personal data must be accurate, sufficient and, where necessary, up to date for the purposes of processing. The Operator takes or ensures the necessary measures to delete or correct incomplete or inaccurate data.

5.7. Personal data is retained in an identifiable form no longer than necessary for the purposes of processing, unless a retention period is established by federal law or by a contract to which the data subject is a party, beneficiary or guarantor. Data is destroyed or depersonalised when the purposes have been achieved or are no longer necessary, unless federal law provides otherwise.

6. Purposes of personal data processing

The references to Russian legislation in this table do not replace any separate legal basis or obligations required under applicable European or US law. See Sections 14 and 15.

7. Conditions for processing personal data

7.1. Personal data may be processed with the data subject’s consent.

7.2. Processing may be necessary to perform a contract to which the data subject is a party, beneficiary or guarantor, or to enter into a contract at the data subject’s request or under which the data subject will be a beneficiary or guarantor.

7.3. Processing may be necessary to exercise the rights and legitimate interests of the Operator or third parties, or to achieve objectives of public importance, provided that the data subject’s rights and freedoms are not infringed.

8. Collection, storage, transfer and other processing of personal data

The Operator protects personal data through the legal, organisational and technical measures necessary to meet applicable data protection requirements.

8.1. The Operator safeguards personal data and takes all possible measures to prevent access by unauthorised persons.

8.2. The User’s personal data will not be transferred to third parties except where required by applicable law or where the data subject has consented to a transfer necessary to fulfil obligations under a civil-law contract.

8.3. If personal data is inaccurate, the User may update it by notifying the Operator at dafythereal@gmail.com with the subject “Personal data update”.

8.4. The processing period is determined by the purposes for which personal data was collected, unless a contract or applicable law specifies another period. Users may withdraw their consent at any time by emailing the Operator at dafythereal@gmail.com with the subject “Withdrawal of consent to personal data processing”.

8.5. Information collected by third-party services, including payment systems, communications services and other providers, is stored and processed by those parties under their own user agreements and privacy policies. The Operator is not responsible for those third parties’ actions, without limiting any responsibilities imposed on the Operator by applicable law.

8.6. Restrictions imposed by a data subject on transferring or processing data authorised for dissemination, other than granting or obtaining access, do not apply where processing serves state, social or other public interests defined by Russian legislation.

8.7. The Operator maintains the confidentiality of personal data during processing.

8.8. Personal data is stored in an identifiable form no longer than the processing purposes require, unless a retention period is established by federal law or a contract to which the data subject is a party, beneficiary or guarantor.

8.9. Processing may end when its purposes have been achieved, consent expires or is withdrawn, a request to stop processing is received, or unlawful processing is identified.

8a. Cookies and tracking technologies

8a.1. The Website uses cookies and similar technologies to remember preferences, support analytics and enable affiliate tracking. This may include technologies supplied by third parties.

8a.2. Where applicable law requires consent, non-essential cookies and tracking technologies must remain inactive until the User gives a freely chosen, specific and informed affirmative consent. The cookie controls must offer a clear choice to accept or reject non-essential tracking and manage preferences. Browsing, silence or closing a notice must not be treated as consent.

8a.3. Users must be able to revisit their cookie preferences and withdraw consent as easily as they gave it. Withdrawal must stop subsequent consent-based tracking, without affecting the lawfulness of earlier processing. Cookies can also be managed through browser settings; disabling them may affect some Website functions. Browser settings do not replace the Website’s consent obligations.

8b. Affiliate links

8b.1. The Website contains affiliate (referral) links. Details are provided in the Advertising Disclosure (Russian).

8b.2. When Users follow these links, the Operator does not provide partners with Users’ personal details such as their name, email address or phone number.

8b.3. Following an affiliate link takes the User to a third-party website. That website processes data, including IP addresses and cookies, under its own privacy policy. The Operator is not responsible for that website’s processing, without limiting any responsibilities imposed on the Operator by applicable law.

8c. Third-party services

8c.1. The Website uses the following third-party services for analytics and marketing:

• Yandex Metrica (privacy policy in Russian) for Website usage analytics.
• Affiliate networks, which record referral clicks on the partner’s side.

8c.2. These services may collect technical and usage data through cookies, web beacons and similar technologies. Such data may constitute personal data under applicable law even when it does not include a name. Each service has its own privacy policy, which Users are encouraged to review.

8d. External links

The Website may link to third-party resources. Users follow those links at their own discretion. Dafy Gaming Hub is not responsible for the content or privacy policies of external websites, without limiting obligations imposed by applicable law.

9. Operations performed on personal data

9.1. The Operator collects, records, organises, accumulates, stores, clarifies (updates or modifies), retrieves, uses, transfers (disseminates, provides or grants access to), depersonalises, blocks, deletes and destroys personal data.

9.2. The Operator carries out automated processing, with or without receiving or transmitting information over information and telecommunications networks.

10. Cross-border transfers of personal data

10.1. Before beginning cross-border transfers, the Operator must notify the authorised authority for the protection of data subjects’ rights of their intention to carry out such transfers. This notification is separate from the notification of an intention to process personal data.

10.2. Before submitting that notification, the Operator must obtain the relevant information from the foreign public authorities, individuals or legal entities to which personal data is to be transferred.

10.3. Transfers to foreign countries that do not provide adequate protection may take place in the cases provided by Russian law, including the data subject’s written consent, performance of a contract to which the data subject is a party, or protection of life, health or other vital interests when written consent cannot be obtained. Where GDPR also applies, its separate transfer requirements must be met; see Section 14.

11. Children’s privacy

The Website is not intended for people under 18. The Operator does not intentionally collect minors’ personal data. If you believe a child has submitted personal data through the Website, contact dafythereal@gmail.com to request its removal. Applicable US children’s privacy requirements are described in Section 15.

12. Confidentiality of personal data

The Operator and other persons with access to personal data must not disclose it to third parties or disseminate it without the data subject’s consent unless federal law provides otherwise.

13. Final provisions

13.1. Users may request clarification about the processing of their personal data by emailing the Operator at dafythereal@gmail.com.

13.2. Changes to the Operator’s personal data processing policy will be reflected in this document. This Policy remains in effect until replaced. Changes to the Policy do not by themselves provide consent for new processing that requires consent.

14. European Union and European Economic Area

14.1. Where its territorial and material scope applies, the General Data Protection Regulation (EU) 2016/679 (GDPR) governs processing. Article 3 includes certain non-EU operators offering goods or services to people in the Union or monitoring their behaviour there. Each processing purpose requires an appropriate Article 6 legal basis; Russian legislation alone does not establish that basis.

14.2. Subject to the GDPR’s conditions and exceptions, individuals have rights of access, rectification, erasure, restriction, portability and objection, may withdraw consent, and may complain to a supervisory authority. Send requests to dafythereal@gmail.com. Responses are generally due within one month; an extension of up to two further months requires timely notice and reasons.

14.3. Where GDPR transfer rules apply, transfers outside the EEA require a valid Chapter V mechanism, such as an adequacy decision or appropriate safeguards, unless a permitted derogation applies. This Policy does not itself establish such a mechanism.

14.4. Article 5(3) of Directive 2002/58/EC (ePrivacy Directive), as implemented in national law, generally requires prior consent for storing or accessing information on a device. Exceptions include operations strictly necessary for a service explicitly requested by the user or solely for transmitting a communication. Non-essential analytics or advertising must not be treated as necessary merely because they support the Website. Section 8a describes the required consent controls.

15. United States

15.1. California residents may have rights under the California Consumer Privacy Act (CCPA), as amended by the CPRA, where the Operator meets its business and other applicability requirements. These include rights to know, delete and correct personal information, opt out of its sale or sharing, limit certain uses of sensitive personal information, and receive non-discriminatory treatment. Exceptions apply. See the California Attorney General’s explanation.

15.2. Send privacy requests to dafythereal@gmail.com. Where the CCPA applies, legally required opt-out methods, including recognition of qualifying Global Privacy Control signals, must be available. “Sharing” can include cross-context behavioural advertising without payment. Affiliate or advertising arrangements require assessment; this Policy does not declare that all such activity is exempt from sale or sharing rules.

15.3. Other US state privacy laws may provide additional rights depending on residency, the activity involved and statutory thresholds or exemptions. Mandatory rights under applicable law are not limited by this Policy. Contact the Operator to raise a request concerning your jurisdiction.

15.4. The Children’s Online Privacy Protection Act and COPPA Rule impose requirements on covered services directed to children under 13 and services with actual knowledge that they collect personal information from children under 13. Where applicable, the Operator must meet the parental notice, verifiable consent and other requirements before collecting such information, unless a legal exception applies. The Website’s stated adult audience does not override COPPA where its actual applicability conditions are met.

Contact the personal data operator

For privacy enquiries and requests, email dafythereal@gmail.com.