Personal Data Processing Policy.

This Policy describes how Nevidio OÜ (trading as "IskraVPN", the "Operator") processes users' personal data when ordering and fulfilling orders on the website. It applies alongside the Privacy Policy.

The Russian version is the primary version. This English version is a convenience translation; in case of discrepancy, the Russian text prevails.

01 General

The Operator processes personal data under applicable data-protection law, including the EU General Data Protection Regulation (GDPR) and, for users in the Russian Federation, having regard to Federal Law No. 152-FZ "On Personal Data". This Policy covers data collected by the Operator through the website.

02 What data is processed

The Operator processes the minimum data needed to fulfil an order:

• Email address — to send the receipt, activation code, and order-related messages.
• Payment reference and confirmation of payment, received from the payment provider.
• Content of support enquiries, if you contact us.

The Operator does not collect your name, address, or phone number, and does not receive card data.

03 Purposes

• concluding and fulfilling the agreement (subscription);
• sending the receipt and activation code;
• user support and handling enquiries, including refunds;
• accounting and compliance with legal obligations.

04 Legal bases

• Consent of the data subject, given at checkout.
• Performance of a contract to which the subject is a party.
• Legal obligations of the Operator (e.g., accounting).

05 Consent and its withdrawal

By placing an order and ticking the consent box, you consent to the processing of the data listed above for the stated purposes. You may withdraw consent at any time by writing to privacy@nevid.io. Withdrawal does not affect processing required by law (e.g., retention of payment documents).

06 Sharing with third parties

The Operator engages a payment provider ([PAYMENT_PROCESSOR]) and hosting providers to process orders. Data is shared only to the extent needed to fulfil the order. The Operator does not sell personal data or share it for advertising. Data may be processed outside the user's country of residence, subject to applicable cross-border transfer rules.

07 Retention

Personal data is processed until the purposes are achieved. Order data and payment documents (including email and receipts) are kept for seven years as required by accounting rules. After the retention periods, data is deleted or anonymized.

08 Data-subject rights

You may access your data, request its correction, deletion, or blocking, and withdraw consent. To exercise your rights, write to privacy@nevid.io; we respond within the period set by applicable law.

09 Security measures

The Operator takes legal, organisational, and technical measures to protect personal data from unauthorised access, alteration, disclosure, or destruction, including transmitting data over secure channels and limiting access to it.

10 Changes

The Operator may amend this Policy. The current version is always available on this website.