Privacy and Personal Data Processing Policy

Effective date: 21 August 2026

Version: 1.0

Current version: https://footplus.ru/legal/privacy/en

1. General Provisions

This Privacy and Personal Data Processing Policy (the Policy) defines the procedure for processing personal data and the security measures taken by Futbol Plus LLC (the Operator).

The Policy has been developed in accordance with Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" (Law No. 152-FZ), Federal Law No. 149-FZ of 27 July 2006 "On Information, Information Technologies and Information Protection", the Constitution of the Russian Federation, the Civil Code of the Russian Federation and other regulatory legal acts of the Russian Federation on personal data protection.

The Policy is a publicly available document published at https://footplus.ru/legal/privacy. This English translation is provided for convenience; in case of any discrepancy, the Russian version prevails.

The Policy applies to the processing of personal data carried out by the Operator in providing the Football+ service (the Service), including the website https://footplus.ru and the mobile application for iOS and Android.

Capitalised terms not defined in this Policy have the meanings given to them in the Terms of Service published at https://footplus.ru/legal/terms.

The Service is intended for persons aged 18 and over. The Operator does not knowingly collect personal data of persons below that age. If such processing is discovered, the Operator ceases it and destroys the relevant data.

Use of the Service constitutes agreement with this Policy to the extent that no separate consent is required under Law No. 152-FZ. Separate consents required by law are given by the User through standalone documents as set out in Section 9 of this Policy.

2. Definitions

Personal data — any information relating to a directly or indirectly identified or identifiable natural person (the data subject).

Processing of personal data — any action or set of actions performed on personal data, including collection, recording, systematisation, accumulation, storage, updating, modification, retrieval, use, transfer (provision, access), depersonalisation, blocking, deletion and destruction.

Dissemination of personal data — actions aimed at disclosing personal data to an indefinite range of persons.

Provision of personal data — actions aimed at disclosing personal data to a specific person or a specific range of persons.

Depersonalisation of personal data — actions after which it becomes impossible, without the use of additional information, to attribute personal data to a specific data subject.

User — a natural person using the Service, as well as a natural person acting on behalf of an Organization.

3. Principles of Processing

Personal data is processed on a lawful and fair basis.

Processing is limited to the achievement of specific, predetermined and lawful purposes. Processing incompatible with the purposes of collection is not permitted.

Only personal data that corresponds to the purposes of processing is processed. The content and volume of processed data corresponds to the stated purposes and is not excessive in relation to them.

Databases containing personal data processed for mutually incompatible purposes are not combined.

The accuracy, sufficiency and relevance of personal data in relation to the purposes of processing is ensured.

Personal data is stored in a form that permits identification of the data subject no longer than required by the purposes of processing, unless a retention period is established by law or contract. Once the purposes are achieved, the data is destroyed or depersonalised.

4. Categories of Data Subjects

The Operator processes personal data of the following categories of subjects:

•Specialists — natural persons using the Service to search for work, develop professionally and establish business contacts;

•representatives of Organizations — natural persons acting on behalf of football clubs, academies, federations, agencies and other organizations;

•visitors of the website who have not created an Account;

•persons who have sent an enquiry to the Operator.

5. Categories of Personal Data Processed

5.1 Account information

Email address, telephone number, information on confirmation of the email address and telephone number, identifiers of external authorisation service accounts where used, and access credentials in protected form.

5.2 Profile information

Surname, first name, patronymic, gender, date of birth, city, photograph, personal page address, the "About" section and the document attached to it.

5.3 Professional information

Professional role and position, organization and type of employment, places of work including periods and descriptions of duties, education details (institution, programme, year of completion) and attached education documents, professional skills, languages, information on licences, courses and projects.

5.4 Contact information

Email address, telephone number, messenger and social network usernames, personal website address, and the display settings chosen by the User.

5.5 User Content

Posts, comments, images, documents and other materials placed by the User in the Service, including any information about other persons that they may contain.

5.6 Information related to messaging

The content of Private Messages and attachments, and information on the fact, time and participants of the exchange.

5.7 Information related to job applications

The fact of an application, the scope of Profile information submitted, the stage of review, and information entered by the Organization about the Candidate.

5.8 Information related to Verification

Verification status and the date it was carried out, and documents submitted by the User at their own initiative to confirm qualifications, work experience or authority.

5.9 Technical information

IP address, information on the device and software used to access the Service, session data, cookies and similar technologies, and activity logs for the Account including date and IP address.

5.10 Data the Operator does not process

The Operator does not process special categories of personal data (racial or ethnic origin, political opinions, religious or philosophical beliefs, health, sex life), nor biometric personal data.

The Operator does not collect personal data from open sources and does not purchase personal data databases from third parties.

6. Purposes of Processing

Personal data is processed for the following purposes:

•conclusion and performance of the Terms of Service;

•registration and authentication of the User, providing access to the Account and protecting it;

•providing the functionality of the Service: maintaining a Profile, publishing and viewing Vacancies, submitting and reviewing applications, messaging, publishing materials, establishing professional connections;

•assisting Users in finding work and recruiting personnel;

•carrying out Verification at the User's initiative;

•sending service notifications related to the operation of the Service and actions in the Account;

•handling enquiries and complaints, moderating published materials;

•ensuring the security of the Service, preventing fraud and abuse;

•complying with obligations imposed on the Operator by the legislation of the Russian Federation;

•dissemination of Profile information — where the relevant consent has been given;

•sending advertising and marketing messages — where the relevant consent has been given.

7. Legal Grounds for Processing

The principal legal ground for processing is the necessity of performing a contract to which the data subject is a party — the Terms of Service (clause 5, part 1, article 6 of Law No. 152-FZ). Processing of personal data necessary for creating and operating the Account and providing the functionality of the Service does not require separate consent.

Processing beyond those limits is carried out on the basis of separate consents of the data subject. This applies to the dissemination of personal data and to the sending of advertising and marketing messages.

Processing is also carried out on the basis of federal laws establishing the purposes of processing and the Operator's obligations, and for the purposes of the Operator's legitimate interests, provided that the rights and freedoms of the data subject are not infringed.

The legal ground for processing personal data of third parties contained in materials published by a User is the consent of those persons, which the User is obliged to obtain under the Terms of Service.

8. Procedure and Conditions of Processing

Personal data is processed both with and without the use of automation.

Databases containing personal data of citizens of the Russian Federation are located within the territory of the Russian Federation. Recording, systematisation, accumulation, storage, updating and retrieval of personal data is carried out using databases located within the territory of the Russian Federation.

Access to personal data is granted to employees and engaged persons who require it to perform their duties. The list of such persons is determined by the Operator's internal documents. Those persons are notified of the confidentiality of the data.

Personal data is stored for the duration of the User's Account. Upon expiry of the retention period, achievement of the purposes of processing, withdrawal of consent or deletion of the Account, personal data is destroyed or depersonalised within 30 days, except for data whose retention period is established by the legislation of the Russian Federation.

9. Consents and Their Withdrawal

Consents required by law are given by the User by ticking the corresponding boxes in the Service interface. Boxes are not pre-ticked. Acceptance of the Terms of Service does not constitute consent to the processing of personal data.

Consent to the dissemination of personal data is given separately from all other consents under article 10.1 of Law No. 152-FZ. The consent form is published at https://footplus.ru/legal/consent-distribution.

The User may withdraw any consent at any time through the Service interface or by sending a request to support@footplus.ru.

Upon receipt of a demand to cease dissemination of personal data, the Operator ceases such dissemination within three business days of receiving the demand, or within the period specified in a court decision.

Withdrawal of consent does not in itself entail deletion of the Account and does not terminate processing carried out on other grounds provided by law. Processing of personal data necessary for the operation of the Account is terminated by deleting the Account.

10. Visibility of Profile Information

The purpose of the Service is to establish professional contacts, and accordingly part of the Profile information becomes available to other persons.

By default, the Profile is available to authenticated Users of the Service and is not indexed by search engines. Open access mode, in which the Profile is available to any person without authentication and is indexed by search engines, is enabled by the User independently in the settings and may be disabled by them at any time.

The scope of information available in each mode is determined by the visibility settings the User configures. The settings apply separately to the Profile as a whole, to contact information and to the date of birth.

Publication of Profile information in either mode is carried out solely where consent to the dissemination of personal data has been given. In the absence of such consent, the Profile is available to the Operator only; use of the Service for viewing Vacancies and submitting applications is retained. Submitting an application entails provision of Profile information to the Organization under Section 11 of this Policy regardless of the visibility mode selected.

When open access mode is disabled, the Operator ceases to provide access to the Profile to unauthenticated persons and closes the Profile to indexing by search engines.

Information that has become available to an indefinite range of persons may have been copied, saved or indexed by third parties. The Operator has no technical means of ensuring its removal from external sources.

11. Transfer of Personal Data

The Operator does not sell personal data and does not transfer it to third parties except as set out in this Section.

11.1 Transfer to other Users

Profile information, User Content and the content of messages become available to other Users to the extent determined by the visibility settings and by the actions the User takes.

11.2 Transfer to Organizations

When an application for a Vacancy is submitted, the Specialist's Profile information and attached materials become available to the Organization that published the Vacancy.

When using the functionality for handling applications and maintaining a Candidate database, the Organization independently determines the purposes and scope of processing of Candidates' personal data and acts as an independent data operator. In that respect the Operator acts on the Organization's instruction under the terms published at https://footplus.ru/legal/data-processing. The Organization's obligations regarding the information received are set out in the Terms of Service and in those terms.

11.3 Transfer to persons engaged to operate the Service

The Operator instructs persons engaged to operate the Service to process personal data under contracts providing for confidentiality obligations and compliance with Law No. 152-FZ. Such persons include:

•providers of cloud infrastructure, computing capacity and data storage;

•telecommunications operators and providers of SMS and email delivery services;

•providers of web analytics services.

Information on the specific persons instructed to process data is provided to the data subject on request under article 14 of Law No. 152-FZ.

11.4 Transfer in cases provided by law

Personal data is provided to public authorities, courts and other authorised bodies in the cases, manner and scope established by the legislation of the Russian Federation.

12. Verification

Verification is a voluntary procedure carried out at the User's initiative.

Verification is aimed at confirming that the Account was created and is used by a real natural person and is not aimed at establishing the identity of the User. No comparison of the User's image with images in identity documents, with other images or with any databases is performed.

Following the procedure, the Operator retains solely the result of the check and the date it was carried out. Images and video recordings obtained are not stored, published, transferred to other Users or used to train algorithms.

The Operator does not process biometric personal data.

Documents submitted by the User to confirm qualifications, work experience or authority are not published, are not transferred to other Users and are destroyed once the purpose of their submission is achieved.

13. Machine Learning Based Features

The Service provides functionality based on machine learning technologies, including automated conversion of a resume uploaded by the User into structured Profile information. Such processing is carried out to prepare information for subsequent review and saving by the User.

The result of such processing is probabilistic and must be checked by the User before saving and publication.

The Operator does not take decisions producing legal effects concerning the User or otherwise affecting their rights and legitimate interests based solely on automated processing of personal data. Functionality involving such processing may be provided solely where separate consent of the User under article 16 of Law No. 152-FZ has been given.

14. Cookies and Technical Data

The use of cookies and similar technologies is governed by the Cookie Policy published at https://footplus.ru/legal/cookie.

15. Rights of the Data Subject

The data subject has the right to:

•obtain information on the processing of their personal data, including the legal grounds and purposes of processing, the periods of processing and storage, and the persons to whom personal data may be disclosed;

•demand rectification, blocking or destruction of personal data where it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing;

•withdraw consent to processing where processing is based on consent;

•demand that dissemination of personal data cease;

•appeal the Operator's acts or omissions to Roskomnadzor or in court;

•protect their rights and legitimate interests, including compensation for damages and moral harm.

Requests are sent to support@footplus.ru. The Operator may request additional information to identify the data subject.

Information on the processing of personal data is provided within ten business days of receipt of the request. That period may be extended by no more than five business days, with notice to the data subject of the reasons for the extension.

Where inaccuracy of personal data is confirmed, the Operator rectifies it within seven business days. Where unlawful processing is identified, the Operator ceases such processing within three business days.

16. Deletion of the Account

The User may delete the Account at any time through the Service interface or by sending a request to support@footplus.ru.

Upon deletion of the Account, access to it ceases, Profile information is depersonalised, contact information is detached from the Account, and the Profile ceases to be available to other Users.

Materials published by the User in the public part of the Service and messages sent by them remain available to their recipients and to participants of discussions, without the User's name and photograph, since their removal would affect the rights of other Users.

Personal data is destroyed or depersonalised within the period set out in Section 8 of this Policy.

The account deletion procedure is described at https://footplus.ru/legal/delete-account.

17. Security Measures

The Operator takes legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, provision and dissemination, including:

•appointing a person responsible for organising the processing of personal data;

•issuing documents defining the policy on personal data processing and familiarising employees with them;

•carrying out internal control of compliance of processing with legal requirements;

•identifying threats to the security of personal data and applying information protection measures;

•restricting and recording access to personal data;

•applying encryption when transmitting data over communication channels;

•performing backups and ensuring data recovery.

The Operator notifies Roskomnadzor of any unlawful or accidental transfer of personal data resulting in a violation of data subjects' rights within 24 hours of identifying the incident, and provides the results of the internal investigation within 72 hours.

18. Amendments to the Policy

The Operator may amend this Policy. A new version takes effect upon publication at https://footplus.ru/legal/privacy, unless the new version provides otherwise.

Where amendments materially affect the rights of the User, the Operator notifies the User at least 10 calendar days before the amendments take effect by sending a message to the email address and/or a notification in the Service interface.

19. Operator Details

Futbol Plus Limited Liability Company

Primary State Registration Number (OGRN): 1264700006812

Taxpayer Identification Number (INN): 4706097432

Tax Registration Reason Code (KPP): 470601001

Registered address: 6 Minikha Street, Enkolovo, Vsevolozhsky District, Leningrad Region, 188660, Russia

Email: support@footplus.ru

The Operator is included in the register of operators processing personal data on the basis of a notification filed with the Roskomnadzor Directorate for the North-Western Federal District, registration number 100389552.

The person responsible for organising the processing of personal data is Aleksandr Vadimovich Markelov. Enquiries are sent to support@footplus.ru.

Last updated: 21 August 2026