Personal Data Processing Policy

1.1. This Personal Data Processing Policy (hereinafter referred to as the "Policy") defines the procedure for processing personal data and the measures taken to ensure the security of personal data by Nikolay Vyacheslavovich Belyaev, applying the special tax regime "Professional Income Tax" (TIN: 591156797320, Certificate of Registration KND 1122035 dated 06/09/2026), mailing address: 194358, St. Petersburg, Prospekt Prosveshcheniya, 46, bldg. 1 (hereinafter referred to as the "Operator").

1.2. The Policy has been developed in accordance with the Constitution of the Russian Federation and Federal Law No. 152-FZ dated July 27, 2006 "On Personal Data" (hereinafter referred to as the "Law") and applies to all information that the Operator may obtain about visitors to the nikulina.art website and buyers of the online store.

1.3. The Operator provides unrestricted access to this Policy by permanently publishing it on the website at: nikulina.art/en/privacy. The Policy is published on all pages of the website where personal data is collected (Part 2, Article 18.1 of the Law).

1.4. Using the website, placing an order, and submitting data through the website's forms mean that the user has read this Policy. However, reading the Policy does not replace obtaining explicit, active consent from the user for the processing of their personal data in cases where such consent is required by law. Consent to personal data processing is executed as an independent document and is provided by the user through active actions (completing a separate consent form) in accordance with the requirements of Article 9 of the Law (as amended by Federal Law No. 156-FZ dated June 24, 2025).

1.5. The Operator has notified Roskomnadzor (the Federal Service for Supervision of Communications, Information Technology and Mass Media) about the initiation of personal data processing in accordance with the requirements of Article 22 of the Law. The Operator is included in the Roskomnadzor Register of Personal Data Operators.

1.6. The person responsible for organizing the processing of personal data is Nikolay Vyacheslavovich Belyaev (contact details are specified in Section 9 of this Policy).

2.1. The Operator may process the following personal data of users:

• Surname, first name, patronymic;
• Phone number;
• Email address;
• Delivery address;
• Order details;
• Technical data regarding the website visit, including IP address, cookie data, information about the browser, device, date, and time of page visits.

2.2. The Operator does not process special categories of personal data (Article 10 of the Law) or biometric personal data (Article 11 of the Law) of website users.

2.3. The Operator does not process personal data for the purpose of promoting goods, works, or services through direct contacts with users, including advertising and marketing mailing lists, unless otherwise separately and explicitly agreed upon by the user in the future.

3.1. Users' personal data is processed exclusively for the following purposes:

• Processing, confirming, and executing an order;
• Communicating with the user regarding order inquiries;
• Organizing the delivery of goods;
• Providing customer support;
• Sending technical notifications related to orders, payment, delivery, returns, or website operation;
• Ensuring the correct operation of the website, saving the shopping cart and user preferences;
• Maintaining internal statistics and website traffic analytics.

3.2. The Operator does not use the user's phone number and email address for advertising, news, promotional, or marketing mailing lists without the separate consent of the user.

3.3. The Operator does not make decisions that entail legal consequences for the user based solely on automated processing of personal data.

4.1. The legal bases for processing personal data are:

• The consent of the personal data subject to the processing of their personal data (Article 6, Part 1, Clause 1; Article 9 of the Law);
• The necessity of processing for the execution of a sales contract, organization of delivery, processing of returns, or other obligations to the user to which the personal data subject is a party (Article 6, Part 1, Clause 5 of the Law);
• The fulfillment of duties assigned to the Operator by the legislation of the Russian Federation (Article 6, Part 1, Clause 2 of the Law).

4.2. The Operator processes only those personal data that meet the stated purposes of processing and does not allow their excessive processing.

5.1. The processing of personal data is carried out with the use of automation tools, as well as without their use.

5.2. Personal data of citizens of the Russian Federation is collected and stored using databases located on the territory of the Russian Federation (Article 18, Part 5 of the Law, Federal Law No. 242-FZ dated July 21, 2014).

5.3. The Operator takes necessary legal, organizational, and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision, distribution, as well as from other unlawful actions (Article 19 of the Law).

5.4. Such measures specifically include: using the secure data transfer protocol HTTPS, restricting access to data (only for the Operator), applying passwords and protective measures for databases and hosting accounts.

5.5. The storage periods for personal data are determined depending on the purpose of processing:

• Order data (Full name, delivery address, order details) — 5 years from the execution of the order (statute of limitations, Article 196 of the Civil Code of the Russian Federation; accounting requirements);
• Phone number and email for order communication — until the execution of the order and closure of potential claims, but no more than 5 years;
• Technical data (IP address, cookies, browser data) — no more than 1 year from the moment of collection, unless otherwise provided by cookie consent settings;
• Data processed on the basis of consent — until the consent is withdrawn by the personal data subject (Article 9, Part 5 of the Law).

Upon reaching the expiration of the storage period or upon the occurrence of other legal grounds, personal data is subject to destruction or anonymization.

5.6. In the event of detecting a fact of unlawful or accidental transfer (provision, distribution, access) of personal data, the Operator notifies Roskomnadzor within 24 hours from the moment the incident is discovered (initial notification), and based on the results of an internal investigation — within 72 hours (final notification) in accordance with Article 21 of the Law.

6.1. The Operator has the right to transfer personal data to third parties only in cases necessary to achieve the purposes of processing, execute an order, or comply with legal requirements.

6.2. For order delivery, the Operator transfers the minimum necessary volume of personal data to a logistics partner — LLC "CDEK-Global" (or another engaged delivery service) if necessary for the execution of the order. The transfer of personal data to the delivery service is carried out on the basis of separate user consent, executed as an independent document in accordance with the requirements of Article 9 of the Law (as amended by Federal Law No. 156-FZ dated June 24, 2025).

6.3. Data transferred for delivery may include: the user's surname, first name, patronymic, phone number, and delivery address.

6.4. The transfer is carried out only to the extent necessary for delivery and on the condition that the recipient observes confidentiality and personal data protection requirements.

6.5. The Operator does not carry out cross-border transfers of personal data. The website and all data processing tools used by the Operator function based on servers and services located on the territory of the Russian Federation or in countries providing adequate protection of the rights of personal data subjects (Article 12 of the Law). In the event that a need for cross-border transfer arises in the future, it will be carried out exclusively in accordance with the requirements of Article 12 of the Law, with appropriate notification to users.

7.1. The website uses cookies and similar technologies to ensure the correct operation of the site, save the shopping cart, user preferences, authorization, as well as for traffic analytics and improving the user experience.

7.2. The use of analytical and other not strictly necessary cookies is carried out only with the explicit, active consent of the user via a banner displayed during the first visit to the site. Technical (necessary) cookies do not require separate consent, as the operation of the website is impossible without them.

7.3. The user can change the cookie settings in their browser or in the cookie consent control panel on the website. Disabling certain cookies may lead to the incorrect operation of some website functions.

8.1. In accordance with Articles 14–17 of the Law, the user has the right to:

• Receive information regarding the processing of their personal data (Article 14 of the Law);
• Demand access to their personal data, including obtaining a copy of it (Article 14 of the Law);
• Demand the clarification, blocking, or destruction of personal data if it is incomplete, outdated, inaccurate, illegally obtained, or not necessary for the stated purpose of processing (Article 16 of the Law);
• Withdraw consent to the processing of personal data (Article 9, Part 5 of the Law);
• Appeal against the actions or omissions of the Operator to Roskomnadzor or in court (Article 17 of the Law);
• Demand compensation for damages and compensation for moral harm in court (Article 24 of the Law).

8.2. To exercise their rights, the user has the right to send a request to the Operator using the contact details specified in Section 9 of this Policy.

8.3. Terms for considering requests from personal data subjects:

• Requests for providing information about the processing of personal data — within 30 calendar days from the date of receipt of the request (Article 20 of the Law);
• Demands for clarification, blocking, or destruction of personal data — within 7 working days from the date the subject provides relevant information (Article 21 of the Law).

9.1. For questions regarding the processing of personal data, the user can contact the Operator using the following details:

• Email: nikulina.arts@gmail.com
• Mailing address: 194358, St. Petersburg, Prospekt Prosveshcheniya, 46, bldg. 1
• Phone: +7 964 384 1698

9.2. The person responsible for organizing the processing of personal data: Nikolay Vyacheslavovich Belyaev.

10.1. This Policy is valid indefinitely until replaced by a new version.

10.2. The Operator has the right to make changes to this Policy unilaterally. The current version is always published on the website at: nikulina.art/en/privacy. In the event that the changes introduced affect the conditions of previously obtained consents for personal data processing, the Operator notifies users of this by placing a corresponding notice on the website no later than 10 days before the changes take effect, or by sending a notification using the available user contact details.

10.3. The new version of the Policy takes effect from the moment it is published on the website unless otherwise provided by the new version of the Policy.