iFurn.pro Platform Security Policy
This Security Policy describes the general principles and measures applied by the iFurn.pro platform (hereinafter — the "Service") in order to maintain a level of information protection that the Provider considers reasonable, and the secure use of the Service.
The Provider takes reasonable organisational and technical security measures, taking into account the nature of the Service, available technologies and potential risks.
At the same time, no information system, method of storing or transmitting data over the Internet can guarantee absolute security. The Provider does not guarantee that the Service is fully protected against all possible threats.
1. Data and its storage
The Service may process information necessary for the registration of the User, the functioning of their Account, the provision of services and the operation of the Service's features.
The scope, purposes and other conditions of personal data processing are defined by the Privacy Policy.
The Provider's own infrastructure, data centres, cloud services, hosting providers and other suppliers of technical services may be used for the storage and processing of information.
The Provider takes reasonable measures to restrict access to information in accordance with its purpose; such access may be granted to persons and service providers for whom it is objectively necessary to ensure the operation, support, security or development of the Service.
2. Security measures
Depending on technical necessity and available infrastructure, the Provider may apply, in particular:
- secure data transmission protocols;
- access control and restriction tools;
- backup of certain categories of data;
- updates of software and infrastructure components;
- logging and monitoring tools;
- network and other technical protection measures;
- other organisational and technical measures that the Provider considers appropriate.
The specific composition, architecture and configuration of security measures may change without prior notice to Users in order to develop the Service and maintain an appropriate level of its protection.
Information about specific protection mechanisms may not be disclosed for security reasons.
3. Third-party providers
For the functioning of the Service, the Provider may use the services of third parties, in particular hosting providers, data centres, providers of cloud infrastructure, email, analytics, payment and other technical services.
Such providers' access to information must be limited to the scope necessary to perform the relevant functions, as far as is practically and legally possible, in accordance with the applicable terms and requirements of the law.
The Provider does not control the infrastructure of third parties and cannot guarantee its uninterrupted operation or absolute security. This does not limit the Provider's liability that cannot be excluded in accordance with the law.
The list of the main subprocessors engaged to operate the Service is provided on the "List of Subprocessors" page.
4. User's responsibility
The User is solely responsible for the security of their Account and of the devices used to access the Service.
The User is obliged to:
- use appropriate means of protecting their Account;
- not disclose access credentials to third parties unless necessary;
- ensure the security of their own devices, software and Internet connection;
- keep contact information up to date;
- notify the Provider of any unauthorised access to the Account known to them or of other suspicious activity;
- independently back up critically important data in accordance with the Public Offer Agreement.
Actions performed using the User's credentials may be deemed to be the actions of the User themselves, unless the Provider was notified in a timely manner of their compromise, or unless otherwise established by law.
5. Security incidents
In the event that a security incident is detected, the Provider has the right to take the necessary measures to contain, investigate and remedy its consequences, including temporarily restricting access to certain features or to the Service as a whole.
If the incident requires notification of Users or of competent authorities in accordance with applicable law, such notification is carried out in the manner and within the time limits provided for by the relevant law.
The Provider is not liable for incidents caused by the acts or omissions of the User, third parties, vulnerabilities or failures of third-party infrastructure, or other circumstances beyond the reasonable control of the Provider, to the extent that such limitation of liability is permitted by law and by the Public Offer Agreement.
6. Backup and data availability
The Service is not a specialised system for long-term archival storage of information.
The User independently ensures the preservation and backup of information the loss of which may cause them significant consequences.
The existence of technical backup on the Service's side, if carried out, is not a guarantee that specific data of the User can be recovered.
7. Payment and payment security
Payment for access to the Service may be made using Visa and Mastercard bank cards, as well as by bank transfer to a bank account in accordance with the methods available at the time of payment.
When paying by card, the processing of payment details is carried out by the relevant bank, payment system or other payment service provider.
If the payment card details are entered directly on the side of the payment provider, the Service does not receive or store the full details of such a card.
The terms of payment and refunds are defined by the Public Offer Agreement and by the information available to the User at the time the payment is made.
8. Changes to the Policy
The Provider has the right to amend this Policy, in particular in connection with changes in the functionality of the Service, the infrastructure, the technologies used or the requirements of the law.
The current version of the Policy is published on the Service's website.
9. Relationship with other documents
This Policy describes the general principles of information security and does not establish guarantees of the uninterrupted operation of the Service or of the absolute preservation of information.
This Policy is not a service level agreement (SLA), a guarantee or an independent basis for the Provider's liability; the scope of the Provider's liability is determined by the Public Offer Agreement.
Matters of the Provider's liability, the use of the Service, data storage and limitation of liability are governed by the Public Offer Agreement.
In the event of a conflict between this Policy and the Public Offer Agreement, the provisions of the Public Offer Agreement shall apply. The provisions of this Policy and of the Public Offer Agreement apply subject to the mandatory provisions of law that cannot be changed by agreement.
7. Payment and payment security
Access to the platform can be paid for with Visa and Mastercard bank cards, as well as by bank transfer against an issued invoice.
Card payment takes place on the secure page of the acquiring bank with 3-D Secure support. Card details are entered on the bank's side: the platform does not receive, process or store them.
All settlements are made in hryvnia (UAH). The price is set by the tariff published on the website; the charge is one-off, there are no automatic recurring payments.
Refund conditions and the procedure for handling requests are described in the public offer agreement. For questions about a specific payment, use the contacts stated there.