Personal Data Processing Policy

Effective date: May 01, 2026

1. General Provisions

1.1. This Personal Data Processing Policy (hereinafter referred to as the Policy) has been developed in accordance with the Constitution of the Russian Federation, the Labor Code of the Russian Federation, Federal Law No. 149-FZ of July 27, 2006 "On Information, Information Technologies and Information Protection", Federal Law No. 152-FZ of July 27, 2006 "On Personal Data" (hereinafter referred to as 152-FZ), and other regulatory legal acts of the Russian Federation in the field of personal data protection.

1.2. The Policy defines the procedure for processing personal data, the measures to ensure the security of personal data implemented by the Operator, as well as the rights and obligations of personal data subjects.

1.3. Operator – Limited Liability Company "STUDIO REKLAMA" (LLC "STUDIO REKLAMA"), INN 9302000331, OGRN 1229300004383, e-mail: domen@lookmy.info.

1.4. The Policy applies to all personal data of subjects that is processed by the Operator with and without the use of automation tools.

1.5. The Policy is a publicly available document and is posted on the Operator's Website at: https://vizitka.lookmy.info/privacy. The Operator has the right to amend the Policy. The new version takes effect from the moment of its publication.

2. Terms and Definitions

• Personal data – any information relating directly or indirectly to an identified or identifiable natural person (the personal data subject).

• Personal data subject – a natural person whose personal data is processed by the Operator.

• Personal data processing – any action (operation) or set of actions performed with or without the use of automation tools, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, and destruction of personal data.

• Automated processing – processing of personal data using computer equipment.

• Website – the Operator's website located at https://vizitka.lookmy.info/, including all subdomains, as well as the personal account of the "Vizitka LOOK" service.

• "Vizitka LOOK" Service – software (SaaS) that provides the ability to create and publish digital business cards — pages with contact details, communication methods, services, and an address.

3. Scope of Personal Data to Be Processed

3.1. The Operator may process the following personal data of subjects:

3.1.1. For Service Customers (legal entities, individual entrepreneurs, and natural persons using the service):

• Last name, first name, patronymic (if any);

• E-mail address;

• Contact phone number;

• Information that the Customer posts on the business card themselves: photo, job title, links to messengers and social networks, address, description of services;

• Payment details (to the extent necessary for paying for the service, for example, the last 4 digits of the card, information about the payment system);

• Data provided when contacting technical support.

3.1.2. For website visitors:

• IP address, browser type, operating system, information about pages visited, referrer, cookie data, and analogous information collected by analytics counters (Yandex.Metrica, Google Analytics, etc.), if the Customer has given consent to this via the cookie banner.

3.1.3. For counterparties and candidates:*

• When concluding contracts, hiring employees, or cooperating – data provided for by labor and civil legislation (passport details, taxpayer ID (INN), SNILS, bank details, etc.). Such data is processed on the basis of separate consents.

4. Purposes of Collecting and Processing Personal Data

The Operator processes personal data for the following purposes:

5. Legal Grounds for Processing Personal Data

5.1. The Operator processes personal data only if at least one of the following grounds exists:

• The consent of the personal data subject to the processing of their personal data;

• Processing is necessary to achieve the purposes provided for by an international treaty of the Russian Federation or by law, and to carry out the functions, powers, and duties assigned to the Operator by the legislation of the Russian Federation;

• Processing is necessary for the performance of a contract to which the personal data subject is a party, beneficiary, or guarantor;

• Processing is necessary to protect the life, health, or other vital interests of the personal data subject;

• Processing is necessary to exercise the rights and legitimate interests of the Operator or third parties, or to achieve socially significant purposes, provided that the rights and freedoms of the personal data subject are not violated.

5.2. Consent to the processing of personal data:

• The service Customer gives consent when registering in the Personal Account or when paying for services.

• The website visitor gives consent to the processing of cookies and analytics data when using the website (pop-up notification).

• Consent may be withdrawn by the data subject by sending a written notice to the e-mail domen@lookmy.info. Withdrawal of consent does not terminate processing if it is necessary for the performance of a contract or obligations under the law.

6. Principles and Conditions of Personal Data Processing

6.1. The Operator processes personal data based on the following principles:

• Lawfulness and fairness;

• Limiting processing to the achievement of specific, predefined, and lawful purposes;

• Prohibition of processing personal data incompatible with the purposes of collection;

• Ensuring the accuracy, sufficiency, and relevance of personal data;

• Storing personal data no longer than required by the purposes of processing;

• Prohibition of merging databases containing personal data processed for incompatible purposes.

6.2. Conditions of processing:

• Processing is carried out with the consent of the data subject;

• Processing is necessary for the performance of a contract;

• Processing is carried out for statistical or other research purposes, provided that the data is anonymized;

• Processing is necessary to protect the legitimate interests of the Operator (for example, sending notifications);

• Processing is carried out in connection with a person's participation in legal proceedings or at the request of authorized government bodies.

6.3. Transfer of personal data to third parties:
The Operator may transfer personal data to third parties only in the following cases:

• The data subject has explicitly given consent to such a transfer;

• The transfer is provided for by the legislation of the Russian Federation (at the request of a court, the prosecutor's office, or investigative authorities);

• The transfer is necessary for the performance of a contract (to payment systems, hosting providers, analytics services, email delivery services);

• As part of a reorganization or sale of the business (with the new owner obligated to comply with this Policy).

Specific recipients:

• Payment aggregators (YooKassa, Robokassa, etc. – the list is available upon request);

• Hosting provider (servers located within the territory of the Russian Federation);

• Analytics collection services (Yandex.Metrica, Google Analytics, provided that the rules on cross-border transfer are observed);

• Email newsletter services (Unisender, SendPulse, etc.).

6.4. Cross-border transfer of personal data:
The Operator may carry out cross-border transfer of personal data only to the territory of foreign states that ensure adequate protection of the rights of personal data subjects (member states of the Council of Europe, states that have signed the Convention for the Protection of Human Rights). When transferring data to other countries, the Operator obtains separate consent from the data subject.

7. Terms of processing and storage of personal data

7.1. The personal data of Service Customers is stored for the duration of the offer agreement (use of the service) plus 5 (five) years after termination of the agreement, except where the legislation establishes a different storage period (for example, 5 years for payment documents).

7.2. Personal data collected using cookies is stored for no more than 12 months from the date of the last visit to the site, unless otherwise determined by the browser settings.

7.3. The data of the Customers' end clients (correspondence history) is stored in accordance with the plan settings and the storage policy of the Service itself, but no longer than 30 days after the end of the paid period, after which it is subject to automatic deletion.

7.4. Upon expiration of the storage period, personal data is destroyed or anonymized. Destruction is carried out in a manner that rules out any possibility of subsequent recovery (erasure from storage media, shredding of paper documents, overwriting of information).

8. Rights of personal data subjects

The personal data subject has the right:

8.1. To access their personal data – to require the Operator to confirm the fact of processing, to review the data being processed, and to receive information about the legal grounds, purposes, and terms of processing, and about the persons who have access to the data.

8.2. To rectification, blocking, or destruction – if the data is incomplete, outdated, inaccurate, obtained unlawfully, or not necessary for the stated purpose.

8.3. To withdraw consent to the processing of personal data (provided that processing is not mandatory for the performance of a contract).

8.4. To appeal the actions or inaction of the Operator to the authorized body (Roskomnadzor) or in court.

8.5. To demand that the processing of personal data for direct marketing purposes (advertising mailings) be stopped at any time.

To exercise their rights, the data subject sends a written request by e-mail to domen@lookmy.info or to the Operator's registered address. The request must include:

• The data subject's full name;

• A contact phone number and e-mail address for receiving a response;

• The substance of the request (for example, "confirm that my data is being processed" or "delete my data");

• The preferred method of receiving a response (in writing by e-mail or by post).

The request will be reviewed within 10 business days, unless a different period is provided by Federal Law No. 152-FZ (in the general case, 30 days).

9. Personal Data Protection Measures

9.1. The Operator appoints a person responsible for organizing personal data processing (if the number of data subjects exceeds 10,000, notifying Roskomnadzor is mandatory).

9.2. The Operator applies the following protection measures:

• Designating persons authorized to process personal data;

• Issuing internal regulations on the processing and protection of personal data;

• Establishing restricted access to the premises where processing equipment is located;

• Using antivirus software and firewalls;

• Encrypting communication channels (SSL/TLS for the website and API);

• Performing regular encrypted backups;

• Controlling physical data storage media (issuance logs);

• Conducting internal audits of compliance with the requirements of Federal Law No. 152-FZ.

9.3. When processing personal data in an information system, the Operator ensures:

• logging of access events;

• monitoring of software integrity;

• protection against unauthorized access (password policy, two-factor authentication for employees).

9.4. If a personal data breach is detected, the Operator is obliged to notify Roskomnadzor within 24 hours and take measures to minimize the consequences.

10. Liability

10.1. For failure to perform or improper performance of the obligations provided for by Federal Law No. 152-FZ and this Policy, the Operator bears administrative liability (Article 13.11 of the Code of Administrative Offenses of the Russian Federation), civil liability, and criminal liability (Article 137 of the Criminal Code of the Russian Federation) in accordance with the legislation of the Russian Federation.

10.2. A personal data subject who provides false information or information about a third party without that party's consent is solely responsible for doing so.

11. Final Provisions

11.1. This Policy is an internal regulatory act of the Operator and must be read by all employees authorized to process personal data.

11.2. Compliance with the Policy is monitored by the director of STUDIO REKLAMA LLC or a responsible person appointed by the director.

11.3. All suggestions and comments on the Policy are accepted by e-mail: domen@lookmy.info.

11.4. If the legislation of the Russian Federation on personal data changes, the Policy must be reviewed no later than 30 days after the changes take effect.

12. Operator Details

Limited Liability Company "STUDIO REKLAMA"
INN 9302000331 KPP 930201001
OGRN 1229300004383 E-mail: domen@lookmy.info
Phone: +79996916522