Back
Automatically translated version. May contain inaccuracies compared to the original.
The infrastructure of a private financial company, HERC, is used in the electronic queue system of the State Migration Service. Authors of the Telegram channel Absolution Leaks drew attention to how this integration is organized, who sets the payment fees, and where citizens' personal data end up.
This concerns the system through which users sign up to receive administrative services from SE DMS “Document” and make payments.
A public offer instead of a separate contract for the user
Before making a payment, citizens are asked to agree to the “Public contract for the provision of payment services for transferring funds without opening accounts.”
The document is posted directly on the DMS subdomain — cherga.dmsu.gov.ua.
Before the payment button, the user must check a box indicating that they have read the offer contract regarding organizing registration and payment of administrative services online.
The party to the contract is LLC FC HERC.
Effectively, a citizen who uses the electronic queue and proceeds to payment interacts not only with the government service but also with a private financial company.
The HERC service operates inside the government website
On the official DMS page, the electronic queue service is connected via an iframe from cherga.dmsu.gov.ua.
According to the technical analysis presented by the authors of the publication, an application built on Next.js runs on the subdomain. In the interface, the system is called “QMotion Suite Queue Management System.”
The payment gateway is not embedded directly in the client code. The payment link is formed by the server after creating the corresponding request.
So for an ordinary user the whole process appears as a single government service: they go to the DMS site, choose a service, register in the queue, and proceed to payment. However, part of this chain is actually provided by a private company.
Who sets the fee
A separate question concerns the cost of the service.
The public offer states that information about the commission amount is posted on FC HERC’s own resource.
Thus, according to the investigative authors, the specific commission amount is effectively determined by the private company and published on its site.
At the same time, the user accesses this payment mechanism directly from the government service.
The authors also note the lack of a noticeable alternative payment method within the electronic queue itself.
This raises the logical question: does a citizen have a real choice of payment operator if a private service is already integrated into the standard scenario for obtaining a government service?
Citizens' personal data
The most sensitive part of the story is the processing of personal data.
The contract states that the user agrees to the processing, use, and storage of their personal data.
In the document on personal data processing cited by the authors, the data owners are listed as both SE “Document” and HERC.
It is also indicated that personal data may be stored for up to five years.
Thus the private company gains access to citizens’ information within the service, which is visually and technically linked to the government resource.
This point requires a separate explanation from the DMS and SE “Document”: which specific data are transferred to the private operator, on what legal grounds, where they are physically stored, and who has access to them.
Even technical support directs users to HERC
On the DMS page, to resolve issues with an already paid receipt, users are advised to contact the email address [email protected].
When contacting them you must provide your last name, first name, patronymic, and ticket number.
So even in the case of a payment problem, a citizen transmits additional personal data directly to the private company’s email domain.
According to the authors, there is no separate government channel provided for such inquiries.
Why questions arise
The mere participation of a private financial company in payment for government services is not extraordinary. Such models are used in many electronic services.
Questions arise because of the specific system configuration.
The private service is integrated directly into the government site, the company participates in the operation of the electronic queue, receives users' personal data, independently publishes information about the commission, and acts as a technical support channel for citizens.
For the user, the line between the government service and the private infrastructure is practically invisible.
Absolution Leaks’ authors also link FC HERC to businessman Kostiantyn Tkach and mention criminal proceedings under Art. 212 of the Criminal Code of Ukraine concerning structures associated with him. At the same time, from the publication itself it is impossible to establish Tkach’s procedural status in such proceedings or their outcomes, so these claims require separate verification.
The authors also refer to previously discovered financial violations in the activities of SE “Document” amounting to about 71 million UAH. This episode should also be considered separately from the question of HERC’s operation.
The main question is different: why is a private payment operator so deeply integrated into a government service, who controls the size of its commission, and are the personal data of citizens using the DMS electronic queue sufficiently protected?
Document: PDF proof of the original version of the news item "ГЕРЦ, електронна черга ДМС і персональні дані: як приватна платіжна система інтегрована в державний сервіс". It records the publication content at the moment of the first scan, the preservation date and the source: DosieNews.Info.
