Legal information

Privacy Policy

In force · Version of 16 September 2026

Almavi processes personal data in accordance with the EU General Data Protection Regulation (GDPR). Below is what data we collect, why, how we protect it and what rights you have.

This is a courtesy translation of the Russian original. In case of any discrepancy, the Russian version prevails.

1. Who processes the data

The data controller is Almavi: a sole trader registered in Portugal. The controller's name, tax number (NIF), address and e-mail are given at the end of this policy and on the “Contacts” page.

2. What data we process

We process only the data needed to provide the services:

identification and contact data: name, Telegram ID and username, e-mail address, phone number;
recipient data and delivery address;
order data: product links, contents, sizes, prices, status history;
payment data: method, amount and payment status; for card payments — masked card number, issuing country and bank (we do not receive the full card number or CVV); for cryptocurrency payments — the transaction ID (txid), through which the addresses and amount of the transfer are visible on the public blockchain;
technical data: IP address and browser information in server logs.

3. Purposes and legal bases

We process data on the following GDPR legal bases:

performance of the contract — placing, paying for, purchasing and delivering the order, customer support;
compliance with legal obligations — accounting and tax records, customs clearance, compliance with EU sanctions;
legitimate interests — website and payment security, fraud prevention (including checking the card's issuing country and the connection country to show available payment methods), service improvement;
consent — newsletters and marketing messages if you have subscribed; consent can be withdrawn at any time.

4. Who receives the data

We share only the minimum necessary data with: postal and courier services (CTT, EMS, DHL and delivery services in the destination country), customs representatives, licensed payment service providers (card and cryptocurrency payments), Telegram — the channel for placing orders, support and personal account sign-in — and the hosting provider in Germany whose servers run the website. Data is not sold or used for third-party advertising.

For delivery outside the EU, recipient data is transferred to carriers and to the customs authorities of the destination country to the extent necessary to deliver the shipment (Article 49(1)(b) GDPR — performance of a contract at the data subject's request).

5. Data and payment security

The website works only over the secure HTTPS (TLS) protocol with an HSTS policy: form data is transmitted encrypted.

Card payments are made on the secure payment page of a licensed payment service provider compliant with the Payment Card Industry Data Security Standard (PCI DSS). The card number, expiry date and CVV are entered on the provider's side: Almavi does not receive, process or store them. Payment authentication via 3-D Secure is performed by the issuing bank.

Sign-in to the personal account is via Telegram — we store no passwords, and the session is protected by a signed cookie. Access to order data is limited to those who need it to fulfil the order. In the event of a personal data breach posing a risk to your rights, we will notify the supervisory authority and the affected persons within the time limits set by the GDPR.

6. Retention

We keep personal data for as long as necessary to provide the services and to meet legal requirements (including tax and accounting), after which we delete or anonymise it.

7. Your rights

Under the GDPR you have the right to:

access your data and obtain a copy;
rectify inaccurate data;
erase data (“right to be forgotten”);
restrict or object to processing;
receive your data in a portable format;
withdraw consent at any time;
lodge a complaint with the supervisory authority (in Portugal — CNPD).

8. Cookies

The website uses only strictly necessary cookies — for signing in to the personal account and protecting forms against request forgery — and the browser's local storage to remember notices you have closed. There are no analytics or advertising cookies, pixels or third-party counters on the website; if this changes, we will update this policy in advance.

9. Data protection contact

For questions about the processing of personal data and exercising your rights, write to the support e-mail or the Telegram bot — contact details are on the “Contacts” page.

More: Contacts