Personal data processing policy

1. GENERAL PROVISIONS

1.1. The Operator is Individual Entrepreneur Alexandra Mikhailovna Koverzneva (INN 780228653744, OGRNIP 325784700140380), operating the Atelier beauty salon (the “Salon”). Place of business: 1 Voznesensky Prospekt, St. Petersburg, Russia. Postal address for enquiries and correspondence: Apt. 10, Building A, 72 Vyborgskoye Shosse, St. Petersburg, 194356, Russia.

1.2. This Policy takes effect on 16 October 2026 and must be published on the Salon’s Website and on the information board at the Salon to ensure unrestricted access (Part 2 of Article 18.1 of the Personal Data Law).

1.3. Personal data are processed by the Operator on a lawful and fair basis, are limited to specific, pre-defined and legitimate purposes, and processing incompatible with the purposes for which the personal data were collected is not permitted (Article 5 of the Personal Data Law).

1.4. This Policy applies to all personal data processed by the Operator, including: • personal data of clients obtained when booking services (by phone, through the Website, through online booking services, or through the Salon administrator) and when receiving services; • personal data of Website users obtained through web analytics services (IP address, cookies, information about the browser, device, time and actions on the Website); • personal data of persons who contact the Operator by phone, email, via messaging services, or in person; • personal data of Salon employees and engaged specialists, to the extent necessary for organising their activities (the processing of employees’ personal data is additionally governed by the Operator’s internal policies).

1.5. Use of the Website, booking a service, and receiving services mean that the data subject has been informed of this Policy. If a data subject does not agree to the processing of personal data for purposes requiring consent, they may withhold such consent or withdraw it in accordance with Section 13 of this Policy. Refusal to consent to analytics or marketing communications does not prevent the data subject from booking or receiving services.

1.6. This Policy is a publicly available document. The Operator ensures unrestricted access to this Policy by publishing it on the Website and on the information board at the Salon (Part 2 of Article 18.1 of the Personal Data Law).

1.7. This Policy applies only to the Website and the Operator’s activities. The Operator does not control and is not responsible for third-party websites to which a User may navigate through links available on the Website, or for the processing of personal data by third-party services acting not on the Operator’s instructions, as described in Section 8 of this Policy.

2. TERMS AND DEFINITIONS

2.1. The following terms are used in this Policy: • personal data — any information relating to an identified or identifiable natural person (a data subject) (Article 3 of the Personal Data Law); • operator — Individual Entrepreneur Alexandra Mikhailovna Koverzneva, who independently organises and carries out the processing of personal data and determines the purposes of processing, the categories of personal data, and the actions performed with them; • data subject — a client, visitor to the Salon, Website user, or other natural person whose personal data are processed by the Operator; • client — a natural person who has booked services at the Salon or received services from the Salon; • Website user — a natural person who uses the Website; • Website — the Operator’s web page at https://atelier-spb.com, including all of its pages and functionality; • services — non-medical hairdressing and beauty services provided by the Salon in accordance with the public offer for the conclusion of a paid services agreement with the Atelier beauty salon; • booking — the submission and confirmation of a request for services (by phone, through the Website or online booking services, or through the Salon administrator); • processing of personal data — any action (operation) or set of actions performed with personal data using automated means or without such means, including collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer, anonymisation, blocking, deletion, and destruction; • personal data information system — a set of personal data contained in databases and the information technologies and technical means used to process them.

2.2. Terms not defined in this Policy shall be interpreted in accordance with the legislation of the Russian Federation on personal data.

3. LEGAL BASES FOR PROCESSING PERSONAL DATA

3.1. The legal bases for the Operator’s processing of personal data include: • the Constitution of the Russian Federation; • the Civil Code of the Russian Federation; • the Labour Code of the Russian Federation (with respect to the processing of employees’ personal data); • Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”; • Law of the Russian Federation No. 2300-1 of 7 February 1992 “On Consumer Protection”; • Federal Law No. 54-FZ of 22 May 2003 “On the Use of Cash Register Equipment for Payments in the Russian Federation”; • Russian tax legislation (with respect to obligations to record income and issue payment documents); • the data subject’s consent to the processing of their personal data (Paragraph 1 of Part 1 of Article 6 of the Personal Data Law); • an agreement to which the data subject is a party, concluded, among other things, by acceptance of the public offer for the conclusion of a paid services agreement with the Atelier beauty salon (Paragraph 5 of Part 1 of Article 6 of the Personal Data Law); • other federal laws and regulatory legal acts providing for cases and features of the processing of personal data.

4. PURPOSES OF PROCESSING PERSONAL DATA

4.1. The Operator processes personal data for the following purposes: • concluding and performing a paid services agreement: booking and confirming services, informing the client of the date and time of the service, providing services, accepting services, making payments (including issuing cash register receipts), and resolving claims and disputes; • providing information about the Salon’s services, their cost, and the terms of their provision upon a data subject’s request; • sending information and advertising materials about the Salon’s services to a data subject (only with the data subject’s prior separate consent in accordance with Article 15 of the Personal Data Law); • ensuring the safety of visitors, staff, and Salon property; • analysing Website traffic, ensuring the proper operation of the Website, improving the user experience, identifying technical errors and vulnerabilities, and generating anonymised statistics on Website use; • preparing statistical reports and analysing the effectiveness of the Salon’s operations; • performing obligations imposed on the Operator by the legislation of the Russian Federation (accounting and tax records, use of cash register equipment, and responses to requests from authorised state authorities in cases provided for by law).Vproviding information about the Salon’s services, their cost, and the terms of their provision upon a data subject’s request; • sending information and advertising materials about the Salon’s services to a data subject (only with the data subject’s prior separate consent in accordance with Article 15 of the Personal Data Law); • ensuring the safety of visitors, staff, and Salon property; • analysing Website traffic, ensuring the proper operation of the Website, improving the user experience, identifying technical errors and vulnerabilities, and generating anonymised statistics on Website use; • preparing statistical reports and analysing the effectiveness of the Salon’s operations; • performing obligations imposed on the Operator by the legislation of the Russian Federation (accounting and tax records, use of cash register equipment, and responses to requests from authorised state authorities in cases provided for by law).

5. CATEGORIES OF DATA SUBJECTS

5.1. The data subjects whose personal data are processed by the Operator include: • clients and visitors to the Salon — natural persons who have booked services or received services from the Salon; • Website users; • persons who have contacted the Operator by phone, email, through the Website or online booking services, via messaging services, or in person; • Salon employees and engaged specialists, to the extent necessary for organising their activities.

6. CATEGORIES OF PERSONAL DATA PROCESSED

6.1. The categories of personal data processed are determined by the purposes of processing and are not excessive in relation to the stated purposes: • in relation to clients and persons making enquiries: surname, first name, patronymic; contact phone number; email address; other information voluntarily provided when booking or receiving services (including service preferences); and information contained in documents issued in connection with the provision of services (including cash register receipts); • in relation to Website users: technical and analytical data collected through web analytics services (IP address, cookies, information about the browser and device, time and actions on the Website); and data provided by the User when booking services through the Website or online booking services.

6.2. Information about a data subject’s health, contraindications, and allergic reactions, voluntarily provided when booking or receiving services, is processed solely for the purpose of providing the service safely and only with the data subject’s separate consent. Such information is available only to the specialist providing the service and is not disclosed to third parties, except in cases provided for by the legislation of the Russian Federation.

6.3. Health-related data are not collected through the Website’s web analytics services.

6.4. The Operator does not process biometric personal data. The Operator does not take actions aimed at identifying Website users based on data collected through web analytics. Salon clients are identified only to the extent necessary to perform the agreement and achieve the processing purposes set out in this Policy.

7. PROCEDURE AND CONDITIONS FOR PROCESSING PERSONAL DATA

7.1. Personal data are processed by the Operator on the bases provided for by the Personal Data Law, including: with the data subject’s consent; for the purpose of concluding and performing an agreement to which the data subject is a party; in performance of the Operator’s statutory obligations; for the protection of the data subject’s vital interests; and in other cases provided for by law.

7.2. A data subject may give consent to the processing of personal data in any form that allows the fact of its receipt to be confirmed, including by ticking the relevant box in forms on the Website, when subscribing to a mailing list, by selecting “Allow analytics” in the cookie notice, or by sending a written request to the Operator (Part 1 of Article 9 of the Personal Data Law).

7.3. In cases provided for by the legislation of the Russian Federation, personal data are processed without the data subject’s consent, including where processing is necessary for the performance of an agreement to which the data subject is a party, for the performance of statutory obligations, or for the protection of the data subject’s life and health.

7.4. The Operator processes personal data using automated means, including through information and telecommunications networks (the Website, online booking services, email, and messaging services), and without automated means (booking logs and paper documents).

7.5. When collecting personal data, including via the Internet, the Operator ensures that the recording, systematisation, accumulation, storage, updating, and retrieval of personal data of citizens of the Russian Federation are carried out using databases located in the territory of the Russian Federation (Part 5 of Article 18 of the Personal Data Law).

7.6. Personal data are transmitted electronically over open Internet communication channels using the security measures described in Section 11 of this Policy.

7.7. The Operator does not disclose or disseminate personal data to third parties without the data subject’s consent, except in cases provided for by federal law (Article 7 of the Personal Data Law). Personal data may be provided to authorised state authorities of the Russian Federation only on the grounds and in the manner established by the legislation of the Russian Federation.

7.8. Cookies and web analytics. The Website uses cookies for technical and analytical purposes. Technical cookies necessary for the proper operation of the Website are used without separate consent. Analytics services (Yandex Metrica and Google Analytics 4) are loaded only after the User selects “Allow analytics” in the cookie notice; the choice may be changed on the cookies page. If the User declines analytics, the Website and booking links continue to work.

8. TRANSFER OF PERSONAL DATA AND THIRD-PARTY SERVICES

8.1. The Operator may entrust the processing of personal data to third parties (providers of online booking services, web analytics services, organisations providing accounting services, and other persons) on the basis of the data subject’s consent or another legal basis provided for by law, including for the purpose of performing an agreement, under a personal data processing agreement (Part 3 of Article 6 of the Personal Data Law). A person processing personal data on the Operator’s instructions must maintain the confidentiality of personal data and comply with data protection requirements; the Operator is responsible to the data subject for the actions of such persons (Parts 4 and 5 of Article 6 of the Personal Data Law).

8.2. When using the Website, the Operator uses the following third-party services: • Yandex Metrica — a web analytics service that provides reports on Website traffic and User actions (including recordings of page actions that do not contain information enabling the User to be identified); it is enabled only after the User selects “Allow analytics”; • YClients — an online booking service to which the Website’s booking buttons lead; data provided by the User when booking are processed by the service in accordance with its rules and the Operator’s instructions; • Yandex Maps — a service for displaying the Salon’s location and building routes; • Google Analytics 4 — a service for analysing visits and clicks on the booking, phone, and map buttons; the Website does not transfer booking data entered by the User to this service; analytics are enabled after the User selects “Allow analytics”.

8.3. This Policy does not apply to the processing of data by third-party services to which the Operator has no access or control and which process data under their own rules. The list of such services is provided in this Section.

8.4. Video surveillance in adjacent areas. Video surveillance may be carried out in areas adjacent to the Salon and organised by the building owner (the hotel). The Operator is not the operator of the relevant video surveillance system, does not collect, store, or view video recordings, and does not determine the purposes or methods of their processing. Matters related to such processing are governed by the rules and policies of the building owner (the hotel). Visitors are informed about video surveillance in such areas by the building owner (the hotel).

8.5. Cross-border transfer of personal data. When Google Analytics 4 is used, analytics data may be transferred to and processed outside the territory of the Russian Federation. The Operator carries out cross-border transfers of personal data in accordance with Article 12 of the Personal Data Law, complying with the requirements of Part 5 of Article 18 of the Personal Data Law regarding the localisation of databases and the procedure established by Roskomnadzor. The Operator submits to Roskomnadzor a notification of its intention to carry out a cross-border transfer of personal data in relation to the specified service and does not begin the cross-border transfer until the period for reviewing the notification by Roskomnadzor has expired, unless Roskomnadzor has restricted or prohibited such transfer. The User’s consent to the processing of analytics data, including their cross-border transfer, is given by selecting “Allow analytics” in the cookie notice; the cookie notice expressly states that analytics data may be transferred outside the territory of the Russian Federation. Declining analytics prevents the transfer of analytics data through Google Analytics 4 and does not affect the ability to browse the Website or book services.

9. PERIODS FOR PROCESSING AND STORING PERSONAL DATA

9.1. Personal data are stored in a form that allows the data subject to be identified for no longer than required for the purposes of processing, unless a shorter retention period is established by federal law or by an agreement to which the data subject is a party (Parts 6 and 7 of Article 5 of the Personal Data Law).

9.2. Clients’ personal data are processed for the entire period of the data subject’s interaction with the Operator and for 3 (three) years after that interaction ends, unless a shorter period is provided for by law.

9.3. Personal data contained in cash register receipts and other accounting and tax records are retained for the periods established by the legislation of the Russian Federation on accounting and on taxes and fees.

9.4. Website analytics data are processed until the purposes of processing have been achieved or until the User withdraws consent, after which they are deleted or anonymised.

9.5. Processed personal data must be deleted or anonymised once the purposes of processing have been achieved or when there is no longer a need to achieve those purposes, unless otherwise provided for by federal law (Part 7 of Article 5 of the Personal Data Law). Once the purposes of processing have been achieved or consent has been withdrawn, the Operator ceases processing personal data and deletes or anonymises them within no more than 10 (ten) business days from the date the purpose of processing was achieved or consent was withdrawn, unless otherwise provided for by this Policy or by law.

10. CIRCUMSTANCES FOR CEASING THE PROCESSING OF PERSONAL DATA

10.1. The processing of personal data ceases in the following cases: • the purposes of processing personal data have been achieved; • the consent to the processing of personal data has expired; • the data subject has withdrawn consent to the processing of their personal data (where the Operator is not entitled to continue processing without consent under the law); • unlawful processing has been identified (processing must cease within no more than 3 (three) business days from the date it was identified); • the Operator ceases its activities.

11. INFORMATION ON DATA PROTECTION MEASURES IMPLEMENTED

11.1. The Operator takes legal, organisational, and technical measures necessary and sufficient to ensure the fulfilment of obligations under the Personal Data Law (Articles 18.1 and 19), including: • appointing a person responsible for organising the processing of personal data (these functions are performed by Individual Entrepreneur Alexandra Mikhailovna Koverzneva); • issuing and applying this Policy and internal policies on personal data processing, including those determining the categories and list of personal data processed, the methods and periods of their processing and storage, and the procedure for their destruction; • implementing legal, organisational, and technical data protection measures, including identifying security threats, using information security tools, keeping records of machine-readable media, and recovering personal data modified or destroyed as a result of unauthorised access; • carrying out internal monitoring of compliance with the legislation of the Russian Federation in the processing of personal data; • informing Salon employees and engaged specialists who directly process personal data about the provisions of personal data legislation, this Policy, and the Operator’s internal policies; • restricting access to personal data and personal data information systems, and differentiating employees’ access rights.

11.2. If an incident resulting in the compromise of personal data is identified, the Operator notifies Roskomnadzor of the incident no later than 24 hours after its identification and of the results of the internal investigation no later than 72 hours after its identification (Part 3.1 of Article 21 of the Personal Data Law), and also informs data subjects whose data have been compromised.

11.3. The Operator takes commercially reasonable technical, physical, managerial, and organisational measures to protect data subjects’ information from accidental loss and unauthorised access, use, alteration, or disclosure. The Operator cannot absolutely guarantee that unauthorised third parties will never gain access to personal data, but undertakes to implement the measures provided for by the legislation of the Russian Federation.

12. RIGHTS OF DATA SUBJECTS

12.1. A data subject has the right to: • receive information concerning the Operator’s processing of their personal data (Part 7 of Article 14 of the Personal Data Law); • request the updating, blocking, or deletion of their personal data if the data are incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose of processing; • withdraw consent to the processing of personal data in the manner established by this Policy; • request the cessation of the processing of personal data for the purpose of promoting goods, works, or services on the market and refuse to receive advertising materials (Article 15 of the Personal Data Law); • appeal against the actions or inaction of the Operator to the authorised personal data protection authority (Roskomnadzor) or in court, and to seek compensation for losses and/or non-pecuniary damage (Article 17 of the Personal Data Law).

12.2. Information provided for in Part 7 of Article 14 of the Personal Data Law is provided to the data subject or their representative in an accessible form within 10 (ten) business days from the date of the request or receipt of the data subject’s request. This period may be extended by no more than 5 (five) business days upon sending the data subject a reasoned notice stating the reasons for the extension (Part 3 of Article 14 of the Personal Data Law).

12.3. A data subject’s request must contain the information specified in Part 3 of Article 14 of the Personal Data Law (the number of the main identity document, the date of issue, and the issuing authority; information confirming the data subject’s relationship with the Operator; and the signature of the data subject or their representative). A request may be submitted as an electronic document signed with an electronic signature.

13. PROCEDURE FOR OBTAINING AND WITHDRAWING CONSENT TO THE PROCESSING OF PERSONAL DATA

13.1. Consent to the processing of personal data is given freely, by the data subject’s own will and in their own interest, and is specific, informed, conscious, and unambiguous (Part 1 of Article 9 of the Personal Data Law).

13.2. The processing of personal data necessary for booking and providing a service is carried out on the basis of an agreement concluded by acceptance of a public offer. Separate consent of the data subject is not required for such processing, unless otherwise provided for by the Personal Data Law.

13.3. Consent to the processing of personal data for web analytics purposes is deemed given when the User selects “Allow analytics” in the cookie notice on the Website. Declining analytics does not affect the operation of the Website or the ability to book services.

13.4. Consent to the processing of personal data for the purpose of sending information and advertising materials (Article 15 of the Personal Data Law) is requested separately by the Operator, including by ticking the relevant consent box, and may be withdrawn by the data subject at any time. Upon receiving such a request, the Operator must immediately cease processing personal data for the specified purposes.

13.5. Consent remains valid until the purposes of processing have been achieved or until the data subject withdraws consent, whichever occurs first. Consent may be withdrawn by submitting a written statement to the Salon administrator, sending a written statement to: Apt. 10, Building A, 72 Vyborgskoye Shosse, St. Petersburg, 194356, Russia; sending an electronic request to: ateler.beauty@gmail.com; or calling: +7 937 949-94-94. A request received by phone is recorded by the Salon administrator in the enquiries log, indicating the date of receipt, the content of the request, and the data subject’s details.

13.6. If consent is withdrawn, the Operator ceases processing the data subject’s personal data within no more than 10 (ten) business days from the date of receipt of the withdrawal, and may continue processing personal data without consent where there are grounds set out in Paragraphs 2–11 of Part 1 of Article 6, Part 2 of Article 10, and Part 2 of Article 11 of the Personal Data Law (Part 2 of Article 9 of the Personal Data Law). Withdrawal of consent does not affect the lawfulness of personal data processing carried out before such withdrawal.

14. PROCEDURE FOR RECEIVING AND CONSIDERING DATA SUBJECTS' REQUESTS

14.1. Requests and enquiries from data subjects (requests for information, updating, blocking, or deletion of personal data, withdrawal of consent, or refusal of advertising materials) are accepted by the Operator at: Apt. 10, Building A, 72 Vyborgskoye Shosse, St. Petersburg, 194356, Russia; by email: ateler.beauty@gmail.com; by phone: +7 937 949-94-94; or through the Salon administrator (1 Voznesensky Prospekt, St. Petersburg, Russia).

14.2. All requests and enquiries from data subjects are recorded and considered by the Operator within the periods established by the Personal Data Law (including within no more than 10 (ten) business days from the date of receipt of the request, with the possibility of extending the period in cases established by law).

14.3. If it is confirmed that personal data are inaccurate or have been processed unlawfully, the Operator updates the personal data or ceases their processing within the periods established by Article 21 of the Personal Data Law.

15. LIABILITY

15.1. Persons guilty of violating the requirements of the legislation of the Russian Federation on personal data bear civil, administrative, criminal, or other liability provided for by the legislation of the Russian Federation (Article 24 of the Personal Data Law).

16. FINAL PROVISIONS

16.1. This Policy is subject to review and updating in the event of changes to the legislation of the Russian Federation on personal data, changes to the Operator’s organisational structure or purposes of processing personal data, or based on the results of monitoring compliance with personal data legislation.

16.2. Amendments to this Policy take effect from the moment the new version of the Policy is published on the Website and/or on the information board at the Salon. The current version of the Policy is published on the Website; previous versions of the Policy are provided to a data subject upon request.

16.3. Matters not regulated by this Policy are governed by the legislation of the Russian Federation on personal data.