CONSENT TO THE PROCESSING OF PERSONAL DATA

1. Giving Consent

1.1. By checking the box “I consent to the processing of my personal data” during registration with TLOA, the User freely, voluntarily and in their own interest gives Individual Entrepreneur Oksana Vladimirovna Vezhina, OGRNIP 324470400023858, INN 470516487295 (the “Operator”), consent to process personal data under the terms of this document.

1.2. This Consent is provided separately from acceptance of the User Agreement.

1.3. Before giving this Consent, the User is provided with an opportunity to review:

• this Consent;

• the Privacy Policy: https://tloa.app/privacy;

• the User Agreement: https://tloa.app/terms.

1.4. TLOA is intended for Users aged 18 or over.

2. Personal Data Covered by This Consent

2.1. Registration and account data:

• name;

• email address;

• account identifier;

• information necessary for authentication, including a securely stored password hash;

• information concerning the consents given by the User and their respective versions.

2.2. Data created by the User when using TLOA:

• intentions;

• beliefs and other user-generated texts;

• test responses;

• test results;

• exercise results;

• information about programme completion and progress;

• checklists;

• user settings;

• data created through the virtual tools provided as part of TLOA functionality;

• voice recordings created by the User through the relevant functionality.

2.3. Technical data necessary for the operation and security of the Service:

• IP address;

• date and time of use of the Service;

• browser and operating system information;

• session data;

• technical cookies;

• technical event and error logs;

• information necessary to ensure account security;

• push notification settings.

2.4. Data relating to payments and subscriptions that the Operator may receive from the Prodamus payment service:

• payment status;

• transaction identifier;

• payment date and amount;

• selected plan;

• subscription status.

The Operator does not receive or store the User’s full payment card details.

2.5. When the User contacts support, the Operator may also process information contained in the relevant enquiry and correspondence.

3. Purposes of Personal Data Processing

Personal data is processed for the following purposes:

3.1. Creating and maintaining the User’s account.

3.2. Authenticating the User and providing access to TLOA.

3.3. Providing TLOA functionality, including storing and displaying intentions, beliefs, test and exercise results, progress, checklists, user settings and audio recordings.

3.4. Performing the User Agreement and providing free and paid functionality.

3.5. Recording payments and subscription status.

3.6. Sending necessary service communications relating to:

• registration;

• account recovery and security;

• subscription and payment;

• changes to legal documents;

• upcoming deletion of an inactive account;

• other significant events associated with the use of TLOA.

3.7. Operating push notifications provided as part of TLOA functionality.

3.8. Processing User enquiries and providing technical support.

3.9. Ensuring information security, preventing unauthorised access and investigating technical incidents.

3.10. Complying with the Operator’s obligations under the legislation of the Russian Federation.

3.11. Confirming that the User has given consent and performed other legally significant actions.

4. Personal Data Processing Operations

4.1. With respect to the personal data specified above, the Operator may perform the following operations:

• collection;

• recording;

• systematisation;

• accumulation;

• storage;

• clarification, updating and modification;

• retrieval;

• use;

• disclosure to persons engaged by the Operator to process data to the extent necessary for the operation of TLOA;

• blocking;

• deletion;

• destruction.

4.2. Processing is carried out primarily by automated means using information systems and, where necessary, with the involvement of authorised personnel of the Operator.

4.3. Personal data is not disclosed to an indefinite number of persons and is not made publicly available on the basis of this Consent.

4.4. This Consent does not constitute consent to the dissemination of personal data.

4.5. This Consent also does not constitute consent to receive advertising or marketing communications.

5. Data Storage and Engagement of Third Parties

5.1. The primary TLOA V1 infrastructure used to store personal data, including the main database, user files, audio recordings and backups, is located within the Russian Federation.

When collecting personal data of Russian citizens, the law generally prohibits the use of databases located outside the Russian Federation for the recording, systematisation, accumulation, storage, modification and retrieval of such data.

5.2. The Operator may engage third parties to process personal data to the extent necessary for the operation of the Services, including:

• providers of server and technical infrastructure;

• services used to deliver service emails;

• push notification services;

• the Prodamus payment service in relation to payments and subscriptions;

• other technical contractors where their involvement is necessary to provide TLOA functionality.

5.3. Such persons may process only the data and only to the extent necessary to perform the relevant function or the Operator’s instructions.

5.4. The Operator does not sell the User’s personal data to third parties.

6. Special Categories of Personal Data and Voice Recordings

6.1. TLOA V1 is not intended to intentionally collect information concerning:

• race or ethnicity;

• political views;

• religious or philosophical beliefs;

• health;

• intimate life.

6.2. The User should not enter such information into TLOA’s free-text fields unless the relevant function is specifically designed to process such information.

6.3. If TLOA later introduces a function involving the intentional processing of a category of data for which the law requires separate consent, such consent will be requested immediately before the User uses the relevant function and in the form required by law.

6.4. The User’s voice recordings are not used to establish or verify the User’s identity.

Accordingly, TLOA does not use voice recordings for biometric identification or authentication.

7. Duration of Consent and Data Retention

7.1. This Consent remains valid from the moment it is given by the User until the first of the following occurs:

• the User withdraws the Consent;

• the User’s account is deleted;

• processing is discontinued because the relevant processing purpose has been achieved;

• another ground for termination of processing arises under applicable law.

7.2. Certain information may continue to be processed after this Consent ceases to apply where the Operator has another lawful basis for doing so, including compliance with legal requirements, accounting or tax obligations, or the protection of lawful rights and interests.

7.3. If the User does not log in to TLOA for 12 consecutive months, a warning is sent to the registered email address 30 calendar days before the scheduled deletion of the account.

If the User does not return to TLOA, once 12 consecutive months of inactivity have elapsed, the account and associated user data are deleted, except for information that must continue to be retained on another lawful basis.

7.4. After information is deleted from the primary system, the corresponding data in backups is deleted or overwritten as part of the established technical backup rotation cycle.

8. Withdrawal of Consent and Deletion of Data

8.1. The User may withdraw this Consent at any time.

8.2. Consent may be withdrawn:

• through the relevant consent withdrawal function provided in TLOA;

• by deleting the User’s account;

• by sending a request to info@tloa.app.

8.3. Withdrawal of Consent may make it impossible to continue providing TLOA functions that require the processing of the relevant personal data.

8.4. Upon receipt of a withdrawal, the Operator ceases processing based solely on this Consent where there is no other lawful basis for continuing the processing.

8.5. Where continued retention of the data is not required, the data is destroyed within the time limits established by the legislation of the Russian Federation.

Under the applicable provisions of Federal Law No. 152-FZ, where consent is withdrawn and the data is no longer required for processing purposes and there is no other lawful basis for retaining it, such data must be destroyed within the period prescribed by law.

9. User Rights

The User has the right to:

9.1. Obtain information about the processing of their personal data.

9.2. Use the “Download all data” function to obtain data associated with their account.

9.3. Update the editable information in their profile.

9.4. Request clarification, blocking or destruction of personal data in cases provided for by the legislation of the Russian Federation.

9.5. Use the “Delete account” function.

9.6. Withdraw applicable consents.

9.7. Contact the Operator regarding personal data processing at:

info@tloa.app

10. Recording and Evidence of Consent

10.1. The Operator must be able to demonstrate that this Consent has been obtained.

10.2. When Consent is given, the following information may be recorded:

• User identifier;

• date and time;

• IP address;

• type of consent given;

• version of this document;

• other technical information necessary to demonstrate that Consent was given.

10.3. By checking the box “I consent to the processing of my personal data” and completing registration, the User confirms that this Consent has been given.

11. Final Provisions

11.1. This Consent applies together with the TLOA Privacy Policy.

11.2. Personal data processing matters not expressly governed by this Consent are governed by the Privacy Policy and the legislation of the Russian Federation.

11.3. If the purposes of processing, categories of data or other circumstances change in a manner that requires new consent from the User under applicable law, the Operator obtains such new consent before commencing the relevant processing.

11.4. The current version of this Consent is available at:

https://tloa.app/personal-data-consent

12. Operator Details

Individual Entrepreneur Oksana Vladimirovna Vezhina

Primary State Registration Number of the Individual Entrepreneur (OGRNIP): 324470400023858
Taxpayer Identification Number (INN): 470516487295
Registered address: Apt. 53, 1 Shvedsky Proezd, Gatchina, Gatchinsky District, Leningrad Region, 188300, Russian Federation

Website: https://tloa.app
Application: https://web.tloa.app
Email: info@tloa.app