Privacy Policy

PRIVACY POLICY AND PERSONAL DATA PROCESSING PROCEDURE
OF LIMITED LIABILITY COMPANY
"PARK 3020" (hereinafter – the Policy)

This Privacy Policy of Limited Liability Company "PARK 3020" (EDRPOU code 44351725) (hereinafter – the Company) has been developed in accordance with the Law of Ukraine "On Protection of Personal Data" (hereinafter – the Law) and other applicable legislation of Ukraine in the field of personal data processing and information confidentiality.

This Policy enters into force on September 1, 2026, is posted on the Website, and remains in effect until a new version of the Policy takes effect.

The Policy contains information regarding the procedure for processing personal data, the composition of the personal data being processed, the purpose and legal basis for processing, categories of personal data subjects, the Company's interaction with third parties, conditions for accessing personal data, contact information for Forum Participants to request access, make changes, or request the deletion of their personal data, and to address any questions that may arise regarding the protection of their personal data, as well as requirements for ensuring the confidentiality of information concerning the Company's business relationships with Forum Participants and any third parties.

The Company processes personal data exclusively to fulfill the purpose defined in the Policy and in accordance with the Forum Participant's Consent.

Definitions

• Personal data base — a named set of ordered personal data in electronic form and/or in the form of personal data filing systems;
• Personal data base owner — an individual or legal entity that, by law or with the consent of the personal data subject, is granted the right to process such data, approves the purpose of personal data processing in this database, and establishes the composition of such data and the procedures for their processing;
• Consent — a voluntary expression of will by an individual (provided they are informed) to grant permission for the processing of their personal data in accordance with the stated purpose of processing, expressed in writing or in a form that allows for the conclusion that consent has been granted;
• Processing of personal data — any action (operation) or set of actions, including collection, recording, systematization, accumulation, storage, updating (modification), retrieval, use, transfer (distribution, provision of access), depersonalization, blocking, deletion, destruction, etc., of personal data;
• Personal data — information or a set of information about an individual who is identified or can be specifically identified;
• Personal data controller — an individual or legal entity authorized by the personal data database controller or by law to process such data. A personal data database processor does not include a person who is entrusted by the personal data controller and/or processor with technical tasks related to the personal data database without access to the content of the personal data;
• Site — the Company's software or a set of software tools engaged by the Company that allows the latter to receive, process, and service the data subject's requests.
• Data subject — an individual (Forum participants, visitors, artists, partners, and other persons, referred to in this Policy as the Forum Participant) whose personal data is being processed;
• Third party — any person, excluding the data subject, the personal data controller or processor, and the Ukrainian Parliament Commissioner for Human Rights, to whom the personal data controller or processor transfers personal data;
• Personal data involving special risks — personal data regarding racial, ethnic, or national origin; political, religious, or ideological beliefs; membership in political parties and/or organizations, trade unions, religious organizations, or public organizations of an ideological nature; health status; sexual life; biometric data; genetic data; criminal or administrative records; measures taken against the individual within the framework of pre-trial investigations; measures taken against the individual as provided by the Law of Ukraine "On Operational-Investigative Activities"; commission of any form of violence against the individual; and the individual's location and/or travel routes.

Categories of data subjects

The Company is the Controller and Processor of the personal data. The place of personal data processing is located at the Company's registered address: 1 Park Kraina Edem Street, Strilky village, Lviv district, Lviv region, 81220. A personal data processor may also be an individual or legal entity authorized by the Company or by law to process Personal Data on behalf of the Company.

A data subject is an individual who has a business relationship with the Company regarding participation in the Forum (Forum Participant).

The Forum Participant agrees that, in the course of processing, the Company has the right to transfer their Personal Data to Third Parties if necessary to achieve the purposes of processing, provided that such third parties maintain the confidentiality and security of the Forum Participant's personal data.

Purpose and legal basis for processing Personal Data

The purpose of processing the Forum Participants' Personal Data is to ensure civil, tax, and accounting relationships, in particular, to facilitate business operations, provide/receive and exercise the right to participate in the Forum, process payments for purchased goods/services, and send informational and marketing communications (news, promotions, information about special offers, promo codes and discounts, personalized recommendations, personalized discounts and offers) containing information about works of art, goods and/or services, as well as advertising and commercial offers regarding such works of art, goods and/or services, etc. In the event of a change in the defined purpose of Personal Data processing to a new purpose that is incompatible with the previous one, the Company, as the Controller and Processor of personal data, must obtain the Forum Participant's consent for the processing of their data in accordance with the changed purpose.

The basis for processing the Forum Participant's personal data is the unconditional, perpetual, and irrevocable Consent of the Forum Participant, provided by checking the box granting permission for the processing of their personal data in accordance with the purposes of processing/use of the Site as defined in the Policy.

By providing Consent to the processing of their personal data, the Forum Participant agrees to the inclusion of their personal data in the Personal Data Database, for which the Company is the controller. The Forum Participant confirms that they have read and agree to the terms of this Policy and the rights granted to them as a data subject under Article 8 of the Law of Ukraine "On the Protection of Personal Data," namely:

1. to be informed about the sources of collection, the location of their personal data, the purpose of its processing, and the location or place of residence (stay) of the personal data controller or processor, or to authorize a representative to obtain this information on their behalf, except in cases established by law;
2. to receive information regarding the conditions for accessing personal data, including information about third parties to whom their personal data is transferred;
3. to access their personal data;
4. to receive, no later than thirty calendar days from the date of the request, except in cases provided by law, a response as to whether their personal data is being processed, as well as to receive the content of such personal data;
5. to submit a reasoned request to the personal data controller objecting to the processing of their personal data;
6. to submit a reasoned request for the modification or destruction of their personal data by any controller or processor of personal data if such data is being processed unlawfully or is inaccurate;
7. to protect their personal data from unlawful processing and accidental loss, destruction, or damage due to intentional concealment, failure to provide, or untimely provision of such data, as well as protection against the provision of information that is inaccurate or defamatory to the honor, dignity, and business reputation of an individual;
8. to file complaints regarding the processing of their personal data with the Commissioner or the court;
9. to apply legal remedies in the event of a violation of personal data protection legislation;
10. to include reservations regarding the limitation of the right to process their personal data when providing consent;
11. to withdraw consent for the processing of personal data;
12. to be informed about the mechanism of automated personal data processing;
13. to protection against automated decision-making that has legal consequences for them.

The Forum participant consents to the cross-border transfer of their personal data to the Company and acknowledges that, during such cross-border transfer, the recipients of the personal data may be located in other countries.

The Company does not process personal data that poses a special risk.

Composition of personal data

The composition of the Forum participant's personal data includes:

• surname, first name, and (if applicable) patronymic;
• mobile phone number;
• email address;
• other information that the Company receives in connection with entering into a business relationship with the Forum participant, including during the term of such relationship.

Primary sources of information about a Forum participant include: documents issued in their name; documents signed by them; and information provided by the Forum participant about themselves, including on the Website.

Forum participants agree to provide the Company with complete, accurate, truthful, and up-to-date information, details, and data, including personal data, and assume full responsibility for doing so. Forum participants are liable (including criminal liability) for the use of third-party information, details, and data.

Personal Data Processing Procedure

The Company processes personal data using automated means, as well as without the use of such means. For the processing of personal data, the Company has the right to engage Third Parties, for whose actions the Company bears responsibility as if they were its own.

The retention period for personal data covers the entire period of the business relationship between the Forum Participant and the Company, as well as 1 year after the termination of such relationship with the Forum Participant.

The Company ensures the secure storage of Personal Data using various methods and levels of protection designed to prevent unauthorized access to Personal Data. The Company's information security system includes: the installation of technical security and personal data protection measures; the setting of passwords for all technical and software tools; the selection and installation of antivirus software; and other personal data protection measures.

The deletion/destruction of Forum Participants' personal data is carried out based on a reasoned written request from the Forum Participant and upon the expiration of the Personal Data retention period, as well as in other cases defined by the current legislation of Ukraine. Changes to personal data are made immediately upon the discovery of information about the Forum Participant that is inaccurate.

The Forum Participant consents to the Company having the right to transfer their Personal Data to Third Parties during the processing stage if necessary to achieve the purposes of processing, provided that such Third Parties maintain the confidentiality and security of the Personal Data. The transfer of Personal Data in accordance with this paragraph does not require separate consent or notification of the Forum Participant and occurs without notification to or consent from the Forum Participant regarding such transfer.

Access to Personal Data is granted to persons performing processing only if said person has undertaken obligations to ensure compliance with the requirements of the Law and is capable of ensuring them. Access to the Forum Participant's Personal Data is provided in response to a request for access to personal data, which must specify:

• the surname, first name, and patronymic, place of residence (place of stay), and details of the identity document of the individual submitting the request (for an individual applicant);
• the name, location of the legal entity, the EDRPOU code of the legal entity, and the position, surname, first name, and patronymic of the person certifying the request; confirmation that the content of the request is within the authority of the legal entity (for a legal entity applicant);
• the surname, first name, and patronymic, as well as other details that allow for the identification of the Forum Participant to whom the request relates;
• a list of the Personal Data being requested;
• the purpose and/or legal grounds for the request.

The response time for a request is thirty calendar days from the date of receipt, unless otherwise provided by the current legislation of Ukraine.

Confidentiality Policy

The Forum Participant and the Company agree that any information provided in written, oral, electronic, visual, graphic, or any other form before, during, or after the business relationship between the Forum Participant and the Company is confidential, except for information that is publicly known and/or publicly available, or obtained lawfully from a third party without violating the terms of this Policy.

Unlawful use of confidential information includes, but is not limited to, using confidential information for personal purposes unrelated to the cooperation between the parties, or directly or indirectly providing or disclosing confidential information to third parties without the permission of the information owner.

The Forum Participant and the Company are obligated to keep each other's confidential information secret, not to disclose or divulge it (verbally and/or in writing, including electronically), to take all necessary measures to ensure the security of confidential information, and not to use it for any unlawful purpose.

By using the Site, the Forum Participant consents to the use of cookies (hereinafter – Cookies). Cookies are small text files stored on the device the Forum Participant uses to access the Site. Cookies are saved in their designated folder. Cookies allow data entered into Site forms to be saved, so it does not need to be re-entered during subsequent visits or when navigating between different Site functions. The Forum Participant may decline the use of cookies by adjusting their device settings. However, the Forum Participant understands that declining and/or disabling cookies on their device may limit the use of certain Site functions.

By using the Site, the Forum Participant consents to the Company's use of web analytics tools. These tools are used for general analysis of Site usage and to obtain data for improving the Site's functionality. Information obtained by the Company through web analytics (such as IP address and browser type) may be transmitted in anonymous form to the web analytics service provider's server, where it is stored and processed. By adjusting your device settings, the Forum Participant can prevent the relevant web analytics service from collecting data and storing cookies on their computer.

If you have any comments, requests, or complaints regarding the processing of personal data held by the Company or the confidentiality of information, please contact the Company via email at https://edemresort.com/ or by mail at: 1 Park Kraina Edem Street, Strilky village, Lviv district, Lviv region, 81220.