Personal Data Processing Policy

of Millio Limited Liability Company (Millio LLC) on the website https://atmosarena.space/

This is a translation provided for convenience. The Russian text of this Policy is the legally binding one; in case of any discrepancy, the Russian version prevails.

1. GENERAL PROVISIONS

1.1 Definition and purpose of the Policy

The Personal Data Processing Policy of the website of Millio Limited Liability Company (Millio LLC) https://atmosarena.space/ (hereinafter — the Policy and the Site respectively) sets out the procedure for obtaining, recording, processing, accumulating and storing information classified as personal data of visitors and users of the Site, and for protecting such data in accordance with the applicable law of the Russian Federation, as well as the rights and obligations of Millio LLC, its employees and the users of the Site.

1.2 Scope of the Policy

This Policy applies to all processes on the Site administered by Millio LLC, including user registration, participation in drone racing tournaments, viewing of broadcasts, feedback and other services.

1.3 Terms and definitions

1.4 Grounds and principles of processing

1.4.1 This Policy applies solely to relations with personal data subjects located in the territory of the Russian Federation and does not extend to foreign persons unless otherwise provided by their express declaration of will. The Operator is guided by:

• the Constitution of the Russian Federation;
• Federal Law No. 152-FZ “On Personal Data” (hereinafter — 152-FZ);
• the Civil Code of the Russian Federation;
• other laws and subordinate regulations governing the processing of personal data in the Russian Federation.

1.4.2 The Operator's activity is based on the following principles:

• lawfulness and fairness of personal data processing;
• limitation of processing to the achievement of specific, predefined and lawful purposes;
• prohibition of processing incompatible with the purposes of collection;
• inadmissibility of merging databases containing personal data processed for mutually incompatible purposes;
• correspondence of the content and scope of the personal data processed to the purposes predefined and declared at the time of collection;
• data minimisation — the Operator processes only such data as is necessary to achieve the purposes of processing;
• ensuring the accuracy of personal data, its sufficiency and, where necessary, its relevance to the purposes of processing;
• storing personal data in a form that allows the data subject to be identified for no longer than the purposes of processing require;
• confidentiality of the personal data processed — the Operator transfers data in the cases provided for by law or where the data subject has given consent;
• localisation of processing — the Operator ensures that personal data is collected and processed using databases located in the territory of the Russian Federation.

2. PURPOSES, TYPES AND SCOPE OF PERSONAL DATA PROCESSED

2.1 Purposes of processing

2.2 Categories of subjects and scope of personal data processed

2.3 Legal grounds for processing

• clause 1, part 1, article 6 of 152-FZ — consent of the personal data subject;
• clause 5, part 1, article 6 of 152-FZ — processing is necessary for the performance of a contract to which the subject is a party (for example, participation in a tournament);
• article 10.1 of 152-FZ — the subject's consent to the distribution of personal data (for the information published on the Site and in broadcasts — see clause 3.7 of this Policy);
• other grounds provided for by law.

2.4 Processing periods and conditions of termination

• Data is processed until the subject withdraws consent, or until the purposes of processing are achieved, or until the established retention periods expire, but for no longer than 3 years from the User's last interaction with the Site, unless otherwise provided by law.
• Processing terminates early upon withdrawal of consent (article 9 of 152-FZ) or upon liquidation of the Operator, unless otherwise prescribed by law.
• Upon expiry of the processing periods, personal data is subject to destruction or depersonalisation.

3. CONDITIONS OF PROCESSING AND TRANSFER OF PERSONAL DATA TO THIRD PARTIES

3.1 The Operator ensures the confidentiality of personal data, except where the user voluntarily provides information for public access.

3.2 The Operator may transfer personal data to third parties in the following cases:

• the user has consented to such actions;
• the transfer is necessary for the user to use a particular service or for the performance of the contract with the user (for example, to organise broadcasts or to interact with partner tournament organisers);
• the transfer is provided for by Russian law within an established procedure.

3.3 The Operator does not carry out cross-border transfer of personal data.

3.4 Personal data of users is processed with or without the use of automation tools, including collection, recording, systematisation, accumulation, storage, clarification, retrieval, use, transfer, depersonalisation, blocking, deletion and destruction.

3.5 In the event of loss or disclosure of personal data, the Operator informs the user thereof in the established manner.

3.6 The Operator takes the necessary organisational and technical measures to protect personal information from unlawful or accidental access, destruction, modification, blocking, copying, distribution, and from other unlawful acts of third parties.

3.7 Information published on the Site and in broadcasts (distribution of personal data). The Site is competitive and public in nature. For a User who has registered for an event, the Operator makes the following personal data publicly available:

• the nickname (callsign) and its previous variants;
• the surname and first name;
• the profile photo, club, team, sports organisation, region and city — if the User has provided them;
• the year of birth or the age group — where the rules of the sport require it (age and gender categories); the full date of birth is not published;
• the sports rank or title and judging category — where the event regulations require it;
• information on participation in events, race results, the place taken and the ranking position;
• photographic and video images obtained during the event.

3.7.1 This information is placed on the following information resources: event pages and participant lists on the Site, start and final protocols, tournament brackets, results tables and rankings, the public pilot page, live broadcasts and recordings of events on the Site and in the Operator's official accounts on social networks and video hosting services.

3.7.2 Placing this information constitutes distribution of personal data and is carried out on the basis of the User's separate consent, given under article 10.1 of 152-FZ by a separate tick at registration — independently of consent to other processing of personal data.

3.7.3 The User may set prohibitions and conditions on the distribution of particular items from the list in clause 3.7, and may prohibit their transfer other than by granting access to an unlimited number of persons. A prohibition is set and lifted in the profile settings or by contacting the Operator. The Operator observes the prohibitions set when compiling public lists, protocols and broadcast captions, except for information whose publication is mandatory under the law or the rules of the sport. Where information required by the regulations is covered by a prohibition, the organiser may refuse admission to the event concerned.

3.8 Information the Operator does not publish. The following is not placed in the public domain and is not made available to an unlimited number of persons: email address and telephone number; the full date of birth; identity document details; registered and actual residential addresses; insurance details; vehicle details; the emergency contact; the legal representative's details; information about the use of the Site. The list in clause 3.7 is exhaustive — anything not in it is not subject to distribution.

3.9 Transfer to event organisers. When a User submits an entry for an event, the Operator provides that event's organiser, chief judge, chief secretary and the credentials and technical committees with the User's personal data to the extent necessary to admit them to the competition, compile protocols and determine results:

• surname, first name and patronymic, date of birth and gender — including to check compliance with age and gender categories;
• contact details and the emergency contact;
• information on sports ranks, titles and judging categories;
• information about the equipment used and the results of its technical inspection;
• the information additionally provided for in clauses 3.10–3.12 of this Policy — where the regulations of the particular event require it.

3.9.1 The event organiser receives this information as an independent personal data operator, determines the conditions of its further processing within the running of the event and bears responsibility for that processing. The organiser is obliged to keep the information confidential and may not use it for purposes unrelated to the event.

3.10 Identity document details. Such details (type of document, series and number, issuing authority and date of issue, registered address) are requested not at registration on the Site but when an entry for a particular event is submitted, and only where the law, the rules of the sport or the event regulations require it: the work of the credentials committee, the award of sports ranks and titles, admission to premises with access control, or arranging insurance. The details are passed to the organiser of the event concerned and, in the cases provided for by law, to the competent authorities; they are not published in the public domain.

3.11 Vehicle details. The make, model and registration number of a vehicle, and the driver's surname and first name, are requested when an entry for an event is submitted if a pass is required to enter the premises where it is held. The details are passed to the event organiser and to the owner (administration) of the venue in order to issue the pass and organise parking; they are not published in the public domain.

3.12 Insurance details. The rules of the sport and event regulations require a participant to hold valid accident insurance. The Operator processes insurance details to the following extent: the name of the insurer, the policy number and validity period, the sum insured and the insurance programme. The details are passed to the event organiser to confirm admission and, where a policy is arranged through the Platform, to the insurer issuing it, to the extent necessary to issue the policy.

3.12.1 The Operator does not process special categories of personal data within the meaning of article 10 of 152-FZ: information about health, diagnoses, the results of medical examinations and doctors' opinions are neither collected nor stored on the Platform. A participant's medical clearance is checked by the event organiser outside the Platform; the Operator may process only the fact that such clearance exists or does not exist and its validity period — without any information about health. Nor does the Operator process biometric personal data: images are used solely to show the competition visually, and automated facial recognition is not carried out.

3.13 Transfer to federations, sports organisations and public authorities. Final protocols of completed competitions, entries and the information needed to award sports ranks and titles are transferred to the sports federations under whose auspices the event is held and to the competent public authorities in the field of physical culture and sport — in the cases and to the extent provided for by the law of the Russian Federation and the rules of the sport. The Operator does not publish such documents in the public domain.

3.14 Access of the legal representative. The legal representative of a minor User whose representation has been confirmed on the Site has access to all personal data of the represented minor processed by the Operator, including information on entries, participation in events and results. Access is granted for the duration of the representation.

3.15 Withdrawal of consent to distribution. Consent to the distribution of personal data may be withdrawn by the User at any time in the manner provided for in section 8 of this Policy, and also by a demand sent to the Operator under part 12 of article 10.1 of 152-FZ. From the moment the withdrawal is received, the Operator ceases distributing the information concerned. The withdrawal does not extend to protocols and results of completed competitions to the extent that they must be retained and published under the law and the rules of the sport, nor to previously released broadcast recordings.

4. SPECIFICS OF PROCESSING MINORS' PERSONAL DATA

4.1 The site https://atmosarena.space/ is not intended exclusively for a child audience, but does allow registration and use by minors.

4.2 The processing of personal data of minors under 14 years of age is permitted only with the consent of a legal representative (parent, adoptive parent or guardian).

4.3 The legal representative's consent must be:

• specific — stating the purposes of processing;
• informed — the representative must be acquainted with the Policy;
• conscious — a voluntary declaration of will;
• unambiguous — expressed in a form that does not allow ambiguous interpretation.

4.4 When registering a user who has indicated an age under 14, the Operator requests:

• the legal representative's full name;
• the legal representative's contact telephone number;
• the legal representative's email address;
• the degree of kinship.

4.5 The Operator may request confirmation of the legal representative's status (for example, by sending a copy of an identity document and a document confirming kinship or guardianship).

4.6 Users aged 14 to 18 may give consent to the processing of their personal data themselves, unless otherwise provided by law.

5. USERS' RIGHTS AND THE OPERATOR'S OBLIGATIONS

5.1 The user has the right:

• to obtain information about the processing of their personal data;
• to have their personal data clarified, blocked or destroyed where it is incomplete, inaccurate or unreliable;
• to withdraw consent to the processing of personal data;
• to appeal against the Operator's acts (omissions) to the authorised body for the protection of the rights of personal data subjects or to a court.

5.2 The Operator is obliged:

• to use the information received solely for the purposes stated in this Policy;
• to keep confidential information secret;
• to take the necessary measures to protect personal data from unlawful access, destruction, modification, blocking, copying and distribution;
• to cease processing and destroy personal data upon withdrawal of consent by the subject, achievement of the purposes of processing or expiry of the retention periods;
• to notify the subject of the loss or disclosure of their personal data.

6. CONTACTING THE OPERATOR

6.1 A user or other personal data subject may send the Operator an enquiry on matters relating to the processing of personal data, including a request for information, withdrawal of consent, or clarification or deletion of data.

6.2 The enquiry must contain:

• the number of the principal identity document of the subject or their representative;
• information on the date of issue of the document and the issuing authority;
• information confirming the subject's participation in relations with the Operator (login, nickname, email address, etc.);
• the signature of the subject or their representative.

6.3 Enquiries are sent to the email address millio.n.novgorod@yandex.ru or by post to the Operator's registered address.

7. LIABILITY OF THE PARTIES AND DISPUTE RESOLUTION

7.1 The Operator is liable for losses incurred by the user in connection with the unlawful use of personal data, in accordance with the law of the Russian Federation.

7.2 Before applying to a court, a written claim must be submitted.

7.3 A claim is considered within 30 calendar days from the date of its receipt.

7.4 Failing agreement, the dispute is referred to a court in accordance with the applicable law of the Russian Federation.

7.5 This Policy and the relations between the user and the Operator are governed by the applicable law of the Russian Federation.

8. WITHDRAWAL OF CONSENT

8.1 Consent may be withdrawn by sending a written application to the email address millio.n.novgorod@yandex.ru or by post to the Operator's registered address. Upon withdrawal of consent, the Operator ceases processing the personal data and destroys it within 30 days.

9. ADDITIONAL PROVISIONS

9.1 The Operator may amend this Policy without the user's consent. A new edition of the Policy takes effect from the moment it is published on the Site. Where the Policy changes materially, the Operator requests the consent of registered users again at their next sign-in to the Site.

9.2 By using the Site, the user accepts the terms of this Policy. If the user does not agree with the terms of the Policy, they must stop using the Site.

9.3 The current version of the Policy is always available on the Site at: https://atmosarena.space/privacy

© Millio LLC, 2026