Back
Automatically translated version. May contain inaccuracies compared to the original.
The electronic queue of the State Migration Service uses the infrastructure of the private financial company HERTS. Authors of the Telegram channel Absolution Leaks drew attention to how this integration is organized, who sets the payment fee, and where citizens’ personal data go.
This concerns the system through which users sign up to receive administrative services from SE DMS “Document” and make payments.
Public offer instead of a separate contract for the user
Before making a payment, the citizen is asked to agree to the “Public Agreement on the Provision of Payment Services for the Transfer of Funds without Opening Accounts.”
The document is posted directly on the DMS subdomain — cherga.dmsu.gov.ua.
Before the payment button the user must check a box confirming that they have read the offer contract regarding the organization of registration and payment of administrative services online.
The party to the agreement is LLC FC HERTS.
In practice, a citizen who uses the electronic queue and proceeds to payment automatically interacts not only with the state service but also with a private financial company.
HERTS service operates inside the state website
On the official DMS page, the electronic queue service is connected via an iframe from the address cherga.dmsu.gov.ua.
According to the technical analysis provided by the article’s authors, the subdomain runs an application on Next.js. In the interface the system is called “QMotion Suite Queue Management System.”
The payment gateway is not embedded directly in the client code. The payment link is generated by the server after creating the corresponding request.
So for the ordinary user the whole process appears as a single state service: they go to the DMS site, choose a service, register in the queue, and proceed to payment. However, part of that chain is actually provided by a private company.
Who sets the fee
A separate question concerns the cost of the service.
The public offer states that information about the fee amount is posted on FC HERTS’s own resource.
Thus, according to the investigators, the specific fee amount is effectively determined by the private company and published on its website.
At the same time the user is directed to this payment mechanism directly from a state service.
The article’s authors also point out the lack of a noticeable alternative payment method inside the electronic queue itself.
This raises the logical question: does a citizen have a real choice of payment operator if a private service is already integrated into the standard scenario for obtaining a state service?
Citizens’ personal data
The most sensitive part of the story is the processing of personal data.
The agreement states that the user agrees to the processing, use, and storage of their personal data.
In the personal data processing document cited by the article’s authors, the data holders are named as both SE “Document” and HERTS.
It is also stated that personal data may be stored for up to five years.
In other words, the private company gains access to citizens’ information as part of the service’s operation, which is visually and technically linked to the state resource.
This point requires a separate explanation from the DMS and SE “Document”: exactly which data are transferred to the private operator, on what legal grounds, where they are physically stored, and who has access to them.
Even technical support leads to HERTS
On the DMS page, to resolve issues with an already paid receipt users are advised to contact the email address [email protected].
When contacting them you must provide your surname, given name, patronymic, and ticket number.
So even in the case of a payment problem the citizen submits additional personal data directly to the private company’s email domain.
A separate state channel for such inquiries, the article’s authors note, is not provided.
Why questions arise
The mere participation of a private financial company in the payment of state services is not extraordinary. Such models are used in many e-services.
Questions arise because of the specific system configuration.
The private service is integrated directly into the state website, the company participates in the operation of the electronic queue, receives users’ personal data, independently publishes information about its fee, and acts as a technical support channel for citizens.
At the same time the boundary between the state service and the private infrastructure is practically unnoticeable to the user.
The authors of Absolution Leaks also associate FC HERTS with businessman Kostiantyn Tkach and mention criminal proceedings under Art. 212 of the Criminal Code of Ukraine related to structures connected to him. At the same time, from the publication itself it is impossible to establish Tkach’s procedural status in such proceedings or their outcomes, so these claims require separate verification.
Similarly, the authors refer to previously identified financial violations in SE “Document”’s activities amounting to about 71 million UAH. This episode should also be considered separately from the question of HERTS’s operation.
The main question is different: why is a private payment operator so deeply integrated into a state service, who controls the size of its fee, and are the personal data of citizens who use the DMS electronic queue sufficiently protected.
Document: PDF proof of the original version of the news item "Приватна платіжна система в сервісі ДМС: що відомо про «ГЕРЦ»". It records the publication content at the moment of the first scan, the preservation date and the source: NARDEP 24.
