Policy
CS-Market Privacy Policy
Effective 1 September 2026
This notice explains what personal data we handle, why, and what you can do about it. It is a notice, not a contract: your purchase is governed by the separate License Agreement and Terms of Sale.
1. Who we are
Individual Entrepreneur Gorbunova O.V. (Индивидуальный предприниматель Горбунова О.В.), OGRNIP 325784700122440, INN 732895289100, Russian Federation, trading as CS-Market.
We are the controller of the personal data described below. You can reach us at manager@cs-market.com for any question or request in this notice, including exercising your rights under section 10.
2. What this notice covers
- the website cs-market.com;
- your customer account and your orders;
- our helpdesk;
- the license validation service that our add-ons contact from your CS-Cart installation.
3. What we do not do
We want to be specific about this rather than leave it to be inferred:
- No analytics or tracking services. We do not use Google Analytics, Google reCAPTCHA, advertising pixels, social network widgets, session recording, or any third-party analytics.
- No profiling and no automated decision-making that produces legal or similarly significant effects for you.
- No selling, renting or sharing of personal data with advertisers, data brokers or anyone else for their own purposes.
- No marketing email unless you ask for it.
4. What we collect, why, and on what basis
| Data | Where it comes from | Why we have it | Legal basis (GDPR) |
|---|---|---|---|
| Account data — name, email address, password (stored as a hash), and any company name, phone number or address you choose to enter | You | To create and operate your account, deliver products and license keys, and contact you about your orders | Performance of a contract, Art. 6(1)(b) |
| Order data — what you bought, when, the amount and currency, and invoice details | You and the payment channel you used | To fulfill the order, issue and manage license keys, handle renewals and refunds, and keep required accounting records | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| License validation data — license key, the host name of your CS-Cart administration panel, the product identifier and version, the CS-Cart version, whether the check came from the administration panel or a storefront, and the IP address of the server making the request | Automatically, from your installation | To confirm that the installation is licensed and to detect unlicensed use | Contract, Art. 6(1)(b); our legitimate interest in protecting licensed software, Art. 6(1)(f) |
| Helpdesk data — your tickets, messages and any files, logs or screenshots you attach | You | To answer your questions and fix defects | Contract, Art. 6(1)(b) |
| Diagnostic credentials — administrator, FTP or SSH credentials you give us when you make a warranty claim | You | To reproduce, diagnose and correct a defect you reported | Contract, Art. 6(1)(b) |
| Server logs — IP address, timestamp, requested address, browser identification, response code | Automatically | Operating the service, security, and preventing abuse | Legitimate interest, Art. 6(1)(f) |
| Cookies — see section 6 | Automatically | To make the site function | Strictly necessary |
5. License validation, explained plainly
Our add-ons periodically contact our server to confirm that the installation they run on holds a valid license. This is the one place where we receive data automatically from your own server rather than from you, so it is worth being explicit.
What the check sends: the license key, the host name of your administration panel, the product identifier and version, the CS-Cart version, and whether the request originated in the administration panel or a storefront. Because it is a network request, the connection also carries the IP address of your server.
What it does not send: your customers' personal data, your order data, your catalog data, your administrators' details, your server configuration, and the addresses of pages within your installation or your storefronts.
Older versions of our add-ons also sent the address of the page whose loading triggered the check. Our server discards that value on receipt and does not record it; updating the add-on stops it being sent at all. If you are running an old version and would rather it stopped immediately, update or contact the helpdesk.
The practical effect is that we can see which host name and IP address a given license is running on, and when it last checked in. We use that only to verify licensing and to investigate suspected unlicensed use. Section 7 of the License Agreement describes the mechanism and what happens when a check fails.
6. Cookies
We set only cookies that are necessary for the site to work: a session identifier, your shopping cart, and your language and currency choice. There are no analytics, advertising or tracking cookies, which is why you are not asked to consent to any.
You can block or delete cookies in your browser. If you block the session cookie, you will not be able to log in or complete an order.
7. Who else receives your data
- Our hosting provider, which stores the site and its database on our behalf.
- The CS-Cart Marketplace, if you buy there rather than directly from us. The marketplace handles that transaction under its own privacy policy and is a separate controller for it; we receive the information needed to issue and support your license.
- The cryptocurrency payment gateway, if you pay in cryptocurrency. It processes the payment; we receive confirmation and the transaction reference. We do not receive or store your wallet's private keys.
That is the complete list. We do not pass data to anyone else except where we are legally required to.
8. Where your data is processed
Our business and our systems are in the Russian Federation.
If you are in the European Economic Area or the United Kingdom, that means your data is transferred to a country for which there is no adequacy decision. We rely on Article 49(1)(b) of the GDPR — the transfer is necessary to perform the contract you entered into with us — for your account, order, helpdesk and license data. There is no way to buy or use a licensed add-on without this transfer, because the license validation service is ours and runs here. We tell you plainly so you can decide before you buy rather than afterwards.
9. How long we keep things
| Account data | While your account exists. You can ask us to close and delete it at any time |
| Order and accounting records | For the retention period required by Russian accounting and tax law, after which they are deleted |
| License validation records | For as long as the license exists, since the license is perpetual and we may need to verify it years later |
| Helpdesk tickets | Kept as part of your support history for as long as your account exists. Licenses are perpetual, and an old ticket is often the fastest way to diagnose a problem that comes back years later. Deleted on request |
| Web server logs | Up to 35 days. Access and error logs are rotated weekly and four archived copies are kept, after which they are deleted |
| Diagnostic credentials | Used only for the ticket you gave them for. We ask you to revoke them as soon as the work is finished, and we do not store them beyond the ticket |
10. Your rights
Wherever you are, you can ask us to give you a copy of the data we hold about you, correct it if it is wrong, or delete it. Write to manager@cs-market.com. We will respond within one month. We do not charge for this, and we will not treat you differently for asking.
If you are in the EEA or the UK, you also have the right to restrict or object to processing, the right to data portability, and the right to lodge a complaint with the data protection authority in your country. Where we rely on legitimate interest — server logs and protecting licensed software — you may object, and we will stop unless we have compelling grounds to continue.
If you are in the Russian Federation, you have the rights given by Federal Law No. 152-FZ, including the right to withdraw consent and to complain to Roskomnadzor.
Some data we cannot delete on request: records we are required to keep for accounting and tax purposes, and license records for a license that is still in force, since deleting them would disable your product.
11. If we process data on your behalf
When you give us access to your store for a warranty claim, we may unavoidably see personal data belonging to your customers. For that limited purpose we act as a processor on your behalf, not as a controller. We look only at what the diagnosis requires, we do not copy your customer data out of your installation, and we do not use it for anything.
If you are an EEA or UK merchant and need a data processing agreement under Article 28 of the GDPR before granting access, ask us through the helpdesk and we will sign one.
12. Security
Traffic to the site, the helpdesk and the license service is encrypted in transit. Passwords are stored as hashes and cannot be read by us. Access to the database and to customer records is limited to those who need it to run the business.
No system is perfectly secure, and we do not claim otherwise. If a breach occurs that is likely to put your rights at risk, we will notify you and the relevant authority as the law requires.
13. Children
The site is aimed at businesses and developers, not at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, write to us and we will delete it.
14. Changes to this notice
We may update this notice. The current version and its effective date are always shown at the top of this page, and earlier versions are archived and available on request. If a change materially affects how we use data you have already given us, we will tell account holders by email.
15. Contact
Individual Entrepreneur Gorbunova O.V., OGRNIP 325784700122440, INN 732895289100 — manager@cs-market.com. Further registration details are available on request. We answer Monday to Friday, 09:00–18:00 (GMT+3).