Privacy Policy and Personal Data Processing

Platform «Найди Йогу» (website: naidiyogu.ru)

Version: v1.0 Publication Date: February 1, 2026

---

1. General Provisions and Operator Details

1.1. This Privacy Policy (hereinafter – “Policy”) has been developed in accordance with Federal Law of 27.07.2006 No. 152-FZ “On Personal Data” (hereinafter – “152-FZ”), as well as other normative legal acts of the Russian Federation in the field of processing and protection of personal data.

1.2. The Policy defines the procedure for processing personal data and the measures to ensure their security undertaken by the Operator, and applies to all personal data that the Operator processes when using the platform «Найди Йогу», located at naidiyogu.ru (hereinafter – “Platform”).

1.3. Personal Data Operator:

• Brenzovich Evgenii Aleksandrovich;

• Status: self-employed (self-employed tax payer, NPD);

• INN: 310802761300;

• Mailing address: Belgorod Region, Grayvoronskiy District, village Pervaya-Novostroevka, Pervomayskaya Street, building 96;

• Email address of the Operator: info@naidiyogu.ru.

  1.4. Contact for Personal Data Processing Issues. For any questions related to personal data processing, as well as to exercise the rights of a data subject, you may contact: info@naidiyogu.ru.

  1.5. This Policy is publicly available and is posted freely on the website naidiyogu.ru in accordance with Part 2 of Article 18.1 of 152-FZ.

  1.6. By using the Platform, registering on it, and/or providing your personal data, the subject confirms that they have read this Policy. Consent to process personal data, which requires separate expression by law, is formalized through independent consent forms.

---

2. Terms and Definitions

This Policy uses terms as defined in Article 3 of 152-FZ:

• Personal Data – any information relating to a directly or indirectly identified or identifiable natural person (data subject).
• Operator – a person who organizes and/or carries out the processing of personal data, and also determines the purposes of processing, the composition of personal data and actions with it (see clause 1.3).
• Personal Data Processing – any action (operation) or set of actions on personal data performed using automation or without it (collection, recording, systematization, accumulation, storage, clarification, extraction, use, transmission (distribution, provision, access), depersonalization, blocking, deletion, destruction).
• Automated Processing – processing of personal data using computer equipment.
• Distribution of Personal Data – actions aimed at disclosure of personal data to an indefinite circle of persons.
• Provision of Personal Data – actions aimed at disclosure of personal data to a specific person or specific circle of persons.
• Blocking of Personal Data – temporary cessation of personal data processing (except where processing is necessary for clarification).
• Destruction of Personal Data – actions resulting in the impossibility of recovering the content of personal data and/or the destruction of material carriers of personal data.
• Depersonalization of Personal Data – actions as a result of which it becomes impossible without additional information to determine the belonging of personal data to a specific subject.
• Cross-border Transfer of Personal Data – transfer of personal data to the territory of a foreign state to the authority of a foreign state, a foreign natural or legal person.

Other terms related to the operation of the Platform:

• Student – a natural person using the Platform to search for yoga classes, instructors and studios and book them.
• Instructor – a natural person who places a yoga instructor profile on the Platform and uses tools to work with students (including CRM).
• Studio – a legal entity or sole proprietor who place information about a yoga studio (school) on the Platform. A Studio is an independent personal data operator in respect of data that it receives and processes (see section 11).
• One and the same natural person may simultaneously be a Student and an Instructor.

---

3. Legal Basis for Processing

3.1. The Operator processes personal data on the following legal basis (Article 6 of 152-FZ):

• Consent of the data subject to process their personal data (clause 1 of Part 1 of Article 6, Article 9 of 152-FZ) – formalized through separate consent forms (including marketing consent, consent for use of images/videos in advertising and others);

• Performance of a contract to which the data subject is a party (clause 5 of Part 1 of Article 6 of 152-FZ) – the User Agreement (offer) governing the use of the Platform;

• Achievement of purposes provided by law, and fulfillment of functions assigned to the Operator (fulfillment of operator obligations, maintenance of records, etc.);

• Exercise of rights and legitimate interests of the Operator or third parties, provided that the rights and freedoms of the subject are not violated (clause 7 of Part 1 of Article 6 of 152-FZ) – in the part concerning ensuring the functionality and security of the Platform, preventing abuse.

  3.2. Consent to process personal data is specific, substantive, informed, conscious and unambiguous. A subject has the right to withdraw consent in accordance with section 14 of this Policy.

---

4. Principles of Personal Data Processing

The Operator processes personal data in accordance with the principles established by Article 5 of 152-FZ:

• Processing is carried out on a lawful and fair basis;
• Processing is limited to the achievement of specific, predetermined and lawful purposes; processing incompatible with the purposes of collection is not permitted;
• Merging of databases containing personal data whose processing is carried out for mutually incompatible purposes is not permitted;
• Only personal data that corresponds to the purposes of their processing is processed; the content and volume of data comply with the stated purposes and are not excessive;
• Accuracy, sufficiency, and where necessary, timeliness of personal data is ensured;
• Storage is carried out no longer than required by the purposes of processing, unless a period is set by law or contract; upon achievement of purposes or loss of necessity, data is deleted or depersonalized.

---

5. Categories of Data Subjects

The Operator processes personal data of the following categories of subjects:

1. Students – natural persons using the Platform to search for and book classes.
2. Instructors – natural persons maintaining an instructor profile and working with students.
3. Studio Representatives – natural persons acting on behalf of a Studio (a legal entity or sole proprietor) when registering and maintaining a Studio profile.

---

6. List of Processed Personal Data

6.1. Account Data (common to all users):

• Email address;

• Password (stored exclusively in hash form; the Operator does not have access to it in open form);

• Interface language;

• Fact of email address confirmation (verification).

  6.2. Personal Data of Students:

• Name;

• Phone number;

• Telegram identifier/username;

• Photograph;

• Profile description (bio);

• City;

• Year of birth;

• Month when yoga practice started;

• Mark of marketing consent;

• Selected yoga directions (styles);

• History of class bookings;

• Favorites list;

• Time of last activity.

  6.3. Personal Data of Instructors:

• First and last name;

• Phone number;

• Telegram identifier/username;

• Email address;

• Photograph;

• Video materials;

• Certificates (qualification documents);

• Profile texts (description, methodology, etc.);

• Class schedule;

• Own student data in Instructor’s CRM: contact data, private notes, tags, visit history.

  6.4. Personal Data of Studio Representatives:

• Studio name;

• Address;

• Phone number;

• Email address;

• Website;

• Social media links;

• Prices;

• Photographs;

• Access to data of students who attended the Studio’s classes (in the scope provided by functionality and consents, see section 11).

  6.5. Cross-cutting Data (applicable to different categories of users):

• User private messages – are private; are not processed by artificial intelligence;

• Private notes in Instructor’s CRM – are not transferred to Studios;

• User activity log (log);

• Advertising attribution parameter yclid (Yandex advertising click tag);

• Cookies and session data (including JWT authorization tokens) – see section 10.

  6.6. The Operator does not request and deliberately does not process special categories of personal data (regarding racial, national origin, political views, religious or philosophical beliefs, health status, intimate life). If a subject independently places such information in free fields of their profile or in correspondence, they do so voluntarily and accept associated risks.

---

7. Purposes of Personal Data Processing

The Operator processes personal data for the following purposes:

• Registration and Authentication – creation and maintenance of an account, login to the Platform, confirmation of email address, access recovery. Data: email, password (hash), interface language, fact of verification.
• Search and Class Booking – formation of Student profile, selection of instructors/studios/directions, class booking, maintenance of booking history and favorites. Data: name, city, directions, booking history, favorites.
• Maintenance of Instructor and Studio Profile – publication of information about the instructor/studio for search by other users, schedule maintenance. Data: first/last name, photo, video, certificates, profile texts, schedule; Studio name, address, contacts, prices, photos.
• Messaging (Chat) – provision of private correspondence between users. Data: message content (private, not processed by AI).
• Work with Students (CRM) – maintenance by Instructor of a database of their students: contacts, notes, tags, visit history. Data: Instructor’s students’ CRM data.
• Notifications and Mailings – sending of service notifications (about bookings, schedule changes, etc.), and with marketing consent – informational and promotional mailings. Data: email, phone, Telegram, marketing consent.
• Analytics and Platform Improvement – analysis of Platform usage, ensuring its functionality and security, prevention of abuse. Data: activity log, time of last activity, cookies/sessions.
• Advertising and Attribution – evaluation of advertising campaign effectiveness and sources of transitions. Data: yclid parameter, transmission of data to advertising systems (see section 9).
• Translation of User Content (UGC) – automatic translation of content posted by users using an external artificial intelligence service (function is implemented with separate consent; see sections 9 and 13). Data: profile texts and other content posted by users.

---

8. Storage Terms and Conditions. Cessation of Processing

8.1. Personal data is stored no longer than required by the purposes of their processing, unless a different period is set by federal law or contract.

8.2. Personal data is processed during the entire period of validity of the user’s account on the Platform.

8.3. Cessation of Processing and Deletion. Processing of personal data ceases in the following cases:

• Deletion of the user’s account by the user;

• Withdrawal of consent by the subject, if processing was carried out solely on the basis of consent and there are no other legal grounds;

• Achievement of processing purposes or loss of necessity in their achievement;

• Detection of unlawful personal data processing.

  8.4. Upon achievement of processing purposes, withdrawal of consent (in the absence of other grounds), or deletion of an account, personal data shall be deleted or depersonalized within a reasonable time, except for data whose storage obligation is established by law.

  8.5. Individual information (for example, data necessary to comply with legal requirements, or data whose deletion would violate the rights of third parties) may be stored for periods established by the legislation of the Russian Federation.

  8.6. A request for deletion of personal data is sent to info@naidiyogu.ru. The Operator’s response procedure – see section 14.

  8.7. Data that Instructor or Studio process as independent operators (including student data in Instructor’s CRM, student data at the Studio) are stored and deleted by such persons in accordance with their own policies and obligations (see section 11).

---

9. Transfer of Personal Data to Third Parties. Recipients

9.1. The Operator does not sell personal data and does not distribute it to an indefinite circle of persons. Transfer (provision) of personal data is carried out only in the scope and for the purposes described below.

9.2. Instructors. Upon booking a Student for a class, the relevant Instructor is provided with Student data necessary to conduct the class and maintain contact (name, contact data, booking information). Instructor uses CRM tools to work with their students.

9.3. Studios – Independent Personal Data Operators. Studios (legal entities or sole proprietors) receive access to data of students who attended their classes, in the scope provided by Platform functionality and relevant consents.

• Disclosure by Studio of Instructor’s student data is carried out with Instructor’s consent to disclosure of student data to the Studio.

• The Studio acts as an independent personal data operator in respect of the received data: it independently determines the purposes and methods of their further processing, has its own personal data processing policy and independently bears responsibility for compliance with legal requirements. The Platform Operator is not responsible for personal data processing carried out by the Studio after its receipt.

  9.4. Advertising Systems (Yandex). For the purpose of evaluating advertising effectiveness and attribution of transitions, the Operator uses Yandex services and transmits technical identifiers and the yclid advertising attribution parameter to them. Processing of such data is also governed by documents of the relevant services.

  9.5. Infrastructure Providers. To store and process data, the Operator uses infrastructure in the territory of the Russian Federation (see section 12). The infrastructure provider processes data on the Operator’s behalf in accordance with Part 3 of Article 6 of 152-FZ and does not determine processing purposes.

  9.6. Artificial Intelligence Service for Content Translation (UGC). Translation of user content is performed with the involvement of a Russian artificial intelligence service acting on the Operator’s behalf (Part 3 of Article 6 of 152-FZ) in the territory of the Russian Federation. Transfer of data outside the Russian Federation does not occur. Processing is conducted on the basis of instructions with confidentiality and data security conditions; separate consent for cross-border transfer is not required. The service processes data exclusively for translation purposes and does not determine processing purposes.

---

10. Cookies

10.1. The Platform uses cookies and similar technologies (including JWT authorization tokens, session data) to ensure Platform functionality, user authentication, remember settings, analytics and advertising attribution.

10.2. A detailed procedure for using cookies, their categories and methods of managing them are described in a separate document – the «Cookie Policy», posted on the website naidiyogu.ru.

---

11. Distribution of Operator Roles

11.1. Platform Operator (clause 1.3) processes personal data for the purposes specified in section 7 and ensures the functioning of the Platform.

11.2. Instructor in respect of data of their own students, which they maintain in CRM (contacts, private notes, tags, visit history), acts independently and bears responsibility for the lawfulness of their processing. Private notes of Instructor are not transmitted to Studios.

11.3. Studio is an independent personal data operator in respect of data of students who it receives in connection with attendance of its classes. The Studio:

• independently determines the purposes and methods of further processing of the received data;

• is obliged to have its own personal data processing policy and ensure compliance with 152-FZ requirements;

• independently bears responsibility to subjects and controlling bodies for data processing after its receipt.

  11.4. The Platform Operator is not responsible for personal data processing carried out by Instructors and Studios as independent operators beyond the scope of Platform functionality.

---

12. Localization of Personal Data Databases in the Russian Federation

12.1. In accordance with Part 5 of Article 18 of 152-FZ, when collecting personal data, including via the Internet, the Operator ensures recording, systematization, accumulation, storage, clarification (update, modification), extraction of personal data of Russian Federation citizens using databases located in the territory of the Russian Federation.

12.2. The Platform databases and media files (photos, videos) are hosted on Cloud.ru infrastructure (including Cloud.ru S3 object storage), located in the territory of the Russian Federation.

12.3. Cross-border transfer of personal data by the Operator does not occur. All persons engaged by the Operator to process data on its behalf (including the artificial intelligence service for user content translation – see clause 9.6) act in the territory of the Russian Federation.

---

13. Measures to Ensure Personal Data Security

13.1. The Operator takes necessary legal, organizational and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision, distribution, as well as from other unlawful actions, in accordance with Articles 18.1 and 19 of 152-FZ.

13.2. Such measures include, in particular:

• Appointment of a person responsible for organizing personal data processing and determination of processing procedure;

• Issuance of this Policy and other internal documents regarding personal data processing and protection;

• Limitation and differentiation of access to personal data (access is provided only to authorized persons in the scope necessary to perform their functions);

• Storage of passwords in hash form; use of secure data transmission protocols (channel encryption);

• Application of information protection means, backup, maintenance of access and activity logs;

• Placement of data on infrastructure located in the territory of the Russian Federation (section 12);

• Assessment of harm that may be caused to subjects and control of measures taken.

  13.3. Upon detection of incidents related to unlawful personal data processing or unauthorized access to it, the Operator takes measures to eliminate them and notifies the competent authority in the manner and within the time periods established by 152-FZ.

---

14. Rights of Data Subject

14.1. In accordance with Articles 14, 20 and 21 of 152-FZ, a data subject has the right to:

• Receive information concerning the processing of their personal data (fact of processing, purposes, methods, terms, composition of data, information on persons having access and recipients);

• Require clarification of personal data (correction, addition) if they are incomplete, inaccurate or outdated;

• Require blocking or deletion (destruction) of personal data if they are incomplete, outdated, inaccurate, unlawfully obtained or are not necessary for the stated processing purpose;

• Withdraw consent to process personal data;

• Object to processing in cases established by law;

• Appeal the actions or inaction of the Operator to the competent authority for the protection of data subject rights (Roskomnadzor) or in court.

  14.2. A subject may exercise part of their rights independently through the Platform interface (profile editing, settings changes, withdrawal of marketing consent, account deletion). For other requests, the subject contacts info@naidiyogu.ru.

  14.3. Operator’s Response Procedure and Time Limits:

• Information about processing is provided to the subject in an accessible form within 10 working days from the date of request receipt (the period may be extended, but not more than 5 working days, with notice to the subject);

• Upon confirmation of data inaccuracy, the Operator clarifies it within 7 working days and removes the blocking (if present);

• Upon confirmation of unlawful processing, the Operator ceases it and destroys the data within 10 working days;

• Upon withdrawal of consent and absence of other legal grounds, processing ceases and data is destroyed within 30 days, unless otherwise provided by law.

  14.4. The subject’s request must contain information allowing identification of the subject and their account (to confirm identity the Operator may request additional information).

---

15. Processing of Personal Data When Using the Platform by Users

15.1. By posting data of third parties on the Platform (for example, when maintaining CRM or entering student information), Instructor/Studio guarantee the existence of legal grounds for such processing and independently bear responsibility for their compliance (section 11).

15.2. User private messages are private and are not used by the Operator for purposes not related to ensuring the functioning of the messaging feature; messages are not processed by artificial intelligence.

---

16. Processing of Personal Data of Minors

16.1. The Platform processes personal data only of adult users: registration is available from age 18. The Platform does not collect personal data of minors upon registration.

16.2. Processing of data of minors attending classes is carried out by Instructor/Studio on the basis of consent of their legal representatives and outside the scope of this Policy (section 11).

16.3. If the Operator becomes aware that personal data of a minor was provided during Platform registration, the Operator will take measures to cease processing and delete such data.

---

17. Modification of Policy. Document Availability

17.1. The Operator has the right to make changes to this Policy. The current version of the Policy is posted on the website naidiyogu.ru and is available to an unlimited circle of persons in accordance with Part 2 of Article 18.1 of 152-FZ.

17.2. A new version of the Policy enters into force from the moment of its posting on the website, unless otherwise provided by the new version.

17.3. In case of substantial changes affecting the conditions of personal data processing, the Operator, if possible, additionally informs users through available means.

17.4. Continued use of the Platform after changes enter into force means the user’s agreement with the current version of the Policy. Consents that require separate expression by law may be requested again in case of substantial changes to conditions.