Privacy Policy
Version 6.0
2. Purposes of Data Processing. List of Data and Data Subjects.
3. Legal Basis for Data Processing
4. Principles of personal data processing
5. Procedure and Terms of Handling Data
6. Protection of Personal Data
Annex 2. Rights and obligations of personal data subjects and the NBCO
Annex 4. Third parties: involvement in data processing and transmission
YooMoney prioritizes privacy and data security. In order to respect your rights and freedoms with regard to the personal data protection, we have developed this Privacy Policy. It explains on what basis, how, and for what purposes we process your personal data and more.
Before using our company's services and providing us with the personal information, please read the terms and conditions below in full.
By using our services and providing us with your personal information, you unconditionally agree to this Policy.
1. General Provisions
This document (Policy) defines the basic approaches of "YooMoney", NBCO LLC ("the NBCO", "we") to the personal data processing (based on the Personal Data Law) and other user data (collectively, "Data"). Information defined as personal data in accordance with the Personal Data Law is subject to the rules established by the Legislation.
Terms used in the Policy can be found in Annex 1.
Each person whose Data is processed by the NBCO has a number of rights. Learn more about the rights and obligations related to the personal data protection in Annex 2.
The Russian Federation legislation shall apply to the Policy and the Data processing.
2. Purposes of Data Processing. List of Data and Data Subjects.
We only process your Data for specific purposes. We only process the Data that is necessary to achieve these purposes and don't request Data that is redundant in terms of achieving specific purposes.
For each purpose of Data processing, the NBCO defines:
categories and list of processed Data;
categories of Data subjects;
methods, terms of processing and storage of Data;
Data destruction procedure.
The purposes of Data processing and their respective categories and the list of Data to be processed, categories of Data subjects are set in Annex 3.
3. Legal Basis for Data Processing
We process your Data, if:
it is provided/permitted/allowed by the Legislation, or
it is set by our contract, or
you have given your consent to the Data processing.
4. Principles of personal data processing
lawfulness of predetermined specific purposes and methods of personal data processing;
ensuring adequate personal data protection;
compliance of the purposes of personal data processing with those predetermined and declared at the time of its collection;
compliance of the scope, nature, and methods of personal data processing with the purposes of processing;
reliability of personal data, its sufficiency for the purposes of processing, preventing processing of the personal data that are redundant in relation to the purposes stated at the time of its collection;
preventing the merging of databases containing personal data processed for incompatible purposes;
storing personal data in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed;
destruction or depersonalization of personal data after achievement of data processing purposes, if the period of personal data storage is not established by the Legislation or the contract to which the personal data subject is a party, beneficiary, or guarantor;
ensuring confidentiality and security of processed personal data.
5. Procedure and conditions for Data processing
List of actions. Methods of processing. We use automated and non-automated methods of personal data processing. Subject to the requirements of the Legislation, the NBCO has the right to perform any processing actions with personal data, including collection, recording, systematization, accumulation, storage, specification, extraction, use, transfer, depersonalization, blocking, deletion, and destruction.
Processing period. Storage. The processing and storage period is established according to the requirements, including the conditions of data processing defined by Legislation, and/or taking into account the provisions of the contract, the party, beneficiary or guarantor of which is the Data Subject, and/ or the consent of the Data Subject to the processing of their Data. While Data processing and storage are performed no longer than the purposes of data processing require, unless otherwise specified by Legislation.
The processing of personal data shall be terminated when the purposes of such processing are achieved, as well as upon expiration of the period provided for by law, contract, or the consent of the personal data subject.
The NBCO uses databases located on the territory of the Russian Federation.
Access to Data. As a rule, the NBCO processes Data on its own. When granting access to Data within the NBCO, we rely on the job description of our employees. Our employees are only granted access when it is necessary for the fulfillment of a work task.
Third parties who may have access to your Data are listed in Annex 4. Metric programs and analytics systems used to process Cookies are listed in Annex 5. By interacting with us in the cases described therein, you consent to the processing/transmission/access of your Data by the relevant third parties.
Reuse of Data. By entering any Data in one of the NBCO's services, you consent to the storage of that Data so that it may be used for other NBCO's services without additional re-entry.
Data destruction procedure. Data shall be destroyed in the following cases:
when the purposes of Data processing have been achieved or in case of loss of necessity to achieve the purposes of Data processing, unless otherwise provided by the Legislation;
if the actual unauthorized processing of Data is detected;
when the personal data subject revokes their consent to the processing of their personal data, unless otherwise provided for by the Legislation;
when the personal data subject revokes their consent to the processing of their personal data, unless otherwise provided for by the Legislation.
Methods of Data destruction are determined by the NBCO’s internal regulations.
6. Personal data protection
Personal data protection is one of our key priorities. As a part of a comprehensive system of measures, we ensure:
(1) Confidentiality of personal data. We do not disclose to third parties or disseminate personal data without the consent of the data subject unless otherwise provided by federal law.
(2) Protection of personal data from unlawful actions. We take the necessary legal, organizational, and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, dissemination, as well as from other unlawful actions.
Specifically, we:
an appointed person responsible for personal data processing and a person responsible for personal data security;
have a dedicated information security subdivision;
developed and approved the local acts on personal data processing and protection, information security;
apply legal, organizational, and technical measures to ensure the personal data security in accordance with the Personal Data Law requirements and other legislation in the field of personal data security;
control the compliance of personal data processing with the requirements of the legislation and local acts;
are assessing the harm that may be caused to personal data subjects in case of violation of the Personal Data Law;
familiarized our employees processing personal data with the Personal Data Law and the NBCO's local documents in this field.
7. Handling Requests
We accept personal data enquiries as prescribed by the Legislation and separate agreements/contracts with the personal data subject. Questions and comments regarding this Policy can be sent to dpo@yoomoney.ru.
8. Changes to the Policy
The Policy is to be published on https://yoomoney.ru/. We may make changes to the Policy. Changes are made at the NBCO's discretion.
Annex 1. Terms
(1) Legal acts
Legislation means a legislation of the Russian Federation.
Personal Data Law means a Federal Law 152-FZ of 27.07.2006 "On Personal Data".
(2) Basic terms related to personal data
Personal data means any information relating to a directly or indirectly defined, or identifiable individual (personal data subject).
Processing of personal data means any action (operation) or set of actions (operations) performed with the use of automation means or without the use of such means with personal data, including collection, recording, systematization, accumulation, storage, specification (update, change), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, and destruction of personal data.
Automated processing of personal data means processing of personal data by means of computing equipment.
Dissemination of personal data means actions aimed at disclosure of personal data to an indefinite number of persons.
Provision of personal data means actions aimed at disclosure of personal data to a certain person or a group of persons.
Blocking of personal data means temporary cessation of personal data processing (except for cases when processing is necessary to specify personal data).
Destruction of personal data means actions as a result of which it becomes impossible to restore the content of personal data in the information system of personal data, and (or) as a result of which material carriers of personal data are destroyed.
Depersonalization of personal data means actions as a result of which it becomes impossible to determine, without the use of additional information, whether personal data belong to a particular data subject.
(3) Participants of the relations
The NBCO means" YooMoney", NBCO LLC (Russia, Moscow, 82 Sadovnicheskaya street, building 2) which is the personal data operator. The NBCO details and contacts can be found on https://yoomoney.ru/page?id=525652.
Personal Data Subject means an individual who is directly or indirectly identified through personal data.
Applicant means an individual applying for a vacant position in the NBCO and whose personal data is accepted by the NBCO.
Employee means an individual who has entered into an employment contract with the NBCO/is currently or has been in an employment relationship with the NBCO in the past.
Client means an individual who has entered into an agreement with the NBCO under which the NBCO provides services (currently or in the past), including a Corporate Client Representative;
Corporate Client Representative means an individual whose personal data has been transferred to the NBCO, and who
is a member of the Corporate Client's management bodies;
is the owner/founder/shareholder/participant of the Corporate Client;
is acting on behalf of the Corporate Client on the basis of a power of attorney/specified in the Corporate Client's signature and seal card/authorized to dispose of funds on the Corporate Client's bank account using analogs of handwritten signature, codes, or passwords.
Corporate Client means a legal entity that intends to use, is using, or has used the NBCO's products/services.
(4) Other terms
Identification/Simplified identification means a special procedure for the provision of the client's data to the NBCO as required by the AML/CFT policies.
Annex 2. Rights and obligations of personal data subjects and the NBCO
1. Basic rights and obligations of the personal data subject
| Right | Description | |
| To access | — | The right of the personal data subject to receive information related to its processing in the manner, form, and terms established by the personal data legislation. |
| To correct, block, and destroy data | — | The right to demand specification of personal data, its blocking or destruction, if personal data:
|
| To withdraw | — | The right to withdraw the consent to the personal data processing. In accordance with the Personal Data Law, if a personal data subject withdraws their consent to the personal data processing, the NBCO has the right to continue processing personal data without the consent of the personal data subject on the grounds specified in the Personal Data Law. |
| To defense | — | The right to take measures provided for by law to protect your rights. |
The personal data subject has other rights in accordance with the Legislation.
The obligations of the personal data subject shall be determined in accordance with the Legislation.
2. The NBCO's basic rights and obligations
| Obligation | Description | |
| To comply with the Personal Data Law | — | The NBCO is a legal entity established under the laws of the Russian Federation. Acting as a personal data operator, we are obliged to comply with the Personal Data Law. |
| To ensure confidentiality of personal data | — | The NBCO shall not disclose to third parties or disseminate personal data without the consent of the personal data subject unless otherwise provided for by federal law. |
| To protect personal data | — | When processing personal data, the NBCO shall take the necessary legal, organizational, and technical measures/ensure their adoption to protect personal data from unlawful or accidental access, destruction, alteration, blocking, copying, provision, and dissemination, as well as from other unlawful actions. |
| To provide information regarding the personal data processing | — | The NBCO shall be obliged to provide the personal data subject with information regarding the personal data processing in the manner, to the extent, and on the grounds established by the Legislation. |
| To localize personal data of Russian citizens | — | When collecting personal data, the NBCO shall record, systematize, accumulate, store, specify (update, correct), and extract personal data of the Russian Federation citizens using databases located on the territory of the Russian Federation, except for cases specified in the Personal Data Law. |
The NBCO has other obligations in accordance with the Legislation.
| Right | Description | |
| The right to restrict the subject's access to personal data in individual cases | — | The NBCO has the right to restrict the personal data subject's access to their personal data, if the personal data processing is enabled in accordance with the legislation on combating money laundering and terrorism financing, if the personal data subject's access to their personal data violates the rights and legitimate interests of third parties, as well as in other cases provided for by the Legislation. |
| To trust the processing of personal data to another entity | — | As a personal data operator, the NBCO has the right to entrust the personal data processing to a third party. |
The NBCO has other rights in accordance with the Legislation.
Annex 3. List of purposes of data processing and corresponding categories and list of processed data, categories of subjects whose data are processed, methods, due dates of data processing and storage, data destruction procedure
| № | Purpose of processing | CATEGORIES AND LIST OF PROCESSED DATA | Categories of Data Subjects | METHODS, TERMS OF PROCESSING AND STORAGE | Destruction procedure |
| 1. | Conclusion/execution of contracts with the NBCO and/or NBCO's partners. Providing services and facilities to the NBCO, including:
| Category of personal data: Other personal data not related to special categories, biometric personal data and personal data to be disseminated List of Data (1): email address; phone number; login; full name; date of birth; nationality; details of the identity document; details of the document confirming the right of a foreign citizen or stateless person to stay (reside) in the Russian Federation; migration card details; address of place of residence (registration) or place of stay; INN; SNILS; OMS (health insurance) policy data; place of birth; number of electronic means of payment; information on transactions; information on the client’s actions in the NBCO's services; information on recipients/senders who are not clients; information about the Client’s participation in loyalty programs implemented by the NBCO or its partners; Client identifiers in the NBCO partners’ databases; information about actions performed on NBCO's websites and mobile applications; statistical, technical, and functional data types (e.g., type of action performed by the user on the service, date and time of the action, page URL, type of user device, IP address, etc.); information is automatically transmitted by the Client’s device as a result of technological interaction with the NBCO's website or mobile application, including cookies (2), and other information provided by the person independently in the course of communication with the NBCO |
| Automated and non-automated (mixed) processing with the NBCO performing the following actions: collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (provision, access), blocking, deletion, destruction of personal data. Processing/storage periods: (1) If the basis for processing is the Processing Consent, for the period specified in the Consent; (2) If the basis is a Contract, for the duration of the Contract (unless otherwise provided by the Contract); (3) If the basis is laws, for the periods established by laws. (3.1.) Processing of documents and information necessary for identification of an individual in accordance with regulatory requirements for anti-money laundering, countering the financing of terrorism, and financing the proliferation of weapons of mass destruction, at least 5 years, calculated from the date of termination of the relationship with the client. | Processed data shall be destroyed when the purpose of processing has been achieved or when it is no longer necessary to achieve these purposes (unless otherwise provided for by federal law). The destruction procedure shall be in accordance with Section 5 of this Policy. |
| 2. | Provision of banking services, including:
|
| Automated and non-automated (mixed) processing with the NBCO performing the following actions: collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (provision, access), blocking, deletion, destruction of personal data. Processing/storage periods: (1) If the basis for processing is the Processing Consent, for the period specified in the Consent; (2) If the basis is a Contract, for the duration of the Contract (unless otherwise provided by the Contract); (3) If the basis is laws, for the periods established by laws. (3.1.) Processing of documents and information necessary for identification of an individual in accordance with regulatory requirements for anti-money laundering, countering the financing of terrorism, and financing the proliferation of weapons of mass destruction, at least 5 years, calculated from the date of termination of the relationship with the client. | Processed data shall be destroyed when the purpose of processing has been achieved or when it is no longer necessary to achieve these purposes (unless otherwise provided for by federal law). The destruction procedure shall be in accordance with Section 5 of this Policy. | |
| 3. | Information exchange with the NBCO, including:
|
| Automated and non-automated (mixed) processing with the NBCO performing the following actions: collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (provision, access), blocking, deletion, destruction of personal data. Processing/storage periods: (1) If the basis for processing is the Processing Consent, for the period specified in the Consent; (2) If the basis is a Contract, for the duration of the Contract (unless otherwise provided by the Contract); (3) If the basis is laws, for the periods established by laws. | Processed data shall be destroyed when the purpose of processing has been achieved or when it is no longer necessary to achieve these purposes (unless otherwise provided for by federal law). The destruction procedure shall be in accordance with Section 5 of this Policy. | |
| 4. | Enforcement of legal requirements, including within the framework of:
|
| Automated and non-automated (mixed) processing with the NBCO performing the following actions: collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (provision, access), blocking, deletion, destruction, dissemination of personal data. Processing/storage due dates: (1) Within the due dates set by the laws. (1.1.) Processing of documents and information necessary for identification of the person in accordance with regulatory requirements for anti-money laundering, countering the financing of terrorism, and financing the proliferation of weapons of mass destruction, at least 5 years, calculated from the date of termination of the relationship with the client. | Processed data shall be destroyed when the purpose of processing has been achieved or when it is no longer necessary to achieve these purposes (unless otherwise provided for by federal law). The destruction procedure shall be in accordance with Section 5 of this Policy. | |
| 5. | Work on services, including increasing the attractiveness of the NBCO services, development of new products, applications, usability of services, websites, applications, electronic means of payment, including research and analytics. |
| Automated and non-automated (mixed) processing with the NBCO performing the following actions: collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (provision, access), depersonalization, blocking, deletion, destruction of personal data. Processing/storage periods: (1) If the basis for processing is the Processing Consent, for the period specified in the Consent; (2) If the basis is a Contract, for the duration of the Contract (unless otherwise provided by the Contract); (3) If the basis is laws, for the periods established by laws. | Processed data shall be destroyed when the purpose of processing has been achieved or when it is no longer necessary to achieve these purposes (unless otherwise provided for by federal law). The destruction procedure shall be in accordance with Section 5 of this Policy. | |
| 6. | Organization of events and activities, including the organization of marketing, training, and other events, actions, sending notifications about such events, surveys about the results, collecting suggestions and wishes. |
| Automated and non-automated (mixed) processing with the NBCO performing the following actions: collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (provision, access), blocking, deletion, destruction, dissemination of personal data. Processing/storage periods: (1) If the basis for processing is the Processing Consent, for the period specified in the Consent; (2) If the basis is a Contract, for the duration of the Contract (unless otherwise provided by the Contract); (3) If the basis is laws, for the periods established by laws. | Processed data shall be destroyed when the purpose of processing has been achieved or when it is no longer necessary to achieve these purposes (unless otherwise provided for by federal law). The destruction procedure shall be in accordance with Section 5 of this Policy. | |
| 7. | Security, including ensuring information and other security of Clients, third parties, and the NBCO. Identification of illegal and/or prohibited actions when using the services, cases of fraud, embezzlement of funds, other illegal actions, prevention of such illegal actions in the future and localization of the consequences of such actions, assessment of cooperation risks, verification of the reliability of the provided information. |
| Automated and non-automated (mixed) processing with the NBCO performing the following actions: collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (provision, access), blocking, deletion, destruction of personal data. Processing/storage periods: (1) If the basis for processing is the Processing Consent, for the period specified in the Consent; (2) If the basis is a Contract, for the duration of the Contract (unless otherwise provided by the Contract); (3) If the basis is laws, for the periods established by laws. | Processed data shall be destroyed when the purpose of processing has been achieved or when it is no longer necessary to achieve these purposes (unless otherwise provided for by federal law). The destruction procedure shall be in accordance with Section 5 of this Policy. | |
| 8. | Personnel work means maintaining personnel records and organizing record keeping for NBCO Employees, regulating labor and other directly related relations, other personnel documentation, and ensuring effective work interaction and performance of job duties, including:
| Category of personal data: Other personal data that do not fall under special categories, biometric personal data, or personal data permitted for dissemination List of personal data (3): surname, first name, patronymic; date of birth; place of birth; residential address; gender; profession; position; information on employment; documents confirming the employee’s labor relations with the employer; education; identity document data; citizenship; SNILS; INN; details of electronic means of payment/bank account; presence (absence) of a criminal record and/or fact of criminal prosecution; military registration documents; results of attestation and other types of performance evaluation; if provided by the employee: social media link (if an account link is provided); personal phone number(s); email address; registration number of personal car; other data provided by the employee/candidate. |
| Automated and non-automated (mixed) processing with the NBCO performing the following actions: collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (provision, access), blocking, deletion, destruction, dissemination of personal data. Processing/storage due dates: (1) If the basis for processing is the Processing Consent, for the period specified in the Consent; (2) If the basis is a Contract, for the duration of the Contract (unless otherwise provided in the Contract); (3) If the basis is laws, for the periods established by laws.
For the purposes of providing VHI, the NBCO shall transfer data to third parties specializing in medical and other types of insurance and holding the necessary licenses/permits (when required by applicable laws), and may engage other specialized service providers on matters necessary to achieve the above purpose. | Processed data shall be destroyed when the purpose of processing has been achieved or when it is no longer necessary to achieve these purposes (unless otherwise provided for by federal law). The destruction procedure shall be in accordance with Section 5 of this Policy. |
| 9. | Administrative and business activities, including purchased goods/works/services/rights to the results of intellectual activities, other administrative and business activities | Category of personal data: Other personal data that do not fall under special categories, biometric personal data, or personal data permitted for dissemination List of personal data (4): last name, first name, patronymic; date of birth; residential address; identity document details; SNILS; INN; details of electronic payment means/bank account; email address; phone number(s); and any other data provided by the individual. |
| Automated and non-automated (mixed) processing with the NBCO performing the following actions: collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (provision, access), blocking, deletion, destruction of personal data. Processing/storage periods: (1) If the basis for processing is the Processing Consent, for the period specified in the Consent; (2) If the basis is a Contract, for the duration of the Contract (unless otherwise provided by the Contract); (3) If the basis is laws, for the periods established by laws. | Processed data shall be destroyed when the purpose of processing has been achieved or when it is no longer necessary to achieve these purposes (unless otherwise provided for by federal law). The destruction procedure shall be in accordance with Section 5 of this Policy. |
(1) Maximum list. The specific amount of data depends on the purpose of processing, situation, mandatory legal requirements, if any, and is recorded in the relevant documents/interfaces.
(2) Cookies record your actions, help us improve our products, and make your experience on our website more convenient. You can manage cookies independently by changing the settings of the browser on your device. Changes to user settings may result in certain components of the NBCO's website being unavailable on your device. For more information about the cookies, see Cookies Policy (Annex 5).
(3) May vary. The specific amount of data depends on the situation and mandatory legal requirements, if any.
(4) May vary. The specific amount of data depends on the situation and mandatory legal requirements, if any.
Annex 4. Third parties: involvement in data processing and transmission
(1) We may entrust the personal data processing to third parties in accordance with the Personal Data Law. Information about such engagement and partners is provided to the Client within agreements with the NBCO regulating the terms of use of the respective service/product. For example, such partners may be engaged to facilitate Identification and/or personalization/delivery of bank cards as part of the YooMoney service.
(2) In compliance with the Legislation, your Data may also be transferred to or received from third parties. Such third parties may include:
— when implementing the procedures/requirements established by the Legislation: state authorities, other authorized organizations/persons (e.g., the Bank of Russia, courts, tax authorities, bodies for enforcement of judicial acts, bodies of inquiry and investigation, etc.);
— when using the NBCO's payment services: credit and other organizations involved in transfers/other related processes. For example:
Client's Data is transferred to NSPC JSC (OGRN 1147746831352), FPS participants, as well as payers (recipients) of transactions made within the Faster Payments System of the Bank of Russia Payment System (FPS),
to maintain a proper security level of online payments made via bank cards, the NBCO may receive/transmit information, the list of which is established by payment system security protocols, to and/or from acquiring/issuing banks, payment systems;
— when a Client uses products and services provided by the NBCO's partners, information about the Client may be delivered to such persons to the extent and for the purposes necessary to provide the services to the Client in an appropriate manner, or to enhance the user experience (e.g., for pre-filling registration forms to speed up the registration process in the NBCO's partners services);
— partners providing data storage;
— partners engaged by the NBCO to identify and prevent the NBCO's services from being used for purposes that are unlawful or prohibited by the terms of the respective services;
— the NBCO may provide third parties with access to certain Data (e.g., statistics) for marketing and other research purposes, as well as other Data to enable the delivery of advertising to the Client.
Annex 5. Cookies Policy
The NBCO processes the data specified in this document, collected during visitors’ use of our website. By clicking the "Got it” button in the Cookies processing notification window, you consent to the processing of your Cookies. You may also opt out of the processing of Cookies in accordance with clause 5 of the Cookies Policy.
Session Cookies
They exist only in temporary memory while the user is browsing a website page. Session Cookies are usually deleted after you close the website window. Session Cookies allow information about your choices on a previous page to be remembered, so you don’t have to re-enter information.
Persistent Cookies
They are stored on your computer or mobile device and are not deleted when you close your browser. Persistent Cookies can store user preferences for a specific website, allowing you to use those preferences in future sessions.
Such Cookies allow you to be identified as a unique user and, when you return to the website, help recall information about you and your previous actions.
Analytical/Marketing Cookies
They include information about how you use the website, such as pages you visit and links you click. We use such Cookies mainly to improve the website’s functionality and your user experience. Sometimes, the Cookies also allow us to identify your preferences and provide you with useful targeted information about products, services, and offerings that may interest you.
Mandatory Cookies
They are the minimum list of Cookies required to ensure the correct and uninterrupted operation of the website.
Publication date: March 31, 2025