Consent to Personal
Data Processing

01. General Provisions and the Operator

I hereby freely, voluntarily and in my own interest consent to the processing of my personal data by Individual Entrepreneur Irina Vladimirovna Ivashova (Taxpayer Identification Number [INN] 772030582829; Primary State Registration Number ofan Individual Entrepreneur [OGRNIP] 326774600027927; email: biz.ivashov@yandex.ru; the “Operator”) on the terms set out in this consent.

02. Personal Data Covered by This Consent

This consent applies to the personal data I independently provide when completing a form or submitting a request on the GRANDTHAI website:

• Surname, first name and patronymic, where these fields are included in the form.
• Contact telephone number.
• Email address, where the form includes an email field.
• The selected location, service, date and time of the visit.
• My comment or enquiry text.
• Order number, gift certificate number or other identifiers needed to process my request.
• Technical submission data: the date and time of submission, IP address, source page URL, version of the consent, and browser or device information, but only to the extent necessary to record consent and ensure security.

Ordinary website forms do not request special categories of personal data or biometric personal data.

03. Processing Purposes

• Processing my enquiry, request or order.
• Contacting me in connection with my request.
• Helping me choose a service, spa package, gift certificate, location or appointment time.
• Creating, confirming, changing or cancelling a booking.
• Concluding and performing a contract at my initiative.
• Processing the purchase of gift certificates, massage passes, prepaid spa credit and other services.
• Handling complaints and other requests.
• Ensuring website security and retaining evidence that consent was given.

04. Actions Performed on Personal Data

The Operator may carry out the following actions on my personal data: collection, recording, systematisation, accumulation, storage, clarification (updating or alteration), retrieval, use, provision of access and transfer to the extent necessary for the stated purposes, depersonalisation, blocking, removal and destruction.

Processing may be carried out with or without automated means.

05. Third Parties and Entrusted Processing

The Operator may entrust processing to parties providing services necessary to fulfil the stated purposes, including website hosting, CRM and online booking systems, communications, payments, delivery and technical support, subject to confidentiality and compliance with legislation. Only the minimum data necessary for the relevant purpose may be provided.

Personal data may be provided to state authorities in circumstances and in the manner established by legislation of the Russian Federation.

This consent does not authorise public dissemination or publication of my personal data.

06. Period of Consent and Data Storage

This consent takes effect when it is given and remains valid until the processing purposes have been achieved or I withdraw it, unless a longer storage period is required by legislation or a contract.

When the purposes have been achieved, consent has been withdrawn or another lawful basis for processing no longer exists, the Operator must cease processing and destroy or depersonalise the data in the manner and within the periods required by law.

07. Withdrawing Consent

I may withdraw this consent by emailing biz.ivashov@yandex.ru with the subject “Withdrawal of Consent to Personal Data Processing”.

To help identify the request, I am advised to provide my name, the contact details used in the website form and, where available, the order number or other request identifiers.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. After consent has been withdrawn, the Operator may continue processing only where an independent legal basis exists.

08. Confirmation by the User

By selecting the separate checkbox and submitting the form, I confirm that:

• I have read this consent and the PrivacyPolicy.
• I understand the processing purposes, the categories of data and the actions to be performed on that data.
• I provide the data voluntarily and confirm that it is accurate.
• I understand my right to withdraw consent.
• I am not providing another person's data without a lawful basis or the necessary consent.