Consent to the Processing of Personal Data of Rich Witch Users

Electronic form Revised 25 September 2026

This consent is executed separately from acceptance of the Public Offer, the Terms, age confirmation, and consent to advertising. Operator: Sole Proprietor Maksim Vladimirovich Stolyarov, OGRNIP 314504803100020; INN 504808687272; address: 142300, Moscow Region, Chekhov, Mira St., 10, apt. 98; email: maxim@namnecash.ru, hereinafter the "Operator". The personal data processing policy is published at https://richwitch.com/privacy.

By ticking the box in the interface and pressing the continue button, I, a user of the Rich Witch platform, acting freely, of my own will and in my own interest, give specific, express, informed, conscious and unambiguous consent to the processing of my personal data on the following terms.

1 Data subject and method of confirmation

1.1. The data subject is a registered user or a person filling in a form for an order, an add-on service, an in-person meeting, the Dubai trip raffle (if held), a refund, or support. The consent is linked to the account or Order identifier, the date, time, text revision, and a technical identifier of the action.

1.2. I confirm that I have reached the age of 18. If, in wishes for a video greeting or meeting, I provide another person's data, I confirm the lawfulness of providing it and undertake not to disclose excessive information, special categories of data, or information of an intimate nature.

2 Purposes, data and retention periods

Creating and protecting the account

Data categories: name, email, password hash, ID, role, creation and login dates, session identifiers

Period or criterion: until account deletion; security records — within the periods set by the operator and by law

Placing and fulfilling the Order

Data categories: user and Order ID, event, tier, add-on services, prices, discount, currency, provider, statuses, dates, access window

Period or criterion: the term of the contract and thereafter within the periods for mandatory record-keeping, claims and the statute of limitations

Personal services

Data categories: contact (email/phone/Telegram), wishes, recipient's name, status, internal note

Period or criterion: until fulfilled and any possible claims are resolved; then deletion or anonymisation unless the law requires retention

Payments and refunds

Data categories: payment and refund identifiers, amount, status, dates, encrypted operation key; the Platform does not store the card number or CVV

Period or criterion: within the record-keeping and settlement-confirmation periods set by law

Access recovery and support

Data categories: email, token and its validity period, request text, attachments, technical information

Period or criterion: token — until used or expired; requests — until the matter is resolved and any possible claims are settled

Video access and security

Data categories: order ID, media ID, access mode and version, token time, random ID, IP/network headers, HMAC restriction keys

Period or criterion: tokens and restrictions — short-term per technical configuration; logs — for the period necessary for security and evidentiary purposes

Recording of intent

Data categories: document and checkbox revisions, date, time, user/order ID, technical identifier

Period or criterion: for the term of the contract and the period of any possible claims

In-person meetings and the winner's trip

Data categories: name, contact, the selected service or prize, the agreed date, place and slot; foreign-passport and travel details are requested separately, only when needed for admission or booking and after the recipients have been disclosed.

Period or criterion: until the service is rendered or the prize is issued and any possible claims are settled; then deletion or anonymisation unless the law requires otherwise.

2.1. For registration and an ordinary order, the Operator does not request a passport, residential address, date of birth, SNILS, biometric data, special categories of personal data, the full bank card number, or CVV. Foreign-passport details, where needed to organise an in-person meeting or the winner's trip, are requested separately after the purpose, the list of data, and the recipients have been determined; this general consent by itself is not a basis for collecting a copy of the document or for a cross-border transfer. Such information should not be entered into free-text fields.

2.2. This Consent does not authorise promotional mailings. To send promotional and informational messages and transfer the necessary data to the mailing service, the Operator obtains separate voluntary consent. Declining it does not affect registration or the conclusion and performance of the Agreement.

3 Actions and methods of processing

3.1. Consent is given for the collection, recording, systematisation, accumulation, storage, clarification, retrieval, use, transfer (by way of provision or access) to the persons listed below, anonymisation, blocking, deletion and destruction of personal data.

3.2. Processing is carried out by automated and non-automated means, including within information systems and via transmission over communication networks. The Operator takes legal, organisational, and technical protection measures.

4 Persons and services involved in processing

Timeweb Cloud / TIMEWEB.CLOUD LLC

Hosting of the application and database: account, Orders, logs, requests and other data stored on the Platform.

Timeweb Mail / TIMEWEB JSC

Delivery of recovery and support emails: email, sender address, subject, body and technical headers of the message.

Robokassa / ROBOKASSA LLC

Payment acceptance, fiscalisation, and refunds: Order number and amount, receipt composition, statuses; card details are entered by the User on the payment service's side.

Kinescope / Kinescope B.V.

Protected playback: media and Order ID, access JWT, network and browser information, authorisation result.

Online meeting service: Zoom Communications, Inc.

Organising the chosen meeting: name/nickname, contact, link, time and connection technical details.

The performer of the personal service and authorised administrators

Contact, permitted wishes, duration, and fulfilment status — only to the extent necessary.

The User's email provider

Delivery of emails sent to the User to the address they specified.

Unisender Smart LLC (the UniSender service), OGRN 1227700213180, INN 9731091240, KPP 771501001; address: 127015, Moscow, Butyrsky municipal district, Bolshaya Novodmitrovskaya St., 23, unit 2/46

Only where separate consent has been given: delivery of promotional emails, maintaining the subscription and opt-out list, and delivery statistics — name or nickname, email, user ID, selected segment, the date and source of consent, and delivery, open, click, and opt-out statuses. The password, payment data, and the content of restricted material are not transferred.

The in-person meeting's organiser, restaurant, yacht, carrier, hotel — specific persons to be identified before any transfer

Minimal data needed to confirm attendance and booking; cross-border transfer only after the legal requirements are met and the data subject is informed.

4.1. The persons listed in the table above are involved in the processing. Before publication, the Operator verifies the exact names, addresses, and contractual roles of these persons under current agreements. Organisers of an in-person meeting, hotels, carriers, and other travel-data recipients not yet identified are named before the corresponding data is collected and transferred; separate consent is obtained where necessary.

4.2. Disclosure to government authorities and other persons without consent is permitted only on the grounds and in the manner established by law.

4.3. For promotional mailings, the Operator engages Unisender Smart LLC (the UniSender service) as a processor acting on the Operator's instructions. The Operator ensures that confidentiality, security, data localisation, and the termination of processing upon withdrawal of consent are fixed contractually. If the service is changed, the information in the Policy and in the separate consent is updated before data is transferred to the new processor.

5 Localisation and cross-border transfer

5.1. When collecting personal data of citizens of the Russian Federation via the Internet, the Operator ensures the recording, systematisation, accumulation, storage, clarification, and retrieval of such data using databases located within the Russian Federation, except as otherwise provided by law.

5.2. Cross-border transfer is not carried out until the Operator meets the applicable legal requirements and discloses the country, recipient, purpose, and composition of the data. A User's own decision to follow a link to an external service may constitute the User's independent interaction with that service under its own terms.

6 Term, termination and withdrawal

6.1. This consent is effective from its electronic confirmation until the purposes of processing are achieved or it is withdrawn, whichever occurs first, unless continued processing is required on another lawful basis.

6.2. Withdrawal is sent to support@richwitch.com or to the Operator's address. The request must state the account email and information sufficient to identify the consent. The Operator will stop the relevant processing and destroy the data within the period established by law, unless another legal basis exists.

6.3. Withdrawal does not affect the lawfulness of processing carried out before it was received. The Operator may continue processing data necessary to perform the contract, for mandatory record-keeping, handling claims, protecting rights, and fulfilling other duties on independent legal grounds; such purposes need not formally depend on this consent.

7 Rights of the data subject

7.1. The data subject may obtain information about the processing, demand clarification, blocking, or destruction of incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary data, withdraw consent, appeal the Operator's actions, and exercise other rights under Federal Law No. 152-FZ of 27 July 2006 "On Personal Data".

7.2. Requests are sent to support@richwitch.com or to the Operator's address. A response is provided after reasonably verifying the applicant's identity, within the periods set by law.

8 Electronic confirmation

☐ I consent to the processing of personal data on the terms set out above and confirm that I have read the Personal Data Processing Policy.

The text of this consent checkbox is not combined with acceptance of the Offer, age confirmation of 18+, or consent to advertising.