Personal Data Processing Policy

Version of May 15, 2026.

1. Personal Data Operator

The personal data operator is:

• Full name: Limited Liability Company «BIFRI» (Общество с ограниченной ответственностью «БИФРИ»)
• Short name: LLC «BIFRI»
• TIN (ИНН): 7813133641
• OGRN (Primary State Registration Number): 1037828024090
• KPP (Tax Registration Reason Code): 781301001
• Registered address: 197110, Saint Petersburg, intra-city territory Municipal District Chkalovskoye, Lodeynopolskaya st., 5, lit. A, room 1-N, office 610
• Phone: +7 (812) 438-16-78
• E-mail for personal data inquiries: i-free@i-free.com

Hereinafter — "Operator" or "Company". The website i-free.com (hereinafter — "Website") is owned by the Operator.

2. Definitions

• Personal Data (PD) — any information relating to a directly or indirectly identified or identifiable individual (data subject).
• Operator — a legal entity organizing and/or carrying out the processing of personal data.
• Processing of personal data — any operation or set of operations performed with or without the use of automation tools: collection, recording, systematization, accumulation, storage, clarification, retrieval, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction.
• Consent to processing — voluntary, specific, informed and unambiguous expression of the data subject's will.
• Distribution of personal data — actions aimed at disclosing personal data to an indefinite circle of persons.
• Cookies — small text files stored on the user's device by the browser when visiting the Website.
• Data subject — an individual to whom the personal data relates.

3. Legal Grounds for Processing

The Operator processes personal data on the basis of:

• the Constitution of the Russian Federation;
• Federal Law No. 152-FZ of July 27, 2006 «On Personal Data»;
• other regulatory legal acts of the Russian Federation;
• the consent of the data subject (Art. 6 § 1 cl. 1 of 152-FZ);
• performance of a contract to which the data subject is a party (Art. 6 § 1 cl. 5 of 152-FZ);
• the legitimate interest of the Operator, if it does not violate the rights of the data subject (Art. 6 § 1 cl. 7 of 152-FZ).

4. Purposes of Processing

Purpose 1. Processing of inquiries received by the Operator via e-mail

• Legal grounds: Art. 6 § 1 cl. 1 of 152-FZ — consent of the data subject expressed by sending the inquiry.
• Categories of PD: full name (if provided), e-mail, phone (if provided), content of the inquiry.
• Processing term: 12 months from receipt, or until withdrawal of consent.
• Method: non-automated (incoming correspondence) and automated (storage in the Operator's email systems).

Purpose 2. Operation of the Website and web analytics

• Legal grounds: Art. 6 § 1 cl. 5 of 152-FZ (ensuring Website operation) and consent to the use of cookies (Art. 6 § 1 cl. 1).
• Categories of PD: cookie identifiers, IP address, browser and device technical data, on-site behavior data, referrer.
• Processing term: up to 2 years (determined by the lifetime of the specific cookie); access logs — up to 12 months.
• Method: automated.
• Services used: Yandex.Metrica (web analytics counter by Yandex LLC).

Purpose 3. Informing about the company, projects and publications

• Legal grounds: Art. 6 § 1 cl. 5 of 152-FZ — placement of publicly available corporate information.
• Categories of PD: none (anonymized data, publicly available information, and AI-generated illustrations are used).
• Processing term: unlimited (until publication is withdrawn).
• Method: automated.

5. List of Actions with Personal Data

The Operator performs the following actions (operations) with personal data:

• collection;
• recording;
• systematization;
• accumulation;
• storage;
• clarification (update, modification);
• retrieval;
• use;
• transfer (distribution, provision, access) — in cases stipulated by this Policy and the legislation of the Russian Federation;
• depersonalization;
• blocking;
• deletion;
• destruction.

6. Transfer of Personal Data to Third Parties

The Operator does not transfer personal data to third parties, except in the following cases:

• Contractor-processors (hosting provider, email infrastructure operator) — on the basis of a data processing agreement requiring compliance with 152-FZ and confidentiality.
• Web analytics services (Yandex LLC — for the Yandex.Metrica counter) — to the extent necessary for website traffic statistics.
• State authorities — upon their lawful written request, in the manner and to the extent established by legislation.

Transfer of personal data to third parties in other cases is possible only with the separate consent of the data subject.

The Operator does not carry out cross-border transfer of personal data.

7. Storage and Protection of Personal Data

7.1. Storage locations

Personal data of citizens of the Russian Federation is stored on servers located on the territory of the Russian Federation, in accordance with Art. 18 § 5 of 152-FZ.

7.2. Technical protection measures

• use of secure HTTPS (TLS) data transfer protocol;
• access rights segregation for employees;
• logging of actions with personal data;
• regular encrypted backup of data;
• timely update of software and infrastructure components;
• protection against malware and unauthorized access.

7.3. Organizational protection measures

• appointment of a person responsible for the organization of personal data processing;
• approval of local regulations (Regulation on Personal Data Processing);
• familiarization of employees with access to PD with 152-FZ requirements and internal documents;
• training and periodic information security briefings.

8. Clarification, Deletion and Destruction of Personal Data

8.1. Update

The data subject has the right to demand the clarification of his personal data if it is incomplete, inaccurate or outdated. The Operator updates the data within 7 (seven) business days from receipt of a confirmed request.

8.2. Deletion

Personal data is subject to deletion or depersonalization upon achievement of the processing purposes or upon withdrawal of consent by the subject, unless otherwise provided by the legislation of the Russian Federation.

8.3. Destruction

Upon expiration of the storage period, personal data is destroyed:

• from electronic media — by guaranteed deletion (erasure) with hardware overwriting;
• from paper media — by shredding with the drafting of a destruction act.

Destruction term: no more than 30 (thirty) days from the moment grounds arise (Art. 21 § 4 of 152-FZ).

9. Rights of the Data Subject

The data subject has the right to:

1. Receive information about the fact, purposes, legal grounds and conditions of processing of his personal data, about the Operator and data retention periods (Art. 14 of 152-FZ).
2. Access his personal data, including the right to request copies of records.
3. Demand clarification of his personal data in case of incompleteness, inaccuracy or outdated information.
4. Demand deletion or blocking of his personal data in cases stipulated by 152-FZ.
5. Withdraw consent to processing of personal data at any time (Art. 9 § 2 of 152-FZ) — the withdrawal procedure is described in section 10.
6. Object to processing carried out for the purposes of promoting goods/services and in other cases provided by law.
7. Appeal the actions or inaction of the Operator to Roskomnadzor (rkn.gov.ru) or in court.

9.1. How to submit a request

Requests are submitted:

• by e-mail: i-free@i-free.com;
• by postal mail: 197110, Saint Petersburg, Lodeynopolskaya st., 5, lit. A, room 1-N, office 610.

Operator's response term: no more than 10 (ten) business days from receipt of the request (Art. 20 § 1 of 152-FZ). The term may be extended up to 30 days in cases provided by law.

10. Consent Withdrawal Procedure

The data subject has the right to withdraw his consent to personal data processing at any time by:

1. Sending a written request to i-free@i-free.com with the subject «Withdrawal of consent to personal data processing».
2. Sending a registered letter to the postal address of the Operator (see section 1).

The request should include: full name, contact details (e-mail/phone) used in communications, and a clear expression of will to withdraw consent.

After receiving the withdrawal, the Operator stops processing personal data and deletes (depersonalizes) it within 30 (thirty) days (Art. 21 § 5 of 152-FZ), except in cases where processing can continue without consent by law (e.g., to fulfill legal obligations or defend rights in court).

11. Cookies

The Website uses cookies to ensure functionality and to collect anonymized traffic statistics. On the first visit to the Website, the user is invited to accept or decline non-technical cookies. Technical (functional) cookies are necessary for the Website operation and are always set.

11.1. List of cookies used

The user can opt out of analytics cookies at any time by clearing them in browser settings, or by reopening the cookie banner and changing the choice.

12. Use of Images

The Website uses AI-generated illustrations, anonymized images and photographs placed either with the consent of the depicted persons or in an anonymized form (without names). Placement of photographs of third parties with names is carried out exclusively with written consent to the distribution of personal data (Art. 10.1 § 1 of 152-FZ).

13. Personal Data Operators Registry

Information about the Operator is subject to inclusion in the registry of personal data operators maintained by Roskomnadzor (pd.rkn.gov.ru). The registry record can be verified by TIN 7813133641 or by the name LLC «BIFRI».

14. Policy Changes

The Operator reserves the right to amend this Policy. The current version is always published at i-free.com/en/privacy. Material changes take effect upon publication of the new version.

15. Contact

For all matters related to personal data processing:

• Email: i-free@i-free.com
• Phone: +7 (812) 438-16-78
• Address: 197110, Saint Petersburg, Lodeynopolskaya st., 5, lit. A, room 1-N, office 610

See also: Consent to Personal Data Processing.