Privacy Policy — LEGACY data processing

Privacy PolicyLast updated 17.07.2026

This is an informational translation. The authoritative version is in Russian and is governed by the laws of the Russian Federation.

Security policy

1.1. This Policy explains what information about the User the Operator collects in the course of operating the website legacy.sx, its subdomains and the game servers of the LEGACY project, why it does so, how long such information is retained and what rights the User has in this regard.
1.2. The Operator is individual entrepreneur Bardachev Arseniy Alekseevich, who is also the Contractor under the public offer of the project. The User is any person accessing the Website or the game servers, including the Customer under the offer.
1.3. Technical and organisational protection measures are described in a separate document, the Information Security Policy (https://legacy.sx/security).
1.4. By using the Website, the User accepts the terms of this Policy. If they are unacceptable, the User must stop using the Website.

Legal grounds for data processing

2.1. The Operator processes data on one of the grounds provided for by Article 6 of Federal Law No. 152-FZ of 27.07.2006:
— performance of a contract to which the User is a party (the public offer of the project);
— consent of the User, to the extent going beyond what is necessary for the performance of the contract;
— compliance with obligations imposed on the Operator by law (in particular, tax legislation and legislation on the use of cash register equipment);
— protection of the legitimate interests of the Operator when handling violations and disputes, provided this does not infringe the rights of the User.
2.2. The ground is determined with respect to a specific purpose: processing carried out to operate the Account is based on the contract rather than on consent, and withdrawal of consent does not terminate it; it is terminated by termination of the contract.

Information processed

3.1. Personal data means information by which the User can be identified:
— Steam identifier (SteamID64);
— publicly available Steam profile information transmitted upon authorisation: display name and profile image;
— email address, if the User provided it themselves or it was received from the payment service together with the receipt;
— Discord or Telegram identifier, if the User contacted support through them;
— LC balance status, history of top-ups and enabled features, transaction log.
3.2. Technical information arising in the course of using the Website:
— cookies and similar technologies, including the session identifier;
— browser type and version, operating system, screen parameters.
3.3. The Operator does not treat technical information as anonymised. In combination with the Steam identifier it allows actions to be attributed to a specific person, and it is therefore processed with the same care as the data referred to in clause 3.1.
3.4. The IP address of the User is not stored by the Operator. The address is involved in establishing the connection and in automatic rate limiting, but it is not written to the databases of the Project, is not exported to service logs, is not linked to the Account and is not used to build a profile of the User.
3.5. The Operator does not collect or request: identity documents; information on place of residence; biometric data; special categories of personal data (concerning health, beliefs, ethnicity and the like); payment details.
3.6. The User does not disclose their Steam password to the Operator; login is performed on the side of Valve Corporation by means of the Steam OpenID mechanism. No User passwords exist within the Project.

Sources of data

4.1. From the User themselves, when they contact support or provide information on their own initiative.
4.2. From the Steam service, upon authorisation, to the extent transmitted by Valve Corporation via the OpenID mechanism.
4.3. From the payment service: information on the fact, amount and status of the payment necessary to credit it.
4.4. Automatically in the course of using the Website: the technical information referred to in clause 3.2.

Purposes

5.1. Purposes of processing:
— to create and maintain the Account and to identify the User upon login;
— to maintain the LC balance, credit payments, enable paid features and keep the transaction log;
— to fulfil settlement obligations, including the issuance of receipts;
— to respond to support requests and correspond with the User on the merits of such requests;
— to maintain the operability of the Website and the servers and to detect failures;
— to detect violations of the Project Rules, cheats and abuse, and to resolve disputes;
— to protect the Project against attacks and automated brute-force attempts.
5.2. The data is not used for advertising mailings and is not transferred to advertisers.

Conditions for the transfer of data

6.1. The Operator transfers data only in the following cases:
— to payment services, to the extent necessary to carry out the settlement and issue the receipt;
— to the hosting provider, by virtue of the very fact that the servers are hosted with it;
— to state authorities, upon a lawful request, in the manner prescribed by law;
— to the extent necessary to protect the rights of the Operator in proceedings initiated by the User themselves or connected with a violation committed by the User.
6.2. The Operator does not sell personal data, does not transfer it to advertising networks or data brokers, and does not publish it.
6.3. Persons assisting the Operator in running the Project, namely game server administrators and moderators, have no access to the databases or to the personal data of Users. Their rights are limited to in-game and moderation functions.

Data storage

7.1. The collection, recording, systematisation, accumulation, storage, updating and retrieval of personal data of citizens of the Russian Federation are carried out using databases located within the territory of the Russian Federation, as required by part 5 of Article 18 of Federal Law No. 152-FZ.
7.2. The Operator does not carry out cross-border transfer of personal data.
7.3. The interaction of the User with the Steam service takes place directly between the User and Valve Corporation under the rules of that company. The Operator is not a party to such exchange and does not influence it.

Retention period

8.1. Data is retained for as long as the Account of the User exists and the purpose for which it was collected remains.
8.2. The Account and the data associated with it are deleted:
— upon an application by the User to withdraw consent and delete the profile;
— where the User has not accessed the Project for more than 12 consecutive months;
— on other grounds provided for by the offer.
8.3. Settlement records are retained for the period established by tax legislation and legislation on the use of cash register equipment, irrespective of the deletion of the Account. The Operator is not entitled to delete them before the expiry of that period.
8.4. Once the purpose of processing has been achieved or the retention periods have expired, the data is deleted or anonymised.

Protection

9.1. The Operator takes the organisational and technical measures provided for by Article 19 of Federal Law No. 152-FZ to protect data against unlawful access, destruction, alteration, copying and dissemination. The set of measures is disclosed in the Information Security Policy (https://legacy.sx/security).
9.2. Access to the databases of the Project is held exclusively by the Operator in person.
9.3. In the event of confirmed unlawful access to personal data, the Operator notifies the affected Users and the authorised body for the protection of the rights of personal data subjects in the manner and within the time limits established by law.

Rights of the User

10.1. The User has the right:
— to find out whether their data is being processed and to obtain information on the processing: the list of data, purposes, periods, methods and range of recipients;
— to demand the correction of inaccurate, incomplete or outdated data;
— to demand the blocking or destruction of data if it is processed unlawfully or is not required for the stated purpose;
— to withdraw consent to processing;
— to appeal against the actions of the Operator to Roskomnadzor or to a court.
10.2. The request is to be sent to support@legacy.sx.
10.3. So that the Operator does not disclose information about the User to an outsider, the request must contain the Steam identifier and make it possible to verify that the sender owns the corresponding account. The Operator is entitled to request additional confirmation and to withhold the information until such confirmation is received.
10.4. A response to the request is sent within 10 (ten) business days from the date of its receipt. This period may be extended by no more than 5 (five) business days, with notification to the User of the reasons for the extension, as permitted by Article 20 of Federal Law No. 152-FZ.
10.5. Upon withdrawal of consent, processing ceases and the data is destroyed within a period not exceeding 30 (thirty) days from the date of receipt of the withdrawal, except for information which the Operator is obliged to retain by law (clause 8.3).
10.6. Withdrawal of consent does not terminate processing carried out for the performance of the contract or in fulfilment of the obligations of the Operator under the law. Such processing may be terminated only by terminating the contract, with the consequences provided for by the offer.

Cookies

11.1. The Website uses cookies in order to maintain the session of the User and to enable login via Steam.
11.2. The User manages cookies themselves through the settings of their browser, where they may delete or block them.
11.3. Blocking cookies will make it impossible to log in to the Personal Account and use its functions, as there will be no means of maintaining the session.

Age restrictions

12.1. The Website is not intended for persons under 14 years of age, and the Operator does not knowingly collect their data.
12.2. The conditions of participation of minors, including the rule that paid services are provided from the age of 18, are set out in the age restrictions section of the public offer.
12.3. Upon discovering that data of a person under 14 years of age is being processed, the Operator deletes it. A parent or other legal representative has the right to demand deletion of the data of the child by sending a request to support@legacy.sx.

Amendments to the Policy

13.1. The Operator has the right to amend this Policy. A new version is published on the Website with an indication of the date and applies from the moment of publication.
13.2. The current version is always available at https://legacy.sx/policy.

Details of the Operator

Individual entrepreneur Bardachev Arseniy Alekseevich
INN: 616620944595
OGRNIP: 326619600168508
Website: https://legacy.sx
Email: support@legacy.sx

Privacy PolicyLast updated 17.07.2026

This is an informational translation. The authoritative version is in Russian and is governed by the laws of the Russian Federation.

Security policy

1.1. This Policy explains what information about the User the Operator collects in the course of operating the website legacy.sx, its subdomains and the game servers of the LEGACY project, why it does so, how long such information is retained and what rights the User has in this regard.
1.2. The Operator is individual entrepreneur Bardachev Arseniy Alekseevich, who is also the Contractor under the public offer of the project. The User is any person accessing the Website or the game servers, including the Customer under the offer.
1.3. Technical and organisational protection measures are described in a separate document, the Information Security Policy (https://legacy.sx/security).
1.4. By using the Website, the User accepts the terms of this Policy. If they are unacceptable, the User must stop using the Website.

Legal grounds for data processing

2.1. The Operator processes data on one of the grounds provided for by Article 6 of Federal Law No. 152-FZ of 27.07.2006:
— performance of a contract to which the User is a party (the public offer of the project);
— consent of the User, to the extent going beyond what is necessary for the performance of the contract;
— compliance with obligations imposed on the Operator by law (in particular, tax legislation and legislation on the use of cash register equipment);
— protection of the legitimate interests of the Operator when handling violations and disputes, provided this does not infringe the rights of the User.
2.2. The ground is determined with respect to a specific purpose: processing carried out to operate the Account is based on the contract rather than on consent, and withdrawal of consent does not terminate it; it is terminated by termination of the contract.

Information processed

3.1. Personal data means information by which the User can be identified:
— Steam identifier (SteamID64);
— publicly available Steam profile information transmitted upon authorisation: display name and profile image;
— email address, if the User provided it themselves or it was received from the payment service together with the receipt;
— Discord or Telegram identifier, if the User contacted support through them;
— LC balance status, history of top-ups and enabled features, transaction log.
3.2. Technical information arising in the course of using the Website:
— cookies and similar technologies, including the session identifier;
— browser type and version, operating system, screen parameters.
3.3. The Operator does not treat technical information as anonymised. In combination with the Steam identifier it allows actions to be attributed to a specific person, and it is therefore processed with the same care as the data referred to in clause 3.1.
3.4. The IP address of the User is not stored by the Operator. The address is involved in establishing the connection and in automatic rate limiting, but it is not written to the databases of the Project, is not exported to service logs, is not linked to the Account and is not used to build a profile of the User.
3.5. The Operator does not collect or request: identity documents; information on place of residence; biometric data; special categories of personal data (concerning health, beliefs, ethnicity and the like); payment details.
3.6. The User does not disclose their Steam password to the Operator; login is performed on the side of Valve Corporation by means of the Steam OpenID mechanism. No User passwords exist within the Project.

Sources of data

4.1. From the User themselves, when they contact support or provide information on their own initiative.
4.2. From the Steam service, upon authorisation, to the extent transmitted by Valve Corporation via the OpenID mechanism.
4.3. From the payment service: information on the fact, amount and status of the payment necessary to credit it.
4.4. Automatically in the course of using the Website: the technical information referred to in clause 3.2.

Purposes

5.1. Purposes of processing:
— to create and maintain the Account and to identify the User upon login;
— to maintain the LC balance, credit payments, enable paid features and keep the transaction log;
— to fulfil settlement obligations, including the issuance of receipts;
— to respond to support requests and correspond with the User on the merits of such requests;
— to maintain the operability of the Website and the servers and to detect failures;
— to detect violations of the Project Rules, cheats and abuse, and to resolve disputes;
— to protect the Project against attacks and automated brute-force attempts.
5.2. The data is not used for advertising mailings and is not transferred to advertisers.

Conditions for the transfer of data

6.1. The Operator transfers data only in the following cases:
— to payment services, to the extent necessary to carry out the settlement and issue the receipt;
— to the hosting provider, by virtue of the very fact that the servers are hosted with it;
— to state authorities, upon a lawful request, in the manner prescribed by law;
— to the extent necessary to protect the rights of the Operator in proceedings initiated by the User themselves or connected with a violation committed by the User.
6.2. The Operator does not sell personal data, does not transfer it to advertising networks or data brokers, and does not publish it.
6.3. Persons assisting the Operator in running the Project, namely game server administrators and moderators, have no access to the databases or to the personal data of Users. Their rights are limited to in-game and moderation functions.

Data storage

7.1. The collection, recording, systematisation, accumulation, storage, updating and retrieval of personal data of citizens of the Russian Federation are carried out using databases located within the territory of the Russian Federation, as required by part 5 of Article 18 of Federal Law No. 152-FZ.
7.2. The Operator does not carry out cross-border transfer of personal data.
7.3. The interaction of the User with the Steam service takes place directly between the User and Valve Corporation under the rules of that company. The Operator is not a party to such exchange and does not influence it.

Retention period

8.1. Data is retained for as long as the Account of the User exists and the purpose for which it was collected remains.
8.2. The Account and the data associated with it are deleted:
— upon an application by the User to withdraw consent and delete the profile;
— where the User has not accessed the Project for more than 12 consecutive months;
— on other grounds provided for by the offer.
8.3. Settlement records are retained for the period established by tax legislation and legislation on the use of cash register equipment, irrespective of the deletion of the Account. The Operator is not entitled to delete them before the expiry of that period.
8.4. Once the purpose of processing has been achieved or the retention periods have expired, the data is deleted or anonymised.

Protection

9.1. The Operator takes the organisational and technical measures provided for by Article 19 of Federal Law No. 152-FZ to protect data against unlawful access, destruction, alteration, copying and dissemination. The set of measures is disclosed in the Information Security Policy (https://legacy.sx/security).
9.2. Access to the databases of the Project is held exclusively by the Operator in person.
9.3. In the event of confirmed unlawful access to personal data, the Operator notifies the affected Users and the authorised body for the protection of the rights of personal data subjects in the manner and within the time limits established by law.

Rights of the User

10.1. The User has the right:
— to find out whether their data is being processed and to obtain information on the processing: the list of data, purposes, periods, methods and range of recipients;
— to demand the correction of inaccurate, incomplete or outdated data;
— to demand the blocking or destruction of data if it is processed unlawfully or is not required for the stated purpose;
— to withdraw consent to processing;
— to appeal against the actions of the Operator to Roskomnadzor or to a court.
10.2. The request is to be sent to support@legacy.sx.
10.3. So that the Operator does not disclose information about the User to an outsider, the request must contain the Steam identifier and make it possible to verify that the sender owns the corresponding account. The Operator is entitled to request additional confirmation and to withhold the information until such confirmation is received.
10.4. A response to the request is sent within 10 (ten) business days from the date of its receipt. This period may be extended by no more than 5 (five) business days, with notification to the User of the reasons for the extension, as permitted by Article 20 of Federal Law No. 152-FZ.
10.5. Upon withdrawal of consent, processing ceases and the data is destroyed within a period not exceeding 30 (thirty) days from the date of receipt of the withdrawal, except for information which the Operator is obliged to retain by law (clause 8.3).
10.6. Withdrawal of consent does not terminate processing carried out for the performance of the contract or in fulfilment of the obligations of the Operator under the law. Such processing may be terminated only by terminating the contract, with the consequences provided for by the offer.

Cookies

11.1. The Website uses cookies in order to maintain the session of the User and to enable login via Steam.
11.2. The User manages cookies themselves through the settings of their browser, where they may delete or block them.
11.3. Blocking cookies will make it impossible to log in to the Personal Account and use its functions, as there will be no means of maintaining the session.

Age restrictions

12.1. The Website is not intended for persons under 14 years of age, and the Operator does not knowingly collect their data.
12.2. The conditions of participation of minors, including the rule that paid services are provided from the age of 18, are set out in the age restrictions section of the public offer.
12.3. Upon discovering that data of a person under 14 years of age is being processed, the Operator deletes it. A parent or other legal representative has the right to demand deletion of the data of the child by sending a request to support@legacy.sx.

Amendments to the Policy

13.1. The Operator has the right to amend this Policy. A new version is published on the Website with an indication of the date and applies from the moment of publication.
13.2. The current version is always available at https://legacy.sx/policy.

Details of the Operator

Individual entrepreneur Bardachev Arseniy Alekseevich
INN: 616620944595
OGRNIP: 326619600168508
Website: https://legacy.sx
Email: support@legacy.sx