Personal Data Privacy Policy

Annex No. 2 to Order No. 5 dated October 1, 2025

In this document, ONI STUDIO LLC (also referred to as "we", "us", "our") describes the procedure for processing personal data of visitors to https://ony.ru/ and its subdomains.

If you have questions about the processing of personal data, you may write to us at: 7 Novokhoroshevsky proezd, room 6p, Khoroshevo-Mnevniki District, Moscow, 123308, Russia, or to our official email: hello@ony.ru.

We attach great importance to protecting your privacy and the security of your personal data. Please read this Personal Data Processing Policy (hereinafter — the Policy) carefully to understand the purposes for which we process your personal data and how you can exercise your rights regarding personal data.

Personal data — any information that directly or indirectly relates to you or makes it possible to identify you.

Personal data operator — a legal entity or individual that processes personal data. When you visit our website, we become the operator of your personal data.

Processing of personal data — performing any actions with personal data.

In accordance with the Federal Law "On Personal Data", you have the right to:

• access your personal data;
• have your personal data clarified;
• have your personal data blocked or deleted;
• appeal our actions or inaction;
• appeal decisions made solely on the basis of automated processing of your personal data;
• withdraw your consent to the processing of personal data.

• You may submit an official request to our address (119072, Moscow, Bersenevskaya Embankment, 6 bld. 3, "Krasny Oktyabr" art-cluster), specifying details of the document confirming your identity or the identity of your representative (type of document, series and number, by whom and when issued), your full name or your representative's full name, information about the nature of your relationship with us that confirms the fact of processing of your personal data, your signature or the signature of your representative. Such a request may also be sent to our email in the form of an electronic document signed in accordance with the provisions of the legislation of the Russian Federation on electronic signatures;
• you may also use our email address for inquiries: hello@ony.ru.

You may appeal our actions as a personal data operator to the regional branch of Roskomnadzor in your region.

In this section we describe the purposes and terms of personal data processing and explain to whom we transfer your personal data.

Within the listed purposes we will collect, record, systematize, accumulate, store, clarify (update, change), extract, use, transfer (provide, grant access to), block, delete and destroy your personal data.

Marketing email newsletters

To subscribe to the newsletter, we will ask you to provide:

• your email address.

The personal data processed for this purpose does not relate to special or biometric categories under Articles 10–11 of Federal Law No. 152-FZ and is processed by automated means.

The legal basis for processing this personal data is your Consent to the processing of personal data in accordance with clause 1, part 1, article 6 of Federal Law No. 152-FZ, placed under the data collection form via a hyperlink.

Data received in connection with the subscription is processed until the end of the marketing campaign, your request to be excluded from the mailing list, or until you withdraw your Consent (whichever comes first), and is destroyed within 30 days in accordance with parts 4–5 of article 21 of Federal Law No. 152-FZ.

Upon expiry of the above terms, personal data is destroyed by deletion from the information systems using built-in tools.

Feedback collection

If you wish to contact us regarding our activities, you may do so by filling in the feedback forms "Submit a request", "Discuss a project", "Contact us", "Fill in a brief", or via the contacts published on the website. When processing such a request, the following information about you becomes available to us:

• name;
• contact phone number;
• email address;
• company information;
• information contained in the request.

The personal data processed for this purpose does not relate to special or biometric categories under Articles 10–11 of Federal Law No. 152-FZ and is processed by automated means.

The legal basis for processing is your Consent to the processing of personal data under clause 1, part 1, article 6 of Federal Law No. 152-FZ, placed under the data collection form via a hyperlink.

Data received in connection with the request is processed until the end of the consultation interaction or until you withdraw consent (whichever comes first), and is destroyed within 30 days in accordance with parts 4–5 of article 21 of Federal Law No. 152-FZ.

Upon expiry of the above terms, personal data is destroyed by deletion from the information systems using built-in tools.

Processing of applications from candidates for vacant positions via the application form

If you wish to send a CV in order to be considered for a vacant position, you may do so by filling in the "Application" form. When processing such a request, the following information about you becomes available to us:

• last name, first name, patronymic;
• contact phone numbers;
• place of work;
• information about work experience;
• information about interests;
• information about foreign language skills (language and proficiency level);
• employment history (period of work, name of organization, area of activity, position, functional duties);
• date of birth;
• age;
• desired position;
• photograph;
• current and desired salary;
• citizenship;
• place of birth;
• email address;
• information about personal qualities;
• information about education, qualifications, specialty, retraining;
• gender.

The personal data processed for this purpose does not relate to special or biometric categories under Articles 10–11 of Federal Law No. 152-FZ and is processed by automated means.

The legal basis for processing is your Consent under clause 1, part 1, article 6 of Federal Law No. 152-FZ.

The data received in connection with the application is processed for 3 months from the date of refusal of employment in accordance with articles 391–392 of the Labor Code of the Russian Federation No. 197-FZ of 30.12.2001, after which it is transferred to archival storage in accordance with archival legislation.

Upon expiry of the above terms, personal data is destroyed by deletion from the information systems using built-in tools.

Publication of testimonials

We publish testimonials from our clients on the website. Within such publications we process the following data:

• last name, first name;
• position;
• company name;
• photograph;
• age;
• text of the testimonial.

The personal data processed for this purpose does not relate to special or biometric categories under Articles 10, 11 of Federal Law No. 152-FZ and is processed by automated means.

The legal basis for processing is the Consent to the processing of personal data permitted by the data subject for distribution, in accordance with article 10.1 of Federal Law No. 152-FZ.

If a testimonial is published, the personal data is processed until the decision is made to delete the page of the Company's website on which the personal data was published, or the consent is withdrawn (whichever comes first), after which it is destroyed within 30 days in accordance with parts 4, 5 of article 21 of Federal Law No. 152-FZ.

Publication of project team members' data

We publish information about the composition of the teams working on projects. Within such publications we process:

• last name, first name, patronymic;
• position;
• place of work;
• photograph.

The personal data processed for this purpose does not relate to special or biometric categories under Articles 10, 11 of Federal Law No. 152-FZ and is processed by automated means.

The legal basis for processing is the Consent permitted by the data subject for distribution, in accordance with article 10.1 of Federal Law No. 152-FZ.

Processing of applications from potential strategists and researchers via the website

If you wish to apply to be considered as a researcher and/or strategist, you may do so by filling in the "Submit application" form. When processing such a request, the following information about you becomes available to us:

• last name, first name, patronymic;
• Telegram account information;
• specialty;
• information about yourself;
• information from your portfolio and/or CV.

The personal data processed for this purpose does not relate to special or biometric categories under Articles 10–11 of Federal Law No. 152-FZ and is processed by automated means.

The legal basis for processing is your Consent under clause 1, part 1, article 6 of Federal Law No. 152-FZ.

Event organization

For event registration and further interaction, the following information about you becomes available to us:

• last name, first name, patronymic;
• contact phone numbers;
• email addresses;
• age;
• position held.

The personal data processed for this purpose does not relate to special or biometric categories under Articles 10–11 of Federal Law No. 152-FZ and is processed by automated means.

The legal basis for processing is your Consent under clause 1, part 1, article 6 of Federal Law No. 152-FZ.

What are cookies? Cookies are small files, usually consisting of letters and numbers, downloaded to your device when you access certain websites. Cookies allow websites to recognize your device.

We want you to comfortably use all features of our websites, so for them to work correctly we process cookies: they allow us to recognize you when you visit our websites or use our services, remember your preferences and provide you with a personalized experience.

Cookies can be divided by purpose into:

• essential cookies that help make a website usable by enabling basic functions like page navigation and access to secure areas. The website cannot function properly without these cookies;
• statistical cookies that help website owners understand how visitors interact with websites by collecting and reporting information anonymously;
• marketing cookies that are used to track visitors across websites. They are intended to display advertising that is relevant and engaging for the individual user and thereby more valuable for website owners and third-party advertisers.

Our websites use all three types of cookies. You can refuse the processing of cookies through the appropriate settings of your browser.

In addition to cookies, our websites use tracking technologies such as tags and scripts to collect and store information about you. When you use our services, we have access to the following information about you: your IP address, location (country or city), type and version of your device's operating system, type and version of your browser, type of device and its display resolution, your traffic source, language of the operating system and browser, as well as data on your actions on the internet.

These technologies are used to track your behavior on the website and collect statistical information about our customer base as a whole in order to improve the services we provide.

Like most other organizational information resources, our web servers and security systems store some temporary technical data in their log files.

Our websites use cookies and retargeting pixels of analytical services. Such third-party cookies are used by us for statistical, analytical and marketing purposes. For more information about the services we use, see "Transfer of data to third parties".

Personal data collected by web analytics services is processed after obtaining your consent to the processing of personal data, provided by the website User via the cookie banner placed on the main page of the website.

The personal data processed for this purpose does not relate to special or biometric categories under Articles 10–11 of Federal Law No. 152-FZ and is processed by automated means.

Personal data is processed until the cookie lifetime expires. Upon expiry of the above terms, personal data of the User is destroyed by deletion from the information systems using built-in tools.

You can refuse the processing of cookies through the appropriate settings of your browser.

For the purpose of providing services and improving their quality, we transfer information about you to the following third parties:

The following rules and restrictions apply to personal data published on the Operator's website:

• transfer of personal data to an unlimited number of persons is not prohibited;
• processing of personal data by an unlimited number of persons is not prohibited;
• personal data received by the Operator may be transferred using information and telecommunications networks.

Our website is not intended for the processing of personal data of minors. If you have reason to believe that a child has provided us with their personal data, please notify us by writing to hello@ony.ru.

The personal data we collect and store is considered confidential information. It is protected from loss, alteration or unauthorized access in accordance with the legislation of the Russian Federation in the field of personal data. To this end, we apply technical means and organizational measures. We continuously improve our data protection systems.

We reserve the right to make changes to our Policy at any time. We ask you to regularly review all updates to our Policy. We will send notifications of changes to the Policy if such changes are material, by means available to us.