1. Data controller
The data controller is promintly.com. This Policy describes what data we collect, how we use it and how we protect it.
2. What data we collect
When you buy a coupon: email, payment data (handled by the payment provider — not stored by us), IP address, browser user-agent.
When you register an account: email, password (stored as a hash), account creation and last-login dates.
Automatically: cookies to maintain your session, anonymized analytics (Yandex Metrica, Google Analytics — if enabled).
3. How we use the data
— Fulfilling the contract: coupon delivery, refund processing, order confirmations. — Fraud protection: rate-limiting, detection of suspicious activity. — Improving the service: conversion analytics (without personal identification). — Notifying you about order and refund status.
4. Who we share data with
— Payment providers — to process payments. — Government authorities when required by law.
We do not sell or share data with ad networks, data brokers or any other third parties.
5. How we protect the data
— Data is encrypted in transit (HTTPS/TLS). — Passwords are stored only as hashes. — Session tokens live in secure httpOnly cookies with the Secure and SameSite flags. — Regular session rotation, automatic invalidation on password change. — Restricted database access, audit logging.
6. Your rights
Under GDPR and applicable data protection law, you have the right to: — Get a copy of your data. — Request deletion of your data (except where the law requires us to keep it — for example, order and payment records). — Withdraw your consent to processing. — Update or correct inaccurate data.
To exercise your rights, write to privacy@promintly.com. We respond within 30 days.
7. Cookies
We use strictly necessary cookies (session, CSRF protection) — these do not require consent. Analytics cookies (Yandex Metrica, Google Analytics) are activated only after your explicit consent in the cookie banner.
8. Data retention
— Order and payment records — 5 years (as required by accounting and tax law). — Account data — until deletion at the user's request. — Security logs — 90 days. — Anonymized analytics — indefinitely.
9. Policy changes
For material changes we notify registered users by email.