Privacy policy

Privacy Policy for CoinIQ Website Visitors

Version dated September 23, 2026

This Privacy Policy for CoinIQ website visitors (the "Policy") explains how personal data is processed when you use the coiniq.me website, including its Russian and English pages, the support form, and web analytics tools.

This Policy applies only to the coiniq.me website. Personal data processing in the CoinIQ mobile app for RuStore is described in separate app legal documents.

If you do not agree with this Policy, please stop using the website and do not submit personal data through website forms.

1. Controller

The personal data controller for website visitors is:

Individual Entrepreneur Evgeny Igorevich Panchuk, OGRNIP 326280000036101.

Controller contacts:

• privacy matters: privacy@coiniq.me;
• website and support matters: support@coiniq.me.

The controller determines the purposes and means of processing personal data received through the website support form.

2. Terms

Personal data means any information relating directly or indirectly to an identified or identifiable individual.

Processing means any action or set of actions performed with personal data, including collection, recording, systematization, accumulation, storage, updating, retrieval, use, transfer, blocking, deletion, and destruction.

Website means the CoinIQ website available at https://coiniq.me, including Russian and English pages.

3. Data Processed on the Website

The controller processes only the data needed to operate the website, respond to requests, maintain security, and use web analytics.

3.1. Support Form Data

When a visitor submits a request through the website support form, the controller may process:

• the name provided by the visitor;
• email address;
• comment or request text;
• information voluntarily included in the message;
• technical email headers and sending date.

The support form is intended for CoinIQ-related questions. Please do not include passwords, payment details, passport details, special categories of personal data, health information, political views, biometric data, or third-party data unless you have a lawful basis to do so.

3.2. Website Technical Data

When you open website pages, the web server and website technical tools may process:

• IP address;
• date and time of request;
• page URL;
• browser, device, and operating system information;
• technical errors;
• data required to protect the website and deliver pages correctly.

3.3. Cookies and Web Analytics

The website uses a cookie banner and Yandex Metrica. The current Yandex Metrica counter is 112945928.

Depending on the visitor's choice and the technical operation of the website, the following data may be processed:

• cookies and similar identifiers;
• IP address;
• information about pages, navigation, referral source, browser, device, and approximate technical geography of the visit;
• technical events needed to evaluate website traffic and reliability.

Webvisor, scroll map, and form analytics are disabled in the Yandex Metrica counter settings. The website should not use Metrica to record form contents.

4. Purposes of Processing

Website visitors' personal data is processed for the following purposes:

1. receiving and reviewing support form requests;
2. responding to the visitor at the email address provided;
3. maintaining correspondence about the visitor's request;
4. ensuring website reliability and security;
5. preventing abuse and technical errors;
6. obtaining anonymized or aggregated website traffic statistics;
7. complying with the controller's obligations under Russian law.

The controller does not use support form data for advertising or newsletter mailings unless the visitor separately consents to such mailing. As of this Policy version, the website does not run advertising or newsletter mailings.

5. Legal Bases

The controller processes personal data on the following legal bases:

• the visitor's consent when submitting the support form and using applicable cookie or analytics settings;
• the need to review a request submitted by the visitor;
• compliance with the controller's obligations under personal data law;
• the controller's rights and legitimate interests in maintaining website security and reliability, provided that the visitor's rights and freedoms are not violated.

The visitor is not required to submit a request through the website form. If the visitor does not provide a name, email address, or consent, the controller will not be able to receive and answer the request through that form.

6. Processing and Storage

Support form requests are sent to the controller by email at coiniq@ya.ru. The controller has access to this mailbox and the requests received there.

The website technically runs on Drupal and is maintained with the involvement of a website maintenance contractor. New form submissions should not be stored in the active Drupal/Webform database: saving submitted form entries has been disabled for the form. Historical submissions that had previously been stored in the active form database have been deleted from the active database. Their trace may remain in website backups within the backup retention period.

According to information provided by the contractor, the website and website backups are hosted in the Russian Federation by OOO IT-SOFT in the IXcellerate Moscow One data center at: Russia, 127410, Moscow, Altufyevskoe Highway, 33G.

Employees or representatives of the website maintenance contractor may have technical access to the website to the extent necessary for maintenance, backups, troubleshooting, and security.

Web analytics data is processed using Yandex Metrica. Yandex may process such data according to its own rules and documents.

7. Recipients and Involved Parties

The following parties may be involved in website operation and request processing:

• Yandex: the coiniq@ya.ru mailbox and Yandex Metrica;
• OOO Vesta / WebVesta: website maintenance;
• OOO IT-SOFT: website and backup hosting;
• email providers of the sender and recipient;
• other parties where disclosure is required by law, needed to protect the controller's rights, or necessary to fulfill the visitor's own request.

The controller does not sell website visitors' personal data.

8. Cross-Border Transfer

According to the available information, the main website infrastructure and its backups are located in the Russian Federation.

Cross-border transfer may occur if the visitor provides an email address served by a foreign email provider, if an email is routed through foreign email infrastructure, or if individual technical services process data outside the Russian Federation. Before using such routes, the controller takes into account the requirements of Russian personal data law.

9. Retention Periods

Support form data and request correspondence are retained for as long as needed to review the request, respond to the visitor, protect the controller's rights, and confirm compliance with request-handling obligations.

The indicative retention period for request correspondence is up to 3 years after the request is closed, unless a longer period is required by law or needed to protect the controller's rights.

New form submissions should not be stored in the active Drupal/Webform database. Traces of historical submissions deleted from the active database may remain in website backups for approximately one month.

Technical logs and backups are retained within periods necessary for website security, diagnostics, and recovery.

Yandex Metrica data is retained according to Yandex Metrica service rules and counter settings.

10. Personal Data Protection

The controller takes necessary legal, organizational, and technical measures to protect personal data against unauthorized or accidental access, destruction, modification, blocking, copying, provision, dissemination, and other unlawful actions.

In particular, the following measures are used:

• website access over HTTPS;
• restricted administrative access;
• backups;
• limiting storage of new support form submissions in the active Drupal/Webform database;
• access separation for mailboxes and administrative sections;
• website maintenance by authorized persons.

11. Data Subject Rights

Website visitors have the rights provided by Russian personal data law, including the right to:

• receive information about the processing of their personal data;
• request correction, blocking, or deletion of personal data if it is incomplete, outdated, inaccurate, unlawfully obtained, or no longer needed for the stated processing purpose;
• withdraw consent to personal data processing;
• complain about the controller's actions or inaction to the competent personal data authority or to a court.

To submit a personal data request, contact privacy@coiniq.me. Please include the email address used in your request, the substance of your request, and data allowing the controller to find the relevant correspondence. The controller may request additional information if it is necessary to verify the connection between the request and specific data.

12. Policy Changes

The controller may update this Policy when the website, support form, analytics services, contractors, processing methods, or legal requirements change. The current version is published on the website.

If the Russian and English versions of this Policy differ, the Russian version prevails.