Privacy Policy

On the processing of personal data of users of the website lastcent.app. Version of July 23, 2026.

1. General provisions

1.1. This Policy defines how the personal data of users of the website https://lastcent.app (the “Website”) is processed and protected.

1.2. The personal-data operator is the limited liability company “XP Digital Solutions” (LLC "XP Digital Solutions"), registered in the Kyrgyz Republic (the “Operator”).

1.3. The Policy is drawn up in accordance with the personal-data legislation of the Kyrgyz Republic (Chapter 11 of the Digital Code of the Kyrgyz Republic, adopted on 31 July 2025).

1.4. The Website is available to users from various countries. For users located in certain countries, the Operator additionally complies with the requirements of the legislation of the relevant country.

1.5. The Policy is a public document and is freely available on the Website.

1.6. Using the Website means that the user has read this Policy.

2. Information about the Operator

3. Key definitions

3.1. Personal data: any information relating to a directly or indirectly identified or identifiable natural person.

3.2. Processing of personal data: any action or set of actions, including collection, recording, systematization, accumulation, storage, updating, use, transfer, anonymization, blocking, deletion and destruction.

3.3. User: a natural person using the Website.

3.4. Platform: a third party (Apple, Microsoft, Sony, Valve and others) whose products or services are purchased as part of an Order.

3.5. Order: a request placed on the Website by a User to purchase a digital product or service.

4. Categories of data subjects and the data processed

4.1. The Operator processes the personal data of the following categories of subjects:

4.1.1. Buyers who placed an Order for a digital product: email address; name or nickname; Order details; payment identifier.

4.1.2. Buyers who ordered a service in respect of an account: email address; name or nickname; account identifier; Order details; payment identifier.

4.1.3. Users who contacted support: email address or a messenger account identifier; the content of the request; Order details.

4.1.4. Users who subscribed to the newsletter: email address; name (if provided).

4.2. Technical data collected automatically: IP address; cookie data; browser type and version; device and operating-system type; interface language; date and time of the request; pages viewed; referral source.

4.3. The Operator does not process special categories of personal data or biometric data.

4.4. The Operator does not request or store bank-card details. Payment details are processed by the connected payment service.

4.5. Account passwords are not requested by the Operator.

5. Purposes of processing personal data

5.1. Conclusion and performance of a contract with the User.
5.2. Making settlements and confirming payments.
5.3. Sending service notifications about the Order.
5.4. Handling requests and complaints.
5.5. Ensuring the security of the Website and preventing fraud.
5.6. Keeping records as required by law.
5.7. Sending promotional mailings: only with separate consent.
5.8. Analytics and service improvement: only with consent to analytics cookies.

6. Legal grounds for processing

6.1. Performance of a contract to which the data subject is a party.
6.2. The subject’s consent for promotional mailings, analytics cookies and cross-border transfer.
6.3. Fulfilment of obligations imposed by law.
6.4. The Operator’s legitimate interests in ensuring security.

7. Procedure and conditions of processing; localization

7.1. Processing is carried out in a mixed manner: with and without automation.
7.2. Only the necessary personal data is processed.
7.3. Primary collection of data of users of the Russian Federation is carried out using a database located in the territory of the Russian Federation.
7.4. Website forms transmit data directly to the database in the Russian Federation without intermediate foreign services.
7.5. Subsequent access constitutes a cross-border transfer.
7.6. The legislation of the Kyrgyz Republic does not require localization.

8. Transfer of personal data to third parties

8.1. Data is transferred only to the extent necessary and on the basis of an agency agreement.

8.2. Recipients of personal data:

8.3. The list of payment services is shown on the Website. The Operator may change the set of services.
8.4. The Operator does not sell or transfer data to third parties for their own marketing purposes.

9. Cross-border transfer of personal data

9.1. The Operator is registered in the Kyrgyz Republic. Data of users of the Russian Federation is collected in a database in the Russian Federation, after which access constitutes a cross-border transfer.
9.2. Cross-border transfer for users of the Russian Federation is carried out on the basis of separate consent.
9.3. Transfer to Platforms outside the Russian Federation and Kyrgyzstan is carried out to the extent necessary with the User’s consent.
9.4. The Operator complies with the Kyrgyz Republic’s requirements for cross-border transfer.

10. Processing and storage periods

10.1. Data processed in the performance of an Order is stored for the necessary period and for the period required for tax accounting.
10.2. Data processed on the basis of consent is stored until such consent is withdrawn.
10.3. Once the purposes are achieved, data is deleted or anonymized, except for data subject to mandatory storage.

11. Rights of the data subject

11.1. The User has the right to: obtain information about the processing of their data; request rectification, blocking or deletion; withdraw consent; appeal against actions to an authority or a court.
11.2. Requests are sent to support@gift-code.ru.
11.3. Withdrawing consent to the necessary data may make it impossible to perform the Order.
11.4. The User may contact the State Agency for Personal Data Protection under the Government of the Kyrgyz Republic or (for the Russian Federation) Roskomnadzor.

12. Personal-data protection measures

12.1. The Operator takes legal, organizational and technical protection measures.
12.2. The measures applied include: appointing a responsible person; approving the Policy; differentiating access rights; a secure SSL/TLS connection; two-factor authentication; backups; anti-virus protection; agreements with contractors.
12.3. If a leak is detected, the Operator takes measures and notifies the authorized body.

13. Cookies and web analytics

13.1. Strictly necessary cookies are used without consent for the Website to function.
13.2. Analytics and marketing cookies are used only with prior consent, given by clicking “Accept” in the banner.
13.3. The User may refuse by clicking “Decline” or by changing browser settings.
13.4. Detailed information is provided in the Cookie Notice on the Website.

14. Specifics for users from certain jurisdictions

14.1. The general provisions apply to all Users.

14.2. Users located in the territory of the Russian Federation:
1) Legal framework: Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”.
2) Localization: primary collection is carried out using a database in the territory of the Russian Federation.
3) Consents are executed as separate documents.
4) Cross-border transfer is carried out on the basis of separate consent.
5) The subject may contact Roskomnadzor.
6) Promotional mailings: only with separate consent.

14.3. Users located in other countries: processing is carried out in accordance with the legislation of the Kyrgyz Republic and any additional requirements applicable to the Operator’s activities.

14.4. When activity in respect of the EU begins, the Operator will supplement the Policy with a GDPR section.

15. Final provisions

15.1. The Operator may amend the Policy. A new version takes effect once posted on the Website.
15.2. The current version is available via the link on the Website.
15.3. Questions are sent to support@gift-code.ru.