Privacy Policy

This English version is a translation provided for convenience. If it differs from the Russian version, the Russian version prevails (clause 13.4 of the Terms of Use).

1. General provisions

1.1. This Policy describes how the Operator of the Vitrina service (the bot @VitrinaRandomBot, the mini app in Telegram and the website vitrinarandom.com) processes Users’ data. Details of the Operator are on the Operator page. Terms are used as defined in the Terms of Use.

1.2. This Policy is the privacy policy of the bot and the mini app within the meaning of Telegram’s rules. Processing of data by Telegram itself is governed by Telegram’s privacy policy.

1.3. Personal data of Participants and Organizers is processed on the basis of the Personal Data Processing Consent, the contract (the Terms of Use), the Operator’s legitimate interests and legal requirements.

1.4. We collect only the data the Service needs to work, and we do not use Telegram data to train artificial intelligence models or sell it to third parties.

2. What data we process

2.1. Telegram data that Telegram passes to the bot and the mini app: user ID, first and last name from the profile, username, profile photo, interface language, Telegram Premium status, and IP address when the mini app is opened.

2.2. Participation data: the activities you take part in, tries and their results, wins and their activation, ticket codes, friend invitations and referral links, completed tasks, the tag of the link you came from, subscriptions to the activity’s channels, blocks.

2.3. Organizer data: connected channels and groups, their names, descriptions, avatars and subscriber counts, the bot’s rights, activities, prizes, promo codes, posts, team members and their access rights, activity statistics.

2.4. Payment data: the plan, the amount in Telegram Stars, the date, the Telegram payment ID, refunds. We do not receive bank card details — payment takes place in Telegram and the app stores.

2.5. Linked accounts: your MAX messenger ID if you have linked a MAX channel.

2.6. Requests: messages to support and their contents and, if you wrote to us by email, your email address.

2.7. Technical data: information about the device and the Telegram app, logs of actions in the Service, error reports, cookies and local storage data on the website (section 9).

2.8. We do not ask for a phone number, email address, passport details or payment details. If an Organizer requests such data from a winner to deliver a prize, the Organizer does so as an independent data controller.

3. Why we process data

• to provide the Service: run activities, determine results, deliver prizes, keep statistics;
• to check participation conditions, including channel subscriptions;
• to prevent fraud, artificial inflation and abuse, and to ensure security;
• to accept payments and keep payment records;
• to send messages about wins, tries, prize deadlines and changes to documents and, with your consent, informational and promotional messages;
• to show activities on the Vitrina home feed and in collections under the Recommendation Technology Rules;
• to respond to requests and resolve disputes;
• to analyze and improve the Service, including on the basis of anonymized statistics;
• to comply with legal requirements.

4. Who we share data with

4.1. Organizers of the activities you take part in — the data needed to run the activity and deliver prizes: your Telegram name, username and ID, participation history, wins, tags. The Organizer can export this data to a file.

4.2. Cross-promo partners — the data needed to receive a bonus prize.

4.3. Publicly — in an activity’s winners list: part of the name, avatar, time of the win, the prize’s rarity.

4.4. Contractors that keep the Service running: hosting and data storage, file storage, analytics, error tracking, communications. Contractors process data on the Operator’s instructions and are obliged to protect it.

4.5. Telegram — to the extent needed for the bot and the mini app to work — and payment providers — for payments.

4.6. Public authorities — upon a lawful request, and to protect the rights of the Operator and Users.

4.7. In the event of a reorganization, sale or transfer of the Service, data may pass to the successor on the terms of this Policy.

5. Where data is stored

5.1. Data is stored on servers of the Operator and its contractors, which may be located in different countries. By using the Service, you agree to cross-border transfer of data, including to countries where the level of data protection may differ from that of your country of residence.

5.2. The Operator takes measures to protect data regardless of where it is stored and complies with data localization requirements where they apply.

6. How long we keep data

6.1. Participation and account data is kept while you use the Service and for 3 years after your last action in the Service.

6.2. Payment data is kept for as long as tax and accounting law requires.

6.3. Logs and technical data are kept for up to 12 months.

6.4. Anonymized and aggregated data may be kept indefinitely.

6.5. When the retention periods expire or consent is withdrawn, data is deleted or anonymized, except where the law requires it to be kept or it is needed to protect the Operator’s rights.

7. Your rights

7.1. You have the right to:

• find out what data of yours we process and get a copy of it;
• have inaccurate data corrected;
• have data deleted or its processing restricted;
• withdraw consent to data processing and to receiving messages;
• object to processing based on legitimate interests;
• lodge a complaint about our actions with the competent data protection authority.

7.2. To do so, write to @vitrina_manager from the Telegram account whose data you are asking about — this way we know right away that the request comes from you. You can also write to info@vitrinarandom.com, stating your Telegram username; we will then confirm the request in Telegram. We will reply within the period set by law, and no later than 30 days.

7.3. Withdrawing consent or deleting data means you will no longer be able to use the Service: take part in activities, receive and activate prizes. Data we are required by law to keep is retained for the prescribed period.

8. How we protect data

8.1. We use encryption in transit, access control, backups, logging and monitoring, and limit employees’ and contractors’ access to the data they need.

8.2. No method of transmitting or storing data is completely secure. If an incident affects your data, we will take action and notify you where the law requires it.

9. Cookies and the website

9.1. The website vitrinarandom.com uses cookies and the browser’s local storage:

• essential — remember your choices: language, currency in prices, your answer to the cookie banner; without them the website works worse;
• analytics — the Yandex Metrica service: helps us understand which pages are read and where visitors come from; enabled only with your consent.

9.2. You can change your choice in the cookie banner (the “Cookie settings” link at the bottom of every page) or delete cookies in your browser settings.

9.3. The website does not collect visitors’ contact details: there are no forms on the website. We talk in Telegram and accept official letters at info@vitrinarandom.com.

10. Age

The Service is intended for persons over 18. We do not knowingly process data of persons under 18. If you learn that a child is using the Service, write to @vitrina_manager or info@vitrinarandom.com and we will delete their data.

11. Changes to this Policy

The Operator may unilaterally amend this Policy. A new version takes effect upon publication on vitrinarandom.com unless it specifies otherwise. We may additionally announce material changes via the bot.