This Consent is given by the user of the CyberPass mobile application (the "App") at the moment of registration in the App, by ticking the corresponding checkbox in the registration form.
By ticking the checkbox, you freely, of your own will and in your own interest, consent to the processing of your personal data on the terms set out below.

1. Operator of personal data
Elena Leonidovna Saltykova, Sole Proprietor (Individual Entrepreneur) Registration No. (OGRNIP): 323350000008567 Taxpayer No. (INN): 352813858590 Address: 28 Kosmonavta Belyaeva St., Cherepovets, Vologda Region, 162616, Russia Email: support@cyberpass.tech

2. Data subject
An individual aged 18 or older who registers in the App and provides their data in the registration form. The data subject is identified by the phone number confirmed at authentication.

3. Categories of personal data covered by this Consent

• surname and first name (or the name provided at registration);
• mobile phone number;
• email address;
• date of birth of the account holder;
• unique account identifier (UUID) used to generate the QR code;
• Digital Account status: credits and debits of minutes (hours) of the Digital Subscription;
• session booking data: date, time, booking status, place of service;
• device push notification token;
• technical device information: device type, operating system version, app install identifier — to the extent necessary for the delivery of push notifications.

The Operator does not process special categories of personal data, biometric personal data, or payment card data. The Operator does not process personal data of persons under the age of 18.

4. Purposes of processing

• creating, maintaining and identifying the user account;
• confirming that the user has reached the age of 18, which is required to create an account and receive the Service;
• sending birthday greetings and related special offers — where consent to receive promotional and informational messages has been given;
• authentication in the App by phone number;
• providing access to the Service, crediting and debiting minutes (hours) of the Digital Subscription, generating and displaying the QR code;
• booking gaming sessions with the Service Provider and giving the Service Provider access to the information required to render the service;
• collecting feedback on the quality of the Service through the App interface;
• processing the Client's requests for events and other individual services offered by Service Providers — subject to a separate consent given at the time the request is submitted;
• sending service push notifications regarding the Digital Account status and the operation of the App;
• handling user support requests;
• performing the agreement concluded on the terms of the Public Offer published at https://cyberpass.tech/en/user-agreement;
• complying with the requirements of the legislation of the Russian Federation, including tax and accounting legislation.

5. Operations performed on personal data and methods of processing
The Operator may perform the following operations: collection, recording, systematisation, accumulation, storage, updating (amendment, modification), retrieval, use, transfer (provision, access), blocking, deletion and destruction of personal data.
Processing is carried out by mixed means — with and without the use of automation. Databases containing personal data are hosted on servers located in the Russian Federation. Certain technical device identifiers are transferred outside the Russian Federation solely for the delivery of push notifications — see Section 6.

6. Transfer of personal data to third parties
The data subject consents to the transfer of their personal data to the following recipients, strictly to the extent and for the purposes set out below:


About Service Providers. Authorised staff of a Service Provider access the data listed above, including the Client's phone number and email address, exclusively through the Platform's software (the Service Provider interface), only to the extent necessary to render the Service, and only in respect of Clients receiving the Service from that Service Provider.
Service Providers process this data on the Operator's instructions under Part 3 of Article 6 of Federal Law No. 152-FZ of 27 July 2006, on the basis of an agreement with the Operator that obliges them to maintain confidentiality and comply with Article 19 of that law. In this respect, the Operator remains responsible to the data subject for the actions of Service Providers.
A Service Provider may not use the Client's contact details to send promotional or informational messages on its own behalf, pass them to third parties, export or copy them outside the Platform's software, or use them for any purpose unrelated to rendering the Service to that particular Client.
A Service Provider may process contact details for its own purposes only in the case described in Section 6.1, and only on the basis of a separate consent given by the Client.
Delivery of push notifications to Android devices is carried out primarily through the RuStore push notification service (Mnogo Prilozheniy LLC), whose servers are located in the Russian Federation. Where the RuStore service is unavailable on the user's device, delivery is carried out through the fallback channel — Firebase Cloud Messaging (Google LLC).
Cross-border transfer. The data subject consents to the cross-border transfer of their personal data to Google LLC and Apple Inc., both incorporated in the United States of America, solely for the purpose of delivering push notifications. The following are transferred: the device push notification token, technical device information (device type, operating system version, app install identifier) and the content of the push notification, to the extent necessary for its delivery and display. The United States of America is not included in the list of foreign states providing adequate protection of the rights of personal data subjects. Notification of the intention to carry out cross-border transfer of personal data has been submitted by the Operator to Roskomnadzor under Article 12 of Federal Law No. 152-FZ of 27 July 2006.
Databases containing personal data of citizens of the Russian Federation are located in the Russian Federation.
The Operator does not sell personal data and does not transfer it to third parties for purposes unrelated to the provision of the Service.

6.1. Transfer of data to a Service Provider when submitting a request
Where the Client submits a request for an event or another individual service offered by a Service Provider, the App displays a separate screen naming the specific Service Provider and listing the data to be transferred. The request is sent to the Service Provider only after the Client ticks the checkbox on that screen.
Data transferred: name, phone number, email address (where provided), content of the request.
Purpose: contact between the Service Provider and the Client regarding the substance of the request, agreement of terms, and organisation of the service.
In respect of data received through such a request, the Service Provider acts as an independent operator of personal data: it may process that data for its own purposes connected with fulfilling the request, and bears independent responsibility for such processing. This is what distinguishes a request from the ordinary access a Service Provider has to Client data through the Platform interface, as described in Section 6.
Consent to such a transfer remains valid until the purpose of processing is achieved or until it is withdrawn by the Client, which may be done either by contacting the Operator at support@cyberpass.tech or by contacting the Service Provider directly.

7. Term of this Consent and how to withdraw it
This Consent is valid from the day it is given until the day it is withdrawn by the data subject.
The data subject may withdraw this Consent at any time by:

• deleting their account in the App settings ("Profile" → "Delete account");
• sending a written request to support@cyberpass.tech, stating the phone number used at registration;

Withdrawal of this Consent results in the cessation of processing and the erasure of personal data within no more than seven (7) calendar days, except for information that must be retained under the legislation of the Russian Federation (including for tax and accounting purposes) and information necessary to perform obligations of the Operator that arose earlier.
Withdrawal of this Consent means that the App can no longer be used, since the processing of the data listed above is necessary in order to provide the Service.
8. Rights of the data subjectThe data subject may:

• obtain information concerning the processing of their personal data (Article 14 of Federal Law No. 152-FZ of 27 July 2006 "On Personal Data");
• require that personal data be updated, blocked or destroyed where it is incomplete, outdated, inaccurate, unlawfully obtained, or no longer necessary for the stated purpose of processing;
• withdraw this Consent in the manner set out in Section 7;
• appeal against the acts or omissions of the Operator to Roskomnadzor or before the courts.

A detailed description of how personal data is processed is set out in the Privacy Policy at https://cyberpass.tech/en/app-privacy.

CONSENT TO RECEIVE PROMOTIONAL AND INFORMATIONAL MESSAGES

This consent is given separately and is voluntary. Declining to give it does not affect your ability to use the App or to receive the Service.

By ticking the corresponding checkbox in the registration form, the user gives Elena Leonidovna Saltykova, Sole Proprietor (OGRNIP 323350000008567) consent to receive promotional and informational messages through the following channels:

• push notifications in the App;
• messages within the App interface;
• messages to the email address provided;
• SMS messages to the phone number provided.

Content of the messages: information about products, promotions and special offers of the Platform, as well as about the services, events and special offers of Service Providers — the Platform's partner venues. Such messages are sent by the Operator on its own behalf; the Client's contact details are not passed to Service Providers for this purpose.
For these purposes the Operator processes: name, phone number, email address, push notification token, and information about the use of the Digital Subscription and venues visited — in order to make offers relevant.
This consent is given in accordance with Part 1 of Article 18 of Federal Law of the Russian Federation No. 38-FZ of 13 March 2006 "On Advertising" and remains valid until withdrawn.
You may opt out of these messages at any time:

• by turning off push notifications in the App settings on your device — in respect of push notifications;
• via the "Unsubscribe" link in the email — in respect of email messages;
• by sending a request to support@cyberpass.tech — in respect of all channels, including SMS.

Withdrawal of this consent does not stop service notifications relating to the performance of the agreement (Digital Account status, booking confirmations, technical notices).