Version dated 09 June 2026

This Privacy Policy (the “Policy”) sets out the procedure and conditions for personal data processing by Dmitry Alekseevich Khramov, a self-employed individual (Professional Income Tax payer), Taxpayer Identification Number (INN) 524926369896, acting as a personal data operator/controller (the “Operator”, “Content Provider”).

This Policy applies to all information the Operator may obtain about personal data subjects when they use the website, feedback forms, the Personal Account, the Platform used to provide access to the Content, and when entering into and performing agreements with Content Users.

This Policy is developed in accordance with the laws of the Russian Federation on personal data and is publicly available at: https://alexandrakhramova.com/en/privacy-policy

1. GENERAL PROVISIONS

1.1. This Policy is an official document of the Operator and defines general principles, purposes, legal bases, procedures and conditions for personal data processing, as well as information on the security measures implemented.

1.2. This Policy covers personal data obtained by the Operator from data subjects via the Operator’s website, web forms, the Personal Account, the Platform, electronic communications, and in the course of entering into and performing agreements related to access to the Content and/or the provision of services by the Content Provider.

1.3. By using the website, submitting data via web forms, registering, placing an order, accepting the offer, checking a box to agree with this Policy, and/or otherwise providing personal data, the data subject confirms that they have read this Policy.

1.4. If the data subject does not agree with this Policy, they should refrain from using the website, from providing personal data to the Operator, and from entering into agreements with the Operator in ways that entail personal data processing.

1.5. This Policy applies together with other documents of the Operator, including the Public Offer, the Consent to Personal Data Processing, the Consent to Receive Marketing Communications, and documents governing the use of cookies if published separately.

2. KEY TERMS

2.1. Personal Data Processing means any action or set of actions performed on personal data with or without automation tools, including collection, recording, systematization, accumulation, storage, adjustment, retrieval, use, transfer, provision, access, anonymization, blocking, deletion and destruction.

2.2. Operator (Controller) means Dmitry Alekseevich Khramov, who independently organizes and carries out personal data processing, and determines the purposes of processing, the scope of personal data and the actions performed with personal data.

2.3. Personal Data means any information relating directly or indirectly to an identified or identifiable individual.

2.4. Platform means software and/or a digital platform used by the Operator to provide the Content User with access to the Content, the Personal Account, materials, messages, classes and other functions. If the Operator uses the GetCourse platform, the Platform also means the “GetCourse 2.0” software available at https://getcourse.ru.

2.5. Content User means a data subject who uses the Operator’s website, places an order, enters into an agreement with the Operator, obtains access to the Content and/or receives services from the Content Provider.

2.6. Content Provider means the Operator providing Content Users with access to the Content and/or rendering services described on the Operator’s website and/or delivered via platform solutions.

2.7. Website means the collection of web pages of the Operator available at: https://alexandrakhramova.com.

2.8. Data Subject means an individual to whom the personal data processed by the Operator relates.

2.9. Cookies are small data fragments stored on the user’s device when visiting the website, enabling preferences to be saved, usage to be analyzed and the website to function properly.

3. LEGAL BASES FOR PROCESSING

3.1. The Operator processes personal data lawfully and fairly under Russian law, including Federal Law No. 152-FZ “On Personal Data,” other applicable regulations, and this Policy, the Public Offer and other Operator documents.

3.2. Processing is carried out where at least one legal basis applies:

·         the data subject’s consent;

·         necessity to enter into, perform, amend or terminate an agreement with the data subject;

·         necessity to comply with the Operator’s legal obligations under Russian law;

·         necessity to pursue the Operator’s or third parties’ legitimate interests provided the data subject’s rights and freedoms are not infringed;

·         other cases provided by Russian law.

3.3. Where required, the Operator obtains separate consents (e.g., for marketing communications and cross-border transfers).

4. CATEGORIES OF DATA SUBJECTS AND PERSONAL DATA PROCESSED

4.1. Categories of data subjects include Content Users; website visitors submitting inquiries; persons requesting information about the Content and/or services; and other individuals whose data are received by the Operator in connection with the Content Provider’s activities on lawful grounds.

4.2. Personal data processed may include:

·         full name;

·         email address;

·         phone number;

·         account data and identifiers;

·         payment information to the extent necessary for processing payments, accounting received funds and performing contractual obligations;

·         technical data: IP address, cookies, browser and device information, operating system, access time, referrer URL and similar data;

·         correspondence, applications and inquiries submitted via the website, Platform or Personal Account.

4.3. The Operator does not request or process special categories of personal data or biometric data unless required by law and/or supported by a separate lawful ground.

4.4. The data subject provides accurate, up-to-date and sufficient personal data and updates them upon changes.

5. PURPOSES OF PROCESSING

5.1. Personal data are processed for:

·         identification and registration; granting access to restricted sections, materials, lessons, live sessions, tasks and other Content;

·         entering into, performing, amending and terminating agreements, including ordering, payment, access to the Content, service delivery, support and handling of contract-related inquiries;

·         sending service, informational and organizational messages regarding orders, access, schedules, changes in service terms, order status, technical support, account security and related communications;

·         handling inquiries, requests, applications, claims and other messages received from data subjects;

·         providing feedback, consultations, demo materials and information on the Content, rates, services and cooperation terms upon request;

·         improving the website, Platform, Personal Account and user experience; conducting statistics and analytics; ensuring proper operation of interfaces; remembering user settings; ensuring security and protection against abuse;

·         marketing and promotional communications about the Operator, its Content, services, special offers and events - only with a separate consent where required by law;

·         complying with legal obligations, including tax, accounting, civil-law and other mandatory record-keeping, and interacting with state authorities as required by law.

5.2. Processing is limited to what is necessary to achieve stated purposes and is not excessive.

6. COLLECTION, PROCESSING AND STORAGE

6.1. Personal data are obtained directly from the data subject or their legal representative, including via web forms on the website, registration on the website or Platform, placing orders, submitting inquiries, participating in surveys, using the Personal Account, and by other means that clearly imply the provision of data to the Operator.

6.2. When collecting data via web forms, the Operator ensures that the data subject can review this Policy and, where applicable, the Public Offer, the Consent to Personal Data Processing, the consent to marketing communications and other documents to be accepted or acknowledged.

6.3. Consent to personal data processing is provided as a separate document communicated before data submission.

6.4. When obtained via the website and/or the Platform, consent is expressed by the data subject checking a designated box next to the respective consent text and then submitting the form.

6.5. The fact of checking the box and submitting the form is recorded by technical means used by the Operator and/or the Platform and may be used as evidence of consent within the scope stated in the consent text.

6.6. Processing is carried out with and without automation tools, and in mixed modes.

6.7. Personal data are stored in a form that allows identifying the data subject no longer than required by the purposes of processing, unless longer storage is mandated by Russian law, an agreement or another lawful ground.

6.8. Upon achieving the purposes of processing, losing the need to achieve them, expiry of retention, withdrawal of consent, or upon another proper request, personal data are destroyed, anonymized, or further stored only where another lawful ground exists.

6.9. Where processing is necessary to perform an agreement with a Content User, withdrawal of consent may not automatically terminate all processing if other lawful grounds still apply, including contract performance and legal obligations.

7. COMMISSIONED PROCESSING, DISCLOSURE TO THIRD PARTIES, PLATFORM, COOKIES AND CROSS-BORDER TRANSFER

7.1. The Operator may instruct third parties to process personal data under a contract or other proper legal ground where necessary to achieve processing purposes, perform agreements with Content Users, operate the website, Platform and Personal Account, handle inquiries, accept payments, send messages, store data, provide technical support, perform analytics, ensure information security and related functions.

7.2. Processors must comply with processing principles and rules, ensure confidentiality, and implement required security measures under Russian law and the assignment terms.

7.3. The Operator may use third-party platform and technical solutions to host Content, provide Personal Account access, communicate with Content Users and automate processes.

7.4. When using the GetCourse Platform, the Operator may instruct LLC “Sistema Getkurs” to process personal data of Content Users to the extent necessary for the Platform’s operation, storage and display of data in the Personal Account, provision of access to the Content, technical interaction with the Content User, order processing, payment infrastructure, communications and related functions, as required to perform agreements and operate the chosen infrastructure.

7.5. When processing is commissioned to third parties, including LLC “Sistema Getkurs,” the Operator remains responsible to the data subject within the limits provided by law, unless otherwise prescribed by law.

7.6. Personal data may be disclosed to third parties where: the data subject has consented; disclosure is necessary to perform the agreement with the data subject; disclosure is necessary to use the website, Platform or selected services; or disclosure is required by law.

7.7. Cookies and similar technologies are used for proper operation of the website, saving preferences, analytics, improving user experience and, with consent where required, for personalized information and advertising.

7.8. Technical information may be transmitted to the Operator and/or services it uses for analytics and to ensure operation of the website, including IP address, browser/device details, access time, page URLs, referrer, on-site actions and related data.

7.9. The Operator may use measurement and analytics services in compliance with Russian law. The list of services and cookie controls may be provided in the cookie banner, a separate cookie policy and/or website interfaces.

7.10. The user may limit cookies through browser or device settings, but this may affect the availability of certain website functions.

7.11. The Operator may transfer personal data across borders only in compliance with Russian law, including Federal Law No. 152-FZ “On Personal Data,” and subject to the rules established for cross-border transfers.

7.12. Before making a cross-border transfer of personal data, the Operator assesses the conditions of processing in the recipient state, sends the notices required by law to the competent authority where necessary, and ensures that the recipient takes sufficient measures to protect the personal data.

7.13. Cross-border transfer may occur, in particular, when using foreign hosting, analytics, message delivery, cloud storage and other technical solutions used by the Operator to operate the website and provide services.

8. DATA SUBJECT RIGHTS

8.1. The data subject has the right to obtain information regarding the processing of personal data to the extent and in the manner established by Russian law.

8.2. The data subject may request rectification, blocking or deletion of personal data if such data are incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose; may take legally provided measures to protect their rights; and may lodge complaints with the competent authority or in court.

8.3. The data subject may withdraw consent to personal data processing in the manner provided by Russian law and this Policy.

8.4. The data subject may object to processing of personal data for the purpose of promoting goods, works and services if such processing is based on consent, and may opt out of marketing messages at any time by using the method specified in the relevant message or by contacting the Operator.

8.5. The data subject may challenge the acts or omissions of the Operator before the competent personal data authority or in court if they believe the Operator processes personal data in violation of Russian law.

8.6. The data subject enjoys other rights provided by Russian law on personal data.

9. SECURITY MEASURES

9.1. When processing personal data, the Operator takes necessary and sufficient legal, organizational and technical measures, or ensures their adoption, to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful acts.

9.2. Such measures may include:

·         limiting access to personal data to persons who need such access to perform their duties;

·         applying local rules and procedures for personal data processing and protection;

·         using antivirus software, access control tools, backups and other technical safeguards;

·         recording requests, inquiries and incidents related to personal data processing;

·         controlling access to information systems and services used for personal data processing;

·         other measures appropriate to the nature of the processed data and risks to data subjects’ rights and freedoms.

9.3. When processing is commissioned to third parties, the Operator takes reasonable steps to select contractors that comply with Russian personal data requirements.

10. RETENTION PERIODS

10.1. The Operator processes and stores personal data no longer than required for the purposes of processing, unless a different period is established by Russian law, a contract with the data subject, or another lawful basis.

10.2. The retention period may be determined, in particular, by:

·         the term of the agreement with the Content User;

·         the period necessary to provide access to the Content and/or services;

·         the term of consent, if processing is based on consent;

·         statutory retention periods for documents and records;

·         the period necessary to protect the Operator’s rights and legitimate interests in disputes, claims or audits.

10.3. In the absence of grounds for longer retention, personal data are processed and stored for no more than 10 (ten) years from the last interaction with the data subject, including the last login, order placement, inquiry or other recorded action, after which they are destroyed or anonymized if no other lawful ground for further processing exists.

10.4. When the purposes of processing are achieved, the Operator ceases processing and destroys the data or ensures their destruction within no more than 30 days unless otherwise provided by law or another lawful basis.

10.5. Upon withdrawal of consent, the Operator ceases the respective processing and destroys or anonymizes the data within no more than 30 days unless otherwise provided by law or if another lawful ground for continued processing exists.

10.6. Documents and records containing personal data may be retained beyond the general processing term where required by law, including accounting, tax, civil-law or other mandatory record-keeping.

11. REQUESTS AND AMENDMENTS TO THIS POLICY

11.1. The data subject may send the Operator a request for information, rectification, withdrawal of consent, cessation of processing or other request using the contacts in this Section.

11.2. A request must allow the Operator to identify the applicant and the subject matter. The Operator may request additional information to verify identity and properly handle the request if needed to protect the data subject’s rights and prevent unlawful disclosure to third parties.

11.3. The Operator responds within the periods established by Russian law.

11.4. The Operator may amend this Policy at any time. The new version becomes effective upon posting on the website unless otherwise stated therein.

11.5. The current version of the Policy is permanently available at: https://alexandrakhramova.com/pd-policy.

12.OPERATOR’S CONTACT DETAILS

Name: Dmitry Alekseevich Khramov, self-employed individual (Professional Income Tax payer)

Taxpayer Identification Number (INN): 524926369896

Website: https://alexandrakhramova.com

Address: 48A Chkalova Avenue, Dzerzhinsk, Nizhny Novgorod Region, Russia

Phone: +7 930 692-48-90

E-mail: dima.xramoff2020@gmail.com