Date of posting: 31.08.2026
Effective date: 31.08.2026
Version: 310826

This Personal Data Processing Policy (the "Policy") has been developed by "3D Innovations" LLC, official state registration number 1117847131984, registered office at 197183, Saint-Petersburg, Savushkina street, 12A, premises 12-N ("Varwin", the "Company" or the "Operator"), in accordance with the requirements of the applicable personal data protection law.

The Policy determines the procedure for, and the terms of, the processing of personal data carried out by Varwin in connection with the use of the website https://varwin.com, the Varwin platform and the services related thereto, as well as in connection with the interaction of users with the Company relating to the provision of those products and services.

For the purposes of this Policy, the Varwin platform means the Varwin hardware and software complex, including the software products, functional capabilities, services and corresponding modes of use provided as part thereof and available to the user depending on the access right or licence granted to that user.

This Policy applies to the personal data of individuals who provide their personal data to Varwin themselves, or whose personal data Varwin obtains in any other manner provided for by the applicable law.

This Policy is a publicly available document and is posted on the Internet at https://varwin.com/en/vr-development/privacy-policy/.

Personal data means any information relating to a directly or indirectly identified or identifiable individual (personal data subject).

Processing of personal data means any action (operation) or set of actions (operations) performed with personal data with or without the use of automation tools, including the collection, recording, systematisation, accumulation, storage, updating (renewal, modification), extraction, use, transfer (dissemination, provision, access), depersonalisation, blocking, deletion and destruction of personal data.

1. Amendment of the Policy

Varwin shall be entitled to amend this Policy in connection with changes in the applicable law, in the procedure for the processing of personal data, in the technologies used, in the functionality of the website, the platform and the software, as well as in other cases where this is necessary in order to keep the Policy up to date.

The current version of the Policy is posted on the Internet at https://varwin.com/en/vr-development/privacy-policy/.

A new version of the Policy shall apply from the date specified in that version of the Policy, unless otherwise provided by the applicable law.

Where amendments to the Policy require a separate consent of the personal data subject or the performance of any other action by the personal data subject as provided for by law, Varwin shall take the corresponding steps under the procedure established by law.

On matters relating to the processing of personal data, the exercise of the rights of personal data subjects and the obtaining of information on the processing of personal data, you may contact Varwin at the e-mail address: dpo@varwin.com

2. Principles of the Processing of Personal Data

Varwin processes personal data on the basis of the following principles:

— lawfulness and fairness of the processing of personal data;

— limitation of the processing of personal data to the achievement of specific, predetermined and lawful purposes;

— prevention of any processing of personal data incompatible with the purposes of their collection;

— prevention of the merging of databases containing personal data processed for purposes incompatible with each other;

— processing only of such personal data as correspond to the declared purposes of their processing;

— correspondence of the content and volume of the personal data processed to the declared purposes of the processing;

— prevention of the processing of personal data that is excessive in relation to the declared purposes of their processing;

— ensuring the accuracy, sufficiency and, where necessary, the currency of personal data in relation to the purposes of their processing;

— destruction or depersonalisation of personal data upon achievement of the purposes of their processing or upon the loss of the need to achieve such purposes, unless otherwise provided by the applicable law.

3. Categories of Personal Data Processed

Depending on the website, the Varwin platform and the services you use, and on the nature of your interaction with Varwin, the Company may process the following categories of personal data.

4.1. Personal data provided by the subject independently

Depending on the manner of interaction with Varwin, the personal data subject may provide independently:

— first name;

— surname;

— e-mail address;

— telephone number;

— city, country or other location information provided by the user;

— information required for the execution and performance of a contract concluded with Varwin;

— other information which you provide to Varwin voluntarily within the relevant interaction.

4.2. Technical data

When the website, the Varwin platform and the services related thereto are used, Varwin may automatically process:

— IP address;

— information on the operating system used;

— information on the browser;

— information on the device and on the parameters of its interaction with the website;

— the date and time of visiting and using the website;

— information on user actions on the website, to the extent necessary to ensure its operation and security;

— information obtained automatically as a result of the use of cookies;

— other technical information automatically transmitted by the device and software used.

4.3. Data obtained by means of device functions

Where the use of a particular function of the website, the platform or the software requires access to the camera, the microphone, geolocation or other functions of the device, the relevant information may be processed by Varwin solely to the extent and for the purposes necessary for the operation of such function, taking into account the settings of the device and of the software used.

5. Cookies and Similar Technologies

When the Varwin website is used, cookies may be stored on the user's device and similar technologies may be applied.

A cookie is a small piece of data stored in the browser on the user's device which allows, in particular, the correct operation of the website to be ensured, the user's settings to be saved, the user session to be maintained and information on the use of the website to be obtained.

Varwin may use:

— necessary cookies — to ensure the operation of the website, authorisation, maintenance of the user session and the operation of individual functions;

— functional cookies — to save the settings selected by the user and to improve the convenience of using the website;

— analytical cookies — to obtain aggregated information on the use of the website and to analyse its operation.

The composition and storage period of the cookies used may vary depending on the purpose of the relevant file and on the services used on the website.

The user may change the settings for the use of cookies by means of the browser settings and, where such functionality is provided on the website, by means of the available cookie settings.

Disabling certain categories of cookies may result in a limitation of the functionality of the website.

More detailed information on the cookies used may be provided directly on the website in the relevant notice or in the cookie settings management interface.

6. Purposes and Legal Grounds for the Processing of Personal Data

Varwin processes personal data for the following purposes:

— registration and identification of the user, including the creation and maintenance of an account;

— identification of the user in the cases where such identification is necessary for the use of the relevant functions;

— conclusion and performance of contracts with users, including the placing of an order, the granting of a software licence, the activation of a licence, the granting of access to the relevant products and services, and the handling of related requests;

— provision of technical and user support, handling of requests and elimination of technical problems that arise;

— ensuring the security of the website, the platform and the Varwin information systems, including the prevention of fraud, unauthorised access and other unlawful actions;

— ensuring the operation and improvement of the website, the platform and the Varwin information systems, including the analysis of technical errors and user interaction, and improvements to the design and ease of use;

— analysis of technical errors and user interaction and improvement of the website, the platform and their functionality;

— compilation of aggregated statistics and carrying out of analytics in respect of the use of Varwin products and services;

— sending you service messages relating to the use of the website, the platform and the services provided;

— sending informational and advertising messages on the products, services and events of Varwin — where a corresponding legal ground exists and, in the cases where this is required by law, with the necessary consent obtained;

— performance of the obligations established by the applicable law, including obligations in the field of accounting, tax and other mandatory records;

— protection of the rights and legitimate interests of Varwin in the event of disputes, claims and other legal situations.

The processing of personal data is carried out on the grounds provided for by the applicable law, including the necessity of processing personal data for the conclusion and performance of a contract, the performance of obligations established by law and, in the cases provided for by law, the consent of the personal data subject.

Where the processing of personal data for particular purposes requires a separate consent of the personal data subject, such consent shall be given under the procedure established by the applicable law.

Where it becomes necessary to use personal data for purposes not provided for by this Policy, Varwin shall determine the corresponding legal ground and, where this is required by law, shall provide the personal data subject with the necessary information and obtain the subject's consent before the commencement of such processing.

7. Withdrawal of Consent

The personal data subject shall be entitled to withdraw the consent given to the processing of personal data in the cases and under the procedure provided for by the applicable law.

The withdrawal of consent shall not affect the lawfulness of the processing of personal data carried out prior to the moment of such withdrawal.

The withdrawal of consent shall not terminate the processing of personal data where the continuation thereof is permitted by the applicable law on another legal ground, including where the processing is necessary for the performance of a concluded contract or for the fulfilment of obligations established by the applicable law.

To withdraw consent or to exercise other rights in respect of the processing of personal data, you may contact Varwin at: dpo@varwin.com

8. Periods and Procedure for the Storage of Personal Data

Varwin stores personal data for no longer than is necessary to achieve the purposes of their processing, unless a longer storage period is established by the applicable law or is necessary for the protection of the rights and legitimate interests of Varwin.

The storage period is determined taking into account the nature and purposes of the processing of the relevant personal data, as well as the requirements of the law.

Upon achievement of the purposes of the processing or upon the loss of the need to achieve them, personal data shall be destroyed or depersonalised, unless otherwise provided by the applicable law.

Where a demand for the deletion of personal data is received from a personal data subject, Varwin shall consider such demand under the procedure established by law.

Where grounds provided for by law exist for the further storage of certain data, such data may be retained for the established period.

9. Place of Storage and Processing of Personal Data

The personal data of users are stored on servers located within the territory of the Russian Federation.

For the storage and processing of personal data, Varwin may use its own information systems as well as the information systems and infrastructure of third parties engaged by Varwin to ensure the operation of the website, the platform and the services related thereto.

Varwin thereby takes the legal, organisational and technical measures necessary for the protection of personal data in accordance with the requirements of the applicable law.

Information on the persons processing personal data on the instruction of Varwin, and other information provided for by law, shall be provided to the personal data subject under the procedure established by this Policy and by the applicable law.

On matters relating to personal data protection measures, you may contact us at: dpo@varwin.com

10. Measures to Ensure the Security of Personal Data

The security of the personal data processed by Varwin is ensured through the application of the legal, organisational and technical measures necessary to comply with the requirements of the applicable personal data protection law.

In order to prevent unauthorised access to, modification, dissemination, blocking and destruction of, and other unlawful actions in respect of, personal data, Varwin takes, in particular, the following measures:

1. identification and authentication of access subjects and access objects;

2. management of the access of access subjects to access objects;

3. restriction of the software environment;

4. protection of the machine media on which personal data are stored and/or processed (the "machine media of personal data");

5. registration of security events;

6. anti-virus protection;

7. intrusion detection (prevention);

8. control (analysis) of the security of personal data;

9. ensuring the integrity of the information system and of personal data;

10. ensuring the availability of personal data;

11. protection of the virtualisation environment;

12. protection of technical means;

13. protection of the information system, its facilities, and communication and data transmission systems;

14. detection of, and response to, incidents (a single event or a group of events) which may lead to failures or to disruption of the operation of the information system and/or to the emergence of threats to the security of personal data;

15. configuration management of the information system and of the personal data protection system;

16. application of other legal, organisational and technical measures provided for by the applicable law and by the internal documents of Varwin.

The specific set of protection measures applied is determined taking into account the nature and volume of the personal data processed, the current security threats and the requirements of the applicable law.

Where a user is provided with credentials for access to the website, the platform or other Varwin services, the user shall be obliged to maintain the confidentiality of those credentials independently and not to transfer them to third parties. Varwin shall not be liable for the consequences of the user transferring the user's credentials to third parties, unless otherwise provided by the applicable law.

11. Transfer of Personal Data to Third Parties

Varwin may provide personal data to third parties in the cases and to the extent necessary to achieve the purposes of the processing of personal data specified in this Policy, as well as in the cases provided for by the applicable law.

Such third parties may include:

— providers of information, telecommunication, technical and other services ensuring the operation of the website, the platform and the services related thereto;

— organisations and individual entrepreneurs engaged to provide services relating to the technical support, maintenance and development of information systems;

— payment organisations and other persons involved in the processing of payments and in ensuring settlements;

— organisations ensuring information security and the prevention of fraudulent actions, spam and other abuses;

— persons to whom personal data must be provided in accordance with the requirements of the applicable law;

— other persons, where such provision is necessary for the performance of contracts with the user or is carried out on another lawful ground.

Where personal data are processed by a third party on the instruction of Varwin, such person undertakes to comply with the requirements of the applicable personal data protection law and to ensure the confidentiality and security of the personal data processed.

Personal data shall not be provided to third parties for use for purposes incompatible with the purposes specified in this Policy, unless otherwise provided by the applicable law.

In the event of a reorganisation, a change of owner, a sale of the business or a part thereof, a transfer of individual assets, a merger, an accession or other corporate changes, personal data may be transferred to a legal successor or to another person in the cases and under the procedure provided for by the applicable law, subject to compliance with the requirements for the processing and protection of personal data.

Where necessary, Varwin shall take the measures provided for by law to notify personal data subjects of changes in the terms of the processing of their personal data.

12. Rights of Personal Data Subjects and the Procedure for the Exercise Thereof

In accordance with the applicable law, a personal data subject shall be entitled:

1. to demand the updating, blocking or destruction of the subject's personal data in the cases provided for by the applicable law, including where the personal data are incomplete, outdated or inaccurate, or are not necessary for the declared purpose of the processing;

2. to receive information concerning the processing of personal data, to the extent and under the procedure provided for by the applicable law, including:

(a) confirmation of the fact of the processing of personal data;

(b) the legal grounds and purposes of the processing of personal data;

(c) the purposes and the methods applied for the processing of personal data;

(d) the name and location of the operator, information on the persons (other than the operator's employees) who have access to the personal data or to whom the personal data may be disclosed on the basis of a contract with the operator or on the basis of the applicable law;

(e) the personal data processed and the source from which they were obtained, unless another procedure for the presentation of such data is provided for by the applicable law;

(f) the periods of the processing of personal data, including the periods of their storage;

(g) the procedure for the exercise of rights;

(h) information on any cross-border data transfer carried out or intended;

(i) the name of the person processing personal data on the instruction of Varwin, where the processing is or will be entrusted to such person;

(j) other information provided for by the current legislation;

3. to protect the subject's rights and legitimate interests, including to demand compensation for losses and/or compensation for moral harm in court.

In order to exercise the subject's rights in the field of the processing of personal data, the personal data subject may send a request to Varwin at the e-mail address dpo@varwin.com.

The request must allow the applicant to be identified and must contain the information necessary for the consideration of the relevant demand.

In the cases provided for by the applicable law, Varwin shall be entitled to request additional information and documents necessary to confirm the identity of the applicant and the applicant's powers.

Requests of personal data subjects shall be considered within the periods and under the procedure established by the applicable law.

13. Processing of Personal Data of Minors

Independent registration, submission of forms on the website varwin.com and use of the Varwin personal account by individuals are permitted where the user has reached the age of 18 years, unless otherwise expressly provided by the terms of the relevant product or service.

Persons under the age of 18 years may use certain Varwin products and services in the cases and under the procedure provided for by the terms of the relevant product or service, including with the participation of their legal representative or within the use of a product or service organised by an educational organisation.

In the cases where the applicable law requires the consent of the legal representative of a minor to the processing of the minor's personal data, such consent shall be obtained under the procedure established by law.

If Varwin becomes aware of the registration or use of a personal account by a person who has not reached the established age, in breach of the established terms of use, Varwin shall take the measures provided for by law and by the applicable terms of use, including the termination of the relevant access and the deletion of the personal data, unless lawful grounds for their further processing exist.

In the cases provided for by the applicable law, certain personal data may be retained to the extent and for the period necessary for the performance of the relevant legal obligations or for the protection of the rights and legitimate interests of Varwin.

14. Requests and Complaints

If a personal data subject considers that the processing of the subject's personal data is carried out in breach of the requirements of the applicable law or violates the subject's rights and legitimate interests, the subject shall be entitled to send a request to Varwin at dpo@varwin.com, and also to apply to the competent supervisory authority for the protection of the rights of personal data subjects or to a court under the procedure established by the applicable law.