Back
Automatically translated version. May contain inaccuracies compared to the original.
The infrastructure of the private financial company HERTS is used in the operation of the electronic queue of the State Migration Service. Authors of the Telegram channel Absolution Leaks drew attention to exactly how this integration is organized, who sets the payment commission, and where citizens' personal data end up.
This concerns the system through which users register to receive administrative services from SE DMS “Document” and make payments.
A public offer instead of a separate contract for the user
Before making a payment, the citizen is asked to agree to the “Public contract for the provision of payment services for the transfer of funds without opening accounts.”
The document is posted directly on the DMS subdomain — cherga.dmsu.gov.ua.
Before the payment button the user must tick a box indicating that they have read the offer-contract regarding organizing registration and payment of administrative services online.
The party to the contract is LLC FC HERTS.
In practice, a citizen who uses the electronic queue and proceeds to payment automatically interacts not only with the state service but also with a private financial company.
The HERTS service operates inside the state website
On the official DMS page, the electronic queue service is connected via an iframe from cherga.dmsu.gov.ua.
According to the technical analysis provided by the publication's authors, an application built on Next.js runs on the subdomain. In the interface the system is called “QMotion Suite Queue Management System.”
The payment gateway is not embedded directly into the client code. The payment link is formed by the server after creating the corresponding request.
So for an ordinary user the whole process looks like a single state service: they go to the DMS website, choose a service, register in the queue, and proceed to payment. However, part of that chain is actually provided by a private company.
Who sets the commission
A separate question concerns the cost of service.
The public offer states that information about the commission amount is posted on FC HERTS’s own resource.
Thus, according to the investigators, the specific commission amount is in practice determined by the private company and published on its website.
At the same time, the user enters this payment mechanism directly from the state service.
The authors of the publication also point out the lack of an obvious alternative payment method within the electronic queue itself.
This raises the logical question: does a citizen have a real choice of payment operator if a private service is already integrated into the standard scenario for obtaining a state service?
Citizens' personal data
The most sensitive part of the story is the processing of personal data.
The contract states that the user agrees to the processing, use, and storage of their personal data.
In the personal data processing document cited by the publication's authors, the data holders are named as both SE “Document” and HERTS.
It is also stated that personal data may be stored for up to five years.
Thus the private company gains access to citizens' information within the operation of a service that is visually and technically linked to a state resource.
This point requires a separate explanation from the DMS and SE “Document”: exactly which data are transferred to the private operator, on what legal grounds, where they are physically stored, and who has access to them.
Even technical support leads to HERTS
On the DMS page, to resolve issues with an already paid receipt, users are asked to contact the email address [email protected].
When contacting them you must provide your surname, first name, patronymic, and ticket number.
So even in the case of a payment problem a citizen transmits additional personal data directly to the private company's mail domain.
As the publication's authors note, no separate state channel for such inquiries is provided.
Why questions arise
The mere participation of a private financial company in the payment of state services is not extraordinary. Such models are used in many electronic services.
Questions arise because of the specific system configuration.
The private service is integrated directly into the state website, the company participates in the operation of the electronic queue, receives users' personal data, independently publishes information about the commission, and serves as a technical support channel for citizens.
At the same time, for the user the boundary between the state service and the private infrastructure is practically indistinguishable.
Absolution Leaks’ authors also associate FC HERTS with businessman Kostyantyn Tkach and mention criminal proceedings under Art. 212 of the Criminal Code of Ukraine around structures related to him. At the same time, from the publication itself it is impossible to establish Tkach’s procedural status in such proceedings or their outcomes, so these claims require separate verification.
The authors also refer to previously discovered financial violations in SE “Document”’s activities totaling about 71 million UAH. This episode should likewise be considered separately from the question of HERTS’s operation.
The main question is different: why is a private payment operator so deeply integrated into a state service, who controls the size of its commission, and are the personal data of citizens who use the DMS electronic queue sufficiently protected?
Document: PDF proof of the original version of the news item "Комісії та персональні дані: як «ГЕРЦ» працює всередині сервісу ДМС". It records the publication content at the moment of the first scan, the preservation date and the source: ZmiOne.
