Privacy policy.

Personal Data Processing Policy

of A-MEDIA LLC (ООО «А-МЕДИА»)

Edition of 22 September 2026.

1. General Provisions

1.1. This Personal Data Processing Policy (hereinafter the “Policy”) has been developed in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (hereinafter the “Personal Data Law”) and other regulatory legal acts of the Russian Federation in the field of personal data, and defines the procedure for processing personal data and the measures to ensure the security of personal data taken by A-MEDIA LLC (hereinafter the “Operator”).

1.2. Operator details: A-MEDIA LLC, INN 9710096078, KPP 775101001, OGRN 1227700102321, registered address: 108814, Moscow, Kommunarka municipal district, Kommunarka settlement, Bachurinskaya st., 7, bldg. 2, premises 4K/12.

1.3. The Policy applies to all personal data that the Operator receives from personal data subjects, including when they use the Operator’s website available on the Internet at epic-name.ru (hereinafter the “Website”), when they submit requests and enquiries, and in the course of the conclusion and performance of contracts by the Operator.

1.4. The Policy is published in free access on the Website in accordance with Part 2 of Article 18.1 of the Personal Data Law. The current edition of the Policy is permanently available at: epic-name.ru.

1.5. The Operator may amend the Policy. A new edition takes effect from the moment it is posted on the Website, unless otherwise provided by the new edition. The new edition specifies the date of the last update. The date of the last update of this edition is 22.09.2026.

2. Basic Terms

2.1. Personal data means any information relating to a directly or indirectly identified or identifiable natural person (personal data subject).

2.2. Processing of personal data means any action (operation) or set of actions (operations) performed on personal data with or without the use of automation tools, including collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), depersonalisation, blocking, deletion and destruction.

2.3. Personal data subject (hereinafter also the “User”) means a natural person whose personal data is processed by the Operator, including a visitor of the Website, a person who has submitted a request or enquiry to the Operator, and a representative of a customer or other counterparty of the Operator.

2.4. Other terms are used in the meanings defined by the Personal Data Law.

3. Categories of Subjects and List of Personal Data Processed

3.1. The Operator processes personal data of the following categories of subjects: visitors of the Website; persons who have submitted requests and enquiries to the Operator (including via forms on the Website, by e-mail, telephone and messengers); representatives (employees, authorised persons) of customers and other counterparties of the Operator; customers who are natural persons.

3.2. List of personal data provided by the User independently:

— surname, first name, patronymic (if any);

— contact telephone number;

— e-mail address;

— name of the organisation, position (for representatives of counterparties);

— information contained in the request or enquiry (description of the task, project, services of interest);

— other information that the User independently specifies in forms on the Website or in enquiries to the Operator.

3.3. Data transmitted automatically in the course of using the Website: IP address; cookie data; information about the browser and operating system; technical characteristics of the device; date and time of access to the Website; addresses of requested pages; information collected by metric programs (web analytics services) specified in Section 8 of the Policy.

3.4. The Operator does not process special categories of personal data (information on racial or ethnic origin, political opinions, religious or philosophical beliefs, health, intimate life) or biometric personal data.

3.5. The Website and the Operator’s services are intended for persons who have reached the age of 18. The Operator does not deliberately collect personal data of minors.

3.6. The Operator does not verify the accuracy of the personal data provided by the User and assumes that the User provides accurate and sufficient data and keeps it up to date.

4. Purposes and Legal Grounds for Processing Personal Data

4.1. The Operator processes personal data for the following purposes and on the following legal grounds:

4.1.1. Conclusion and performance of contracts for the provision of the Operator’s services (including services in the field of website and application development, internet marketing and design), interaction with the customer in the course of performance of the contract, document flow and settlements — on the basis of Clause 5 of Part 1 of Article 6 of the Personal Data Law (processing is necessary for the conclusion and performance of a contract to which the personal data subject is a party, beneficiary or guarantor).

4.1.2. Consideration of Users’ requests and enquiries, consulting on the Operator’s services, feedback — on the basis of the consent of the personal data subject (Clause 1 of Part 1 of Article 6 of the Personal Data Law).

4.1.3. Interaction with representatives of customers and other counterparties for the purpose of concluding and performing contracts between the Operator and such counterparties — on the basis of Clause 5 of Part 1 of Article 6 of the Personal Data Law and, to the extent not covered by that ground, on the basis of the consent of the personal data subject.

4.1.4. Sending informational and advertising messages, including about the Operator’s services, cases and special offers — solely with the separate prior consent of the User obtained in accordance with Article 15 of the Personal Data Law and Article 18 of Federal Law No. 38-FZ of 13 March 2006 “On Advertising”. The User may opt out of receiving such messages at any time.

4.1.5. Improving the quality of the Website, analysing its traffic, statistical and marketing research based on depersonalised data — on the basis of the User’s consent to the processing of cookies and metric program data (Section 8 of the Policy).

4.1.6. Fulfilment of the obligations imposed on the Operator by the legislation of the Russian Federation, including in the field of accounting and taxation — on the basis of Clause 2 of Part 1 of Article 6 of the Personal Data Law.

4.2. The processing of personal data is limited to the achievement of specific, predetermined and lawful purposes. Processing of personal data that is incompatible with the purposes of its collection is not permitted, nor is the merging of databases containing personal data processed for purposes that are incompatible with each other.

5. Procedure for Obtaining Consent to the Processing of Personal Data

5.1. Where the legal ground for processing is the consent of the personal data subject, such consent must be specific, subject-defined, informed, conscious and unambiguous.

5.2. Consent to the processing of personal data is executed separately from other information and/or documents that the personal data subject confirms and/or signs (Part 1 of Article 9 of the Personal Data Law). Use of the Website does not in itself constitute consent to the processing of personal data. Consent is given by the User by performing a separate affirmative action — ticking the relevant box in a form on the Website or signing a separate document.

5.3. Consent to receive advertising messages (Clause 4.1.4 of the Policy) is executed separately from other consents.

5.4. The personal data subject may withdraw consent to the processing of personal data at any time by sending the Operator a corresponding statement using the contact details specified in Section 13 of the Policy. In the event of withdrawal of consent, the Operator ceases processing the personal data and destroys it within a period not exceeding 30 (thirty) days from the date of receipt of the withdrawal, except where processing may be continued on another legal ground provided for by the Personal Data Law.

6. Procedure and Conditions for Processing Personal Data

6.1. Personal data is processed with and without the use of automation tools, in a mixed manner.

6.2. The Operator performs the following actions with personal data: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), blocking, deletion and destruction.

6.3. The confidentiality of the User’s personal data is maintained. The Operator does not disclose personal data to third parties or disseminate it without the consent of the personal data subject, unless otherwise provided by federal law.

6.4. The Operator may entrust the processing of personal data to third parties on the basis of a contract concluded with them (operator’s instruction) containing the conditions provided for by Part 3 of Article 6 of the Personal Data Law. The processing of personal data is entrusted to the following persons: Beget LLC (ООО «Бегет», INN 7801451618, St. Petersburg) — the hosting provider on whose servers the Website is hosted and the data received via the Website forms is stored; 1C-Bitrix LLC (ООО «1С-Битрикс», INN 7717586110, Moscow) — the operator of the Bitrix24 cloud service in which the Operator keeps records of requests. The servers of these persons are located in the territory of the Russian Federation. A person processing personal data on behalf of the Operator is obliged to comply with the principles and rules of personal data processing provided for by the Personal Data Law and to ensure the confidentiality and security of personal data.

6.5. Personal data is transferred to state authorities solely in the cases and in the manner provided for by the legislation of the Russian Federation.

6.6. When collecting personal data, including via the Internet, the Operator ensures the recording, systematisation, accumulation, storage, clarification (updating, modification) and extraction of personal data of citizens of the Russian Federation using databases located in the territory of the Russian Federation (Part 5 of Article 18 of the Personal Data Law).

6.7. The Operator does not carry out cross-border transfer of personal data. Fonts, scripts and other resources of the Website are hosted on the Operator’s servers; external services that transmit visitor data outside the Russian Federation are not used on the Website. Should such a transfer become necessary, the Operator will notify the authorised body for the protection of the rights of personal data subjects in advance in the manner established by Article 12 of the Personal Data Law.

6.8. The Operator does not take decisions giving rise to legal consequences for the personal data subject or otherwise affecting his or her rights and legitimate interests solely on the basis of automated processing of personal data.

7. Processing and Storage Periods. Destruction of Personal Data

7.1. Personal data is processed for the period necessary to achieve the purposes of processing, unless a different period is established by federal law or a contract.

7.2. Personal data processed for the purposes of concluding and performing a contract is stored for the term of the contract and for the periods established by the legislation of the Russian Federation on accounting and on taxes and levies (as a rule, no more than 5 years after completion of settlements, unless a longer period is provided for by law).

7.3. Personal data processed on the basis of consent is processed until the purpose of processing is achieved or until the consent is withdrawn by the personal data subject, whichever occurs first.

7.4. Upon achievement of the purposes of processing, as well as in the event of withdrawal of consent (in the absence of another legal ground for processing), personal data is subject to destruction within a period not exceeding 30 days. Personal data is destroyed in a manner that precludes its restoration, and the destruction is documented in accordance with the requirements approved by the authorised body for the protection of the rights of personal data subjects.

8. Cookies and Metric Programs

8.1. The Website uses cookies: technical cookies (session identifier, short-term storage of data entered into forms, a mark that the cookie notice has been accepted) and cookies of the Yandex Metrica metric program (a web analytics service of Yandex LLC; the data is processed on servers located in the territory of the Russian Federation). The metric program is launched only after the User confirms consent in the cookie notice on the Website.

8.2. Cookies and metric program data are used to ensure the operability of the Website, analyse its traffic, improve the quality of the Website and, subject to the User’s separate consent, personalise offers.

8.3. Cookies that are not strictly necessary for the functioning of the Website are processed subject to the User’s consent given via the relevant interface (banner) on the Website. The User may refuse such processing and may also prohibit the saving of cookies or delete previously saved cookies in the settings of his or her browser; in this case certain functions of the Website may become unavailable.

9. Rights of Personal Data Subjects

9.1. The personal data subject has the right:

— to receive information concerning the processing of his or her personal data to the extent provided for by Part 7 of Article 14 of the Personal Data Law;

— to demand the clarification of his or her personal data, its blocking or destruction if the personal data is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing;

— to withdraw consent to the processing of personal data;

— to opt out of receiving advertising messages;

— to appeal against the actions or omissions of the Operator to the authorised body for the protection of the rights of personal data subjects (Roskomnadzor) or in court;

— to the protection of his or her rights and legitimate interests, including compensation for losses and/or compensation for moral harm.

9.2. To exercise his or her rights, the personal data subject may send an enquiry (request) to the Operator using the contact details specified in Section 13 of the Policy. The request must contain the information provided for by Part 3 of Article 14 of the Personal Data Law: the number of the main identity document of the subject or his or her representative, information on the date of issue of that document and the issuing authority, information confirming the subject’s participation in relations with the Operator or information otherwise confirming the fact of processing of personal data by the Operator, and the signature of the subject or his or her representative.

9.3. The Operator responds to a request of the personal data subject within 10 (ten) business days from the date of the request. This period may be extended by no more than 5 (five) business days, with a reasoned notice sent to the subject.

10. Measures to Ensure the Security of Personal Data

10.1. The Operator takes the necessary and sufficient legal, organisational and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision, dissemination and other unlawful actions, including:

— a person responsible for organising the processing of personal data has been appointed;

— internal regulations on the processing and protection of personal data have been issued, and employees are familiarised with their provisions;

— access to personal data is granted only to those employees who need it to perform their job duties;

— information security tools are applied, including anti-virus protection, differentiation of access rights and backup;

— internal control over the compliance of personal data processing with legal requirements is carried out;

— an assessment is made of the harm that may be caused to personal data subjects in the event of a violation of personal data legislation.

10.2. If an unlawful or accidental transfer (provision, dissemination, access) of personal data resulting in a violation of the rights of personal data subjects is established, the Operator notifies the authorised body for the protection of the rights of personal data subjects in the manner and within the time limits established by Part 3.1 of Article 21 of the Personal Data Law.

11. Obligations of the Operator

11.1. The Operator is obliged to: provide the personal data subject, upon request, with information concerning the processing of his or her personal data; organise the processing of personal data in accordance with legal requirements; respond to enquiries and requests from personal data subjects and from the authorised body for the protection of the rights of personal data subjects; and provide the authorised body, upon its request, with the necessary information within the established time limit.

12. Final Provisions

12.1. Matters not regulated by the Policy are governed by the legislation of the Russian Federation.

12.2. The Policy is a publicly available document and is subject to posting on the Website.

12.3. The invalidity of individual provisions of the Policy does not entail the invalidity of its other provisions.

13. Operator’s Contact Details

13.1. The personal data subject may send all proposals, questions, requests and other enquiries regarding this Policy and the processing of personal data to the Operator:

— by e-mail: info@epic-name.ru;

— by post: 108814, Moscow, Kommunarka municipal district, Kommunarka settlement, Bachurinskaya st., 7, bldg. 2, premises 4K/12;

— by telephone: +7 (495) 790-05-95.

14. Language of the document

This English text is a translation provided for convenience. The document is executed in Russian; in the event of any discrepancy between the Russian and English versions, the Russian version prevails.