Russia (Россия) - International privacy rights
If the law where you live provides additional rights, identify them in your request.
RoskomnadzorFederal Law No. 23-FZ of February 28, 2025Federal Law No. 152-FZ, current consolidated textRoskomnadzor personal-data operator noticeRoskomnadzor cross-border transfer noticeData and content requestsLegal noticeРоссияRussia (Россия)PrivacyTermsDelete dataSupportInternational privacy rightsLegal noticeOpen app
Russian controller, purposes and current configuration
Alexander Goytom, established in Italy, is the personal-data operator and can be contacted at ertalex@hotmail.it. NerdScore processes the profile, private-group, physical-game, match, optional-media and technical-security data described in the Privacy Policy only to provide, protect and support the current Free service.
NerdScore does not sell personal data, show advertising, request precise location, create biometric templates or make decisions with legal or similarly significant effects. Photos, notes and taunts are optional. Analytics is unavailable when Russia is selected, and an old consent record cannot reactivate Firebase Analytics.
Primary-database localisation under Article 18(5)
From July 1, 2025, Article 18(5) of Federal Law 152-FZ, as amended by Federal Law 23-FZ, prohibits an operator collecting personal data of Russian citizens from using databases outside Russia for recording, systematisation, accumulation, storage, clarification or retrieval, except for narrow statutory cases that do not cover NerdScore's ordinary service.
NerdScore's current primary database, media, security logs and backups are hosted in Frankfurt, Germany. A later Russian copy would not cure the first foreign write. Russia remains disabled until a separately audited architecture proves that every covered collection operation first uses compliant Russian infrastructure and that backups, logs, support and later transfers follow the same boundary.
Roskomnadzor operator and cross-border notices
Before Russian processing begins, the controller must complete the applicable Article 22 operator notice with the purposes, data and data-subject categories, legal bases, operations, security measures, retention, destruction and Russian database location. NerdScore does not publish or invent a registry number or filing receipt.
Any later transfer from the localised Russian environment is separately assessed under Article 12 and requires the applicable cross-border notice before transfer. Where the destination is not recognised as providing adequate protection, the statutory review period must be respected and Roskomnadzor may restrict or prohibit the transfer. An Article 22 filing does not replace the Article 12 filing.
Russian data-subject requests and response controls
Through Support, the export and deletion tools, or ertalex@hotmail.it, a person may request confirmation, access and a copy, correction, blocking, cessation of unlawful processing or destruction where the law applies. A complete access request is answered within 10 working days; a documented extension of no more than five working days is used only where permitted. Inaccurate data is corrected within seven working days after sufficient evidence is supplied.
Unlawful processing is stopped within three working days and, if it cannot be made lawful, the affected data is destroyed within ten working days. Purpose completion, consent withdrawal and cessation requests use the applicable 30-day or 10-working-day route, with any permitted extension recorded. If immediate destruction is impossible, data is blocked and destroyed within the statutory maximum, normally no later than six months. Identity checks remain proportionate and protect other private-group members.
Russian security-incident 24/72-hour branch
A suspected unlawful or accidental transfer, disclosure, access, alteration, destruction or loss is recorded, contained and assessed immediately. Where Article 21(3.1) applies, NerdScore notifies Roskomnadzor within 24 hours of the incident becoming known and supplies the investigation results within 72 hours, including the cause and the persons whose actions led to it where identified.
The protected incident register preserves knowledge time, affected data and people, consequences, containment, mitigation, notifications, investigation and every reasoned decision. Because the controller is established in Italy, the GDPR branch runs in parallel and any shorter or additional applicable duty is followed.
Minimum age, capacity and guardian permission
NerdScore is not directed to children under 16 and does not accept them into the service. A 16- or 17-year-old must declare that a parent or legal representative has read the Terms and permitted use of the current Free service, including optional uploads and the limited private-group content licence.
The versioned declaration is a conservative product rule, not identity or age verification and not a conclusion that every Russian civil-capacity question is satisfied. A Russian release requires a local legal determination covering the exact contract, uploads and content licence before the market is enabled. Lowering the age or adding payment, prizes or public-social features reopens the assessment.
Private-group content, reports and platform scope
NerdScore provides invited private groups for in-person games. It has no anonymous or random chat, direct one-to-one chat, public feed, follower discovery or content amplification. Users can report unlawful or harmful photos, names, notes and taunts; the service records triage, removal or preservation, a reasoned decision and review.
The current facts do not meet the 500,000-daily-user social-network threshold. They do not by themselves establish whether a future Russian operation would be treated as an organiser of information dissemination under Federal Law 149-FZ. That classification, any notice and any local retention or authority-access duty must be resolved before launch rather than inferred from the private-group design.
Current Free offer and Russian release gate
The current release is free: no Billing, subscription, in-app purchase, advertising, wager, prize, monetised content or sale of personal data. NerdScore records scores for physical tabletop games; it is not an electronic game, marketplace, payment service or public social network. Russian legal pages and support text are available in Russian, with English as the fallback.
Language and legal market remain independent. Selecting Russia shows this notice without changing the interface language, but no Russian Play track is authorised. The market may be enabled only after compliant primary localisation, Article 22 and Article 12 evidence, the local capacity and platform-scope determination, and full restore, deletion, export, incident and failure-isolation tests.
Your rights
You may request access, a machine-readable export, correction, deletion, restriction or portability, and may object where processing relies on legitimate interests. Write to ertalex@hotmail.it; identity checks may be required to protect other users.
You may withdraw analytics consent in the app at any time. You may also complain to your local supervisory authority; in Italy this is the Garante per la protezione dei dati personali.
International privacy rights
We provide every user, regardless of country, a way to request access, a copy, correction, and deletion of their data. We do not discriminate against anyone who exercises a privacy right, and we do not sell or share personal data for money or targeted behavioral advertising.
Changing NerdScore's language changes only the translation you read. It does not change your country, the law that applies, the competent authority, or any mandatory rights you have where you live.
Data controller
The data controller is Alexander Goytom. For privacy, access, export, correction, deletion or removal requests, write to ertalex@hotmail.it.
NerdScore is a scorekeeping service for private board game groups. It does not require an email account and does not sell personal data.