PERSONAL DATA PROCESSING POLICY OF "THE BANYA"

1. General Provisions
This Personal Data Processing Policy (the "Policy") is drafted in compliance with the requirements of Federal Law No. 152-FZ of July 27, 2006, "On Personal Data" (hereinafter referred to as the "Personal Data Law") and defines the procedure for processing personal data and the measures taken by LLC "ZE BANYA" (the "Operator") to ensure the security of personal data.
1.1. The Operator’s highest priority is respecting the rights and freedoms of individuals when processing their personal data, including the protection of privacy, personal, and family confidentiality.
1.2. This Policy applies to all information the Operator may obtain about visitors to the website https://thebanya.ru/en.

2. Key Definitions
2.1. Automated Processing of Personal Data
Processing of personal data using computer technology.
2.2. Blocking of Personal Data
Temporary suspension of personal data processing (except where processing is necessary to clarify personal data).
2.3. Website
A collection of graphical and informational materials, as well as computer programs and databases, ensuring their accessibility on the internet at the web address https://thebanya.ru/en.
2.4. Personal Data Information System
A set of personal data contained in databases and the information technologies and technical means enabling their processing.
2.5. Depersonalization of Personal Data
Actions that make it impossible to determine, without additional information, the attribution of personal data to a specific User or other personal data subject.
2.6. Processing of Personal Data
Any action (operation) or set of actions performed with or without automation tools on personal data, including:

• Collection, recording, systematization, accumulation, storage,
• Updating, modification, retrieval, use,
• Transfer (distribution, provision, access),
• Depersonalization, blocking, deletion, or destruction of personal data.

2.7. Operator
A state body, municipal authority, legal entity, or individual that independently or jointly with others organizes and/or carries out the processing of personal data, as well as determines:

• The purposes of processing,
• The scope of personal data to be processed,
• The actions (operations) performed with personal data.

2.8. Personal Data
Any information relating, directly or indirectly, to an identified or identifiable User of the website https://thebanya.ru/en.
2.9. Personal Data Permitted for Dissemination
Personal data to which access by an unlimited number of persons has been granted by the data subject through consent to the processing of personal data permitted for dissemination in accordance with the Personal Data Law (hereinafter referred to as "personal data permitted for dissemination").
2.10. User
Any visitor to the website https://thebanya.ru/en.
2.11. Provision of Personal Data
Actions aimed at disclosing personal data to a specific person or a specific group of persons.
2.12. Dissemination of Personal Data
Any actions aimed at disclosing personal data to an indefinite group of persons (transfer of personal data) or making personal data available to an unlimited audience, including:

• Publication in mass media,
• Placement in information and telecommunication networks,
• Providing access in any other way.

2.13. Cross-Border Transfer of Personal Data
Transfer of personal data to the territory of a foreign state, to a foreign government authority, foreign individual, or foreign legal entity.
2.14. Destruction of Personal Data
Any actions resulting in the irreversible destruction of personal data, making it impossible to restore the content of personal data in the personal data information system, and/or the physical destruction of storage media containing personal data.

3. Rights and Obligations of the Operator
3.1. The Operator has the right to:
— Receive from the data subject reliable information and/or documents containing personal data;
— If the data subject withdraws consent to the processing of personal data or submits a request to terminate the processing of personal data, the Operator may continue processing the personal data without the data subject's consent if there are grounds specified in the Personal Data Law;
— Independently determine the composition and list of measures necessary and sufficient to fulfill the obligations stipulated by the Personal Data Law and the regulatory legal acts adopted in accordance with it, unless otherwise provided by the Personal Data Law or other federal laws.
3.2. The Operator is obliged to:
— Provide the data subject, upon request, with information regarding the processing of their personal data;
— Organize the processing of personal data in accordance with the procedure established by the current legislation of the Russian Federation;
— Respond to inquiries and requests from data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;
— Submit the necessary information to the authorized body for the protection of the rights of personal data subjects within 10 days of receiving such a request;
— Publish or otherwise provide unrestricted access to this Personal Data Processing Policy;
— Implement legal, organizational, and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, disclosure, distribution, as well as other unlawful actions regarding personal data;
— Terminate the transfer (distribution, provision, access) of personal data, cease processing, and destroy personal data in the manner and cases provided for by the Personal Data Law;
— Fulfill other obligations stipulated by the Personal Data Law.

4. Rights and Obligations of Data Subjects
4.1 Data subjects shall have the right to:

1. Request information about the processing of their personal data, except in cases stipulated by federal laws. The Operator shall provide such information in an accessible format, excluding personal data of other subjects unless legally permitted. The scope and procedure for obtaining this information are established by the Personal Data Law;
2. Demand rectification, blocking, or destruction of their personal data if such data is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated processing purposes, and to take legal measures to protect their rights;
3. Require prior consent for processing personal data for marketing purposes (promotion of goods, works, or services);
4. Withdraw consent to personal data processing and submit requests to terminate such processing;
5. File complaints with the authorized personal data protection authority or in court regarding unlawful actions/inaction by the Operator in processing their personal data;
6. Exercise other rights granted by Russian legislation.

4.2 Data subjects shall be obliged to:

1. Provide the Operator with accurate information about themselves;
2. Notify the Operator about any updates or changes to their personal data.

4.3 Persons who provide:

1. False information about themselves; or
2. Information about another data subject without consent

shall be held liable under Russian law.

5. Principles of Processing
5.1 Personal data shall be processed lawfully and fairly.
5.2 Processing of personal data shall be limited to achieving specific, predetermined, and legitimate purposes. Processing of personal data incompatible with the purposes of collection is prohibited.
5.3 The merging of databases containing personal data processed for incompatible purposes is prohibited.
5.4 Only personal data relevant to the processing purposes shall be processed.
5.5 The content and scope of processed personal data shall correspond to the declared processing purposes. Excessive processing of personal data relative to stated purposes is prohibited.
5.6 The Operator shall ensure the accuracy, adequacy, and (where necessary) timeliness of personal data in relation to processing purposes. The Operator shall take necessary measures to delete or rectify incomplete or inaccurate data.
5.7 Personal data shall be stored in a form permitting identification of data subjects no longer than required by processing purposes, unless storage periods are established by:

• Federal law;
• A contract where the data subject is a party, beneficiary, or guarantor.
• Processed personal data shall be destroyed or anonymized upon achieving processing purposes or when no longer necessary, unless otherwise prescribed by federal law.

6. Purposes of Processing
To communicate with users via email, WhatsApp, and SMS.
Personal Data Processed:

• Last name, first name, and patronymic
• Email address
• Phone numbers

Legal Basis:
The Operator’s statutory (foundational) documents.
Types of Personal Data Processing:

• Collection, recording, systematization, accumulation, storage, destruction, and anonymization of personal data
• Sending informational emails
• Sending informational communications via email, WhatsApp, and SMS

7. Processing Conditions
7.1 The processing of personal data is carried out with the consent of the personal data subject to the processing of their personal data.
7.2 The processing of personal data is necessary for achieving the purposes stipulated by an international treaty of the Russian Federation or by law, for performing the functions, powers and duties imposed on the Operator by the legislation of the Russian Federation.
7.3 The processing of personal data is necessary for the administration of justice, the execution of a judicial act, an act of another authority or official subject to enforcement in accordance with the legislation of the Russian Federation on enforcement proceedings.
7.4 The processing of personal data is necessary for the performance of a contract where the personal data subject is either a party, beneficiary or guarantor, as well as for concluding a contract on the initiative of the personal data subject or a contract under which the personal data subject will be a beneficiary or guarantor.
7.5 The processing of personal data is necessary for exercising the rights and legitimate interests of the Operator or third parties, or for achieving socially important purposes, provided that this does not violate the rights and freedoms of the personal data subject.
7.6 The processing involves personal data made publicly available by the personal data subject or at their request (hereinafter referred to as "publicly available personal data").
7.7 The processing involves personal data subject to publication or mandatory disclosure in accordance with federal law.

8. Data Collection, Storage, and Transfer
The security of personal data processed by the Operator is ensured through the implementation of legal, organizational, and technical measures necessary to fully comply with the requirements of current personal data protection legislation.
8.1 The Operator ensures the integrity of personal data and takes all possible measures to prevent unauthorized access to personal data.
8.2 User's personal data will never, under any circumstances, be disclosed to third parties, except when required by applicable law or when the data subject has given consent to the Operator for such disclosure to fulfill obligations under a civil contract.
8.3 If inaccuracies in personal data are identified, the User may update them independently by sending a notification to the Operator's email address 4089083@mail.ru with the subject line "Personal Data Update."
8.4 The period for processing personal data is determined by the purposes for which the data was collected, unless another period is stipulated by contract or applicable law. The User may withdraw consent to the processing of personal data at any time by sending a notification to the Operator's email address 4089083@mail.ru with the subject line "Withdrawal of Consent to Process Personal Data."
8.5 All information collected by third-party services, including payment systems, communication services, and other service providers, is stored and processed by these parties (Operators) in accordance with their User Agreements and Privacy Policies. The Operator is not responsible for the actions of third parties, including the service providers mentioned in this section.
8.6 Restrictions imposed by the data subject on the transfer (except for granting access) and processing (except for obtaining access) of personal data authorized for dissemination do not apply in cases where personal data is processed in state, public, or other public interests as defined by Russian law.
8.7 The Operator ensures the confidentiality of personal data during processing.
8.8 The Operator stores personal data in a form that allows identification of the data subject for no longer than required by the purposes of processing, unless the storage period is established by federal law, contract, or if the data subject is a party to, beneficiary of, or guarantor under such contract.
8.9 Processing of personal data may be terminated upon achievement of the processing purposes, expiration of the data subject's consent, withdrawal of consent by the data subject, request to terminate processing, or discovery of unlawful processing of personal data.

9. Actions Performed by the Operator
9.1 The Operator performs collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), anonymization, blocking, deletion, and destruction of personal data.
9.2 The Operator carries out automated processing of personal data with receipt and/or transmission of the obtained information through information and telecommunication networks or without such transmission.

10. Cross-Border Transfers
10.1. Prior to initiating any cross-border transfer of personal data, the Operator shall notify the authorized body for the protection of personal data subjects' rights of its intention to conduct such transfer. (This notification shall be submitted separately from the notification of intention to process personal data.)
10.2. Before submitting the aforementioned notification, the Operator shall obtain relevant information from the foreign state authorities, foreign individuals, or foreign legal entities to whom the cross-border transfer of personal data is planned.

11. Confidentiality
The Operator and any other parties granted access to personal data are obligated not to disclose or distribute such data to third parties without the consent of the data subject, unless otherwise required by federal law.

12. Заключительные положения
12.1. The User may request clarifications regarding the processing of their personal data by contacting the Operator via email at 4089083@mail.ru.
12.2. Any amendments to this Personal Data Processing Policy by the Operator will be incorporated into this document. The Policy remains in effect indefinitely until replaced by a new version.
12.3. The current version of the Policy is publicly available on the Internet at https://thebanya.ru/en/policy.