CONSENT

to the processing of personal data of a user of the «Laffy Smart Wishlist» application

Version of 7 September 2026

This English version is a translation provided for convenience. In case of any discrepancy, the Russian version at https://laffy.store/consent.html prevails.

This Consent is a separate electronic document and is not part of the user agreement, offer or Privacy Policy.

I, a user of the «Laffy Smart Wishlist» application, acting freely, of my own will and in my own interest, give INOLT LLC, INN 2223639154, KPP 222301001, located at office N15, 99 Vlasikhinskaya St., Barnaul, Altai Krai, Russia, my consent to the processing of my personal data on the terms set out below.

1. List of personal data

I allow the processing of:

• my mobile phone number;
• my name or the display name I have chosen;
• my city of residence;
• my profile photo;
• my account identifier;
• the wishlists I have created;
• names, descriptions, links and images of wishes;
• visibility settings and information about my actions within the Application;
• my support requests;
• IP address;
• information about my device and operating system;
• the Application version;
• the installation identifier and push token;
• information about sign-ins, errors and security events.

My photo is used only as a profile image and is not used for biometric identification or face recognition.

2. Purposes of processing

I give my consent for:

• registration and creation of an account;
• confirmation of my phone number;
• sign-in and access recovery;
• filling in and displaying my profile;
• creating, storing and editing wishlists;
• providing sharing features;
• synchronising data between devices;
• sending service and security-related messages;
• handling requests;
• preventing fraud and abuse;
• diagnosing errors and improving the Application;
• complying with the law.

This Consent is not consent to receive advertising and is not consent to the dissemination of personal data to an indefinite range of persons.

3. Permitted actions

I allow the Operator to carry out:

• collection;
• recording;
• systematisation;
• accumulation;
• storage;
• clarification, updating and modification;
• retrieval;
• use;
• granting access to authorised processors;
• depersonalisation;
• blocking;
• deletion;
• destruction.

Processing may be carried out by automated means, without automation, or by mixed means.

4. Parties engaged in processing

I have been informed that the Operator may entrust processing to organisations providing Russian hosting, sending of SMS codes, delivery of push notifications, technical support, image storage, error monitoring and information security:

5. Term

The Consent is valid from the day it is given for as long as my account exists and until the purposes of processing are achieved.

After my account is deleted or the Consent is withdrawn, the Operator stops processing and destroys the data within the periods provided for by law, unless there is another lawful basis for keeping it.

6. Withdrawal of Consent

I may withdraw the Consent:

• using the account deletion feature;
• by e-mail: laffyconnect@bk.ru;
• by letter to the address of INOLT LLC.

Withdrawal does not affect the lawfulness of processing carried out before it was received.

I understand that after the Consent is withdrawn, the Operator may delete my account if the Application's features cannot be provided without the relevant data.

7. How the Consent is given

The Consent is deemed given after I have:

• read the separate text of the Consent;
• ticked the box «I consent to the processing of personal data» myself;
• confirmed my phone number with a one-time SMS code;
• tapped the «Create account», «Sign up» or another button with unambiguous wording.

The Operator records the version of the Consent, the date and time it was accepted, the account identifier, the phone number, the result of SMS confirmation, the IP address and device information to the extent necessary to confirm that the Consent was obtained.