Consent to the Processing of Personal Data

Version 1.0 of 1 November 2026

This version is in force and is applied on the service. The text is under review by a lawyer.

1. Who Gives Consent and to Whom

1.1. I, a user of the NAP Store online service (https://store.napsystem.com, the "Service"), acting freely, of my own will and in my own interest, give specific, substantive, informed, conscious and unambiguous consent to the processing of my personal data to:

• [LEGAL ENTITY NAME], Republic of Serbia, MB [МБ], PIB [ПИБ], address: [АДРЕС] (the "Operator");
• and, for orders paid through ЮKassa, also to the seller named in the order and in the receipt: [РОССИЙСКОЕ ЮРЛИЦО ИЛИ ИП, ОГРН/ОГРНИП, ИНН, АДРЕС].

1.2. This consent is issued separately from other documents (Article 9(1) of Russian Federal Law No. 152-FZ "On Personal Data" as in force since 01.09.2025) and constitutes consent within the meaning of Articles 6(1)(a) and 7 GDPR and Articles 12(1)(1) and 15 of the Serbian Law on Personal Data Protection (ZZPL).

2. Which Data

2.1. This consent covers the following data:

1. Account: e-mail address, password (stored only as a hash), display name, interface language, roles, account creation and deletion time.
2. Orders and payments: app purchases and subscriptions (app, price, status, dates, refunds); hardware orders (items, prices), parcels, tracking events, returns; payment status and payment provider references (the Operator does not receive card numbers).
3. Delivery: recipient name, company, address (address lines, city, region, postal code), phone, optional Latin transliteration; saved addresses.
4. Reviews: text, rating, display name (published with the review), helpful votes, reports.
5. Devices and sessions: registered playback devices (type, capabilities), playback sessions (app, time, progress, completion), headphone confirmation, left/right channel test result.
6. Technical data: session and security (CSRF) cookies, IP address and request IDs in technical logs, audit log entries.
7. Requests: e-mail correspondence.
8. For developers and suppliers — also name / company name, payout account ID (Stripe Connect), uploaded files.

2.2. Wellbeing data, questionnaire answers and measurements (heart rate, HRV) are not covered by this consent. They are processed only under the separate "Consent to the Processing of Wellbeing Data and Measurements".

3. Purposes

3.1. The data are processed in order to:

1. register and maintain the account and log in to the Service;
2. provide access to apps, subscriptions and the player;
3. place, pay for and deliver orders, handle returns and warranty service;
4. publish and moderate reviews;
5. send notifications about order performance (order status, moderation, refunds);
6. ensure the security of the Service and prevent fraud;
7. handle requests and claims;
8. comply with accounting, tax and consumer protection law.

4. Operations

4.1. I consent to the following operations with my data: collection, recording, organisation (systematisation), accumulation, storage, rectification (updating, alteration), retrieval, use, transfer (provision, access), anonymisation, blocking, erasure, destruction.

4.2. Processing is carried out both with and without the use of automated means (mixed processing).

5. Disclosure to Third Parties, Including Cross-Border

5.1. I consent to the transfer of (provision of, access to) data to the following recipients to the extent necessary for the stated purposes:

5.2. My personal data are not disclosed to app developers; they see only aggregated statistics and my reviews with my display name.

5.3. I understand and agree that data may be transferred outside my country of residence — between Serbia, EU Member States, the USA and Russia — subject to the safeguards described in the Privacy Policy (adequacy decisions, standard contractual clauses). Cross-border transfers of data of users in Russia are carried out in accordance with Article 12 of 152-FZ.

6. Term of Consent and Retention

6.1. This consent is valid until the purposes of processing are achieved, until I delete my account or until I withdraw consent, whichever occurs first.

6.2. The data are then deleted or anonymised. However, order, payment and accounting records are kept for the period required by accounting and tax law (as a rule 5–10 years) — on the basis of law, not of this consent.

7. How to Withdraw Consent

7.1. I may withdraw consent at any time by:

• sending a request to [E-MAIL ПО ПЕРСОНАЛЬНЫМ ДАННЫМ] from the e-mail address linked to my account; or
• deleting my account in my profile.

7.2. Withdrawal does not affect the lawfulness of processing before it. After withdrawal, the Operator stops processing and destroys the data within the time limits set by law (under 152-FZ — within 30 days), unless another legal ground applies. Without processing of account data it is not possible to use the account or place orders.

8. How Consent Is Given

8.1. Consent is given by ticking a separate, not pre-ticked box "I consent to the processing of personal data" at registration. The text of this consent is available via the link next to that box and in the Service footer.

8.2. Detailed information on processing is set out in the NAP Store Privacy Policy.

Notes for the lawyer (remove after review)

1. Separateness (152-FZ Art. 9(1)). The document is separate and confirmed by a separate checkbox; ensure the UI does not merge it with acceptance of the Terms of Use.
2. Localisation (Art. 18(5)) — depends on [СТРАНА РАЗМЕЩЕНИЯ СЕРВЕРА]; a decision is needed if initial recording happens outside Russia.
3. Roskomnadzor notifications — of processing (Art. 22) and of cross-border transfer (Art. 12).
4. Consent as a basis under GDPR/ZZPL. For data necessary to perform the contract, the primary GDPR/ZZPL basis is the contract; consent here is needed mainly for 152-FZ. Check the wording so that withdrawal is not read as blocking performance of already paid orders.
5. Publication of display names in reviews — separate consent to dissemination may be required (Art. 10.1).
6. [ПОЧТОВЫЙ СЕРВИС] and [ХОСТИНГ-ПРОВАЙДЕР] are not yet chosen — complete once selected.
7. Technical log retention of [90] days — confirm.
8. EU representative (Art. 27 GDPR) — if the Service targets EU users; a Serbian representative is not needed (the operator is Serbian).
9. Age — consent may be given by persons 18+; younger only via a parent's account. Check thresholds: ZZPL Art. 16 (15), GDPR Art. 8 (16), Russia (14).
10. Russian seller for ЮKassa orders — confirm whether naming it as a recipient of this consent is sufficient or a separate document in its name is needed.