PRIVACY POLICY

Svetlana Litvinovskaya, Individual Entrepreneur
TIN (INN) 380415021166
Address: 664007, Irkutsk, Karl Liebknecht St. 27, Russian Federation
E-mail: svetlanaxxxxxxx@gmail.com
Website: aisveta.com
Version dated «07» 08.2026
This document is a translation. The binding version is the Russian-language original — see clause 13.4.

1. General provisions
1.1. This Privacy Policy (the Policy) sets out the procedure for processing personal data and the security measures applied by Svetlana Litvinovskaya, Individual Entrepreneur (the Operator), and has been prepared pursuant to clause 2 part 1 article 18.1 of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (the Law).
1.2. The Policy applies to all information about visitors to the website aisveta.com (the Website), as well as about clients and counterparties of the Operator, which the Operator may obtain in connection with its activity in creating audiovisual, graphic and other content and providing production services.
1.3. The current version of the Policy is freely available at aisveta.com/privacy.
1.4. Use of the Website means that the visitor has been made aware of this Policy. The Policy does not constitute consent to the processing of personal data — consent is given as a separate document through an affirmative action by the visitor.

2. Operator details

3. Definitions
Personal data — any information relating to a directly or indirectly identified or identifiable natural person. Data subject — a natural person whose personal data is processed: a Website visitor, a client, a representative of a counterparty. Processing — any operation performed on personal data, whether or not by automated means. Destruction — actions as a result of which it becomes impossible to restore the content of personal data and/or as a result of which the material carriers of personal data are destroyed.

4. Categories of data subjects and data processed
4.1. Visitors who submit an enquiry through the Website form

• name (or the name or nickname provided by the visitor);
• e-mail address;
• telephone number and/or messenger handle — if provided;
• company name and job title — if provided;
• the content of the enquiry and any information voluntarily included by the visitor, including the description of the task and any attached materials.

A name and one contact channel are required to submit the form. All other fields are optional.
4.2. Clients and representatives of counterparties

• full name;
• TIN and payment details;
• information contained in signed documents: contract, statement of work, acceptance certificate, invoice;
• passport details and registered address — solely where a contract is concluded with a natural person and this is necessary for its performance and for tax reporting.

4.3. Data collected automatically by the Website
IP address; browser and device information (user agent, screen resolution, language, operating system); date and time of access; pages viewed; referral source and UTM parameters; cookies and web analytics identifiers.
4.4. Data the Operator does not process
The Operator does not process special categories of personal data (racial or ethnic origin, political opinions, religious or philosophical beliefs, health, sex life), biometric personal data within the meaning of article 11 of the Law, or personal data of persons under 18. Where such information reaches the Operator unintentionally — for example, in the free text of an enquiry — it is destroyed as soon as practicable.

5. Purposes of processing and legal bases
5.1. The Operator does not send marketing or newsletter communications and does not process personal data for the purpose of promoting goods, works or services of third parties.
5.2. The Operator does not take decisions producing legal effects concerning the data subject based solely on automated processing (art. 16 of the Law).

6. Principles and conditions of processing
6.1. Processing is carried out on a lawful and fair basis and is limited to the achievement of specific, predetermined purposes.
6.2. Only personal data that corresponds to the purposes of processing is processed; its content and volume are not excessive.
6.3. Databases processed for mutually incompatible purposes are not combined.
6.4. A data subject’s refusal to provide data that is not mandatory cannot serve as grounds for refusing to provide a service (pt. 4 art. 16 of the Law).
6.5. The recording, systematisation, accumulation, storage, updating and retrieval of personal data of citizens of the Russian Federation is carried out by the Operator using databases located within the territory of the Russian Federation (pt. 5 art. 18 of the Law).

7. Retention periods
7.1. Processing ceases and personal data is destroyed: - upon achievement of the purpose of processing — within 30 days (pt. 3 art. 21 of the Law); - upon withdrawal of consent, where the data cannot be retained on another lawful basis — within 30 days (pt. 5 art. 21); - where unlawful processing is identified — within 10 business days after expiry of the period allowed to remedy the breach (pt. 3 art. 21).
7.2. Destruction is evidenced by a destruction certificate and/or an extract from the event log of the information system, prepared in accordance with Order of Roskomnadzor No. 179 of 28 October 2022.

8. Disclosure to third parties
8.1. The Operator does not sell personal data and does not disclose it to third parties except as set out in this section and as provided by the legislation of the Russian Federation.
8.2. Personal data is transferred to the following recipient on the basis of an instruction to process (pt. 3 art. 6 of the Law), subject to confidentiality and security requirements:
8.3. Personal data is provided to state authorities (the Federal Tax Service, law enforcement agencies, courts) to the extent and in the manner established by the legislation of the Russian Federation, without the consent of the data subject.
8.4. Processing of personal data submitted through the Website form is carried out by Tilda Publishing JSC on the instruction of the Operator in accordance with the Personal Data Processing Instruction forming an integral part of that company’s user agreement. The Operator requires the processor to maintain the confidentiality of personal data and to ensure its security in accordance with article 19 of the Law.
8.5. Where contractors are engaged in content production, the Operator discloses to them only the minimum information necessary to perform the work, under a contract containing a confidentiality clause.

9. Cross-border transfers and use of generative AI services
9.1. The Operator uses generative artificial intelligence software services in its production process, the servers of which may be located outside the Russian Federation.
9.2. Personal data of data subjects is not transferred to such services. The Operator uploads only synthetic, anonymised or otherwise non-identifying material. Images, voice recordings, contact details and identifying information of data subjects are not sent to foreign services.
9.3. Materials received from a client are anonymised before use: names, contact details and other information permitting identification of a natural person are removed.
9.4. Should the performance of a particular project require the transfer of information relating to an identified natural person outside the Russian Federation, such transfer will be carried out only in compliance with article 12 of the Law — after notifying Roskomnadzor and obtaining separate written consent from the data subject specifying the name of the recipient and the state in which it is located.

10. Cookies and web analytics
10.1. Strictly necessary cookies enable the basic functionality of the Website and are used on the basis of the Operator’s legitimate interest; disabling them may render the Website inoperable.
10.2. Analytics cookies collect anonymised traffic statistics and are set only after consent has been given through the banner.
10.3. Advertising and marketing cookies are not used.
10.4. A visitor may change or withdraw consent at any time through the cookie settings on the Website, and may delete cookies and block their storage in the browser settings.
10.5. The Operator uses the web analytics system. Yandex Metrica data collection may be opted out of using the official blocker at https://yandex.com/support/metrica/general/opt-out.html.

11. Security measures
Pursuant to part 1 article 18.1 and article 19 of the Law, the Operator:

• has appointed a person responsible for organising the processing of personal data;
• has issued this Policy and made it freely available;
• has identified the security threats applicable to the processing of personal data;
• applies organisational and technical measures: access control, unique passwords and two-factor authentication, encrypted connections (HTTPS/TLS), backups, anti-virus protection;
• maintains an event log for personal data operations and a register of machine-readable media;
• carries out internal monitoring of compliance with the legislation;
• prevents uncontrolled access to material carriers of personal data.

In the event of an incident (unlawful or accidental transfer of, provision of, dissemination of or access to personal data), the Operator notifies Roskomnadzor within 24 hours of the incident and within 72 hours of the results of its internal investigation (pt. 3.1 art. 21 of the Law), and cooperates with the State System for Detection, Prevention and Elimination of Consequences of Computer Attacks (GosSOPKA).

12. Rights of the data subject
12.1. The data subject has the right to:

• obtain information concerning the processing of their personal data (art. 14 of the Law);
• require the rectification, blocking or destruction of personal data where it is incomplete, out of date, inaccurate, unlawfully obtained or not necessary for the stated purpose;
• withdraw consent to processing at any time (pt. 2 art. 9 of the Law);
• lodge a complaint against the acts or omissions of the Operator with Roskomnadzor or before a court;
• protection of their rights and legitimate interests, including compensation for losses and moral harm.

12.2. How to exercise these rights. A request is sent to svetlanaxxxxxxx@gmail.com or by post to the address in section 2. The request must contain: the number of the main identity document of the data subject or their representative, its date of issue and issuing authority; information confirming the data subject’s interaction with the Operator (date of enquiry, contract number); and the signature of the data subject or their representative. The request may be submitted as an electronic document signed with an electronic signature.
12.3. The Operator responds within 10 business days of receipt. This period may be extended by no more than 5 business days, with a reasoned notice sent to the data subject.
12.4. Withdrawal of consent is effected by a free-form statement sent to svetlanaxxxxxxx@gmail.com. Following withdrawal, processing ceases and the data is destroyed within 30 days, except for data that must be retained on another lawful basis.

13. Final provisions
13.1. The Operator may amend this Policy. A new version takes effect upon publication on the Website. Superseded versions are archived by the Operator.
13.2. This Policy and the relationship between the data subject and the Operator are governed by the law of the Russian Federation. Disputes are resolved in accordance with the legislation of the Russian Federation.
13.3. Contact for all personal data matters: svetlanaxxxxxxx@gmail.com.
13.4. Language. This Policy has been drawn up in Russian and may be provided in other languages for information purposes. In the event of any discrepancy between the Russian version and a version in another language, the Russian version prevails.

OPERATOR DETAILS
Svetlana Litvinovskaya, Individual Entrepreneur
Version dated «7» 08.2026