PERSONAL DATA PROCESSING POLICY

Website: https://art-aristocrat.ru
Edition: 2.1 of — (in progress)

This Personal Data Processing Policy (hereinafter — the “Policy”) has been developed
in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”
and establishes the procedure for the processing of personal data of individuals interacting
with the creative agency ART Aristocrat through the website https://art-aristocrat.ru, as well as
through the communication channels connected with it.

The Policy is a publicly available document and is published at
https://art-aristocrat.ru/privacy in accordance with the requirement of Article 18.1(2)
of Federal Law No. 152-FZ.

1. OPERATOR OF PERSONAL DATA

The operator of personal data is:

Individual entrepreneur Tamazova Elizaveta Sergeevna
(commercial designation — creative agency “ART Aristocrat”)

• INN (taxpayer identification number): 263211722452
• OGRNIP (primary state registration number of an individual entrepreneur): 322774600496477
• Address (registered and postal, for legally significant correspondence): 107370, Moscow, Tyumensky proezd 3, bldg. 1, apt. 820
• Email: info@art-aristocrat.ru
• Website: https://art-aristocrat.ru

(hereinafter — the “Operator”)

1.1. The Operator provides services in the field of website and web application development, branding,
graphic and digital design, implementation of AI automations, and related services
to both legal entities and individuals.

1.2. The Operator independently determines the purposes of the processing of personal data, the composition
of the data processed and the actions performed with them.

1.3. This Policy is binding on the Operator, as well as on the persons
engaged by the Operator in the processing of personal data on the basis of an agreement on the
assignment of processing to a third party (Article 6(3) of Federal Law No. 152-FZ).

1.4. The Operator has submitted the notification of the processing of personal data
to the Federal Service for Supervision of Communications, Information Technology and Mass Media
(Roskomnadzor). Information on the inclusion of the Operator in the register of operators
carrying out the processing of personal data will be published in this clause
after the authorised body completes its review of the notification — (in progress).

2. TERMS

Personal data — any information relating to a directly or indirectly
determined or determinable individual (data subject).

Processing of personal data — any action or set of actions
performed with personal data, including collection, recording, systematisation,
accumulation, storage, updating, extraction, use, transfer
(provision, access), depersonalisation, blocking, deletion, destruction.

Data subject — an individual to whom the
processed data relate: a website visitor, a person who has submitted a request, a customer of services,
a representative of a customer that is a legal entity, a newsletter subscriber.

User — a person using the website https://art-aristocrat.ru.

Assignee of processing (assignment of processing to a third party) — a person to whom the Operator assigns the processing
of personal data on the basis of an agreement: a hosting provider, an email service,
an analytics service and other engaged services.

Cross-border transfer — transfer of personal data to the territory
of a foreign state to a foreign state authority, a foreign
individual or a foreign legal entity.

RU perimeter — processing of the data of users of the Russian segment of the website
(domain art-aristocrat.ru) and of customers resident in the Russian Federation.

INT perimeter — processing of the data of international customers and users
contacting the Operator outside the Russian Federation.

3. LEGAL GROUNDS FOR PROCESSING

3.1. The processing of personal data is carried out on the basis of:

• the Constitution of the Russian Federation;
• the Civil Code of the Russian Federation;
• Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”;
• Federal Law No. 149-FZ of 27 July 2006 “On Information, Information Technologies and Protection of Information”;
• Law of the Russian Federation No. 2300-1 of 07 February 1992 “On Protection of Consumer Rights” (as regards relations with consumer customers);
• Federal Law No. 38-FZ of 13 March 2006 “On Advertising”;
• Federal Law No. 402-FZ of 06 December 2011 “On Accounting”;
• Federal Law No. 54-FZ of 22 May 2003 “On the Use of Cash Register Equipment in the Making of Settlements in the Russian Federation”;
• the Tax Code of the Russian Federation;
• service agreements concluded by the Operator with customers;
• consents of data subjects;
• other regulatory legal acts of the Russian Federation.

3.2. Specific legal grounds depending on the purpose of processing:

3.3. Processing carried out on the basis of consent ceases upon withdrawal of
consent. Processing that has another lawful ground may, upon withdrawal of consent, be
continued within the limits of that ground — for example, storage of closing documents
for the period established by the accounting legislation.

4. PRINCIPLES OF PROCESSING

4.1. The Operator is guided by the principles set out in Article 5 of Federal Law
No. 152-FZ:

• lawfulness and fairness — processing is carried out only on a lawful ground and does not violate the rights of the subject;
• limitation to purposes — data are collected for specific, predetermined purposes and are not processed for purposes incompatible with those declared;
• inadmissibility of merging databases — the merging of databases created for mutually incompatible purposes is not permitted;
• minimisation — the volume and composition of the data correspond to the declared purposes; excessive data are not collected;
• accuracy — the Operator takes measures to keep the data up to date, and inaccurate data are corrected or deleted;
• limitation of the storage period — data are stored no longer than required by the purposes of processing, after which they are destroyed or depersonalised;
• security — the Operator ensures the confidentiality and protection of the data.

5. SUBJECTS AND CATEGORIES OF DATA

5.1. The Operator processes the data of the following categories of subjects:

• Website visitors — persons using the website without submitting forms;
• Leads — persons who have submitted a request through a form, the calculator, a brief or the chatbot;
• Customers — individuals who have concluded a service agreement;
• Representatives of customers — individuals acting on behalf of legal entities and individual entrepreneurs;
• Newsletter subscribers — persons who have given separate consent to receive advertising and informational messages;
• Personal account users — persons who have registered an account on the website.

5.2. Data provided by the subject voluntarily when filling in the forms on the website:

• name (or first name and surname);
• email address;
• telephone number;
• company name and field of activity (where indicated);
• preferred means of communication (Telegram, WhatsApp, email);
• description of the task, content of the enquiry, comments on the request;
• project type, approximate budget, desired deadlines;
• the set of services selected in the cost calculator;
• attached files — technical specification, brief, references (formats PDF, DOC, DOCX, JPG, PNG, TXT, up to 10 MB each; the file type is checked by its content and not by the extension in its name);
• the content of the correspondence with the website chatbot and with a manager in messengers.

5.3. Data generated automatically when the website is used:

• IP address — stored solely as an irreversible hash (SHA-256 with a secret salt, the salt being subject to periodic rotation); the original IP address is not retained in the Operator’s databases;
• user agent (information about the browser, the operating system, the device type);
• the address of the referring page (referrer);
• visitor identifier (visitor_id) and session identifier, stored in cookie files;
• date and time of the visit, information about the pages viewed, about the start and the completion of the filling in of forms (in depersonalised form — for conversion analytics);
• the fact, date, time and version of the text of the consent given by the user (consent log).

5.4. Data generated in the course of handling a request and performing an agreement:

• the history of enquiries and the statuses of their handling;
• the commercial proposals generated and their composition;
• information about the letters and notifications sent;
• information about the settlements under the agreement (amounts, dates, purposes of payments);
• the details of the customer — an individual entrepreneur or a legal entity (to the extent necessary for issuing invoices and closing documents);
• materials of the working correspondence and recordings of working meetings (where consent is given — see clause 5.6).

5.5. Special categories of personal data (racial or ethnic
origin, political views, religious beliefs, state of health,
intimate life) and **biometric personal data are not collected and
not processed by the Operator.** The User undertakes not to place such information in the forms
of the website, in the description of the task or in attached files.

5.6. Recordings of working meetings and negotiations. The Operator has the right to make an audio or
video recording of online working meetings and telephone negotiations for the purposes of recording
agreements, quality control and the resolution of possible disagreements. The recording
is made provided that the participants are notified in advance before it begins. A participant
who does not agree to the recording has the right to state so — in that case the meeting is held
without recording or is documented in written minutes.

5.7. Data of third parties. If a user transfers to the Operator the personal data
of other persons (employees, contractors, clients of the customer — for example, as part of
a technical specification or of content for a website), the user confirms that he or she has a
lawful ground for such transfer and has obtained the necessary consents. In respect of
such data the Operator acts as a person processing the data on the assignment of the
customer, and the customer remains their operator.

5.8. Identity document data. For customers who are individuals,
self-employed persons and individual entrepreneurs, the Operator offers, for the conclusion of the agreement and
the arrangement of settlements, a separate protected agreement registration form. It processes:

• surname, first name and patronymic;
• passport series and number, by whom and when issued, subdivision code;
• date of birth;
• taxpayer identification number of an individual;
• at the Customer’s choice — an electronic copy (scan or photograph) of the passport pages;
• bank details for settlements and refunds.

**The purpose is solely the conclusion and performance of the agreement and the generation of a cash
receipt** in accordance with Federal Law No. 54-FZ. This information is not processed for other purposes:
it is not used for analytics, for mailings or for
profiling, and it is not transferred to the services listed in section 8, with the
exception of those through which the receipt is generated and the accounting records are kept.

Information of this category is not requested when a request is submitted, in the cost
calculator or in a dialogue with the chatbot — only in the agreement registration form, and only
after a separately ticked mark of consent. Filling in the form is voluntary:
without it, the agreement is executed as a single document signed by the Parties.

Storage. The electronic copy of the document is placed in a closed storage to which access
is available only to the Operator’s employees involved in the registration of the agreement
and in settlements; the link to the file is not public and does not work without authorisation.
The storage period is the same as for the primary accounting documents to which this information
relates (section 10).

The Operator does not request through the website, in correspondence or through the chatbot: passwords,
confirmation codes from SMS messages and banking applications, CVC/CVV, PIN codes or full numbers
of bank cards. A page or a message requesting such information on behalf of
ART Aristocrat has no relation to the Operator.

6. PURPOSES OF PROCESSING

6.1. The processing of personal data for purposes not specified in this section
is not carried out.

6.2. The Operator **does not take decisions producing legal consequences for the
data subject or otherwise affecting his or her rights and legitimate
interests solely on the basis of automated processing.** The automatic
suggestion of a suitable service in the calculator and the preliminary qualification of an enquiry
by the chatbot are informational in nature; final decisions on a request are taken by
an employee of the Operator.

7. PROCEDURE FOR COLLECTING AND OBTAINING CONSENT

7.1. Personal data are provided by the subject voluntarily. A refusal to
provide the data makes it impossible to handle the request, but does not restrict
access to the informational sections of the website.

7.2. Consent to the processing of personal data is expressed by ticking
a separate mark (checkbox) under the form before it is submitted. The mark is not
pre-ticked; submitting the form without ticking it is technically impossible.
The text of the consent is published at https://art-aristocrat.ru/consent.

7.3. Consent to receive advertising and marketing messages is expressed by a **separate
mark**, is voluntary and does not affect the possibility of obtaining the services.
The text — https://art-aristocrat.ru/marketing-consent.

7.4. Analytical cookies: two modes, by domain.

• Russian website (art-aristocrat.ru). Web analytics is carried out by a Russian service, the data are processed in the territory of the Russian Federation, and there is no cross-border transfer here. The counter is connected when the page loads; on the first visit the banner informs about the use of cookies and provides a link to this Policy and to the cookie policy. The User has the right to refuse analytical cookies by means of the browser, and also to apply to the Operator for the deletion of information already collected.
• International website (art-aristocrat.com). Until consent is obtained, no analytics service is connected — neither foreign nor Russian. The reason is that, for a visitor accessing the site from abroad, the transfer of information about his or her behaviour to a Russian analytics service also requires consent. The scripts are loaded only after an active action in the banner.

Continuing to browse the website, scrolling or closing the banner without making a choice are
not deemed to be consent. Technical cookies, without which the website does not function, are used
without consent on both domains. Details and the list of specific files —
https://art-aristocrat.ru/cookie-policy.

7.5. Consent to the cross-border transfer of personal data is separate
and is requested in the text of the consent (section “Cross-border transfer”).

7.6. The Operator records the fact of obtaining consent in the consent log: the
visitor identifier, the hash of the IP address, the user agent, the type and version of the text of the consent,
and the date and time are stored. The log serves as evidence of the exact edition of the text
to which the subject agreed.

7.7. When the text of the consent changes, a new version of the document is published. Previously
obtained consents remain valid in respect of the edition to which the subject
actually agreed; for new purposes of processing, new consent is requested.

8. TRANSFER OF DATA TO THIRD PARTIES AND ENGAGED SERVICES

8.1. The Operator does not sell personal data, does not transfer them to advertising networks for
independent use by third parties and does not disseminate them to an unlimited
circle of persons.

8.2. Individual operations of processing are assigned to services acting as assignees of processing on the basis of
an agreement providing for the obligation to observe confidentiality and the requirements
of Article 6(3) of Federal Law No. 152-FZ. The full list:

Hosting and storage of data (Russian Federation):

Services outside the Russian Federation (cross-border transfer — see section 9):

Speech recognition in the assistant’s voice messages is planned and, as at the date of
this edition, does not operate. Until it is launched, voice messages are not
processed, and consent to such transfer is not requested; upon launch the
list will be supplemented by a new edition, and consent will be requested anew.

8.3. AI processing: transitional state. The processing of enquiries to the AI assistant
is being transferred to the infrastructure of MTS PJSC (MTS Web Services), located
in the city of Moscow; the terms of use of the service do not provide for the storage
by the provider of the content of the enquiries. Until the transfer is completed, part of the enquiries
is processed by the service of Anthropic PBC (United States of America) — that is,
with cross-border transfer of the text of the dialogue in accordance with section 9.

Both recipients are named deliberately: while the transfer is not completed, it would be incorrect to
state that the processing is carried out entirely in the Russian Federation. Upon
completion of the transfer, this clause will be removed by a new edition of the Policy.

Before the text of a dialogue is transferred to either of the specified services, the measures
described in clause 9.4 are applied.

8.4. The Operator transfers personal data to state authorities solely
in the cases and to the extent provided for by the legislation of the Russian Federation,
on the basis of a reasoned request.

8.5. Recording of actions on the page (Webvisor — session recording). Yandex Metrica includes
an enabled session recording function: pointer movements, scrolling, clicks
and the sequence of the pages viewed are saved. The recording is made by the analytics service
in the territory of the Russian Federation, serves to find inconvenient places in the interface
and is not used to establish identity. Passwords and bank card numbers are not recorded
by the service. Visit recordings are stored by the service for a limited time
and, upon its expiry, are deleted by it automatically. This function is managed
together with the rest of the analytics, in accordance with section 14.

8.6. When contractors (designers, developers, copywriters) are engaged to work
on a customer’s project, the Operator transfers to them only the data that are necessary
for the performance of the work, and obliges them to observe confidentiality by agreement.

9. LOCALISATION AND CROSS-BORDER TRANSFER

9.1. Localisation (RU perimeter). When collecting the personal data of citizens of the Russian
Federation, the Operator ensures the recording, systematisation, accumulation, storage,
updating and extraction of such data using databases located
in the territory of the Russian Federation (Article 18(5) of Federal Law No. 152-FZ).
The primary and principal database of requests is hosted on a server in the Russian Federation.

9.2. Cross-border transfer. Individual processing operations are performed by services
whose infrastructure is located outside the Russian Federation (the list —
clause 8.2). Such transfer is carried out:

• on the basis of the separate consent of the data subject, expressed in accordance with Article 12(4) of Federal Law No. 152-FZ;
• to the extent minimally necessary to achieve the relevant purpose;
• while retaining a full copy of the data in a database in the territory of the Russian Federation.

9.3. Countries to whose territory transfer is possible:

Transfer to states that do not ensure adequate protection is carried out
where there is the consent of the data subject expressed in accordance with
Article 12(4) of Federal Law No. 152-FZ, and after the Operator has obtained from
the foreign recipients information about the personal data protection measures they apply
and about the legal regulation in the field of personal data in
the relevant state.

9.4. Contacting through the chatbot and messengers entails cross-border transfer:
the text of the dialogue is transferred to the response generation service (on the transitional basis of clause 8.3),
and the internal notification about the request — to the messaging service; without this transfer
the said channels cannot operate. A subject who does not wish cross-border transfer
contacts the Operator by the email address or the telephone number indicated in the section
“Contacts”; such enquiries are handled by the means of the Russian perimeter — the data
are stored on a server in the Russian Federation, and the chatbot and messengers are not used.
Refusal to make contact through the chatbot does not entail a refusal to provide the services.

Before the text of a dialogue is transferred to the response generation service, the Operator automatically
replaces with placeholder tokens email addresses, telephone numbers, bank
card numbers, taxpayer identification numbers, account names
in messengers and links; the mapping table is not transferred outside the Russian perimeter.
**Names and other information named by the subject in the free text of the dialogue
are not subject to such replacement** — their automatic recognition is not performed by the Operator,
and the depersonalisation of the dialogue is partial. The same transformation
is applied to the free text of the enquiry in the internal notification to an employee.

The information listed in clause 5.8 (identity document data,
date of birth, taxpayer identification number of an individual,
electronic copy of the document) **is not subject to cross-border transfer under any
circumstances** and is processed exclusively within the Russian perimeter.

9.5. INT perimeter. For international customers contacting the Operator outside
the Russian Federation, the processing of data may be carried out on servers
in the European Union. Both this Policy and the applicable data protection legislation of the
subject’s country apply to such relations; where a subject applies
from the European Economic Area, the Operator ensures rights equivalent to
those provided for by the General Data Protection Regulation (GDPR): access, rectification,
erasure, restriction of processing, portability, objection to processing.

9.6. The Operator notifies the authorised body (Roskomnadzor) of its intention to carry out
the cross-border transfer of personal data in accordance with the procedure established by Article 12
of Federal Law No. 152-FZ, and ceases or restricts such transfer at the
demand of the authorised body.

10. STORAGE PERIODS

10.1. Upon the achievement of the purposes of processing or upon the expiry of the specified periods, personal
data are subject to destruction. Depersonalisation instead of destruction is applied
only where this is directly indicated in the table above — to the content of the correspondence
with the chatbot: the technical records connected with it are needed for the operation of the service even after
the content itself has been deleted.

The periods in the table are maximum periods. Destruction is carried out upon the expiry of the period,
and also earlier — upon an application by the subject in accordance with section 11.

10.2. Upon withdrawal of consent or receipt of a demand for deletion, the data are marked
for deletion immediately and are physically destroyed within no more than 30 days, with
the exception of the data whose storage is mandatory by virtue of law.

10.3. The fact of the destruction of personal data is recorded by an act or by a corresponding
entry in the information system.

11. RIGHTS OF THE DATA SUBJECT

11.1. The data subject has the right:

11.2. An application is sent by any of the following means:

• by email to info@art-aristocrat.ru with the subject line “Request under 152-FZ”;
• by postal item to the address 107370, Moscow, Tyumensky proezd 3, bldg. 1, apt. 820;
• through the feedback form on the website.

11.3. The application must indicate the information allowing the subject to be identified
and his or her connection with the processed data to be confirmed: surname and first name, the email
address or the telephone number from which the request was submitted, and the substance of the demand. The Operator
has the right to request additional information if that provided is insufficient for
identification; until identification, the information is not provided, in order to avoid disclosing
the data to an unauthorised person.

11.4. The Operator has the right to refuse to satisfy a demand if the data are processed
on a ground unrelated to consent (performance of an agreement,
requirement of law), stating the reasons for the refusal.

11.5. In the event of disagreement with the actions of the Operator, the subject has the right to apply
to the Federal Service for Supervision of Communications, Information Technology and Mass Media
(Roskomnadzor): https://rkn.gov.ru, 109992, Moscow, Kitaygorodsky
proezd 7, bldg. 2 — or to a court in accordance with the procedure established by the legislation
of the Russian Federation.

12. PROTECTION MEASURES

12.1. The Operator takes legal, organisational and technical measures to protect
personal data against unlawful access, destruction, modification, blocking,
copying, dissemination and other unlawful actions (Articles 18.1, 19
of Federal Law No. 152-FZ):

• the appointment of a person responsible for organising the processing of personal data;
• the issuance and application of this Policy and of internal documents establishing the procedure for the processing and destruction of data;
• the restriction of the circle of persons having access to personal data, on the principle of the minimum necessary rights;
• the encryption of connections (TLS) when data are transferred between the user and the website;
• the storage of IP addresses solely as an irreversible hash with a secret salt and periodic rotation of the salt;
• the storage of account passwords solely as cryptographic hashes;
• the protection of forms against automated submissions and the limitation of the frequency of requests (rate limiting);
• the checking of uploaded files by type and content, the limitation of their size;
• regular backup with encryption of the backup copies;
• the maintenance of logs of access and of actions with the data;
• the assessment of the harm that may be caused to subjects in the event of a breach of the requirements of the legislation.

12.2. In the event that an incident involving the unlawful transfer of
personal data is detected, the Operator notifies Roskomnadzor of the fact of the incident
within 24 hours and of the results of the internal investigation — within 72 hours
of its detection (Article 21(3.1) of Federal Law No. 152-FZ), and also
notifies the affected data subjects.

13. PERSON RESPONSIBLE FOR ORGANISING THE PROCESSING

13.1. The person responsible for organising the processing of personal data is
individual entrepreneur Tamazova Elizaveta Sergeevna.

13.2. The responsible person ensures control over compliance with this Policy, the
consideration of the applications of subjects, the conduct of internal checks and the interaction
with the authorised body.

13.3. Contact: info@art-aristocrat.ru.

14. COOKIE FILES

14.1. The website uses cookie files and similar technologies. The procedure for their use, the
categories, the list of specific files and the storage periods are established by a separate document —
the Cookie Policy: https://art-aristocrat.ru/cookie-policy.

14.2. Technical cookies necessary for the operation of the website, for authorisation and for saving
the user’s choice regarding cookies are used without consent on both
domains. The procedure for analytical cookies differs by domain and is set out
in clause 7.4: on the international website they are connected only after consent,
and on the Russian one the banner informs, while refusal is effected by means of the browser
and by applying to the Operator.

15. FINAL PROVISIONS

15.1. This Policy comes into force upon its publication on the website
and is valid indefinitely until it is replaced by a new edition.

15.2. The Operator has the right to make changes to the Policy. A new edition comes into force
upon its publication on the website, unless otherwise stated in the edition itself. Material
changes affecting the purposes of processing or the composition of the data processed require
that new consent be obtained from the subject.

15.3. The current edition is always available at
https://art-aristocrat.ru/privacy.

15.4. In everything not regulated by this Policy, the legislation
of the Russian Federation applies.

*The document has been developed in accordance with: Federal Law No. 152-FZ “On Personal
Data” (Articles 5, 6, 9, 12, 18, 18.1, 19, 20, 21, 22), Federal Law No. 149-FZ
“On Information, Information Technologies and Protection of Information”, Federal
Law No. 38-FZ “On Advertising” (Article 18), Federal Law No. 402-FZ “On
Accounting” (Article 29).*