Privacy Policy

PFC CSKA is operated by Sport Star Management LLC (OOO «Sport Star Management», OGRN 1097746525898), a company registered in the Russian Federation, with its registered office at 34 Verkhnyaya Krasnoselskaya Street, Moscow, 107140, Russia (“we”, “us”). We are the operator of personal data within the meaning of Federal Law No. 152-FZ “On Personal Data”; where the UK or EU General Data Protection Regulation applies to you, we are the data controller.

Professional Football Club CSKA (“the club”) is the operator of the data in the fan account, tickets, season passes and loyalty programme; the club's own rules govern those services. We process that data on the club's behalf and are the operator only of the data needed to run the app itself: device, usage and crash data.

Questions, requests and complaints: privacy@highglossy.com.

• News and matches need no account. Browsing, live text coverage and push alerts work without telling us who you are.
• The fan account is the club's. Profile, Fan ID, tickets, season passes, orders and bitkoni are records in the club's systems; the app shows and updates them. We process them on the club's behalf.
• Payments go to the bank, not to us. Card details are entered on the acquiring bank's secure page; neither we nor the club see the full card number.
• Location is optional and used only to show directions and nearby services at the arena.
• We do see: usage statistics and crash reports. No ads SDK, no selling of personal data.

• Apple Wallet passes. Tickets and season passes you add to Apple Wallet are stored by the operating system on the device.
• Downloaded tickets. PDF tickets are saved where you choose on the device.

Every category we hold, why we hold it, the lawful basis and how long we keep it:

• Fan account: name, email, phone number, date of birth, Fan ID where the law requires it for a match — To sign you in, issue tickets in your name and apply your discounts. The club is the operator; we process it on its behalf. Basis: Performance of the agreement with you (Art. 6 of Federal Law No. 152-FZ). Kept: while the account exists, then as the club's rules and the law require.
• Orders, tickets and season passes: seats, prices, order status, payment confirmation from the bank — To sell and deliver tickets and let you cancel an order. Basis: Performance of the agreement with you (Art. 6 of Federal Law No. 152-FZ). Kept: while the account exists; accounting records 5 years.
• Loyalty: bitkoni balance, points earned and spent, catalogue orders — To run the club's loyalty programme. Basis: Performance of the agreement with you (Art. 6 of Federal Law No. 152-FZ). Kept: while the account exists.
• Favourite settings and push tokens — To send the alerts you asked for about news and matches. Basis: Your consent (Art. 6 and 9 of Federal Law No. 152-FZ). Kept: until the token is revoked or goes stale.
• Location (only if you grant the permission) — To show directions to VEB Arena and services around you. Basis: Your consent (Art. 6 and 9 of Federal Law No. 152-FZ). Kept: not stored; used in the moment.
• Usage statistics: which sections are opened, on which device model and OS version, under a random installation identifier — To understand what fans use and improve the app. Basis: Our legitimate interests in security and reliability (Art. 6 of Federal Law No. 152-FZ). Kept: 14 months.
• Crash and error reports: stack traces, device model, OS version, app version — To find and fix defects. Basis: Our legitimate interests in security and reliability (Art. 6 of Federal Law No. 152-FZ). Kept: 90 days.
• Support correspondence: your email address and what you write to us — To answer you. Basis: Our legitimate interests in security and reliability (Art. 6 of Federal Law No. 152-FZ). Kept: 24 months.

We do not sell personal data and we do not use it for advertising or profiling.

We use a small number of processors. Each is bound by a data processing agreement and may use the data only to provide the service to us.

• PFC CSKA and its ticketing and loyalty systems — the club is the operator of the fan account, tickets, season passes and loyalty data; the app reads and writes those records on your instruction.
• The acquiring bank — takes card payments for tickets on its own secure page. We never see your card number.
• Google Firebase Analytics — anonymous usage statistics (which features are used, on which kind of device). We have disabled the collection of the advertising identifier in it; it identifies the installation with a random identifier that is reset when you reinstall the app.
• Google Firebase Cloud Messaging / Apple Push Notification service — delivery of push notifications. Receive the notification token and the notification text.
• Crash reporting (Sentry, hosted in the European Union) — receives stack traces, device model, OS and app version. Crash reports carry no IP address and no user identifier.
• Our hosting provider in the Russian Federation — runs the servers holding accounts and records.

We also disclose data where we are legally compelled to: to comply with a legal obligation, to protect our rights or property, to investigate possible wrongdoing in connection with the app, or to protect the safety of users or the public.

Where the law requires a Fan ID to attend a match, the club passes the ticket and identity data to the state system that issues it.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

The section above gives the retention period for each category. Deleting the fan account from the app's settings removes what identifies you from our systems and asks the club to do the same; the club keeps ticket and accounting records for as long as the law requires.

Personal data of citizens of the Russian Federation is recorded, stored and processed on servers located in the Russian Federation, as Federal Law No. 152-FZ requires. Some processors listed above operate outside Russia; they receive only the data named there. If you are located outside the Russian Federation and use the app, you consent to your data being transferred to and processed in the Russian Federation. Where the UK or EU GDPR applies, cross-border transfers rely on the Standard Contractual Clauses or an adequacy decision.

Wherever you live, you can ask us to:

• Give you a copy of the personal data we hold about you, in a portable format.
• Correct anything inaccurate.
• Delete your data. You can do this yourself in the app; we will also do it on request.
• Restrict or object to processing we carry out on the basis of legitimate interests.
• Withdraw consent, for example for notifications by turning them off in your device settings, without affecting what we did before you withdrew it.

Write to privacy@highglossy.com. We respond within 30 days (within 10 business days where Federal Law No. 152-FZ requires it).

Requests about the fan account, tickets or loyalty we forward to the club, which is their operator, and help it respond.

In the Russian Federation you may also complain to Roskomnadzor, the authority for the protection of the rights of personal data subjects. If you are in the UK or the EEA, you may complain to your data protection authority.

Under the CCPA as amended by the CPRA, in the last 12 months we collected the categories described above for the business purposes stated there, from you and from your device. We have not sold personal information and we have not shared it for cross-context behavioural advertising. We have no actual knowledge of selling the personal information of consumers under 16.

You have the right to know, delete, correct, and to be free from discrimination for exercising those rights. Exercise them at privacy@highglossy.com.

PFC CSKA is not directed to children and is not intended for anyone under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with data, write to privacy@highglossy.com and we will delete it.

Data in transit is protected with TLS. Access to our systems is limited to the people who need it to run the service and is logged. No system is perfectly secure, and we will not claim otherwise; if a breach affects your personal data, we will notify you and the competent authority as the law requires.

We will update this policy when what we do changes. The date at the top always reflects the current version. If a change materially reduces your rights or widens what we collect, we will tell you in the app before it takes effect.

Sport Star Management LLC, 34 Verkhnyaya Krasnoselskaya Street, Moscow, 107140, Russia

Support: support@highglossy.com · Privacy: privacy@highglossy.com