FINAL EFFECTIVE VERSION

Version 2026-08-03.2

4.1 Controller

The personal-data controller/owner is PE ROHOVYI VALERII, registered in Ukraine and operating under the commercial name MYRQELON Interactive Technologies. Office and correspondence address: Office 4, Section 1, 13 Hlybochytska Street, Kyiv, 04052, Ukraine. Privacy contact: privacy@myrqelon.com.

Where MYRQELON processes personal data solely on a B2B client's documented instructions, the parties' roles are additionally governed by the DPA.

4.2 Scope

This Policy applies to Website visitors, prospects, customers, company representatives, account users, support recipients, payers, contractors and persons whose data is lawfully supplied for a project.

4.3 Data categories

Depending on the interaction, MYRQELON may process:

- name, organisation, title and authority;

- email, phone, messenger, address and country;

- account, language, settings, login and one-time confirmation records;

- enquiries, communications, specifications, files, feedback and support records;

- Order, invoice, amount, currency, payer, payment status and provider identifiers;

- limited bank-supplied payment metadata, but not full card numbers or CVV;

- IP address, user agent, timestamps, security logs, cookies/local storage and diagnostics;

- sanctions, fraud or compliance screening data;

- project data required for development, testing, migration or support;

- marketing preferences and consent where separately given.

Do not send passwords, CVV, private keys, seed phrases, secret tokens, unnecessary ID documents or sensitive data without prior written agreement and lawful necessity.

4.4 Sources

Data may come from the individual or organisation, payment and intermediary banks, authentication/hosting/email/support providers, public registers and sanctions sources, technical device interaction, or a B2B client under documented instructions.

4.5 Purposes and legal bases

| Purpose | Typical basis |

|---|---|

| Enquiries and proposals | pre-contract steps; legitimate interests |

| Contract and delivery | contract performance |

| Payment, invoice, accounting and refund | contract; legal obligations |

| Support and defect correction | contract; legitimate interests |

| Security, fraud prevention and clickwrap evidence | legitimate interests; contract; legal obligations |

| Sanctions/compliance | legal obligations; legitimate interests |

| Service improvement | legitimate interests; consent for non-essential technologies |

| Marketing | consent or another lawful basis expressly permitted by law |

| Claims and defence | legitimate interests and legal claims |

Consent may be withdrawn for future processing. Withdrawal does not affect prior lawful processing or processing required for contract or law.

4.6 Required information

Fields marked required are necessary for response, contract, payment, security or law. MYRQELON may be unable to provide a service without them. Optional fields are identified as such.

4.7 Recipients and providers

Data may be disclosed on a need-to-know basis to JSC UNIVERSAL BANK/monobank, payer/intermediary banks and payment infrastructure; hosting, domain, CDN, backup and cybersecurity providers; business email, forms, CRM, ticketing and communications providers; professional advisers; project contractors subject to confidentiality; public authorities where legally required; and the B2B client for its project.

A current subprocessor register is published on the Website or provided on request before relevant processing. A new provider does not receive personal data until it is entered in the register and the required contractual and security safeguards are in place.

4.8 International transfers

Data may be processed outside Ukraine where providers operate internationally. MYRQELON uses an adequacy decision, standard contractual clauses, contractual/technical safeguards or another lawful mechanism. EEA/UK users may request information about the applicable mechanism subject to security and third-party rights.

4.9 Retention

Unless a longer period is legally required or necessary for a dispute:

- unsuccessful enquiries: up to 24 months after last interaction;

- account and active contract: for the relationship;

- contracts, invoices, payments and accounting records: statutory and limitation periods;

- security logs: normally up to 12 months, longer for an investigation;

- clickwrap evidence and document versions: contract plus limitation/recordkeeping period;

- support records: up to 36 months after closure where no dispute exists;

- project files: according to the Specification and backup cycle;

- marketing: until withdrawal or 24 months of inactivity;

- backups: normally up to 90 days after operational deletion.

4.10 Cookies

Necessary cookies/local storage may support security, sessions, language, checkout, choices and consent records. Non-essential analytics, advertising or third-party tracking is enabled only after required consent. See the Cookie Policy.

4.11 AI and automated tools

MYRQELON may use automation for routing, spam detection, security, technical analysis or assistance in producing a deliverable. Decisions with significant contractual, sanctions or similar effects receive human review where required. Confidential project data is not sent to an external AI provider without an appropriate basis, controls and relevant disclosure.

4.12 Security

Measures may include access control, minimisation, encryption in transit, backups, logging, patching, environment separation and contractual confidentiality. No system can be absolutely secure. Suspected incidents should be reported to support@myrqelon.com.

4.13 Rights

Depending on applicable law, an individual may request information, access, correction, deletion, restriction, objection, portability, withdrawal of consent and human review of certain automated decisions, and may complain to the Ukrainian Parliamentary Commissioner for Human Rights or the competent local authority. Requests go to privacy@myrqelon.com. Identity and authority may be verified.

4.14 Children

The Website and paid services are not directed to children and MYRQELON does not knowingly enter online contracts with persons lacking capacity. Suspected unlawful collection should be reported to privacy@myrqelon.com.

4.15 Changes

The version and date are published. Material changes are notified through the Website, email or account as appropriate.

---