Back
Automatically translated version. May contain inaccuracies compared to the original.
The infrastructure of the private financial company HERC is used in the operation of the electronic queue of the State Migration Service. Authors of the Telegram channel Absolution Leaks drew attention to how this integration is organized, who sets the fee for payments, and where citizens’ personal data go.
This concerns the system through which users register to receive administrative services from the state enterprise DP SMS “Document” and make payments.
Public offer instead of a separate contract for the user
Before making a payment, the citizen is asked to agree to the “Public Agreement on the Provision of Payment Services for the Transfer of Funds without Opening Accounts.”
The document is posted directly on the SMS subdomain — cherga.dmsu.gov.ua.
Before the payment button, the user must check a box indicating that they have read the offer-agreement regarding organizing registration and payment of administrative services online.
The party to the agreement is LLC FC HERC.
In fact, a citizen using the electronic queue and moving to payment automatically interacts not only with a state service but also with a private financial company.
HERC’s service operates inside the state site
On the official page of the State Migration Service, the electronic queue service is connected via an iframe from cherga.dmsu.gov.ua.
According to the technical analysis provided by the authors of the publication, an application built on Next.js runs on the subdomain. In the interface the system is called “QMotion Suite Queue Management System.”
The payment gateway is not embedded directly in the client code. The payment link is formed by the server after creating the corresponding request.
So for an ordinary user the whole process looks like a single state service: they go to the SMS website, choose a service, register in the queue, and proceed to payment. However, part of this chain is actually provided by a private company.
Who sets the commission
A separate question concerns the cost of service.
The public offer states that information about the commission amount is posted on FC HERC’s own resource.
Thus, according to the investigators, the specific commission amount is effectively determined by the private company and published on its website.
At the same time, the user arrives at this payment mechanism directly from the state service.
The authors of the publication also note the absence of a noticeable alternative payment method within the electronic queue itself.
This raises the logical question: does a citizen have a real choice of payment operator if a private service is already integrated into the standard scenario for obtaining a state service?
Citizens’ personal data
The most sensitive part of the story is the processing of personal data.
The agreement states that the user agrees to the processing, use, and storage of their personal data.
In the personal data processing document cited by the authors of the publication, DP “Document” and HERC are simultaneously named as data controllers.
It is also stated that personal data may be stored for up to five years.
Thus the private company gains access to citizens’ information within the scope of the service, which is visually and technically linked to the state resource.
This point requires a separate explanation from the State Migration Service and DP “Document”: which exact data are transferred to the private operator, on what legal grounds, where they are physically stored, and who has access to them.
Even technical support leads to HERC
On the SMS page, to resolve issues with an already paid receipt users are advised to contact the email address [email protected].
When contacting them you must provide your last name, first name, patronymic, and ticket number.
So even in the case of a payment problem, a citizen sends additional personal data directly to the private company’s mail domain.
A separate state channel for such inquiries, the authors of the publication note, is not provided.
Why questions arise
The mere involvement of a private financial company in the payment of state services is not extraordinary. Such models are used in many electronic services.
Questions arise because of the specific system configuration.
The private service is integrated directly into the state website, the company participates in the operation of the electronic queue, receives users’ personal data, independently publishes information about its commission, and serves as a technical support channel for citizens.
For the user the boundary between the state service and the private infrastructure is practically imperceptible.
The authors of Absolution Leaks also link FC HERC to businessman Kostyantyn Tkach and mention criminal proceedings under Art. 212 of the Criminal Code of Ukraine around structures associated with him. At the same time, from the publication itself it is impossible to determine Tkach’s procedural status in such proceedings or their outcomes, so these claims require separate verification.
Similarly, the authors refer to previously identified financial violations in DP “Document”’s activities totaling about 71 million UAH. This episode should also be considered separately from the question of HERC’s operation.
The main question is different: why is a private payment operator so deeply integrated into a state service, who controls the size of its commission, and are the personal data of citizens using the SMS electronic queue adequately protected?
Document: PDF proof of the original version of the news item "Хто контролює оплату в електронній черзі ДМС і до чого тут «ГЕРЦ»". It records the publication content at the moment of the first scan, the preservation date and the source: Info-Impulsi.
