Privacy Policy

Edition 2026-10-12

1. General Provisions

1.1. This Policy defines the procedure for processing personal data of clients of the A7 International Platform (hereinafter referred to as the "Platform" or “Operator”) in accordance with the applicable legislation to the Platform in the field of personal data processing.

1.2. The purpose of collecting, processing, and using personal data is to ensure the Platform's obligations to its clients, including but not limited to the provision of services, fulfillment of contractual obligations, and providing information about products and services.

1.3. All operations with personal data (collection, storage, use, modification, distribution, and destruction) must be performed in accordance with the principles of legality, good faith, and transparency.

1.4. This Policy applies to all personal data that the Platform receives from its clients.

2. Key Terms and Definitions

2.1. Client – a capable natural person who has reached the age of 18 and has entered into or intends to enter into an agreement with the Platform.

2.2. Personal data processing – any action (operation) or set of actions (operations) with personal data, performed with personal data, regardless of the methods, by the Platform or on its behalf, including using automated tools. Such actions (operations) include: collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), anonymization, blocking, deletion, destruction of personal data.

2.3. Personal data – information recorded on a material medium about a specific person, which is identified with them or can be identified with them, allowing for the identification of this person directly or indirectly, in particularу, by reference to one or more factors specific to their biological, economic, cultural, civil, or social identity.

2.4. Data subject – a natural person to whom personal data relates.

3. Composition and Updating of clients' Personal Data

3.1. The role of the Platform in processing personal data of Users is as follows:

3.1.1. Acts as the operator (owner of the record) when processing personal data of its Users (clients, their representatives, beneficiaries);

3.1.2. May also act as a data processor within the framework of partnership agreements with banks and other financial institutions, where data processing is conducted on behalf of such organizations;

3.1.3. Provides its digital services in accordance with the terms of the Terms of Use.

3.2. The Platform processes the following categories of clients' personal data:

• First name, last name, patronymic;
• Passport information;
• Address of residence (or stay);
• Email address;
• User's mobile phone number;
• Information regarding banking details;
• IP address;
• Information contained in cookies;
• Other information provided by the User.

3.3. The Platform may also collect and process anonymized technical data about clients visiting the Platform’s official website, including: cookies; user IP address; type and version of operating system and browser; geographical location; source of access to the website and interaction history with the interface.

3.4. If personal data is incomplete, inaccurate, or outdated, the client has the right to request its updating and also has the right to withdraw their consent to the processing of personal data at any time by sending an appropriate written request to the Platform.

3.5. The Platform does not verify the accuracy of the personal data provided by the client. The Platform assumes that the client:

• Is a capable natural person (in the case of the client's incapacity, consent to process personal data is provided by their legal representative);
• Provides accurate and sufficient information about themselves (or about the person they represent);
• Independently maintains the presented personal data up to date.

4. Legal Grounds and Terms for Processing Personal Data

4.1. The Platform processes personal data exclusively for the following purposes based on the legal grounds set out in the applicable legislation to the Platform:

4.1.1. Identification and authentication of users (including representatives of legal entities) when authorizing in the user’s personal account, providing services based on user orders and applications, as well as granting access to the Platform;

4.1.2. Monitoring compliance with regulatory requirements (anti-money laundering and counter-terrorism financing);

4.1.3. Operation of digital services (online receipt of applications and orders from clients, provision of Platform services, including client personal accounts, API interfaces, and technical support);

4.1.4. Sending notifications, statements, reports, and marketing messages (in case of a separate consent);

4.1.5. Interaction with partner banks, clearing services, and other financial services and systems under agency agreements.

4.2. Processing is based on the consent obtained in accordance with the applicable legislation to the Platform (voluntary, specific, informed, and unambiguous consent to the processing of personal data). Consent for the processing of personal data is effective from the day it is provided by the client until it is revoked by the client, unless otherwise provided by the applicable legislation to the Platform . The client has the right to withdraw the consent provided to the Platform at any time in the manner established by this Policy.

5. Principles of Processing Personal Data

5.1. The processing of personal data is carried out based on the principles established in applicable legislation to the Platform:

• Legality, fairness, and transparency;
• Purpose limitation – data processing is limited to specific, predetermined, and legitimate purposes;
• Data minimization – the processed data must be adequate, relevant, and not excessive;
• Accuracy – data must be accurate and, where necessary, up to date;
• Storage limitation – data is retained no longer than necessary;
• Integrity and confidentiality – appropriate security measures.

6. Client Rights as a Data Subject

6.1. The client has the following rights in accordance with the applicable legislation to the Platform:

• Right for information – to obtain confirmation of processing, purposes, categories of data, recipients, retention period, and other information. The Operator is obliged to provide this information within seven business days from the date of request.
• Right of access – to receive a copy of all personal data concerning the data subject. The Operator must provide this information within seven business days.
• Right to rectification – the right to correct or supplement incomplete, inaccurate, or outdated data. The Operator must respond within seven business days.
• Right to deletion (right to be forgotten) – the right to delete personal data if they are no longer needed, consent has been revoked, and there are no other legal grounds for storing personal data. The Operator is obliged to delete the data immediately upon request.
• Right to restriction of processing– the Operator restricts the processing of data upon receiving objections from the Client. The Operator must inform the data subject of the introduction or removal of restrictions on the processing of personal data.
• Right to object – to object to the processing of data to protect their legal interests, for the purposes of direct marketing activities, or in cases of unfair processing. The Operator must immediately cease processing data unless it provides sufficient legitimate grounds for continuing processing.
• Right to data portability – to receive the personal data provided to the Operator in a structured, commonly used, machine-readable format and transfer it to another data controller if the processing is based on consent or contract and is carried out by automated means.
• Right to file a complaint – with the industry body for personal data protection or in court.

7. Duties of the Platform

7.1. The Platform is obliged to:

• Process clients' personal data solely on legal grounds, for purposes agreed with the client, and in accordance with the applicable legislation to the Platform;
• Ensure confidentiality, security, and protection of personal data from unauthorized or accidental access, alteration, blocking, copying, distribution, as well as from other unlawful actions;
• Take necessary legal, organizational, and technical measures to protect personal data in accordance with the requirements of the applicable legislation to the Platform;
• Retain personal data in a form that allows the identification of the data subject for no longer than necessary for the purposes of processing, unless a longer period is established by law or agreement;
• Ensure the timely destruction or anonymization of personal data upon achieving the purposes of processing, in the event of the client withdrawing consent, or upon termination of legal grounds for processing.

8. Procedure and Conditions for Processing Personal Data

8.1. The processing of clients' personal data is carried out by the Platform under the following conditions:

• Processing of personal data may be carried out by automated, non-automated, or mixed methods;
• Collection, recording, systematization, accumulation, and storage of clients' personal data are conducted using databases located within the territory of the main operation by the Platform;
• The Platform undertakes not to transfer personal data received from clients to third parties, except as provided by the applicable legislation to the Platform and this Policy;
• Transfer of clients’ personal data to third parties (Platform partners) for the fulfillment of obligations to clients is carried out exclusively with the consent of the clients;
• The Platform and third parties who have access to clients' personal data on legal grounds are obliged to maintain confidentiality and not disclose or distribute personal data without the clients' consent, unless otherwise provided by the applicable legislation to the Platform.

8.2. The Platform shall compile a list of third parties (Platform partners) to whom clients' personal data may be transferred and ensures access for clients to this list by posting it on the official website of the Platform or by other accessible means.

8.3. The client has the right to receive information from the Platform concerning the processing of their personal data. The Platform shall provide the client or their legal representative with access to personal data pertaining to the client free of charge within a period not exceeding 7 (seven) days from the date of the corresponding request. If any incompleteness, inaccuracy, or outdated information is identified, the Platform is obliged, based on the client's request, to make the necessary amendments to their personal data within a period not exceeding 7 (seven) business days and notify the client in writing of the changes made.

8.4. A written request from the client for access to or modification of data must contain: the client’s full name, details of the identity document (series, number, authority and date of issuance), information confirming the client’s participation in the relationship with the Platform (agreement number, date), or other information confirming the fact of processing personal data by the Platform. The request may be sent in the form of an electronic document.

8.5. If, during the review or based on the client’s request, it is established that personal data has been unlawfully collected or processed, the Platform is obliged to block such data within 3 (three) business days for the duration of the investigation. If illegal acquisition, unlawful processing, or inconsistency of actions with personal data concerning the stated purposes is confirmed, the Platform must immediately destroy such data and inform the client in writing about the measures taken.

8.6. The Platform is obliged to cease processing personal data (and ensure the cessation of such processing by third parties – partners of the Platform) in the following cases:

• Detection of unlawful processing of personal data;
• Withdrawal of consent by the client for processing their personal data;
• Achievement of the purposes of processing personal data.

In the event of the occurrences described in this clause, the Platform shall cease processing personal data and shall destroy or anonymize the personal data in a manner that excludes the possibility of restoring the identity of the client within a period not exceeding 7 (seven) days from the date of achieving the processing purpose or receiving a request for withdrawal of consent, unless otherwise provided by the agreement between the Platform and the client or the applicable legislation to the Platform.

9. Measures to Ensure the Security of Personal Data

9.1. The Platform applies necessary legal, organizational, and technical measures to protect clients' personal data from unlawful or accidental access, destruction, alteration, blocking, copying, distribution, as well as from other unlawful actions, in accordance with applicable legislation to the Platform. Such measures include:

• Restriction of the number of persons having access to personal data, and provision of such access exclusively to the authorized personal of the Platform for the performance of their official duties.
• Using certified antivirus software and specialized information protection systems against unauthorized access;
• Employ of modern encryption methods and cryptographic protection when transmitting and storing personal data;
• Ensuring physical security of the premises and technical means where components of personal data information systems are located;
• Appointing a responsible person for organizing the processing and ensuring the security of personal data within the Platform;
• Conducting regular audits of information systems to identify vulnerabilities and ensure compliance with information security requirements.

9.2. In the event of unlawful or accidental transmission (provision, distribution, access) of personal data, resulting in a violation of clients' rights (security incident), the Platform shall promptly, upon detecting such an incident, localize the source of the leak, conduct an internal investigation, and take measures to minimize negative consequences.

10. Procedure for Storing and Destroying of Personal Data

10.1. The storage of clients' personal data must be conducted in a way that allows identification of the data subject (client) for no longer than necessary for the purposes of processing, except where the storage period is established by the applicable legislation to the Platform or an agreement to which the Client is a party.

10.1.1. Specific storage periods:

• Client data related to account servicing and transactions must be stored for 5 years after the termination of the contractual relationship with the Platform (in accordance with legislation on anti-money laundering and counter-terrorism financing).
• Access logs (IP addresses, logs) must be stored for 1 year.
• Marketing data – until consent is withdrawn.
• Data processed under the Terms of Use is retained for the duration of the agreement, and after its termination – for the period necessary to consider potential claims (generally up to 3 years, unless a longer storage period is required by law).

10.1.2. Upon the expiration of the storage period, personal data shall be destroyed or anonymized in accordance with applicable legislation to the Platform.

10.2. Clients' personal data shall be destroyed or anonymized upon reaching the purposes of processing, in case of withdrawal of consent by the client, or when the need to achieve these purposes ceases, unless otherwise provided by the applicable legislation to the Platform.

10.3. The destruction of personal data shall be carried out in a manner that excludes the possibility of subsequent restoration of the content of personal data in the information system or physical medium. An appropriate act shall be drawn up regarding the destruction of clients' personal data at the Platform, if necessary.

11. Final Provisions

11.1. This Policy shall come into force upon its approval and shall remain in effect indefinitely. The Policy shall be reviewed and updated as the applicable legislation to the Platform in the field of personal data or the internal processes of the Platform change.

11.2. The Platform reserves the right to make changes and amendments to this Policy unilaterally at any time. The new edition of the Policy shall come into effect upon its approval by the Platform, unless otherwise provided by the edition itself.

11.3. The Platform provides clients with free access to the current edition of the Policy by posting it on the Platform.

11.4. In all matters not regulated by this Policy, the Operator shall be guided by the provisions of applicable legislation.