1. General Provisions

This Personal Data Processing Policy (hereinafter — the Policy) is developed in accordance with Federal Law No. 152-FZ of July 27, 2006 "On Personal Data" and applies to personal data that IP Vakorina N.N. (hereinafter — the Operator) receives from users through the website arom-soft.com and its subdomains (hereinafter — the Website).

2. What is Personal Data

Personal data is any information relating directly or indirectly to a defined or identifiable natural person (subject of personal data).

3. Personal Data Operator

- Name: IP Vakorina N.N.

- TIN: 860223700140

- OGRNIP: 318723200070592

- Legal address: Tyumen region, urban okrug, Tyumen city, Tyumen

- Contact email: requests@arom-soft.com

4. Personal Data Collected

The Operator collects the following personal data from users who provide their data in feedback forms on the Website:

- Feedback Form #1: Email address

- Feedback Form #2: Surname, name; email address; phone number; company name

- Registration form (ai.arom-soft.com): Login, password

- Yandex.Metrika: IP address, cookie data, visited page information, visit time, referral source, device type and browser

5. Purposes of Personal Data Processing

- Responding to inquiries submitted through feedback forms or registration;

- Contacting the user via provided contact details;

- Providing access to restricted Website sections (ai.arom-soft.com);

- Collecting Website visit statistics via Yandex.Metrika;

- Improving Website functionality and service quality.

6. Legal Grounds for Personal Data Processing

- Consent of the subject of personal data expressed by checking the checkbox under the feedback form (subpara. 1 para. 1 sec. 1 Art. 6 of Federal Law No. 152-FZ "On Personal Data");

- The subject of personal data's initiative to obtain a response to their query (subpara. 5 para. 1 Art. 6 of Federal Law No. 152-FZ "On Personal Data");

- Use of cookies and statistics collection — with the user's consent expressed via cookie-banner upon first visit to the Website;

- Processing of data for the performance of a service provision agreement (subpara. 5 para. 1 Art. 6 of Federal Law No. 152-FZ "On Personal Data");

- Other purposes expressly stated in this Policy.

7. List of Actions with Personal Data

The Operator performs the following actions with personal data:

- Collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transfer (provision, access) to persons involved in processing, anonymization, blocking, deletion, destruction of personal data.

8. Principles of Personal Data Processing

- Processing is carried out on a lawful and fair basis;

- Processing is limited to achieving specific, pre-determined and lawful purposes;

- The content and volume of processed personal data correspond to the stated purposes of processing;

- In processing personal data, accuracy of personal data, their sufficiency and, where necessary, availability to other persons is ensured.

9. Storage of Personal Data

- Storage of personal data is carried out in a format that allows identification of the subject of personal data, no longer than this is required for the purposes of processing personal data.

- Personal data is stored in a secure format that does not allow identification of the contained personal data, longer than this is required for the purposes of processing personal data.

10. Retention Period of Personal Data

- The retention period of personal data is determined by the achievement of the purposes of processing personal data, unless otherwise provided by the legislation of the Russian Federation or by a contract of which the subject of personal data is a party, an beneficiary or a guarantor.

11. Destruction of Personal Data

- Upon achieving the purposes of processing or upon cessation of processing personal data, personal data shall be destroyed or anonymized.

- Expiration of the consent period for processing personal data shall result in cessation of processing personal data (except in cases where personal data is processed without the consent of the subject of personal data on the basis of Russian Federation legislation).

12. Organization of Personal Data Processing

- The Operator takes all necessary organizational and technical measures to protect personal data from unauthorized or accidental access to them, destruction, alteration, blocking, copying, distribution.

13. Transfer of Personal Data to Third Parties

- The Operator does not transfer personal data to third parties, except in cases provided for by the legislation of the Russian Federation.

14. Rights of Subjects of Personal Data

- The subject of personal data has the right to obtain information containing:

- confirmation of the fact of processing personal data by the Operator;

- information on the purposes of processing personal data used by the Operator;

- information on the lawful grounds and conditions for processing personal data;

- information on entities that carry out processing of personal data;

- information on personal data that are subject to processing;

- the right to obtain from the Operator information concerning the processing of their personal data;

- The subject of personal data may demand from the Operator to clarify personal data, block or destroy them if they are incomplete, outdated, inaccurate, illegally obtained or are not necessary for the stated purpose of processing.

15. General Provisions

- This Policy applies to all information that IP Vakorina N.N. may obtain about visitors to the website arom-soft.com.

- This Policy applies to all personal data that the Operator receives from subjects of personal data.

- This Policy shall remain in effect indefinitely.

- Policy update dates: October 1, 2026. The right to amend this Policy belongs to the Operator (except in cases provided for by current Russian Federation legislation). The current version is published on the website at: arom-soft.com/privacy. The user shall monitor changes. Use of the website after publication of changes signifies consent with the new conditions.