PERSONAL DATA PROCESSING POLICY "ИП Макаров Ярослав Владимирович"

As amended on 12.02.2026

1. Terms and Definitions.

All capitalized terms used in this policy have the following meanings:

"Platform" — software for the remote sale of food products, prepared meals, beverages, and other similar and auxiliary goods over the Internet, including the Seller's website, its mobile applications for iOS and Android operating systems, modules for integrating online acquiring with acquiring banks (Tinkoff Bank JSC, Sberbank PJSC, Alfa-Bank JSC), and modules for integration with third-party Product and Order accounting systems (iiko, r-keeper, Poster).

"Seller" — "ИП Макаров Ярослав Владимирович" (OGRN: 322330000018512, INN: 333412473305) address: 602209, Владимирская область, Муромский р-н, с Якиманская слобода, ул. Красина, д. 3, namely, the entity using the Platform for a fee to conduct commercial activities, organizing and processing personal data on the Platform, and determining the purposes of personal data processing, the scope of personal data subject to processing, and the actions (operations) performed with such personal data.

"Buyer" — an individual using the Platform to review the Seller's product range and the terms of sale of Products and/or to purchase/receive Products, in accordance with the purpose of the Platform and the terms set forth by the Seller in its offer to Buyers.

"Recipient" — the individual designated by the Buyer as the Recipient of the Order.

"Order" — a request to purchase Products submitted by the Buyer through the Platform. By placing an Order, the Buyer enters into a contract with the Seller for the sale and purchase of the Product and, if necessary, the provision of delivery services.

"Product" — food products, dishes, beverages, and other similar and auxiliary goods.

"Third Parties" — parties accepting and/or processing the Order, delivering and/or issuing the Product, as well as the Seller's partners, parties conducting joint activities with the Seller on the Platform, other parties involved in concluding and/or executing contracts concluded between the Seller and the Buyer through direct or indirect use of the Platform, or parties to whom the transfer of personal data is required by the current legislation of the Russian Federation.

"Personal Data" — any information directly or indirectly related to an identified or identifiable individual.

"Personal Data Processing" — any action (operation) or series of actions (operations), whether automated or not, with personal data. Such actions (operations) include, but are not limited to, the collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), comparison, depersonalization, blocking, deletion, and destruction of personal data.

"Personal Data Security" means the protection of personal data from unauthorized and/or illegal access, destruction, modification, blocking, copying, provision, distribution, and other illegal actions.

2. General Information

2.1. This Personal Data Processing Policy (hereinafter referred to as the "Policy") has been created by the Seller in accordance with the provisions of Federal Law of the Russian Federation No. 152-FZ of July 27, 2006 "On Personal Data" (hereinafter referred to as the "Law"), including Clause 2, Part 1, Article 18.1 thereof.

2.2. This Policy sets forth the Seller's position regarding the processing and protection of personal data (hereinafter referred to as "personal data"). It contains information regarding the collection, storage, use, and transfer of personal data, as well as security requirements. It also addresses the rights of individuals whose personal data is processed.

2.3. This Policy applies to all actions related to the processing of personal data by the Seller and Third Parties.

2.4. By placing an Order, registering/logging in to the Platform by any available means, submitting a complaint/feedback, creating an Account, or using any other functionality of the Platform, the Buyer consents to the processing of their personal data by the Seller and Third Parties, including personal data received from Third Parties during registration/login using Third Party services. By using the Platform, the Buyer consents to this Personal Data Processing Policy. The Platform cannot fulfill Buyer Orders without the Buyer's consent to the Personal Data Processing Policy.

2.5. The Seller acts as an independent operator with respect to the processing of personal data received from Buyers (Recipients) and/or Third Parties, as defined in the "Terms and Definitions" section of this Policy. The Seller processes this data for the purpose of fulfilling contracts for the sale and purchase of Goods, contracts for the provision of Goods delivery services, and other contracts concluded on the Platform between the Buyer and the Seller, with or without the participation of third parties.

2.6. This Policy applies to personal data obtained both before and after the implementation of this Policy.

3. Legal basis and purposes of personal data processing by the Seller.

3.1. The Seller is responsible for processing and ensuring the security of personal data in order to fulfill its obligations in accordance with the legislation of the Russian Federation, including, but not limited to, the Constitution of the Russian Federation, Federal Law No. 152-FZ of July 27, 2006 "On Personal Data," as well as other applicable laws of the Russian Federation, guidelines, methods of regulatory authorities, and the Seller's internal regulations.

3.2. The Seller may process personal data under the following circumstances and on the following legal grounds:

Personal data may only be processed with the consent of an individual, which may be expressed in any form that confirms consent, including by the methods specified in paragraphs 2.4 and 4.3 of this Policy.

Processing is necessary to fulfill the Seller's obligations to the personal data subject and third parties, to fulfill the personal data subject's obligations to the Seller, and to fulfill the obligations imposed on the Seller by Russian law, including as a personal data operator. Personal data may also be processed for other purposes stipulated by international treaties or Russian law.

Processing is necessary for the performance of a contract, such as a sales contract or any other contract between the Seller and the Buyer.

Processing is necessary to comply with the terms and conditions of use of the Platform, published online at https://starterapp.ru/privacy.

Processing is necessary to protect the legitimate interests of the Seller and/or Third Parties, or to achieve socially significant goals, provided that the rights and freedoms of an individual are not infringed.

Processing is necessary for statistical, marketing, and research purposes, provided that personal data is anonymized.

Processing is necessary for other purposes specified in this Policy.

3.3. Individuals whose personal data is processed by the Seller through the Platform include Buyers, Recipients of Goods (if the Buyer designates another individual as the Recipient of Goods), and any other individuals who submit applications, requests, claims, or other communications (documents, letters) to the Seller.

3.4. The Seller processes the personal data of the following categories of individuals:

a) Buyers, for the following purposes:

Conclusion and execution of contracts related to Orders and delivery on the Platform, including contracts for the retail sale of Goods and contracts for the provision of services for a fee.

Providing Buyers with information about Products, promotions, and special offers.

Informing Buyers about the status of their Orders.

Assisting in resolving any claims between Buyers and Third Parties.

Accepting payment for Products from Buyers/recipients, including transferring payment acceptance rights to the acquiring bank or any other Third Parties.

Returning Products and/or funds paid for Products.

Providing Buyers with the opportunity to leave reviews about Products, the Platform, and/or the Seller.

Analyzing and improving the quality of customer service.

Determining Buyers participating in promotions and managing the accrual, accounting, and use of loyalty program bonus points.

Fulfilling the Seller's obligations related to promotions.

Complying with the Platform's terms of use.

Any other cases specified in this Policy and expressly permitted by applicable law.

b) Recipients of Products purchased by Buyers for delivery purposes.

c) Persons involved in the delivery process (couriers, persons responsible for issuing Products).

d) Persons who submit reports of violations of their rights or the rights of third parties to the Platform for the purposes of processing these reports, exchanging information with the relevant parties involved in the alleged violations, assisting in resolving claims, and deciding on the application of penalties provided for in the Platform Terms of Use and other Platform documents.

e) Seller's employees for the performance of employment contracts in accordance with Russian legislation.

f) Seller's counterparties, whose personal data is processed within the framework of contractual relations between the parties.

3.5. If the Buyer provides the Seller with the personal data of another person for processing, it is presumed that the Buyer has received consent from that person to provide their personal data to the Seller.

4. Categories of personal data processed by the Seller.

4.1. To processed Products

Personal data includes information obtained during registration, authorization, and order placement, such as last name, first name, middle name, date of birth, gender, telephone number, email address, registered address, work address, delivery address, and cookies. In addition, information obtained during interactions with Buyers is processed, such as gender, age, passport details, payment details, city of residence, and address. Information related to the placement or fulfillment of Buyer Orders is also processed, including information about the delivery method, payment status, and, if necessary, information about the final Recipient of the Product (such as last name, first name, middle name, delivery address, and telephone number). The processed data also includes Buyer complaints submitted through the Platform or by any other means, as well as reviews of Products and Sellers, geolocation information, and data on the Buyer's behavior on the Platform (e.g., viewed Products and categories, products added to the Cart). The Seller also processes the unique identifier of the Buyer's Personal Account. A more detailed list of processed Personal Data, its purposes, terms, legal grounds, and methods for processing and destroying personal data are set out in Appendix No. 1 to this Policy.

4.2. The Seller processes certain categories of personal data of individuals who contact the Seller with complaints, feedback, and statements regarding alleged violations of their rights. This includes the last name, first name, patronymic, passport details (or details of another identity document), and contact information (phone and/or fax numbers, email address) of the individual submitting the complaint, feedback, or statement.

4.3. The personal data specified in the preceding paragraphs may be obtained by the Seller by means such as: data subjects completing the relevant forms on the Platform, sending correspondence or emails to the Seller's email addresses, and third parties providing data during the Buyer's registration and/or authorization through third-party services. In addition, personal data may be obtained from third parties in accordance with applicable law. The Seller may also obtain personal data through automated processing and systematization of information provided by personal data subjects.

4.4. The Seller uses the Yandex.Metrica web analytics service provided by Yandex LLC and the top.mail.ru service provided by VK LLC on the Platform to collect and analyze statistical information about visits to and use of the Platform, evaluate the effectiveness of advertising and marketing campaigns, improve the structure, content, and functionality of the Platform, and enhance the ease of use for the Buyer.

4.5. When using the Yandex.Metrica and top.mail.ru services, cookies may be installed on the Buyer's device, and information about the Buyer's actions while using the Platform, including the technical parameters of their device and software, session date and time, the address of pages visited, and other similar information may be automatically transmitted. The processing of this data is carried out by Yandex LLC and VK LLC on their own behalf in the manner and under the terms and conditions set forth in the Yandex.Metrica and top.mail.ru Terms of Use and their Privacy Policy, and the Seller only has access to anonymized statistical data.

5. Principles and Conditions of Personal Data Processing.

5.1. When processing personal data, the Seller is guided by the following principles:

Personal data must be processed lawfully and fairly.

Personal data must be limited to achieving specific, predetermined, and legitimate purposes. Processing of personal data incompatible with the purposes for which it was collected is prohibited.

Merging databases containing personal data processed for incompatible purposes is prohibited.

Only personal data that is relevant for the purposes for which it is processed may be processed.

The content and volume of personal data processed must correspond to the stated purposes of processing. Processed personal data must not be excessive in relation to the stated purposes of processing.

When processing personal data, the accuracy, sufficiency, and, where necessary, relevance of the personal data to the purposes of processing must be ensured. The operator must take necessary measures or ensure that they are taken to delete or clarify incomplete or inaccurate data.

Personal data must be stored in a form that allows identification of the data subject for no longer than required for the purposes of processing the personal data, unless the storage period for personal data is established by federal law, agreement, or other legal entitym, to which the personal data subject is a party, beneficiary, or guarantor. Processed personal data is subject to destruction or anonymization upon the achievement of the processing purposes or when these purposes are no longer necessary, unless otherwise provided by federal law.

5.2. The Seller does not process personal data related to race, nationality, political views, religion, philosophy, beliefs, health, personal life, membership in public associations, including trade unions, or biometric data. Voice input and verification of personal data are not performed over unsecured data transmission channels. Providing personal data to Seller's employees by data subjects is voluntary and implies that the data received will be used in accordance with this Policy.

5.3. The Seller reserves the right to outsource the processing of personal data to third parties with the consent of the Buyer. Such consent is expressed by accepting an offer or by entering into an agreement with the Seller and/or such third parties. Such delegation of processing authority may occur for the following purposes:

Processing Buyer and/or Recipient requests via various communication channels, such as voice and non-voice channels, email, online chat, mobile applications, and social media.

Delivering Products to Buyers and Recipients.

Receiving payment for Products and related services.

Analyzing the quality of services provided by the Platform and improving the overall quality of services.

Creating personalized offers and terms of service.

Personalizing advertising.

Sending advertising and informational messages.

Conducting statistical or other marketing research.

5.4. The Seller may transfer the personal data of Buyers and persons designated by Buyers as Recipients of Orders to other persons via the Internet, in accordance with the rules established by the current legislation of the Russian Federation.

a) Persons processing personal data on behalf of the Seller or the Platform, including delivery services, are obligated to comply with the principles and rules for processing and protecting personal data set forth in the current legislation.

5.5. The Seller has the right to disclose personal data to Third Parties with the individual's consent, subject to the following conditions:

a) This data is necessary for the performance of contracts with the Seller, delivery services, and related counterparties that provide the Seller with services for the purpose of technical and informational support of the Seller's processes. This may include, in particular, services for processing Buyer Orders, accepting payment, organizing their delivery, and providing technical support.

b) To protect the rights and legitimate interests of the Platform or Third Parties, in cases where an individual violates any terms of use of the Platform, this Policy, or the current legislation of the Russian Federation.

c) To comply with a court decision or in accordance with the requirements of current legislation.

d) In accordance with the legal requirements of competent government agencies.

5.6. To achieve the purposes of using personal data, the Buyer and/or Recipient agree and provide consent to the Seller to process (including collecting, recording, systematizing, accumulating, storing, clarifying (updating, modifying), comparing, extracting, using, depersonalizing, blocking, deleting, and destroying) their account and other personal data. Third parties acting on behalf of the Platform or processing personal data in accordance with applicable law may participate in such processing.

a) Third parties engaged in the processing of personal data act as independent data processors. The Buyer and/or Recipient agree to the transfer of their personal data necessary for the performance of the agreement concluded using the Platform to such third parties. The Buyer and/or the Recipient acknowledge and agree that the obligations and rights associated with providing consent to the processing of personal data by a Third Party, as well as the subsequent processing of their personal data by the Third Party as an independent data processor, are between the Buyer and the Third Party or between the Recipient and the Third Party, in accordance with the terms of the consent provided by the Buyer and/or the Recipient. To revoke such consent to the processing of personal data, the Buyer and/or the Recipient must follow the instructions set out in subparagraph "e" of paragraph 6.1 of this policy.

5.7. In order to comply with the requirements of Russian legislation and contractual obligations, the Seller and Third Parties process personal data, with or without automation. Processing actions include collection, recording, systematization, accumulation, storage, clarification (updating, changing)

(i) extraction, use, transfer (distribution, provision, access), anonymization, blocking, deletion, and destruction of personal data.

5.8. The Seller and Third Parties do not make decisions that have legal consequences for individuals or affect their rights and interests solely through the automated processing of personal information.

5.9. The Seller and Third Parties do not verify the accuracy and reliability of the information provided by Buyers and/or Recipients on the Platform. The Seller and Third Parties assume that Buyers and/or Recipients act reasonably and in good faith by providing sufficient and accurate information and keeping it up to date.

6. Rights of Individuals Regarding Their Personal Data.

6.1. Individuals whose personal data is processed by the Seller have the following rights:

a) Individuals have the right to update or supplement the personal data they have provided at any time by logging into their personal account on the Platform, if the Platform allows such changes.

b) Individuals may request deletion of their personal data by sending a written notice to the Seller, specifying the personal data they wish to delete.

c) Individuals have the right to receive the following information from the Seller:

Confirmation of the processing of personal data and information about the existence of personal data related to them.

Information about the legal basis and purposes for processing personal data.

Information about the methods used by the Seller to process personal data.

Information about the name and location of the Seller.

Information about individuals (except for employees whose personal data the Seller may not disclose) who have access to personal data or may have access to personal data based on a contract or legal requirement.

Personal data relating to an individual and information about the source from which such data was obtained, unless otherwise provided by law.

Information about the duration of personal data processing, including the retention period.

Information about the procedures for individuals to exercise their rights under personal data legislation.

Information about third parties processing personal data on behalf of the Seller.

Any other information required by law.

d) Individuals may request the Seller to correct, block, or destroy their personal data if it is incomplete, outdated, inaccurate, illegally obtained, or no longer necessary for the purposes of processing.

e) Individuals have the right to revoke their consent to the processing of their personal data at any time by sending a duly certified email to cliche.coffee@mail.ru. Once the Seller receives the revocation of consent, the processing of personal data will cease, and the individual's personal data will be deleted, unless processing must continue in accordance with Russian Federation law. Furthermore, revocation of consent will also be considered a unilateral refusal to fulfill any related Orders if such revocation makes fulfillment of the Orders impossible.

f) Individuals have the right to demand the elimination of any unlawful actions committed by the Seller and/or Third Parties in relation to their personal data.

g) Individuals have the right to take legal measures to protect their rights and interests, including seeking compensation for losses or damages through legal proceedings.

h) The rights specified in this section may be limited in accordance with Russian Federation law or if the Seller and/or Third Parties process personal data on legal grounds other than the individual's consent.

7. Seller's Obligations.

7.1. The Seller is obligated to:

a) Upon request, provide an individual with information about the processing of their personal data or reject the request in accordance with current Russian Federation law within thirty days of receipt of the request. b) Upon request from an individual, within seven business days, clarify, block, or delete personal data being processed if it is incomplete, outdated, inaccurate, illegally obtained, or no longer necessary for the intended purpose of processing. This request must be supported by evidence provided by the individual or their representative.

c) Maintain records of requests for personal data processing, noting requests submitted by individuals and the actions taken by the Seller in response to these requests.

d) Inform the individual about the processing of their personal data, unless such data was received directly from the individual, except for the cases specified in paragraph 1 of Article 6 of Federal Law No. 152-FZ "On Personal Data" of July 27, 2006.

e) Immediately terminate

Cease processing personal data and destroy the relevant data within thirty days of achieving the processing purpose, unless otherwise provided by an agreement between the Seller, the Supplier, and the individual, or if the Seller has the legal right to process personal data without the individual's consent.

f) If an individual revokes their consent to the processing of their personal data, immediately cease processing and destroy the personal data within thirty days of the revocation, unless otherwise provided by an agreement between the Platform and the individual.

g) If an individual requests that the processing of personal data cease, immediately cease processing such personal data, except in cases provided by law.

h) When collecting personal data, including through online channels, the Seller ensures that the recording, systematization, accumulation, storage, clarification (updating, modification), and retrieval of personal data of Russian citizens are carried out using databases located within the Russian Federation.

8. Protection of Personal Data.

8.1. The Seller implements the necessary legal, organizational, and technical measures to protect personal data from unauthorized access, destruction, modification, blocking, copying, disclosure, distribution, and other illegal actions.

8.2. Implementation of such measures includes:

Appointing a person responsible for organizing the processing of personal data.

Developing and approving local policies for the processing and protection of personal data.

Implementing legal, organizational, and technical measures to ensure the security of personal data.

Monitoring the effectiveness of measures taken to ensure the security of personal data and the level of protection of personal data information systems.

Assessing the potential damage to individuals in the event of a violation of personal data legislation and assessing the adequacy of the measures taken by the Seller to fulfill its obligations under the law.

Ensuring the prevention of unauthorized access to physical records containing personal data and maintaining the security of personal data. Conducting internal control and/or auditing of personal data processing compliance with current legislation, personal data protection requirements, the Seller's personal data processing policy, and the Seller's internal regulations;

Other measures stipulated by current Russian Federation legislation.

9. Personal Data Processing (Storage) Periods.

9.1. The personal data processing (storage) period is determined based on the data processing purposes and in accordance with the terms of agreements with data subjects and the requirements of current legislation:

The personal data of registered Buyers is stored for the duration of the Buyer's account.

The personal data of unregistered Buyers and Recipients of goods (if the Recipient is not the Buyer) will be stored for three years from the date of fulfillment of the Buyer's order, unless otherwise provided in Appendix No. 1 to this Policy.

The personal data of individuals who have filed claims of rights infringement will be stored for the entire period of claim processing and review and for three years after completion of processing and/or review, unless a different storage period or the statute of limitations for the relevant disputes is established by law or Appendix No. 1 to this Policy.

These periods may be extended or shortened in cases stipulated by the current legislation of the Russian Federation.

9.2. Upon expiration of the processing (storage) period, personal data is subject to destruction, unless otherwise provided by the legislation of the Russian Federation. Personal data may be stored after processing has ceased only after it has been anonymized.

10. Process for Requesting Information about Personal Data Processing.

10.1. Individuals whose personal data is processed by the Seller may obtain clarification regarding the processing of their personal data by personally contacting the Seller or sending a written request to the Seller's address.

11. Collection of Automated Information.

11.1. The Seller may collect and process the following information, including non-personal data:

Information about Buyer interests on the Platform, based on search queries entered by Buyers for products sold and offered on the Platform. This information is used to provide relevant information to Buyers and analyze demand for various sections of the Platform and the products featured.

Information about Buyer interests based on received queries and Buyer Orders. This information is used to provide relevant information to Buyers and analyze demand for various Platform features.

Information that constitutes the Seller's rating in the system, including reviews.

Buyers, order fulfillment information, and other relevant data.

Other information specified in this Policy and its appendices.

11.2. The Seller processes and stores search queries made by the Buyer on the Platform to create and analyze statistics on the use of various sections of the Platform and to identify the most popular Products.

11.3. The Seller automatically receives certain types of information when the Buyer interacts with the Platform, including through web protocols and cookies.

12. Other Terms

12.1. The Seller reserves the right to periodically amend this Policy in accordance with changes to the Seller's services, Products, Platform functionality, or to comply with applicable laws. The updated version of this Policy shall take effect upon its publication, unless otherwise stated.

Appendices:

List of Personal Data processed, purposes, terms, legal grounds, methods of processing and destruction

Personal Data that may be transferred to Third Parties, and the purposes of such transfer.

Appendix 1

to the ИП Макаров Ярослав Владимирович Personal Data Processing Policy.