Consent to Personal Data Processing
By registering and using Service Rivrox, the user gives consent to the processing of personal data in accordance with Federal Law No. 152-FZ, No. 242-FZ, and Regulation (EU) 2016/679 (GDPR). This consent is granted under the terms below.
1. Data Processed
Email address, name or nickname, profile images, country and city, IP address, cookie/LocalStorage identifiers, technical logs (login time, security events), and Service activity (plays, uploads, likes, reposts, playlists, comments, messages). Sources: provided by the user, collected automatically through the Service, and/or publicly posted by the user.
2. Purposes
User registration and identification; provision of Service features (upload, storage and streaming of audio, playlists/albums, messaging, comments, charts); content personalization and recommendations; security/abuse prevention; statistics and analytics; compliance with legal and contractual obligations.
3. Legal Basis and Scope of Consent
Processing is based on: (a) user consent — including personalization, marketing and analytics; (b) performance of a contract (Service functionality); (c) legal obligations; (d) legitimate interests of the controller (security and service improvement) without overriding user rights and freedoms. This consent covers the aforementioned purposes and international transfers subject to safeguards.
4. Mandatory/Optional Data and Consequences
Email and security/session data are mandatory — without them registration and use are not possible. Profile fields (bio, avatar, city) are optional; absence may limit some features/appearance. Essential cookies are necessary for operation; analytical/marketing cookies are subject to separate consent and can be disabled.
5. Methods of Processing
Automated and/or manual means: collection, recording, structuring, storage, updating, retrieval, use, disclosure (including to processors), anonymization, restriction, deletion and destruction.
6. Recipients and Processing on Behalf
Data may be disclosed strictly as needed to: hosting/cloud (including S3-compatible), analytics providers, email/verification services, anti-fraud/security and content-moderation providers, and payment processors (if applicable). Data Processing Agreements (DPA) and confidentiality obligations apply.
7. Cross-border Transfer and Localisation
Data of Russian citizens are primarily processed and stored in Russia (242-FZ). For EEA users, transfers outside the EEA occur only where an adequate level of protection exists (Art. 45 GDPR) or under Standard Contractual Clauses (Art. 46) with additional safeguards (encryption, access control).
8. Security
Data are transmitted over HTTPS/TLS; role-based access control, logging, backups, environment isolation, and least-privilege principles are applied. In case of a security incident, risk assessment and notifications to authorities and/or users will be made when required by law.
9. Duration of Consent and Retention
Consent remains valid until withdrawn. Data are retained while the account is active and up to 30 calendar days after deletion for technical completion unless longer retention is required by law. Security logs may be stored up to 12 months; anonymized analytics up to 24 months.
10. Withdrawal Procedure
You may withdraw consent by emailing info@rivrox.com or via your account (if available). Identity verification may be required. Upon withdrawal, processing stops and data are deleted (or anonymized) within 30 calendar days, except where retention is required by law.
11. Data Subject Rights and Response Times
Rights: access and copy; rectification; erasure; restriction; portability; objection (including to profiling); withdrawal of consent; complaint to Roskomnadzor or an EU supervisory authority. Send requests to info@rivrox.com. We respond within 30 days (extendable up to 60 for complex requests with prior notice).
12. Children
The Service is not intended for independent use by children. In the EU — under 16 (or 13–16 depending on local law) — parental consent is required; in Russia — under 18 requires parental consent. If such use is discovered, contact us to delete data.
13. Updates
We may update this Consent. The current version is available at /data-processing.
Last updated: 5 November 2025