Legal Documents

PRIVACY AND PERSONAL DATA PROCESSING POLICY

Version 1.0 Effective date: 4 August 2026

Website: goldenlegacy.ru

This document is the English-language version of the Controller’s privacy and personal data processing policy. It is intended to provide clear information to international visitors. Where mandatory local law grants a visitor stronger rights, that law applies. In the event of an inconsistency, the Russian-language version governs to the extent permitted by applicable law.

1. Controller

Privacy requests, consent withdrawals, and notification opt-outs may be sent to goldenlegacybee@gmail.com.

2. Scope

This Policy applies when a visitor browses goldenlegacy.ru or its Russian and English versions, submits the waiting-list form, gives consent, contacts the Controller, or interacts with cookies and Yandex Metrica analytics. The Controller operates from the Russian Federation. The primary waiting-list database and server-side processing are located in Russia.

3. Data collected

3.1. Website and technical data

• • IP address;
• • date and time of access;
• • requested page and referral source;
• • browser, device, operating system, and language information;
• • approximate region;
• • cookie and similar identifiers;
• • Website interaction events, automatic goal events, error logs, and security logs.

3.2. Waiting-list contact data A visitor may provide at least one of the following, at the visitor’s choice:

• • Telegram username;
• • telephone number.

Providing both contacts is optional.

3.3. Consent and application records

• • date and time of submission and consent;
• • selected communication channel and Website language;
• • technical application identifier;
• • IP address and browser or device information;
• • versions of this Policy and the applicable consent;
• • application status, notification history, opt-out, and withdrawal records.

3.4. Communications Where a visitor contacts the Controller, the Controller may process contact details, the content of the request, attachments, and communication history. The Controller does not intend to collect special-category or sensitive data, biometric data, identity-document details, or health information through the waiting-list form. Visitors should not submit such information.

4. Purposes

• • receive, register, and maintain waiting-list applications;
• • verify the contact and prevent duplicate, fraudulent, or automated submissions;
• • record and demonstrate consent;
• • send sales-launch and product-availability notifications where separate consent has been given;
• • process consent withdrawals and notification opt-outs;
• • operate and secure the Website, form, and administration panel;
• • diagnose errors and maintain security logs;
• • measure Website traffic and improve content, structure, performance, and usability;
• • respond to requests and comply with legal obligations;
• • establish, exercise, or defend legal claims.

5. Legal bases

Depending on the visitor’s location and applicable law, processing is based on one or more of the following:

• • the visitor’s consent;
• • steps taken at the visitor’s request in connection with a potential future purchase;
• • compliance with legal obligations;
• • the Controller’s lawful or legitimate interests in operating and securing the Website, preventing abuse, and protecting legal rights, provided those interests do not override the visitor’s rights;
• • other grounds permitted by applicable law.

For visitors in the European Economic Area, the United Kingdom, or Switzerland, waiting-list contact data is primarily processed on the basis of consent. Analytics requiring consent is not activated until valid consent has been obtained. Consent to personal data processing and consent to receive availability notifications are obtained through separate affirmative actions.

6. Processing operations

The Controller may collect, record, organise, structure, store, update, retrieve, use, restrict, provide access to authorised persons and processors, anonymise, block, delete, and destroy personal data. Processing may be automated or non-automated. The Controller does not make decisions producing legal or similarly significant effects solely by automated means.

7. Waiting list and availability notifications

A visitor may submit the form after providing either Telegram or a telephone number and accepting the separate personal-data consent. Notifications are sent only where the visitor has separately agreed to receive sales-launch and product-availability messages. Depending on the contact provided and technical availability, messages may be sent through Telegram, SMS, telephone communication, or an available messaging service associated with the telephone number. Without separate marketing consent, the contact is not used for general brand newsletters, discounts, promotions, or advertising unrelated to product availability or the start of sales. A visitor may opt out at any time.

8. Storage infrastructure and recipients

8.1. Waiting-list applications are stored in a PostgreSQL database hosted on Yandex Cloud infrastructure in the Russian Federation. Server-side processing also takes place in Russia.

8.2. Applications are accessible through a protected administration panel. Access is restricted to the Controller and authorised persons who need it for their duties.

8.3. Telegram receives only an anonymised technical alert that a new application has been created. The visitor’s Telegram username and telephone number are not included in that alert.

8.4. amoCRM is not used during the pre-launch stage.

8.5. Yandex Cloud Cloud infrastructure is provided by Yandex.Cloud LLC, Primary State Registration Number 1187746678580, 16 Leo Tolstoy Street, premises 528, Moscow 119021, Russian Federation.

8.6. Yandex Metrica Analytics is provided by YANDEX LLC, 16 Leo Tolstoy Street, Moscow 119021, Russian Federation. The Controller determines why the service is used, and Yandex processes Website visitor data within the scope of the service terms and the Controller’s instructions.

8.7. Technical contractors Developers and administrators may receive limited access where necessary to maintain the Website, subject to confidentiality, security, and appropriate contractual obligations.

9. Yandex Metrica and cookies

The Website uses Yandex Metrica, which may process Website activity, cookies, browser, device, operating-system, referral, and technical event information. The intended configuration is:

• • Limited Mode enabled;
• • basic analytics and automatic goals enabled;
• • Webvisor disabled;
• • e-commerce tracking disabled;
• • Advanced Matching disabled;
• • CRM data transfer disabled;
• • waiting-list contacts and form-field values not sent to Metrica.

Automatic goals must not include a Telegram username, telephone number, or any form value that directly identifies a visitor. Where applicable law requires prior consent, analytics cookies and similar technologies are blocked until the visitor makes a valid choice. For other visitors, analytics may start when the Website loads, provided that clear notice and effective controls are available. Rejecting analytics does not prevent use of the Website or the waiting-list form.

10. International transfers

The primary database is located in the Russian Federation. An international visitor who submits the form transfers the submitted data to Russia. Russia may not be recognised by the visitor’s jurisdiction as providing an equivalent or adequate level of data protection. Where explicit consent or another safeguard is required for such a transfer, the Controller relies on that mechanism only after providing the information required by applicable law. The Controller will not intentionally transfer waiting-list contact data from Russia to another country unless legal requirements, regulatory notifications, and appropriate transfer safeguards have been addressed.

11. Retention

Waiting-list contact data is retained until the purpose is fulfilled, but no longer than 12 months from the date of consent. After the notification that completes the purpose of a particular application, data is deleted or anonymised within 30 calendar days unless the visitor separately consents to further notifications or another legal basis requires limited retention. Data may be deleted earlier after withdrawal, opt-out, identification of an invalid contact, discontinuation of the waiting list, or fulfilment of the purpose. A limited record may be retained where strictly necessary to comply with law, demonstrate consent, resolve a dispute, or protect legal rights.

12. Rights

Subject to applicable law, a visitor may request:

• • information about processing and access to personal data;
• • correction of inaccurate data;
• • deletion or restriction of processing;
• • withdrawal of consent;
• • termination of availability notifications;
• • objection to processing based on legitimate interests;
• • a copy or portability of data provided by the visitor where legally applicable;
• • review by a competent supervisory authority or court.

Requests should be sent to goldenlegacybee@gmail.com and should identify the contact used in the form. The Controller may request the minimum additional information reasonably necessary to verify the requester. Withdrawal does not affect processing lawfully performed before withdrawal.

13. Security

• • role-based access and authentication;
• • HTTPS and protected transmission channels;
• • restricted database and backup access;
• • separation of secrets from source code;
• • security and administrative logging;
• • backups and recovery measures;
• • software updates and protection against automated attacks;
• • retention controls and scheduled deletion;
• • confidentiality obligations for authorised persons.

No method of transmission or storage is completely secure, but the Controller applies proportionate measures designed to reduce risk.

14. Children

The waiting-list form is not intended for independent submission by young children. If the Controller learns that a child’s data was submitted without appropriate involvement of a parent or legal guardian, it will be deleted unless another lawful basis applies.

15. Changes

This Policy may be updated when the Website, processing activities, providers, or laws change. The current version and effective date will be published on the Website. Where renewed consent is required, the affected processing will not begin until consent has been obtained.

16. Contact

Individual Entrepreneur Yaroslav Olegovich Kukin Email: goldenlegacybee@gmail.com Telephone: +7 920 247-48-27

Website: goldenlegacy.ru