CONSENT TO THE PROCESSING OF PERSONAL DATA

Edition: 2.1 of — (in progress)
Published at: https://art-aristocrat.ru/consent

I, the data subject, acting freely, of my own will and in my own interest, and
confirming my legal capacity, hereby consent to the processing of my personal
data by the Operator:

Individual entrepreneur Tamazova Elizaveta Sergeevna
(creative agency “ART Aristocrat”)
INN 263211722452, OGRNIP 322774600496477
Address: 107370, Moscow, Tyumensky proezd 3, bldg. 1, apt. 820
Email: info@art-aristocrat.ru
Website: https://art-aristocrat.ru

1. General provisions

1.1. This Consent is given in accordance with Federal Law No. 152-FZ of 27 July 2006
“On Personal Data” and Federal Law No. 149-FZ of 27 July 2006 “On Information,
Information Technologies and Information Protection”.

1.2. The Consent is specific, defined in its subject matter, informed, conscious
and unambiguous.

1.3. The Consent is given in electronic form by ticking a checkbox under a form on
the website before it is submitted. The checkbox is not pre-ticked.
The fact that consent has been given is recorded by the Operator together with the
date, the time, the visitor identifier, the hash of the IP address, browser
information and the version of the text of this Consent.

1.4. By giving this Consent, I confirm that:

• I act voluntarily, of my own will and in my own interest;
• I am a legally capable person who has reached the age of 18;
• I provide accurate information;
• I have read the Personal Data Processing Policy (https://art-aristocrat.ru/privacy);
• I understand the purposes of the processing and the scope of the data provided.

1.5. This Consent is given when filling in any of the website forms: the feedback
form, the project request form, the cost calculator, the mini-brief, the form for
contacting a specialist, and also when sending an enquiry through the website chatbot.

2. List of personal data

2.1. I consent to the processing of the following personal data:

• name (or first name and last name);
• email address;
• telephone number;
• company name and field of activity (if stated by me);
• preferred means of contact (Telegram, WhatsApp, email);
• description of the task, content of the enquiry, comments;
• project type, approximate budget, desired deadlines;
• the set of services selected by me in the cost calculator;
• files attached by me to the request (technical specification, brief, references);
• the content of my correspondence with the website chatbot and with the Operator’s employees;
• visitor identifier and session identifier stored in cookies;
• browser, operating system and device type information (user-agent);
• the address of the page from which the visit to the website was made;
• hash of the IP address (irreversible transformation; the IP address itself is not stored by the Operator);
• the date, the time and the fact of actions performed on the website, including the fact of giving this Consent.

2.1.1. In addition — only when a contract is executed. If I fill in the contract
execution form (payer details), I also consent to the processing of the following
information, and **solely for the purposes of concluding and performing the contract
and issuing a cash receipt** under Federal Law No. 54-FZ:

• last name, first name and patronymic;
• passport series and number, by whom and when issued, division code;
• date of birth;
• taxpayer identification number of an individual;
• an electronic copy (scan or photograph) of the passport pages — if I attach it myself;
• bank details for settlements and refunds.

It has been explained to me that: this information is not transferred outside the Russian Federation;
the electronic copy of the document is placed in closed storage with access
on a need-to-know basis; the retention period is the same as for primary accounting
documents (5 years, Article 29 of Federal Law No. 402-FZ), and if no contract is concluded —
destruction within 30 days; filling in the form is voluntary, and if I refuse, the
contract is executed as a single document signed by the Parties.

This Consent, as regards this clause, is deemed given only when a separate checkbox
is ticked in the contract execution form itself. Submission of other website forms
does not cover it.

2.2. I undertake not to state in the website forms, in the description of the task
or in the attached files any information relating to special categories of personal data
(racial and ethnic origin, political opinions, religious and philosophical beliefs,
state of health, intimate life), nor any biometric personal data. The Operator does not
request and does not process such data.

2.3. If I transfer to the Operator personal data of third parties (for example, information
about the employees or clients of my company as part of a technical specification), I
confirm that there are legal grounds for their transfer and that the necessary consents
of those persons have been obtained.

3. Purposes of processing

3.1. I consent to the processing of my personal data for the following purposes:

• consideration and handling of my enquiry or request;
• contacting me regarding the requested service, including clarifying questions;
• preparation of a cost estimate and drawing up of a commercial proposal;
• sending me a commercial proposal and accompanying documents;
• conclusion and performance of a service contract;
• sending service notifications related to my request and my project;
• operation of the website chatbot and initial qualification of my enquiry;
• keeping internal records of enquiries;
• analytics of website form conversion in depersonalised form;
• ensuring the security of the website and protection against automated submissions;
• consideration of my claims and enquiries;
• compliance with the requirements of the legislation of the Russian Federation.

3.2. Processing of my personal data for purposes not stated in this Consent
is not permitted.

3.3. Sending me advertising and marketing messages is not covered by this Consent
and is carried out solely where separate consent exists
(https://art-aristocrat.ru/marketing-consent).

4. List of actions and methods of processing

4.1. I consent to the following actions being performed with my personal data:
collection, recording, systematisation, accumulation, storage, clarification (updating,
modification), extraction, use, transfer (provision, access) to the extent and in the
cases specified in sections 5 and 6 of this Consent, depersonalisation,
blocking, deletion, destruction.

4.2. Processing is carried out both with the use of automation tools and without
them (mixed processing).

4.3. The Operator does not take decisions in respect of me that give rise to legal
consequences or otherwise affect my rights and legitimate interests
solely on the basis of automated processing of personal data.

4.4. When collecting my personal data as a citizen of the Russian Federation, recording,
systematisation, accumulation, storage, clarification and extraction are carried out
using databases located in the territory of the Russian Federation.

5. Transfer to third parties

5.1. I consent to the transfer of my personal data to persons engaged by the
Operator for processing on the basis of a contract, solely to the extent necessary
to achieve the purposes stated in section 3:

• the hosting provider and the operator of the server infrastructure (Russian Federation);
• the email provider, for sending me letters;
• the web analytics service Yandex Metrica (Russian Federation);
• the services for operational recording of requests and automation of enquiry handling;
• the messenger notification service — to promptly inform an employee of the Operator that my request has arrived;
• the chatbot response generation service — to the extent of the text of my dialogue with the bot;
• the Operator’s contractors engaged in the work on my project — to the extent necessary to perform the work, subject to compliance with confidentiality.

5.2. The full current list of engaged services with their jurisdictions is set out
in section 8 of the Personal Data Processing Policy
(https://art-aristocrat.ru/privacy).

5.3. Transfer of my personal data to state authorities is carried out solely
in the cases provided for by the legislation of the Russian Federation.

5.4. The Operator does not disseminate my personal data to an indefinite range of
persons and does not transfer them to third parties for independent use, including
for advertising purposes.

6. Cross-border transfer

**A separate checkbox under the form. It may be left unticked — the request
is still accepted.**

6.1. I have been notified that part of the processing operations is performed by services
whose infrastructure is located outside the Russian Federation:

6.2. I consent to the cross-border transfer of my personal data to the territory
of the said states to the extent and for the purposes stated in this Consent
(Article 12 of Federal Law No. 152-FZ).

It has been explained to me that **the United States of America and the United Arab Emirates
are not included in the list of foreign states that ensure adequate protection
of the rights of personal data subjects** approved by Roskomnadzor (Federal Service for
Supervision of Communications, Information Technology and Mass Media). Transfer of
data to such states is carried out solely on the basis of this consent
and entails that the level of protection of my rights in those states may
differ from the level established by the legislation of the Russian Federation.

6.3. When making a transfer, the Operator limits the amount of data to the minimum necessary and
retains a full copy of the data in a database in the territory of the Russian Federation.

6.4. **An enquiry through the chatbot and messengers involves a cross-border
transfer.** The text of the dialogue is transferred to the response generation service in the manner
described in clause 6.6, and the service notification about the request — to the messaging service;
without this transfer the said channels cannot work.

If I do not wish my personal data to be transferred across borders, I contact
the Operator by the email address or the telephone number stated in the
“Contacts” section. Enquiries through these channels are handled by the means of the Russian
circuit: the data is stored on a server in the Russian Federation, and the chatbot and
messengers are not used. Refusal to make an enquiry through the chatbot does not entail for
me a refusal to provide services.

6.5. Before transferring the text of the dialogue to the response generation service, the Operator
automatically replaces with placeholders any email addresses,
telephone numbers, bank card numbers, taxpayer
identification numbers, messenger account names and links. **Names and
other information stated by me in the free text of the dialogue are transferred without
such replacement** — their automatic recognition is not performed by the Operator,
and the depersonalisation of the dialogue is partial.

6.6. AI processing: a transitional state. It has been explained to me that the processing
of enquiries to the AI assistant is being moved to the infrastructure of
MTS PJSC (MTS Web Services) located in the city of Moscow, and that the terms of use
of that service do not provide for the provider to store the content of enquiries. **Until
the migration is complete**, part of the enquiries is processed by the service of Anthropic PBC
(United States of America) — that is, with a cross-border transfer in the manner set out in
this section. Once the migration is complete, this clause will be removed by a new
edition of the Consent.

6.7. Speech recognition in voice messages to the assistant is planned and, as at
the date of this edition, does not work: voice messages are not processed, and
I do not give consent to such a transfer. When this capability is launched, the list
will be supplemented by a new edition and consent will be requested anew.

6.8. The information listed in clause 2.1.1 (identity document
data, date of birth, taxpayer identification number of an
individual, electronic copy of the document) **is not subject to cross-border
transfer under any circumstances**.

7. Validity period and withdrawal procedure

7.1. This Consent is valid from the moment it is given:

• until the purposes of the processing are achieved, or
• until the expiry of the retention periods stated in section 10 of the Personal Data Processing Policy, or
• until the moment I withdraw the Consent

whichever occurs first.

7.2. I have the right to withdraw this Consent in full or in respect of individual purposes
at any time by sending a request:

• to the email address info@art-aristocrat.ru with the subject “Withdrawal of consent 152-FZ”;
• by post to the address 107370, Moscow, Tyumensky proezd 3, bldg. 1, apt. 820;
• through the feedback form on the website.

7.3. The request must state information making it possible to identify me:
last name and first name, email address or telephone number stated by me when
submitting the request.

7.4. From the moment the withdrawal is received, the Operator ceases the processing of my personal
data carried out on the basis of consent and destroys them within no more than
30 days, with the exception of information whose storage is mandatory by law
(in particular, accounting and tax records), and of information
necessary for the performance of the contract concluded with me.

7.5. Withdrawal of the Consent does not affect the lawfulness of the processing carried out before
it was received.

7.6. I have been notified that withdrawal of the Consent before the handling of my request is
completed makes further interaction with me regarding that request impossible.

8. My rights

8.1. The rights provided for by Articles 14–17 of Federal Law No. 152-FZ have been explained to me:
to obtain information about the processing of my data and a copy thereof, to require clarification,
blocking and destruction of the data, to withdraw consent, to appeal against the actions of the Operator
to Roskomnadzor or in court. The procedure for exercising these rights and the Operator’s response times are
set out in section 11 of the Personal Data Processing Policy.

9. Final provisions

9.1. This Consent operates in electronic form and does not require a handwritten
signature.

9.2. The current edition is published at https://art-aristocrat.ru/consent.
A change to the text entails publication of a new version; consents given previously
remain valid in respect of the edition with which I actually agreed.

9.3. In all matters not regulated by this Consent, the legislation of the
Russian Federation and the Operator’s Personal Data Processing Policy shall apply.