Version of 26.10.2026. Published at topami.com/en/privacy.
1. General provisions
1.1. This Policy describes how ADILGAZI LLP (Republic of Kazakhstan, BIN 221240032805, address: Duman microdistrict, building 50, Medeu district, Almaty, 050064, Kazakhstan), hereinafter the “Operator”, processes the personal data of users of the website topami.com, the Telegram bot @topami_shop_bot and the support chat (together, the “Service”).
1.2. The Policy is based on Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” (the “Law”) and is published under Part 2 of Article 18.1 of the Law. Terms from the Terms of Service (topami.com/en/terms) have the same meaning here.
1.3. The person responsible for organising personal data processing is the head of ADILGAZI LLP, support@topami.com.
2. What data is processed and why
2.1. Purposes of processing, data and retention periods:
| Purpose | Data | Retention period |
|---|---|---|
| Placing and fulfilling orders | contact email; login or email and password of the Game account (for login top-ups); UID and server; verification code; order contents, amount and status, promo code | login, password and code — until the order is completed or cancelled; everything else — 3 years after the order |
| Video recording of the operator’s work | screen recording with Game account data | 30 days after the order; if a request is made — until the case is closed |
| Profile and TOP balance | email, history of orders, TOP credits and debits | while the profile exists; credit history — 3 years after it is deleted |
| Gift cards | buyer’s email; recipient’s email and name, sender’s name, message, sending date; who activated the card and when | 3 years after purchase; message — until activation or the end of the card’s validity |
| Support and claims | email, Telegram name and ID, message text, order number | 1 year after the last message; claims — 3 years |
| “Lucky of the Day” promotion | participant’s email and order number, amount, date; winner’s profile nickname | 3 years after the draw |
| Newsletters — only with separate consent | email, Telegram ID | until consent is withdrawn |
| Service security | IP address, browser and device data, request times | 30 days |
| Payments and refunds | payment amount, method and status | 3 years after payment |
2.2. Legal grounds (Part 1 of Article 6 of the Law): performance of the agreement with the User, including an agreement for the benefit of a gift card recipient (clause 5); the User’s consent (clause 1) — for newsletters and to the extent of the consent to personal data processing (topami.com/en/consent); the Operator’s legitimate interest — Service security and dispute resolution (clause 7).
2.3. The Operator does not process special categories of personal data or biometric data, does not sell personal data and does not share it for third-party advertising. The only thing shown publicly is the “Lucky of the Day” winner’s profile nickname.
2.4. Bank card details are entered on the payment partner’s page. The Operator does not receive or store them. What the website stores in your browser is described in the Cookie Policy (topami.com/en/cookies).
3. How data is processed
3.1. Actions with data: collection, recording, systematisation, accumulation, storage, clarification (updating, changing), retrieval, use, transfer (provision, access), depersonalisation, blocking, deletion and destruction — with and without automation.
3.2. When data of Russian citizens is collected, it is recorded, systematised, accumulated, stored, clarified and retrieved in databases located in Russia (Part 5 of Article 18 of the Law): servers of the hosting provider VDSina, Moscow.
3.3. Only employees who need the data for their work have access to it.
4. Data transfer
4.1. The Operator entrusts processing to (Part 3 of Article 6 of the Law):
- the payment partner ItPay — to accept payments via SBP and bank cards and to make refunds;
- the hosting provider VDSina (Russia) — to store data;
- the email service SMTP.bz (Russia) — to send order emails, gift cards, sign-in links and newsletters.
Processors must keep the data confidential and comply with the Law.
4.2. If the User writes to the Telegram bot or to support in Telegram, the conversation goes through Telegram under that service’s terms.
4.3. The Operator is a foreign company, so data from databases in Russia is transferred to its employees in the Republic of Kazakhstan. The Operator notifies Roskomnadzor of cross-border transfer (Article 12 of the Law).
4.4. Data is provided to government authorities only upon a lawful request.
5. Data protection
- connections to the Service are encrypted (HTTPS);
- the login, password and verification code are deleted immediately after the order is completed or cancelled;
- the operator’s work in the Game account is recorded on video; the account security guarantee is in section 9 of the Terms of Service;
- employee access to data is restricted;
- in the event of a leak, the Operator notifies Roskomnadzor within 24 hours and reports the results of the investigation within 72 hours (Part 3.1 of Article 21 of the Law), and informs the users whose data was affected.
6. User rights
6.1. The User has the right to:
- find out which of their data is processed, why and to whom it is transferred;
- demand that data be corrected, blocked or deleted if it is incomplete, outdated, inaccurate, unlawfully obtained or not needed for the purpose of processing;
- withdraw consent and unsubscribe from newsletters;
- appeal the Operator’s actions to Roskomnadzor or in court.
6.2. Requests are sent to support@topami.com from the email used in the order, with the order number, or in the form provided by Part 3 of Article 14 of the Law. The Operator replies within 10 business days; this may be extended by 5 more business days with an explanation.
6.3. After consent is withdrawn, the Operator stops processing and destroys the data within 30 days unless it must be kept on another ground under the Law, for example to fulfil a paid order or respond to a claim.
7. Children
The Service is for persons aged 18 and over; those aged 14 to 18 may use it with parental consent. The Operator does not knowingly collect data of children under 14. If such data is received without parental consent, the Operator will delete it.
8. Changes
A new version is published at topami.com/en/privacy with a date and takes effect on publication. The Operator announces significant changes on the website.