How Anti-DDoS PRO processes personal data.
Version of 30 October 2026.
The Russian text of this Policy published on this site is the official wording; this page is a translation provided to help you understand it.
This Personal Data Processing Policy of the sole proprietor (the “Policy”) has been prepared in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (“Law 152-FZ”).
Personal data operator details:
Sole proprietor:
OGRNIP (state registration number of the sole proprietor):
INN (taxpayer identification number):
Email: info@anti-ddos.pro
Website: https://anti-ddos.pro/
This Policy sets out how the operator processes personal data and the measures it takes to keep that data secure, in order to protect human and civil rights and freedoms when personal data is processed, including the right to privacy and to personal and family confidentiality.
The operator collects and processes personal data of users of the website https://anti-ddos.pro/, including by using cookies and collecting IP addresses.
This Policy governs the relationship between the operator and individuals (customers, website users, counterparties and representatives of legal entities) regarding the processing and protection of personal data.
This Policy uses the following key terms (as defined in Article 3 of Law 152-FZ):
Personal data means any information relating to an individual who is directly or indirectly identified or identifiable (the data subject).
Operator means a state body, municipal body, legal entity or individual that, alone or jointly with others, organises and/or carries out the processing of personal data.
Processing of personal data means any action (operation) or set of actions (operations) performed on personal data, with or without automated means, including collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), depersonalisation, blocking, deletion and destruction of personal data.
Blocking of personal data means temporarily suspending the processing of personal data (except where processing is needed to clarify the personal data).
Destruction of personal data means actions that make it impossible to restore the content of personal data in a personal data information system.
The operator must publish this Policy or otherwise provide unrestricted access to it, as required by Part 2 of Article 18.1 of Law 152-FZ.
2.1. Main purposes of personal data processing:
2.1.1. Protection against DDoS attacks and other cyber threats:
— analysing network traffic;
— detecting and blocking malicious activity;
— configuring and optimising protection systems;
— investigating information security incidents.
IP addresses and other data of visitors to customers’ websites are contained in the filtered traffic. For this data, the operator processes it on the customer’s instructions and within the scope of the contract. The customer remains the personal data operator with respect to the visitors of those websites.
2.1.2. Running the business:
— entering into and performing contracts;
— keeping accounting and tax records;
— communicating with customers and counterparties;
— providing technical support;
— carrying out marketing activities.
Advertising messages are sent only with separate consent. You can withdraw that consent by emailing info@anti-ddos.pro.
2.1.3. Operating the website https://anti-ddos.pro/:
— registration, authentication and access to the customer account — to perform the contract;
— handling requests and enquiries — based on separate consent given in the request form (clauses 5.3 and 5.4);
— improving the website and analysing how the services are used — only with separate consent to Yandex.Metrica (clause 4.2).
2.2. Personal data may not be processed in a way that is incompatible with the purposes for which it was collected. Processing is limited to achieving specific, predefined and lawful purposes.
2.3. Purposes, data and retention periods:
— performing the contract: customers and their representatives; surname, first name, phone number, email, tax ID (INN), order details; legal basis — clause 5 of Part 1 of Article 6 of Law 152-FZ; kept for the term of the contract and then for the periods set by the Tax Code of the Russian Federation and Federal Law No. 402-FZ. For primary accounting documents this is at least five years, or longer if the law requires a longer period;
— accounting and tax records: the same details plus payment data; legal basis — clause 2 of Part 1 of Article 6 of Law 152-FZ; kept for the periods set by the Tax Code of the Russian Federation and Federal Law No. 402-FZ;
— replying to a request sent via the website: first name, surname, the country of the calling code, phone number, email, the chosen way to get in touch (email, Telegram, WhatsApp or LINE), a Telegram username if Telegram is chosen, a LINE ID if LINE is chosen, the text of the request and the sender’s IP address. On the Russian version of the site this form offers email, phone, Telegram or Max instead of WhatsApp and LINE. A plan request also includes the selected plan when it is sent from a plan card. The record is stored on a server in the Russian Federation, and a copy is sent to the operator’s email address. The request record stays in Russia. A reply in Telegram, WhatsApp or LINE is written by the operator in the chosen service; legal basis — the data subject’s consent; kept until the reply is sent and for no more than 3 years after that, so that the content of the reply can be confirmed (Article 196 of the Civil Code of the Russian Federation), unless a contract is concluded or the law requires a different period;
— website operation and protection: IP address, cookies, browser details. If there is a contract with the person, the legal basis is clause 5 of Part 1 of Article 6 of Law 152-FZ. If there is no contract and the data is needed to protect the website, the legal basis is clause 7 of Part 1 of Article 6 of Law 152-FZ, and only for as long as this does not violate the data subject’s rights and freedoms. Kept no longer than the session and the analysis of an attack;
— website statistics via Yandex.Metrica: legal basis — separate consent given by clicking “Accept”, on the terms in clause 4.2; kept until consent is withdrawn or cookies are cleared.
3.1. Principles of personal data processing:
The operator processes personal data on the basis of the following principles:
— lawfulness and fairness;
— limiting the processing of personal data to specific, predefined and lawful purposes;
— not processing personal data in a way that is incompatible with the purposes for which it was collected;
— processing only the personal data that is relevant to the purposes of processing;
— ensuring that personal data is accurate, sufficient and up to date for the purposes of processing;
— destroying or depersonalising personal data once the purposes of processing have been achieved.
3.2. Conditions for personal data processing:
The operator processes personal data if at least one of the following conditions is met:
— the data subject has consented to the processing of their personal data;
— processing is necessary to perform a contract to which the data subject is a party;
— processing is necessary to exercise the rights and legitimate interests of the operator or third parties, provided that this does not violate the rights and freedoms of the data subject;
— processing is necessary to fulfil obligations imposed on the operator by the laws of the Russian Federation, including tax and accounting obligations and responding to authorised bodies.
3.3. Confidentiality of personal data:
The operator and other persons who have access to personal data must not disclose it to third parties or disseminate it without the data subject’s consent, unless otherwise provided by federal law.
4.1. Personal data provided by the user:
Personal data for a contract is information without which the contract cannot be performed. Where processing is based on consent, users provide the data themselves. This includes:
— surname, first name and patronymic. For a contract, genuine details are given rather than a pseudonym;
— phone number;
— email address;
— name and tax ID (INN) of the organisation or sole proprietor, if the customer acts as an organisation or entrepreneur;
— the content of messages sent via the ticket system, website forms and messengers;
— payment details returned by the payment system: transaction number, amount, date and masked card number. The full card number is not passed to the operator.
Users provide any other data themselves if it is needed to deliver the service.
4.2. Automatically collected information:
The operator also processes information received automatically when the website is visited:
— the user’s IP address;
— operating system and browser type;
— pages visited on the website;
— information from cookies;
— data on the user’s actions on the website.
Cookies without which the website and customer account cannot work are used to fulfil the user’s request to the website (clause 5 of Part 1 of Article 6 of Law 152-FZ) and to protect the website, provided this does not violate the user’s rights (clause 7 of Part 1 of Article 6 of Law 152-FZ). Separate consent is not required for such cookies. The Yandex.Metrica web analytics service (YANDEX LLC, Russia), including the click map and Webvisor session recording, is described in this clause. Webvisor does not record characters typed into the request form fields. The counter loads only after you click “Accept”. The notice says that by continuing to use the site the visitor agrees to essential cookies and links to this clause. “Accept” turns on the analytics services named in this clause. Continuing to browse is not consent to analytics. “Accept” is consent to those services on the terms of this clause. It is not consent to this Policy as a whole and does not replace the checkbox in the request form. Closing the notice does not give that consent, and the counter is not loaded. You can withdraw consent by clearing your browser cookies or by writing to info@anti-ddos.pro.
When providing protection, the operator keeps technical logs: IP addresses, request times and network traffic details needed to filter attacks.
4.3. Persons who receive the data:
— YANDEX LLC (Russia) processes Yandex.Metrica data on the operator’s instructions, and only after “Accept” is clicked;
— Unitpay and TBank receive payment details on their own side. The card number and security code stay with them; for the operator they are independent operators;
— a copy of a request from the “I'm under attack” form is sent only to the operator’s email address. The website does not send it to Telegram or to any other service outside Russia.
5.1. How consent is obtained (in accordance with Article 9 of Law 152-FZ):
A person decides whether to provide their data. Consent is given freely, of their own will and in their own interest. Under Part 1 of Article 9 of Law 152-FZ it must be specific, informed, conscious and unambiguous: the text shows who processes the data, why, which data, which actions, for how long, and how to withdraw consent.
The checkbox in a request form is separate from the offer, the site rules and this Policy. Agreeing to this Policy is not permission to process data. Opening the site is not consent either. A reply to a request needs its own checkbox (clauses 5.3 and 5.4). Yandex.Metrica needs the “Accept” button (clause 4.2). The clause can be opened from the link before the box is ticked.
5.2. Processing personal data without the data subject’s consent:
Under Part 1 of Article 6 of Law 152-FZ, the operator may process personal data without the data subject’s consent in the following cases:
— processing is necessary to perform a contract to which the data subject is a party, beneficiary or guarantor, or to conclude a contract at the data subject’s initiative (clause 5 of Part 1 of Article 6). Such a contract may not restrict the rights of the data subject;
— processing is necessary for the rights and legitimate interests of the operator or third parties, provided that this does not violate the rights and freedoms of the data subject (clause 7 of Part 1 of Article 6);
— processing is necessary to protect the life, health or other vital interests of the data subject where it is impossible to obtain their consent (clause 6 of Part 1 of Article 6);
— processing is necessary to fulfil the operator’s obligations established by law (clause 2 of Part 1 of Article 6).
5.3. Consent to a reply to a request from the website
The checkbox in the “I'm under attack” form is separate consent given to (OGRNIP ) to process only the data in this request.
The request contains the first name, last name, the country of the calling code, the phone number with that code, email, the chosen way to get in touch (email, Telegram, WhatsApp or LINE), a Telegram username if Telegram is chosen, a LINE ID if LINE is chosen, the text of the request and the IP address shown in the form. On the Russian version of the site this form offers email, phone, Telegram or Max instead of WhatsApp and LINE.
There is one purpose: to reply to the request and to get in touch in the chosen way.
The actions are collection, recording, storage, use, sending a copy to the operator’s email, sending the reply by the chosen method, deletion and destruction. The record stays on a server in Russia. The site does not send the record to a messenger. If a messenger is chosen, the operator sends the reply to that service: Max, Telegram, WhatsApp or LINE.
The data is kept until the reply is sent and for no more than 3 years after that, unless a contract is signed or the law requires a longer period.
Consent can be withdrawn by emailing info@anti-ddos.pro. The operator’s address is the address in the EGRIP register; it can be requested at that email before the box is ticked. To prove the checkbox, the operator keeps the fact of consent, the time, the IP address and the version date of 30 October 2026.
The checkbox does not make a contract and does not turn on Yandex.Metrica.
5.4. Consent to a reply to a plan request and to a consultation
The checkbox in the “Discuss a plan” form or in the “Consultation” form is separate consent given to (OGRNIP ) to process only the data in this request.
The request contains the name; email; the country of the calling code; the phone number with that code if a number is given; and the chosen way to get in touch — email, Telegram, WhatsApp or LINE. On the Russian version of the site this form offers email, phone, Telegram or Max instead of WhatsApp and LINE. It also contains a Telegram username if Telegram is chosen, a LINE ID if LINE is chosen, the domain, legal status, the selected plan if the request comes from a plan card, for a Russian legal entity the name and INN, for a legal entity in another country the name and registration number, the comment if there is one, and the IP address shown in the form.
There is one purpose: to reply to this request and to get in touch in the chosen way. A plan request and a consultation are two different forms, and each has its own checkbox.
The actions are collection, recording, storage, use, sending a copy to the operator’s email, sending the reply by the chosen method, deletion and destruction. The record stays on a server in Russia. The site does not send the record to a messenger. If a messenger is chosen, the operator sends the reply to that service: Max, Telegram, WhatsApp or LINE.
The data is kept until the reply is sent and for no more than 3 years after that, unless a contract is signed or the law requires a longer period.
Consent can be withdrawn by emailing info@anti-ddos.pro. The operator’s address is the address in the EGRIP register; it can be requested at that email before the box is ticked. To prove the checkbox, the operator keeps the fact of consent, the time, the IP address and the version date of 30 October 2026.
The checkbox does not make a contract and does not turn on Yandex.Metrica.
6.1. List of rights (in accordance with Article 14 of Law 152-FZ):
The data subject has the right:
— to receive information about the processing of their personal data;
— to require that their personal data be clarified, blocked or destroyed if the data is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose;
— to withdraw their consent to the processing of personal data;
— to protect their rights and legitimate interests, including claiming damages and compensation for moral harm in court;
— to appeal against the operator’s actions or inaction to Roskomnadzor (the Russian data protection authority) or in court;
— to require that processing be stopped. Processing for the purpose of promoting services through direct contact is stopped immediately (Part 2 of Article 15 of Law 152-FZ);
— to receive the information listed in Part 7 of Article 14 of Law 152-FZ, including confirmation that processing takes place, its legal grounds, purposes, methods and periods, the operator’s name and location, and the list of persons to whom the data is provided;
— The operator does not make decisions that have legal consequences for the data subject or otherwise affect their rights based solely on automated processing of personal data. Filtering network traffic is not such a decision. If such a decision is ever introduced, the data subject may object to it, and the operator considers the objection within 30 days and informs the data subject of the outcome (Article 16 of Law 152-FZ).
6.2. Right to withdraw consent (Article 9 of Law 152-FZ):
The data subject may withdraw their consent by sending a request to the operator at info@anti-ddos.pro. The deadlines and required content of such a request are set out in section 9.
After consent is withdrawn, the operator stops processing. If the data no longer needs to be kept and there is no other legal basis under clauses 2–11 of Part 1 of Article 6 of Law 152-FZ, the operator destroys it within no more than 30 days of receiving the withdrawal (Part 5 of Article 21 of Law 152-FZ). If there is another lawful basis, processing on that basis continues without consent (Part 2 of Article 9 of Law 152-FZ).
7.1. Security measures (in accordance with Article 19 of Law 152-FZ):
The security of personal data processed by the operator is ensured by legal, organisational and technical measures needed to meet federal personal data law. The person responsible for organising processing is the operator. Nobody else has been appointed. Requests under section 9 are accepted at info@anti-ddos.pro.
To prevent unauthorised access to personal data, the operator applies the following organisational and technical measures:
— the person responsible for organising processing is the operator; nobody else has been appointed;
— limiting the number of people who have access to personal data;
— keeping records of data storage media and organising their storage and handling;
— separating users’ access rights to information resources;
— using anti-virus software and tools that protect against unauthorised access;
— encrypting the website’s data transmission channel (HTTPS);
— ensuring that personal data modified as a result of unauthorised access can be restored;
— regularly monitoring and auditing personal data processing systems;
— monitoring the measures taken to keep personal data secure;
— if it is established that personal data has been unlawfully or accidentally transferred (provided, disseminated or accessed), resulting in a violation of data subjects’ rights, the operator notifies Roskomnadzor of the incident within 24 hours and of the results of its internal investigation within 72 hours (Part 3.1 of Article 21 of Law 152-FZ).
8.1. Database localisation (in accordance with Article 18 of Law 152-FZ):
When collecting personal data, including via the internet, the operator ensures that the recording, systematisation, accumulation, storage, clarification (updating, modification) and retrieval of personal data of citizens of the Russian Federation are carried out using databases located in the Russian Federation.
8.2. Personal data processing periods (Article 5 of Law 152-FZ):
The operator stores personal data in a form that allows the data subject to be identified for no longer than the purposes of processing require.
Personal data being processed must be destroyed or depersonalised once the purposes of processing have been achieved or are no longer necessary, unless otherwise provided by federal law.
Where processing is automated, destruction is confirmed by a formal record and an extract from the information system’s event log. These documents are kept for 3 years from the date of destruction (Roskomnadzor Order No. 179 of 28 October 2022). The destruction method is chosen so that the content of the data cannot be restored, taking into account clause 3.1 of Part 2 of Article 19 of Law 152-FZ.
9.1. Ways to exercise rights (in accordance with Article 14 of Law 152-FZ):
To exercise their rights, the data subject can contact the operator:
— by sending an electronic document by email to: info@anti-ddos.pro
— via the ticket system at https://my.anti-ddos.pro/submitticket.php, if the request is signed with an electronic signature or also sent as an electronic document to info@anti-ddos.pro.
A request includes the number of the main identity document of the data subject or their representative, its date of issue and issuing authority; information confirming the data subject’s relationship with the operator (contract number, login or email); and the signature of the data subject or their representative. A request in the form of an electronic document is signed with an electronic signature in accordance with the laws of the Russian Federation (Part 3 of Article 14 of Law 152-FZ). The operator’s postal address is the address recorded in the Unified State Register of Individual Entrepreneurs (EGRIP). At the data subject’s request, the operator provides its location together with the other information listed in Part 7 of Article 14.
9.2. Deadlines for responding to requests:
The operator must inform the data subject or their representative whether it holds personal data relating to that data subject, and give them the opportunity to review it, within the following periods:
— information under Part 7 of Article 14: within 10 working days of receiving the request. This period may be extended by no more than 5 working days if the data subject is sent a reasoned notice explaining why;
— clarifying inaccurate data: within 7 working days of the supporting information being provided, after which the blocking is lifted (Part 2 of Article 21);
— blocking inaccurate or unlawfully processed data: from the moment the data subject applies or the request is received, for the duration of the check (Part 1 of Article 21);
— stopping unlawful processing: within no more than 3 working days of it being discovered. If the processing cannot be made lawful, the data is destroyed within no more than 10 working days of discovery (Part 3 of Article 21);
— if the data cannot be destroyed within the periods set by Parts 3–5.1 of Article 21, the operator blocks it and destroys it within 6 months at the latest (Part 6 of Article 21);
— a demand to stop processing: within 10 working days. This period may be extended by no more than 5 working days by a reasoned notice. Processing continues if it is permitted by clauses 2–11 of Part 1 of Article 6, Part 2 of Article 10 or Part 2 of Article 11. Processing for the purpose of promoting services through direct contact is stopped immediately (Part 2 of Article 15);
— after consent is withdrawn, processing stops; if the data no longer needs to be kept and there is no other legal basis under clauses 2–11 of Part 1 of Article 6, the data is destroyed within no more than 30 days (Part 5 of Article 21).
Services are paid for through secure payment systems. The following payment methods are available:
Via the Unitpay payment system:
— bank cards of the Mir payment system.
Via the TBank payment system:
— SberPay (payment via Sberbank Online);
— bank cards of the Mir payment system;
— TPay (Tinkoff Pay).
When paying, the user is redirected to the payment system’s server (Unitpay or TBank) and enters payment details there. The full bank card number and security code stay with the payment system. The payment system may pass the operator the transaction number, amount, date and masked card number.
11.1. Where the request record is kept
The databases in which the operator records and stores personal data of citizens of the Russian Federation are in Russia (Part 5 of Article 18 of Law 152-FZ). Those databases are not exported abroad.
The request record stays on a server in Russia. A copy goes to the operator’s email. The site does not send the request card to Telegram, Max, WhatsApp, LINE or any other messenger.
If a person asks for a reply in Max, Telegram, WhatsApp or LINE, the operator sends the reply to that service. Max operates in Russia. Telegram, WhatsApp and LINE are services outside Russia. The request card itself stays in Russia.
12.1. Special categories of data (Article 10 of Law 152-FZ):
The operator does not request or process special categories of personal data: racial or ethnic origin, political views, religious or philosophical beliefs, health, or intimate life (Article 10 of Law 152-FZ). If such information appears in the text of a message, the operator does not single it out or use it for any separate purpose.
12.2. Biometric personal data (Article 11 of Law 152-FZ):
The operator does not process biometric personal data (information describing a person’s physiological and biological characteristics).
12.3. Criminal record data:
The operator does not process personal data about criminal records.
13.1. Liability of the operator (Article 24 of Law 152-FZ):
Persons found guilty of breaching the requirements of Law 152-FZ bear the liability provided for by the laws of the Russian Federation (civil, administrative or criminal).
13.2. Compensation for harm:
Moral harm caused to a data subject as a result of a violation of their rights is subject to compensation in accordance with the laws of the Russian Federation. Compensation for moral harm is paid regardless of compensation for property damage and losses incurred by the data subject.
13.3. Exemption from liability:
Section 15 explains when the operator is not liable for downtime or delays caused by force majeure. This does not remove liability for a breach of Law 152-FZ caused by the operator’s fault, nor the obligation to notify Roskomnadzor of an incident.
This Policy is a publicly available document and is published on the operator’s website at: https://anti-ddos.pro/policy
The operator may replace this Policy with a new version. A new version takes effect when it is published at https://anti-ddos.pro/policy, unless it specifies a different date.
The current version of the Policy is freely available on the internet.
This Policy does not apply to third-party websites and services.
The operator is not responsible for the actions of third parties to whom the user has provided information themselves, or for information the user has made publicly available. The operator is liable to the data subject for persons who process data on its behalf, in accordance with Part 5 of Article 6 of Law 152-FZ.
For questions about personal data processing, please contact:
Email: info@anti-ddos.pro
Telegram: @anti_ddos_pro
Ticket system: https://my.anti-ddos.pro/submitticket.php
This version of 30 October 2026 takes effect when it is published on the website and remains in force until it is replaced by a new version.
15.1. The operator is released from civil liability for full or partial failure to perform its contractual obligations, including interruption, suspension or termination of the services and of the website https://anti-ddos.pro/, if this is caused by force majeure: circumstances that are extraordinary and unavoidable under the given conditions and beyond the operator’s control (clause 3 of Article 401 of the Civil Code of the Russian Federation). This release does not apply to obligations and liability under Law 152-FZ.
15.2. Such circumstances include, in particular:
— natural disasters, fire, flood and other natural phenomena;
— military action, armed conflicts, martial law or a state of emergency;
— terrorist acts, sabotage and mass riots;
— strikes by unmanned aerial vehicles and other weapons, and damage to or destruction of buildings, data centres, networks and equipment caused by them;
— acts of state and local government authorities, including restrictions related to security or a counter-terrorism operation, if they prevent an obligation from being performed;
— power supply accidents, power outages and failures of backbone communication channels that are not the operator’s fault;
— acts of foreign state authorities and international organisations, including sanctions.
15.3. If, because of the circumstances listed in clause 15.2, the operator is physically unable to destroy personal data within the period set by Article 21, it blocks the data and destroys it within six months at the latest (Part 6 of Article 21 of Law 152-FZ). A delay in the contractual service itself is assessed under clause 3 of Article 401 of the Civil Code of the Russian Federation. This Policy does not extend or restart the periods set by Articles 14 and 21 of Law 152-FZ.
15.4. Force majeure does not release the operator from the obligation to take available measures to protect data and restore it from backups. Nor does it release the operator from the obligation to notify Roskomnadzor of an incident within the periods set by Part 3.1 of Article 21 of Law 152-FZ.
15.5. The operator reports such a circumstance and its likely duration on the website, in the customer account or by email to the customer as soon as it is technically possible.
15.6. Once the circumstance ends, the operator resumes performance immediately. Days of downtime are not added to the periods set by Articles 14 and 21 of Law 152-FZ and do not restart those periods.
15.7. The following are not force majeure: the operator’s lack of funds, failure by its counterparties to meet their obligations, and DDoS and other computer attacks against which the operator provides protection under the contract, except for attacks that exceed the protection parameters agreed in the contract. If a circumstance lasts more than 30 calendar days, the user may withdraw from the service and the operator may suspend it, giving notice by email or via the ticket system. This rule concerns the contract. It does not limit the data subject’s rights under Law 152-FZ.
Copyright © 2015–2026 Anti-DDoS PRO. All rights reserved.
We use cookies
By continuing to use the site, you agree to essential cookies. More is in the personal data policy.
Leave a phone number and email. We will contact you to turn protection on.