Personal Data Processing Policy

Revision No. 1 · Published: 27 August 2026 · Prequel-Russia LLC

1. General provisions

1.1. This Personal Data Processing Policy (the “Policy”) sets out the procedure for processing personal data and the measures taken to protect it by Prequel-Russia Limited Liability Company (Общество с ограниченной ответственностью «ПРИКВЕЛ-РАША»; the “Operator”) in respect of users of the website and the Mivio mobile application (together, the “Application”).

1.2. Operator details: Prequel-Russia LLC, INN 7704395492, address: Bldg. 1, 1 2nd Karacharovskaya St., Moscow, 109202, Russia.

1.3. The Policy is drawn up in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (“Law No. 152-FZ”) and other regulatory acts of the Russian Federation in the field of personal data.

1.4. The Policy applies to all personal data processing carried out by the Operator in connection with the use of the Application. Terms are used in the meanings defined by Law No. 152-FZ.

2. Purposes of processing

2.1. The Operator processes personal data for the following purposes:

1. providing access to the Application’s functionality, including image generation using artificial intelligence algorithms;
2. concluding and performing the user agreement;
3. user support, handling enquiries and requests;
4. compliance with the legislation of the Russian Federation.

3. Legal grounds for processing

3.1. The legal grounds for processing personal data are:

• the data subject’s consent to the processing of their personal data (Article 6(1)(1) of Law No. 152-FZ);
• a contract to which the data subject is a party — the user agreement concluded by accepting the public offer (Article 6(1)(5) of Law No. 152-FZ);
• the need to fulfil obligations imposed on the Operator by the legislation of the Russian Federation (Article 6(1)(2) of Law No. 152-FZ).

4. Categories of data subjects

4.1. The Operator processes personal data of users (customers) of the Application — individuals located in the territory of the Russian Federation.

5. Categories of personal data processed

5.1. The Operator processes the following categories of personal data:

• email address;
• photo and video images of the face uploaded by the user.

5.2. The Operator does not process special categories of personal data.

6. Specifics of processing photo and video images

7. Processing operations and methods

7.1. The Operator performs the following operations with personal data: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction.

7.2. Processing is carried out by automated means, with the information transmitted over the Internet.

7.3. The Operator does not disseminate personal data.

8. Database localisation

8.1. Recording, systematisation, accumulation, storage, clarification (updating, modification) and retrieval of personal data of citizens of the Russian Federation are carried out using databases located in the territory of the Russian Federation.

9. Entrusting processing to third parties

9.1. The Operator may entrust the processing of personal data to third parties under Article 6(3) of Law No. 152-FZ. Processing is carried out under contracts containing a processing instruction; each party receives only the minimum amount of data necessary for the respective purpose:

9.2. The Operator does not receive or store full bank card details; payment data is processed by the payment provider.

10. Cross-border transfer of personal data

10.1. The Operator does not carry out cross-border transfers of personal data.

11. Processing and retention periods. Destruction procedure

11.1. The user’s source photos are deleted within 24 hours after image generation is completed, unless the user has explicitly chosen to keep them.

11.2. Account data (email address) is processed until the user deletes the account, withdraws consent to processing, or the purposes of processing are achieved — whichever occurs first.

11.3. Upon the occurrence of the grounds set out in clauses 11.1–11.2, personal data is destroyed by means that preclude its further recovery. The fact of destruction is recorded in the manner established by the Operator’s internal regulations.

12. Rights of the data subject

12.1. The data subject has the right (Articles 14, 20 and 21 of Law No. 152-FZ):

• to obtain information about the processing of their personal data;
• to demand clarification, blocking or destruction of personal data if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing;
• to withdraw consent to the processing of personal data.

12.2. To exercise these rights, the data subject sends a request to info@prequel.team. Requests are answered within 10 business days of receipt.

12.3. The user may delete their account from the Application interface; deleting the account terminates the processing of personal data, except where continued processing is required by the legislation of the Russian Federation.

13. Personal data security measures

13.1. The Operator takes the measures provided for in Articles 18.1 and 19 of Law No. 152-FZ:

• a person responsible for organising personal data processing has been appointed;
• internal regulations on the processing and protection of personal data have been issued;
• internal control of compliance of processing with legal requirements is carried out;
• an assessment of the harm that may be caused to data subjects has been performed;
• the level of personal data protection has been determined in accordance with Decree of the Government of the Russian Federation No. 1119 of 1 November 2012;
• organisational and technical measures have been implemented in accordance with Order No. 21 of the FSTEC of Russia of 18 February 2013: access control, identification and authentication, security event logging, anti-virus protection, firewalling, backups.

14. Person responsible for organising personal data processing

14.1. The person responsible for organising personal data processing is the General Director, Grigory Terentyev, contact: info@prequel.team.

15. Final provisions

15.1. The Operator may amend this Policy. The new revision is published on this page and takes effect from the date of publication unless the new revision provides otherwise.

15.2. Current revision: No. 1 of 27 August 2026.