1. Purpose of This Policy

This Privacy Policy (the Policy) applies to all protected information processed on the i-Harbor website on its Russian domain (the Site), including personal data as defined by applicable law. The service is owned and operated by MOYA GAVAN LIMITED LIABILITY COMPANY, located at 41/1 Sovetskaya Street, Severskaya, Krasnodar Krai, 353240, Russia (Site Administration).

Site Administration takes information security seriously and processes information in strict compliance with applicable law when the Site is used.

This Policy explains what information Site Administration collects and considers confidential, and how it processes, stores, and protects that information.

2. Definitions

3. Key User Rights

Where provided by applicable law, the User has the right to access their personal data processed by Site Administration in accordance with this Policy.

If the User believes information held about them by Site Administration is inaccurate or incomplete, they may sign in to their account and correct the information themselves.

The User has the right to:

• request deletion of their personal data;

• request restrictions on processing their personal data;

• object to processing their personal data where provided by applicable law.

Site Administration will fulfill these requests in accordance with applicable law.

Where provided by applicable law, the User may also have rights not listed above.

To exercise these rights, the User may submit a request to Site technical support or, if that function is unavailable in the interface, contact Site Administration.

4. Purposes of Personal Data Collection

Site Administration processes User data for specific purposes and processes only data relevant to achieving those purposes.

Data is processed for the following purposes:

• Providing the User with access to information about goods and services they ordered;

• Holding promotions, promotional sweepstakes, and contests for Site users;

• Collecting and analyzing Site usage statistics;

• Improving the usability and functionality of our Site;

• Contacting the User to send notifications, requests, and information concerning Site operation, performance of agreements, or processing of User requests and applications;

• Registering the User on the Site;

• Sending news about changes in Russian law;

• Receiving User requests and applications;

• Collecting and analyzing Site visitor statistics;

• Providing information about the Site and its services;

• Providing the User with access to the Site;

• Providing access to the account dashboard;

• Arranging User participation in events held by Site Administration.

5. Information Collected and Processed by Site Administration

The personal information collected during Site operation may vary depending on how the User uses the Site. Site Administration does not verify data provided by the User and cannot assess its accuracy. However, it assumes that the User provides accurate and sufficient data and keeps it up to date.

The following User data may be processed through the Site:

• Information about your messages to other users;

• Technical data, including HTTP headers, IP address, cookies, browser identifier data, and hardware and software information, for statistical purposes and service improvement;

• Geolocation information;

• Information about services ordered or received;

• Information about User activity while using the Site;

• The date and time of access to the Site;

• Contact information, including work, home, and mobile phone numbers or other contact methods;

• Account information provided when creating a user account or editing the information entered during account creation;

• Last name, first name, and patronymic;

• Information about User communications with technical support;

• Photographs, images, and other files uploaded or transmitted by the User through the Site;

• Information about audio and video content of the User.

With User consent, Site Administration publishes their personal data in publicly accessible sources.

The User acknowledges and confirms that all data directly or indirectly related to payment for services, including bank card details, is entered by the User on websites owned by third parties unrelated to Site Administration. Site Administration has no access to such information and performs no operations on it, including collection, organization, accumulation, storage, clarification (updating or modification), use, dissemination (including transfer), anonymization, blocking, destruction, or cross-border transfer.

Site Administration does not make decisions that have legal consequences for the User or otherwise affect their rights and lawful interests based solely on automated personal data processing.

6. Who May Receive Information

Site Administration does not disclose User information to third parties except where expressly provided by applicable law.

7. Where User Information Is Processed and Stored

The Site servers used to collect and process your information are located at facilities of Domain Name Registrar REG.RU LLC within the Russian Federation.

8. How Long Site Administration Retains User Information

Site Administration retains User data for the entire period of Site use and for 3 years afterward.

To remove an account or other data from the Site before that period expires, the User must submit a request to Site Administration.

9. How Site Administration Protects User Information

Site Administration has implemented sufficient technical and organizational measures to protect User data from unauthorized, accidental, or unlawful destruction, loss, alteration, misuse, disclosure, access, and other unlawful forms of processing.

In most cases, information is processed automatically without access by Site employees. If access is necessary, it may be granted only to employees who need it to perform their duties, with a documented justification. To protect data and ensure confidentiality, all employees have been informed of and must comply with internal personal data processing rules and procedures.

To provide adequate protection for personal data of the User, Site Administration assesses the potential harm resulting from a personal data security breach and identifies current security threats when the data is processed in personal data information systems.

Physical security of the Site servers is provided by round-the-clock security personnel and an access control system for the server room. Access is limited to authorized individuals.

Protection against unauthorized access is provided through appropriate information security tools and continual updates to system and application software. User and administrator activity is audited. The servers are located in a separate network segment protected by a firewall (DMZ). Computer attack detection and security event analysis tools are used. All security tools have the required certifications from the Federal Service for Technical and Export Control of Russia (FSTEC) and/or the Federal Security Service of Russia (FSB).

The communication channel between the servers and the User is secured using public-key encryption based on HTTPS. The User verifies our servers through a trusted certificate.

The measures taken by Site Administration cannot ensure the required level of confidentiality without adequate measures by the User. The client computer must have modern antivirus software with current definitions, the latest browser and plug-in versions, and a modern operating system. The Site User must have at least a basic understanding of computer security and follow good computer security practices.

10. Questions and Suggestions

Site Administration welcomes questions and suggestions concerning implementation of or changes to this Policy. The User may reach us using the details in the

section. The User may also use these contact methods to submit requests to exercise their rights or complaints about inaccurate User information or unlawful processing.