Personal Data Processing Policy

Revision dated 22 June 2026.

1. General provisions

This Personal Data Processing Policy (the “Policy”) defines how personal data is processed and secured by «Русский веб-технологиялар» ЖЧКсы, OGRN 1257700553967, TIN 9724233790, KPP 772401001, registered address: 115580, Москва, көч. Муса Жалил, 5, кв. 1, кеңсе 216 (the “Operator”), and applies to the website marussia.studio and its related subdomains (the “Site”).

The Policy complies with the Constitution of Russia, Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (“152-FZ”) and related regulations. It applies to all personal data the Operator may obtain in connection with the use of the Site.

The current version of the Policy is permanently available online at marussia.studio/privacy. By using the Site, the data subject confirms that they have read this Policy.

2. Terms and definitions

• Personal data — any information relating to a directly or indirectly identified or identifiable individual (the subject).
• Processing — any operation performed on personal data (collection, recording, storage, use, transfer, deletion, etc.).
• Operator — the entity that organises and/or carries out processing and determines its purposes and the data processed.
• Subject — the individual to whom the personal data relates.
• Anonymisation — actions making it impossible to attribute data to a specific subject without additional information.
• Blocking, destruction — temporary suspension of processing and, respectively, actions making data unrecoverable.
• Cookie — small files stored by the Site in the user’s browser (see the separate

Cookie Policy: marussia.studio/cookies).

3. Processing principles

• lawfulness and fairness of processing;
• processing only for predefined and lawful purposes;
• no merging of databases with incompatible purposes;
• data adequacy and minimisation relative to the stated purposes;
• accuracy and relevance of data; storage no longer than necessary.

4. Categories of data subjects

The Operator processes personal data of:

• Site visitors and users;
• persons who submitted a request via Site forms;
• prospective, current and former clients, and representatives of counterparties.

5. Purposes, legal bases, data and retention

For each purpose the Operator processes only the data strictly needed:

6. Personal data processed

• identification and contact data: name, phone number, email;
• request data: selected service/project type, budget, timeline, comment;
• technical data: IP address, cookies, browser/device data, visit date/time, on-site actions, referral source;
• correspondence data if the subject provides it.

Special categories of personal data (race, health, political views, etc.) and biometric data are not processed. Data of minors is not collected intentionally.

7. Processing conditions

Processing is carried out both with and without automation (mixed). The Operator performs: collection, recording, systematisation, accumulation, storage, update (modification), retrieval, use, transfer (provision, access), anonymisation, blocking, deletion and destruction.

The Operator keeps personal data confidential and does not disclose it to third parties without the subject’s consent, except as provided by law. The Operator makes no decisions producing legal effects on the subject based solely on automated processing.

8. Data collection via the Site, cookies and analytics

The Site uses cookies and web analytics (Yandex Metrica, whose servers are located in Russia). Analytics cookies and counters load only after the user’s consent given via the banner. Cookie categories and consent management are described in the Cookie Policy.

9. Database localisation

Collection, recording, systematisation, accumulation, storage, update and retrieval of personal data of Russian citizens are performed using databases located in the Russian Federation (Art. 18(5) 152-FZ).

10. Data transfer and processors

The Operator may engage third parties to process personal data under a confidentiality and data-protection agreement, including: Yandex LLC (Yandex Metrica web analytics) and the hosting provider whose infrastructure is located in Russia. When engaging a processor, the Operator remains responsible to the subject.

No cross-border transfer of personal data is carried out. Disclosure to other third parties is possible only with the subject’s consent or at the request of authorised state bodies as provided by law.

11. Retention and destruction

Retention is determined by achievement of purposes, the consent term, and contractual/statutory periods. Once purposes are achieved or consent is withdrawn, data is destroyed or anonymised within the periods set by 152-FZ, unless retention is required by law.

12. Security measures

The Operator applies legal, organisational and technical measures (Art. 18.1, 19 152-FZ), including:

• appointing a person responsible for processing;
• internal policies and compliance control;
• access restriction and segregation;
• secure channels (HTTPS) and backups;
• media accounting, harm assessment and incident response.

13. Subject rights and how to exercise them

The data subject has the right to:

• obtain information about the processing of their data;
• request rectification, blocking or destruction of incomplete, outdated or unlawfully obtained data;
• withdraw consent to processing;
• appeal the Operator’s acts or omissions to Roskomnadzor or a court.

A request can be sent to info@marussia.studio. The Operator responds within the timeframes set by 152-FZ (typically 10 business days, extendable to 30 days).

14. Operator’s obligations

• process data lawfully and only for the stated purposes;
• provide the subject with processing information upon request;
• ensure data security and confidentiality;
• notify Roskomnadzor where required by law, including about incidents.

15. Responsible person and contacts

The person responsible for organising personal data processing is the Operator’s General Director, Pavel Denisovich Kuznetsov. Enquiries on personal data matters are accepted at info@marussia.studio.

16. Final provisions

The Operator may amend the Policy. A new version takes effect upon publication on the Site, unless the new version states otherwise. Continued use of the Site after changes means acceptance of the new version.

Арыз формасына кайтуу