Personal Data Processing Policy

Last updated: October 29, 2026

This is an English translation. In case of any discrepancy, the Russian version prevails.

This Personal Data Processing Policy (the “Policy”) sets out how the personal data of users of the website GPartnetship.com (the “Website”) is processed and protected.

The Policy has been prepared in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” and other applicable laws and regulations of the Russian Federation.

1. General provisions

1.1. The personal data operator is NEYROPLUS LLC (OOO Neyroplus), Tax ID (INN) 9705258693, Reg. No. (OGRN) 1267700262169, address: 37 Pyatnitskaya St., premises 1/1, Moscow 119017, Russia (the “Operator”).

1.2. The Operator processes personal data on lawful grounds, observes the principle of purpose limitation and takes the necessary measures to protect the data.

1.3. The Policy applies to personal data that the Operator receives from users when they visit the Website, fill out feedback forms and send requests.

1.4. When using the Website, the user can review this Policy. Where a specific processing activity requires the user’s consent, such consent is requested separately in the manner prescribed by law.

1.5. This Policy does not replace separate consents to the processing of personal data, to receiving advertising messages or to the transfer of data to third parties, where such consents are required by law.

2. Categories of personal data processed

2.1. Depending on the user’s actions, the Operator may process the following personal data:

• first name and last name;
• company name and position, if provided by the user;
• email address;
• phone number and messenger contact details;
• information about the service the user is interested in;
• the content of the user’s message or request;
• technical data transmitted automatically when visiting the Website, including the IP address, information about the browser, device, time of visit and actions on the Website, if such data is collected by the technologies in use.

2.2. The Operator does not request special categories of personal data, biometric personal data or other excessive information through the standard feedback form.

2.3. The user decides what information to include in a message. Passwords, payment details, health information and other sensitive data that are not needed for the request should not be sent through the Website.

3. Purposes of personal data processing

The Operator processes personal data solely for the following specified purposes:

3.1. Handling requests and inquiries: receiving user requests, providing answers and maintaining communication.

3.2. Advisory support: clarifying the client’s needs, discussing possible services and preparing proposals for cooperation.

3.3. Arranging cooperation with partners: considering whether to involve specialized organizations to address the client’s request, where necessary and where there is a proper legal basis for the relevant transfer of data.

3.4. Concluding and performing contracts: preparing contractual documents, interacting with clients and fulfilling the Operator’s obligations.

3.5. Ensuring the operation and security of the Website: technical support, prevention of unlawful actions and checking that the Website works correctly.

3.6. Compliance with legal requirements: fulfilling the obligations imposed on the Operator by the laws of the Russian Federation.

3.7. Advertising and informational messages are sent only where there is the necessary legal basis and the user’s separate consent, when such consent is required by law.

4. Legal grounds for processing

4.1. The Operator processes personal data on the grounds provided for by the laws of the Russian Federation, including:

• the consent of the personal data subject;
• the need to process data in order to conclude a contract at the initiative of the data subject or to perform a contract to which the data subject is a party, beneficiary or guarantor, in cases provided for by law;
• fulfillment of the Operator’s obligations established by law;
• other lawful grounds applicable to the specific purpose of processing.

4.2. Where processing is based on consent, the user may withdraw it in the manner prescribed by law. Withdrawal of consent does not affect the lawfulness of processing carried out before the Operator received the withdrawal.

5. Procedure for processing and storing personal data

5.1. The Operator may process personal data with or without the use of automation tools.

5.2. Processing may include collection, recording, systematization, accumulation, storage, clarification, use, transfer in cases established by law, blocking, deletion and destruction of personal data.

5.3. The Operator processes only the data necessary for the stated purposes and does not allow its use for purposes incompatible with the original purposes of collection.

5.4. Personal data is stored no longer than required by the purposes of processing, the terms of a contract and applicable legal requirements, unless a different period is established by law.

5.5. Once the purposes of processing have been achieved, or other grounds provided for by law arise, personal data is deleted or destroyed, unless there are grounds for its further storage.

5.6. When collecting personal data of citizens of the Russian Federation through the Website, the Operator complies with the requirements of Russian law on database localization.

6. Transfer of personal data to third parties

6.1. The Operator may engage persons who ensure the operation of the Website, data storage, handling of requests and other technical or organizational functions, provided there are appropriate legal grounds and legal requirements are met.

6.2. In the course of GPA’s activities, it may become necessary to arrange cooperation between the user and a foreign company or a specialized partner.

6.3. The user’s personal data is transferred to a partner only where there is a proper legal basis, to the extent necessary for the relevant purpose, and in compliance with applicable legal requirements. If the user’s consent is required, it is requested separately before the data is transferred.

6.4. The Operator does not sell users’ personal data.

6.5. When transferring data to third parties, the Operator takes the measures prescribed by law to ensure the confidentiality and protection of personal data.

7. Cross-border data transfer

7.1. Due to the international nature of GPA’s activities, it may become necessary to transfer personal data outside the Russian Federation.

7.2. Cross-border transfer is carried out only where there is a lawful basis and in compliance with the laws of the Russian Federation, including the applicable requirements to notify the authorized body and to assess the conditions of transfer.

7.3. If a separate consent of the user is required to transfer personal data to a foreign recipient, such consent is obtained separately and includes the necessary information.

7.4. Until the necessary legal requirements have been met, personal data is not transferred to a foreign recipient in cases where such transfer is prohibited or restricted by law.

8. Use of cookies and analytics technologies

8.1. The Website may use cookies and similar technologies to ensure technical operation and security, save settings and analyze traffic.

8.2. The set of cookies used, their purpose and retention periods depend on the tools actually installed on the Website.

8.3. If the analytics or advertising technologies in use collect personal data or require the user’s consent, the Operator obtains the relevant consent and provides the necessary information before such processing begins.

8.4. The user can restrict the use of cookies in the browser settings. Disabling certain cookies may affect some features of the Website.

9. Protection of personal data

9.1. The Operator takes the necessary legal, organizational and technical measures to protect personal data against unlawful or accidental access, alteration, disclosure, destruction and other unlawful actions.

9.2. Such measures may include restricting access to data, using information security tools, controlling access by authorized persons and other measures appropriate to the nature of the processing and legal requirements.

9.3. Persons who have access to personal data in connection with their duties must comply with confidentiality requirements and the applicable information security rules.

10. User rights

In accordance with the procedure established by the laws of the Russian Federation, the user has the right to:

• receive information about the processing of their personal data;
• demand that data be clarified, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose;
• withdraw consent to the processing of personal data;
• object to processing in cases provided for by law;
• appeal against the actions or inaction of the Operator to the authorized body or in court;
• exercise other rights provided for by law.

To exercise these rights, the user may send a request to the following email address: neyroplus.inc@yandex.ru.

11. Handling of requests

11.1. Requests related to the processing of personal data are considered by the Operator within the time limits established by the laws of the Russian Federation.

11.2. To consider a request, the Operator may ask for the information needed to verify the identity of the applicant and their authority, to the extent permitted by law.

11.3. Withdrawal of consent or a request to delete data does not preclude further storage and processing of information for which an independent legal basis remains.

12. Changes to the Policy

12.1. The Operator may amend this Policy in the event of changes in legislation, data processing procedures or the functionality of the Website.

12.2. The new version of the Policy is published on the Website with the date of its update.

12.3. Users are advised to review the current version of the document periodically.

13. Operator details