Consent to Personal Data Processing — Russian-law version

Data controller: EVA CODE (a seller registered in the Republic of Korea, trading as EVA CODE).
Korean business registration number: 209-28-95980.
Representative: KIM VALENTINA.
Address: 경기도 안산시 단원구 별망로 555, 4층 420호, Republic of Korea.
Website: https://evacode.co.kr.
Email: orders@evacode.co.kr.
Phone: +82 10-7652-8595.

This notice is intended for the processing of personal data of users from the Russian Federation where Federal Law No. 152-FZ of 27 July 2006, “On Personal Data”, applies. The legal basis for this version is the applicable legislation of the Russian Federation. The applicable processing rules are explained in the Personal Data Processing Policy. The Terms of Sale are provided separately.

Where consent is required, it is given freely, separately from the Terms of Sale, and separately for each relevant purpose. Placing an ordinary order does not automatically authorize marketing, optional tracking, or research recordings of user behavior.

1. Person giving consent

1.1. As an EVA CODE user, I voluntarily decide whether to consent to a particular processing operation involving my personal data. I confirm that I may provide this information and, if acting through a representative, that the necessary authority exists.

1.2. I understand that the seller is registered in the Republic of Korea but that operations falling under Russian law are governed, as applicable, by Federal Law No. 152-FZ. My consent covers only the purposes I expressly select in a separate form.

2. Processing methods

2.1. For a selected purpose, data may be processed with or without automated tools, but only where the operation is necessary and lawful.

2.2. Operations may include collection, recording, organization, accumulation, storage, correction, retrieval, use, disclosure to specified recipients on an appropriate legal basis, anonymization, restriction, erasure and destruction. This general document does not authorize public dissemination to an unlimited audience. Any required consent for public dissemination must be obtained separately in the legally prescribed manner.

3. Categories of personal data

3.1. Depending on the service or inquiry, the information may include my first and last names, patronymic where provided, phone number, email, shipping address, country, postal code, account identifier, order and payment details, shipping and refund information, and information I submit in customer communications.

3.2. The website may process IP addresses, essential session identifiers, technical logs and cookies for its operation. Optional analytics and advertising require a separate assessment of the lawful basis and, where necessary, a separate user choice.

3.3. Date of birth, gender, place of birth, passport details and voice, image or screen recordings are not required for an ordinary purchase. If a particular function genuinely needs such information, its purpose, exact categories, retention period and lawful basis must be disclosed before collection, with specific consent where required. Merely listing these categories does not mean EVA CODE actually collects them.

4. Purposes of processing

4.1. Account registration, order placement and performance, payment (including bank transfers), delivery, cancellation, exchanges, returns and handling inquiries are performed on applicable lawful grounds, including contractual necessity under Article 6(1)(5) of Law No. 152-FZ. This information notice is not a mandatory blanket consent.

4.2. Order-related contact, investigation of substantiated misuse, handling disputes, protecting rights and website security rely on an independently determined and applicable legal basis for each operation.

4.3. Separate optional consent is used for email promotions and, independently, SMS or specified messenger promotions. Optional analytics, advertising cookies, personalization, loyalty benefits outside the ordinary contract and voluntary user research rely on their own appropriate legal grounds and separately obtained consent wherever required.

4.4. Audio/video recording of delivery or handover, customer interviews, or recording interactions with the website may occur only if actually implemented for a specific lawful purpose, with advance disclosure and any required consent. This document does not authorize continuous screen recording or surveillance of all visitors.

5. Lawful basis and affirmative choice

5.1. Where consent is the lawful basis, Articles 6 and 9 of Law No. 152-FZ apply. Direct marketing through communication channels also falls under Article 15 and applicable Russian advertising rules.

5.2. Consent is given only by my affirmative action for the specific purpose stated beside the relevant checkbox. No checkbox is pre-selected. Declining optional processing does not prevent an ordinary purchase.

5.3. Disclosures to contractors or independent parties, publication of personal data and cross-border transfers require their own lawful-basis assessment and mandatory notices. General consent cannot replace Articles 10.1, 12 and 18 of Law No. 152-FZ.

6. Recipients and persons with access

6.1. Authorized EVA CODE personnel and contractors working on the controller's documented instructions (such as hosting and support providers) may access information only as required for their work, subject to confidentiality and security requirements.

6.2. Depending on the actual order, the parties receiving necessary payment or delivery data may include banks, payment services (PayPal, Visa, Mastercard, Kaspi, Mir and bank transfers, as applicable to the selected payment method), carriers and customs representatives. Listing supported payment methods does not imply that every provider receives every customer's data.

6.3. An ordinary purchase does not authorize disclosure to independent marketing partners for their own purposes. Where consent is the basis for such disclosure, the actual recipient, purpose, data categories and retention period must be disclosed before consent is requested.

7. Duration and withdrawal

7.1. My consent lasts only for the specified purpose and disclosed period or objective completion criterion, unless withdrawn sooner or processing otherwise lawfully ceases. Consent is not indefinite by default.

7.2. I may withdraw optional consent at orders@evacode.co.kr, by using an available unsubscribe link or the site's available settings. An inquiry should identify the relevant consent without submitting bank passwords, CVV/CVC or disproportionate identity documents.

7.3. Withdrawal does not automatically invalidate processing lawfully completed before withdrawal and does not require destruction of data that may or must be processed on another valid legal ground. Processing must stop, and records must be destroyed where required, within the procedures and time limits under Article 21 of Law No. 152-FZ.

8. User rights

8.1. I can request statutory information about my personal data and, where the law so provides, correction, restriction, destruction or cessation of processing, withdraw consent, complain to Roskomnadzor or seek judicial remedies.

8.2. Requests may be sent to orders@evacode.co.kr or the controller's mailing address: 경기도 안산시 단원구 별망로 555, 4층 420호, Republic of Korea. Where reasonably necessary, the controller may proportionately verify my identity or a representative's authority.

9. Processing after withdrawal

9.1. Where a separate statutory ground applies, the controller may continue certain processing without consent as provided by points 2–11 of Article 6(1), Article 10(2) and Article 11(2) of Law No. 152-FZ. This does not permit optional marketing after my consent is withdrawn.

9.2. Data related to unfinished orders, mandatory financial records and specific disputes are retained only under an applicable legal basis and for a justified period, as described in the Personal Data Processing Policy.

10. Accuracy and consent evidence

10.1. I confirm that the information I provide concerns me or another person whose information I may lawfully provide, and I undertake to keep the information reasonably up to date.

10.2. To demonstrate the recorded choice, the controller may retain the type and version of consent, its stated purpose, checkbox state, date and time, collection and withdrawal method, and minimum necessary technical evidence where lawfully justified. The controller must implement actual event recording; publishing this page alone does not record consent.

11. Final provisions

11.1. This consent notice accompanies but does not replace the Personal Data Processing Policy. Payment and sales terms are documented separately.

11.2. Optional consents may be granted or declined individually. Where Russian law applies, the applicable legal regime remains Russian regardless of whether the text is displayed in English or Korean.

11.3. If a particular operation requires special written consent by law, an ordinary checkbox does not substitute for that form.

Separate consent choices on the website