PRIVACY POLICY OF THE MOBILE APPLICATION

This Privacy Policy (hereinafter referred to as the Policy) has been developed in compliance with the requirements of Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" (hereinafter – Federal Law 152-FZ) and defines the procedure for processing and the conditions for ensuring the security of the Users' personal data that the Application Administration receives in the course of personnel selection for the restaurant chain and consideration of franchise purchase requests.

The Policy is a publicly available document posted in the mobile application and on the Administration's official website at https://pivaldi.ru/, as well as in the PIVALDI mobile application.

The legislation of the Russian Federation, including 152-FZ, as well as subordinate regulatory acts, shall apply to relations related to the processing of personal data, including:

• Order of Roskomnadzor No. 18 of 24.02.2021 "On approval of requirements for the content of consent to the processing of personal data authorized by the subject of personal data for dissemination";
• Order of Roskomnadzor No. 140 of 19.06.2025 "On approval of requirements for methods of anonymization of personal data".

1.1. Personal data – any information relating directly or indirectly to a specific or identifiable individual (the subject of personal data).

1.2. Personal data operator (Administration) – Pivaldi Limited Liability Company, INN 5044111331, organizing and carrying out the processing of personal data.

1.3. User – any capable individual using the Application.

1.4. Processing of personal data – any action or set of actions performed with or without the use of automation means with personal data, including collection, recording, systematization, accumulation, storage, updating (renewal, modification), retrieval, use, transfer (dissemination, provision, access), anonymization, blocking, deletion, destruction of personal data.

1.5. Dissemination of personal data – actions aimed at disclosing personal data to an indefinite circle of persons.

1.6. Provision of personal data – actions aimed at disclosing personal data to a specific person or a specific group of persons.

The Administration collects only the data that is necessary for the proper functioning of the Application and the processing of the User's requests. The data is divided into two categories:

2.1. Personal data provided by the User voluntarily:

• For submitting a job application: First name, contact phone number, city of the restaurant of interest. Data retention period – no more than 6 months from the date of the decision to refuse employment. In case of refusal to hire or closing of a vacancy, the data is subject to destruction.
• For submitting a franchise application: Surname, First name, Patronymic (full name), contact phone number, email address (e-mail), city of the proposed restaurant opening. Data may be used for negotiations. The retention period corresponds to the statute of limitations.
• For technical sending of push notifications about the application status (in accordance with clause 3): Unique device token (ExpoPushToken). The data is stored until the consent to the processing of personal data is withdrawn or the function is disabled in the device settings.

2.2. Technical and anonymized data collected automatically:

• Device identifiers for notifications: Unique device token (ExpoPushToken). This identifier is collected automatically for integration with the notification delivery service.

2.3. The Administration processes the Users' personal data on the following grounds:

Consent to the processing of personal data, obtained from the User in accordance with Article 9 of Federal Law No. 152-FZ, is required in accordance with clause 1 of Article 6 of Federal Law No. 152-FZ – for consideration of a job application (on the initiative of the subject for concluding an employment contract), and in accordance with clause 5 of Article 6 of Federal Law No. 152-FZ – for the performance of a contract (with regard to the consideration of franchise requests).

2.4. Consent to the processing of personal data is given by the User by performing an active action – by independently checking (ticking) the appropriate box when filling out the form in the mobile application. Silence, inaction, or a pre-checked box (tick by default) do not constitute the User's consent to the processing of his/her personal data. 2.5. The User has the right to withdraw his/her consent to the processing of personal data at any time by sending a written request to the Administration.

3.1. The collection and processing of information are carried out strictly for the following purposes:

• Reviewing the User's candidacy for open vacancies in the restaurant chain and prompt communication with the applicant.
• Processing commercial inquiries regarding the purchase of a franchise, providing presentation materials and conducting business negotiations.
• Ensuring the technical ability to send important push notifications to the User (for example, about the status of the application review).

3.2. The Administration does not request or process special categories of personal data (race, nationality, political views, religious beliefs, health status, criminal record), nor biometric personal data.

4.1. Administration for commercial or marketing purposes.

The Administration guarantees that it does not disseminate personal data (does not transfer it to an unlimited circle of persons), the Users' personal data is not sold, leased, or transferred to third-party organizations and third parties for commercial or marketing purposes. Data transfer is limited to the Server infrastructure: data from completed forms (vacancies and franchise) is transmitted via a secure communication channel to the corporate e-mail of the administration / to the secure CRM system of the restaurant, exclusively for their subsequent processing by authorized employees.

• In cases provided for by the legislation of the Russian Federation (upon request of a court, law enforcement agencies, etc.).

5.1. The User has all the rights to control his/her personal data in accordance with applicable law:

• The User has the right to withdraw his/her consent to the processing of personal data at any time and demand its complete deletion from the Administration's databases. To do this, send a request to the email address: pivaldi@mail.ru. A response to the request is sent within 30 days (subject to justification) from the date of receipt of the request.
• The User may at any time independently withdraw permission to collect the technical token and receive push notifications by disabling this function in the system settings of his/her mobile device.

5.2. Destruction of personal data is carried out:

• Upon expiration of the storage periods specified in clause 2.1 of this Policy;
• Upon withdrawal of consent by the subject of personal data;
• Upon request of the subject of personal data (in case of refusal to hire);
• In other cases provided for by law.

5.3. Destruction is carried out by erasing information from electronic media using specialized software that prevents recovery, or by physical destruction of the media.

5.4. The fact of destruction is recorded in an act on the destruction of personal data, which is kept by the Administration for the period established by internal regulations.

The Administration takes the necessary technical, legal, and organizational measures to protect the User's personal data from accidental or unauthorized access, destruction, alteration, or blocking.

• All data transfer from the Application forms is carried out using modern encryption protocols (HTTPS).
• Data of applicants and potential partners is stored for the period necessary to achieve the purposes of processing (until refusal to hire or closing of the vacancy, but not more than 6 months, or completion of franchise negotiations), unless a different period is provided by law.
• The Administration appoints a person responsible for organizing the processing of personal data, approves the list of persons having access to personal data, and carries out internal control of compliance of the processing of personal data with the requirements of Federal Law 152-FZ.
• Separate storage of personal data and their material media is ensured.
• The Administration applies methods of anonymization of personal data in accordance with the requirements of Roskomnadzor.
• When storing personal data, the Administration (personal data operator) uses databases located on the territory of the Russian Federation, in accordance with Part 5 of Article 18 of the Federal Law "On Personal Data".

The Administration reserves the right to make changes to this Policy. When changes are made, the date of the last update is updated in the document. The User is advised to periodically review the text of the Policy to update the information.

For all questions related to the processing of personal data or the operation of the Application, the User may contact the following contacts:

9.1. This Policy is an internal document of the Administration and is mandatory for all employees who have access to the Users' personal data.

9.2. If any provision of the Policy is held invalid, this does not affect the validity of the remaining provisions.

9.3. All disputes related to the processing of personal data shall be resolved in accordance with the procedure established by the legislation of the Russian Federation.