PRIVACY POLICY

and the processing of personal data of the GIDIO digital service

Revision of 08.08.2026

This Policy defines the procedure for the processing and protection of the personal data of users of the GIDIO digital service and ensures unrestricted access to information on the principles and conditions of the processing of personal data by the Operator.

1. OPERATOR

Individual Entrepreneur Mesropyan David Davidovich

INN: 540133672385

OGRNIP: 324547600037031

E-mail for inquiries regarding personal data: gidiotravel@yandex.ru

Website: gidio.ru

Platforms: Telegram Mini App, Max Mini App, the GIDIO mobile application, and other interfaces of the Service.

2. CATEGORIES OF DATA, PURPOSES AND GROUNDS

2.1. In order to provide the Service and perform contracts, the following may be processed: the Telegram/Max/application account identifier; name/username; e-mail or telephone number provided upon registration; usage history, completed scenarios, place check-ins, saved impressions and comments; selected travel parameters and preferences; technical payment information - status, amount, date, transaction identifier, masked payment instrument data.

2.2. Purposes: user identification, provision of functionality, synchronization across platforms, maintenance of the Subscription, provision of paid access, processing of refunds, service notifications, protection of the Service against abuse, and compliance with the requirements of the law.

2.3. The legal grounds are the conclusion and performance of the contract with the User, the fulfilment of the Operator's obligations under the law, and, where required, the separate consent of the User.

2.4. On the basis of separate consent, data may be processed for analytics and product improvement, where the specific technology used requires such consent, as well as contact data for advertising/marketing communications.

2.5. When geolocation is used, the Service processes coordinates or information about the current location only after the User has granted the corresponding permission/data, for the purpose of guiding the scenario, verifying the passing of a point, and selecting the next step.

2.6. When interacting with the AI guide, the User's messages may be processed to the extent necessary to generate a response and to operate the scenario. The User should not transmit special categories of personal data, payment details, passwords, or excessive information about third parties.

3. WHAT THE OPERATOR DOES NOT COLLECT INTENTIONALLY

3.1. The Operator does not receive or store full bank card details where payment is made through a payment provider.

3.2. The Operator does not pursue the purpose of processing special categories of personal data or biometric personal data. The User must not submit such information without necessity and a separate legal basis.

4. OPERATIONS WITH DATA

4.1. Depending on the purpose, the Operator may carry out the collection, recording, systematization, accumulation, storage, updating, retrieval, use, provision/transfer in the cases provided for by law, anonymization, blocking, deletion, and destruction of personal data, by automated and non-automated means.

5. STORAGE PERIODS

5.1. Data is stored no longer than required by the purposes of processing or the mandatory storage periods established by law.

5.2. Account data and usage history may be stored for the term of the account/contract and, following its termination, for the period necessary to settle claims, confirm performance of the contract, and comply with the law.

5.3. Payment information and financial/tax accounting documents are stored for the periods established by the legislation of the Russian Federation.

5.4. Upon withdrawal of consent, processing based specifically on such consent ceases, and the data is destroyed within the periods provided for by law, unless there are other legal grounds for continuing the processing.

6. TRANSFER AND ENTRUSTMENT OF PROCESSING

6.1. For the operation of the Service, data may be processed and transferred, to the extent necessary, to the payment provider ROBOKASSA LLC, to the Telegram and Max/VK platforms, to server infrastructure providers, technical contractors, suppliers of artificial intelligence, speech synthesis and speech recognition technologies, and analytics tools - subject to the existence of a legal basis and the necessary contractual and organizational measures.

6.2. The Operator does not sell personal data to third parties.

6.3. Data may be provided to state authorities in the cases and in the manner provided for by law.

7. LOCALIZATION AND CROSS-BORDER TRANSFER

7.1. When collecting the personal data of citizens of the Russian Federation, the Operator ensures that the initial recording, systematization, accumulation, storage, updating, and retrieval are carried out using databases located within the territory of the Russian Federation, in the cases required by law.

7.2. If a specific technology provider entails cross-border transfer, the Operator carries out such transfer only after fulfilling the requirements provided for by law, including the necessary notifications and assessment of the conditions of the transfer.

8. DATA PROTECTION

8.1. The Operator takes the necessary legal, organizational, and technical measures to protect against unlawful or accidental access to, destruction, alteration, blocking, copying, provision, and dissemination of personal data.

8.2. Such measures include: access differentiation, secure communication channels, control of access by employees and contractors, logging of significant actions, backup, and monitoring of the security of the infrastructure to the applicable extent.

9. RIGHTS OF THE USER

• to obtain information about the processing of personal data;
• to demand the updating, blocking, or destruction of data where there are legal grounds;
• to withdraw previously given consent;
• to demand the cessation of processing based on consent, where there are no other legal grounds;
• to appeal against the actions of the Operator to the authorized body or a court.

Inquiries are to be sent to gidiotravel@yandex.ru. The Operator is entitled to request information enabling the identification of the applicant and their correlation with the data in the Service.

10. COOKIES AND WEBSITE ANALYTICS

10.1. The website gidio.ru may use technically necessary cookies for the operation of the interface. Other analytical or marketing cookies are used in accordance with a separate notice/consent settings, where their use requires consent.

11. AMENDMENTS TO THE POLICY

11.1. The current revision is made publicly available on the website gidio.ru. In the event of material changes, the Operator may additionally notify Users through the interface of the Service.

DETAILS

Individual Entrepreneur Mesropyan David Davidovich

INN: 540133672385

OGRNIP: 324547600037031

Date of registration: 04.03.2024, Interdistrict Inspectorate of the Federal Tax Service of Russia No. 16 for the Novosibirsk Region

Current account: 40802810820000820165

Bank: Bank Tochka LLC

BIK: 044525104

Correspondent account: 30101810745374525104

E-mail: gidiotravel@yandex.ru

Website: gidio.ru