Consent to Personal Data Processing

This document is a courtesy translation provided for information purposes only. The legally binding version is the Russian original: Читать на русском / Read in Russian.

Document summary (provided for convenience, has no independent legal force)

1. Your decision. This consent is a separate document. You accept it by your own action, separately from the User Agreement.
2. What we collect. Name, e-mail, role, lesson results, technical data (IP, cookies). We do not store bank card data.
3. Why. So that you can use the platform: registration, lessons, notifications, security, payment.
4. Where the data is stored. On servers in the Russian Federation (TIMEWEB.CLOUD LLC (ООО «ТАЙМВЭБ.КЛАУД»)).
5. To whom we transfer it. Only to those needed for the platform to operate: hosting, mail, payment provider. We do not sell or disclose.
6. AI. We use AI to create exercises. In doing so we transfer only educational content – your name, e-mail and other personal data do not go there. Your data is not used to train models.
7. Mailings and analytics. Only if you separately agree. This does not affect access to the platform.
8. Minors. Registered by a parent. We do not send marketing materials to minors.
9. You can withdraw. In settings or at legal@cutor.ru. Optional consents are withdrawn without consequences; withdrawal of mandatory consent results in deletion of the account.
10. Your rights. Find out what is stored; obtain a copy; demand deletion; complain to Roskomnadzor.

The full text of the document is provided below.

---

Version dated 17 July 2026.

This Consent is given freely, by one's own will and in one's own interest, and is specific, subject-matter-defined, informed, conscious and unambiguous (Part 1 of Article 9 of Federal Law No. 152-FZ of 27.07.2006 "On Personal Data"). The provision of Consent is voluntary. The mandatory part of the Consent (section 3.1) is necessary to provide the User with platform functions; the User has the right not to give the optional consents (section 7) without any consequences for access to the Platform.

Terms used in this Consent with a capital letter (including "Platform", "User", "Tutor", "Student") are used in the meanings defined by the User Agreement posted at cutor.ru/legal/terms.

1. Operator receiving the consent

Sole Proprietor Gindinson Mikhail Aleksandrovich OGRNIP: 326527500104423 · INN: 183511073463 Address: 603155, Nizhny Novgorod, Maxima Gorkogo St., 232, apt. 5 Number in the register of operators of Roskomnadzor: 52-26-260092 Contact e-mail address: legal@cutor.ru Platform website: cutor.ru (hereinafter – the "Platform")

2. Personal data subject

2.1. The subject is the natural person registering or using an account on the Platform (hereinafter – the "User"). Identification of the subject when giving Consent in electronic form is carried out using the data provided upon registration (name, e-mail address, account identifier), and the fact and moment of giving Consent are recorded by the Operator (date, time, document version, technical record) as confirmation of receipt of Consent in a form allowing the fact of its receipt to be confirmed (Part 1 of Article 9 of Federal Law No. 152-FZ). This Consent is given by means of an information system (the Platform), and therefore identification of the subject is carried out in the manner provided for by Part 1 of Article 9 of Federal Law No. 152-FZ.

2.2. Consent with respect to a minor. If an account is created for a minor Student (a person under 18 years of age), this Consent is given by their parent (legal representative) acting as the representative of the personal data subject. Registration of a minor's account is performed precisely by the parent (legal representative) (clauses 3.7–3.8 of the User Agreement). By the fact of registering a minor's account on the Platform, the parent (legal representative) confirms that they have the authority of a legal representative and their consent to the processing of the minor's personal data on the terms of this Consent.

3. Purposes of processing

3.1. Mandatory processing (necessary to use the Platform)

The Operator processes personal data for the following purposes: a) registration, creation and management of an account, authentication (including via VK ID, Yandex ID); b) provision of Platform functions: creating and conducting educational lessons, assigning and completing tasks, recording results and learning activity; c) sending service (transactional) notifications related to the operation of the account and lessons; d) ensuring the security of accounts and preventing abuse, including detecting multiple accounts (see section 5.4); e) processing subscription payments (for Users in the Tutor role); f) fulfilling the requirements of the legislation of the Russian Federation.

3.2. Optional processing

Only with the separate consent of the User (section 7): marketing and informational mailings; behavioral analytics for improving the service that goes beyond depersonalized statistics.

4. List of personal data

The Operator processes the following categories of data (to the extent actually provided by the User or generated during use of the Platform):

• identification: name (and/or display name), information about being of age/a minor;
• contact: e-mail address;
• account: login, protected (hashed) password, role (Tutor / Student), tariff plan; identifiers and profile data obtained upon login via VK ID or Yandex ID (to the extent provided by the respective service);
• educational: assigned lessons, results of completing tasks, learning activity;
• technical: IP address, characteristics of the device and browser (including digital identifiers), cookie files, event logs;
• payment (for Tutors): information necessary to process payments; bank card data is not stored by the Operator and is processed by the payment provider.

Special categories of personal data and biometric personal data are not processed by the Operator.

5. List of actions and methods of processing

5.1. The Operator performs the following actions: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access) to persons carrying out processing on behalf of the Operator (section 6), depersonalization, blocking, deletion, destruction.

5.2. Processing is carried out by a mixed method (using and without using automation tools).

5.3. Storage within the territory of the Russian Federation. Collection, recording, systematization, accumulation, storage, clarification and extraction of the personal data of citizens of the Russian Federation are carried out using databases located within the territory of the Russian Federation (Part 5 of Article 18 of Federal Law No. 152-FZ).

5.4. Free tariff and automated assessment. Access to the basic free tariff is provided by the Operator free of charge and is not a right of the User. The Platform uses automated tools to detect signs of abuse (including signs of multiple accounts – section 3.1(d)). Decisions affecting the User's access to the Platform are not made solely on the basis of automated processing: the results of the automated assessment are checked manually before measures are applied (Article 16 of Federal Law No. 152-FZ). The User has the right to contest a decision made by contacting legal@cutor.ru.

6. Persons carrying out processing on behalf of the Operator

6.1. The Operator entrusts the processing of personal data to the following persons, acting on its behalf and subject to compliance with confidentiality and the requirements of Federal Law No. 152-FZ:

• hosting and data storage: TIMEWEB.CLOUD LLC (ООО «ТАЙМВЭБ.КЛАУД») (INN 7810945525, OGRN 1227800052215; servers within the territory of the Russian Federation);
• sending e-mails: RSIC JSC (АО «РСИЦ») (INN 7733573894, OGRN 1067746823099; servers within the territory of the Russian Federation);
• payment processing (for Tutors): T-Bank (JSC "TBank", АО «ТБанк») (TIN 7710140679, BIC 044525974; servers within the territory of the Russian Federation); bank card data is not stored by the Operator.

6.2. Use of AI services. The AI functions of the Platform use third-party models via API to generate exercises and check educational materials. Only educational content is transferred in requests to AI services (including exercise texts, task parameters, language proficiency level); identification and contact data of Users is not included in requests. User data is not used to train, fine-tune or improve AI models.

6.3. No dissemination is carried out. The Operator does not disseminate personal data (does not disclose it to an indefinite circle of persons) and does not transfer it to third parties for their own purposes. Separate consent to dissemination (Article 10.1 of Federal Law No. 152-FZ) is not required and is not given by this document.

6.4. Authentication services. When the User chooses to log in via VK ID or Yandex ID, profile data is transferred by the respective service to the extent permitted by the User. The specified services are independent operators of personal data and act on the basis of their own privacy policies.

7. Optional consents (given separately)

The following consents are voluntary, are given by separate actions (separate check marks) and do not affect access to the Platform. Each may be withdrawn independently (in the account settings or by contacting support).

☐ 7.1. Marketing mailings. Consent to receive informational and advertising messages about the Platform by e-mail.

☐ 7.2. Extended analytics. Consent to behavioral analysis for improving the service beyond depersonalized statistics.

Marketing and advertising messages are not sent to minor Students regardless of what is set out in this section.

8. Minor Students

8.1. The personal data of minors is processed with enhanced protection measures (Federal Law No. 152-FZ), is not used for marketing purposes and is not transferred to third parties, except in cases directly provided for by legislation.

8.2. The parent (legal representative), as the person who registered the minor's account, has access to their academic performance and activity. Upon the Student reaching 18 years of age, the account may be re-registered by the Student in their own name in the manner of clause 3.13 of the User Agreement, after which the access of the parent (legal representative) ceases, and processing continues on the basis of the consent of the User themselves.

9. Validity period and withdrawal of consent

9.1. The Consent is valid from the moment it is given until deletion of the account or withdrawal of the Consent, whichever occurs earlier. After the cessation of processing, data is deleted or depersonalized; backup copies are stored for no more than 30 calendar days.

9.2. The Consent may be withdrawn at any time in the "Settings" section of the account or by contacting legal@cutor.ru. The processing period for a withdrawal is no more than 30 calendar days. Withdrawal of the mandatory part of the Consent (section 3.1) results in the impossibility of further use of the Platform and, as a rule, deletion of the account; withdrawal of the optional consents (section 7) does not affect access to the Platform.

9.3. After withdrawal, the Operator has the right to continue processing without consent in cases directly provided for by Part 2 of Article 9 and Article 6 of Federal Law No. 152-FZ (including for the fulfillment of obligations established by law).

10. Rights of the personal data subject

The User (and, with respect to a minor, their legal representative) has the right to: receive information about the processing of their personal data; demand its clarification, blocking or destruction; withdraw this Consent; obtain a copy of their data before deletion of the account; appeal the actions of the Operator to Roskomnadzor or in court. Requests are sent to legal@cutor.ru. A copy of the personal data is provided within 30 calendar days from the moment of receipt of the request.

11. Form of provision and recording of Consent

11.1. Consent is provided in the form of an electronic document by the User (or the legal representative of a minor) performing a separate unambiguous action – placing a check mark in a field specially designated for this purpose – after the text of this Consent is displayed. Pre-placed ("default") check marks are not used.

11.2. The fact of providing Consent is recorded by the Operator (User identifier, date and time, document version, IP address) and stored for the purpose of confirming compliance with the requirements of legislation.

---