This English text is an informational summary of Balm’s Privacy Policy, version 3.0, effective from 26 May 2026. The authoritative legal version of this Policy is the Russian-language text published at balm.rentals/ru/privacy, in accordance with Section 1.4 above. In the event of any conflict between this English summary and the Russian version, the Russian version prevails.

1. Scope and acceptance

This Privacy Policy explains what personal data Balm collects, why, how it is processed, with whom it is shared and what rights you have. It applies to the balm.rentals website and the Balm mobile applications for iOS and Android (collectively, the “Service”). By using the Service you confirm that you have read and understood this Policy.

2. Controller

The data controller is Individual Entrepreneur Sergey N. Vikhlyaev, TIN 682004283576, OGRNIP 323680000023219, registered in the Russian Federation. Primary contact: BalmForUsers@gmail.com (with BalmForUsers@yandex.ru as backup).

3. Categories of personal data we process

Identity and contact data (name, phone, email, OAuth identifiers from Apple Sign in and Google Sign In, profile picture); listing data (vehicle photos, description, location, contact number); communications (chat messages and attached media, reviews and ratings); technical data (IP address, device identifiers, OS and app version, push token, crash and performance logs); usage data (search queries, viewed listings, partner-link clicks, VIP status and metrics); location data (when you grant permission, used while the app is active); payment data (transaction status and last four card digits — full card data is never received by us); data received from third parties (Apple, Google, analytics, push providers).

We do not intentionally collect special category data (health, religion, biometrics, etc.). The Service is not directed to minors under 18.

4. Legal bases and purposes

We process your data on the following bases: (a) performance of the contract between you and Balm (to provide the Service); (b) compliance with legal obligations; (c) our legitimate interests in security, fraud prevention, analytics and protection of our rights — provided your rights and freedoms do not override them; (d) your consent for marketing communications, advertising cookies and certain cross-border transfers; (e) vital interests in life-threatening situations.

5. Retention

Account data: while the account exists plus 90 days; listings: until archived plus 12 months; chat messages: up to 365 days; reviews: indefinitely or until anonymised at user’s request; server logs: 12 months; crash logs: 90 days; payment records: 5 years (statute of limitations); consent records: 5 years after withdrawal.

6. Recipients

We share data only with vetted processors acting under written DPAs: hosting and cloud infrastructure providers in the Russian Federation; Apple (Sign in with Apple) and Google (Google Sign In) as authentication providers; Apple Push Notification service and Firebase Cloud Messaging for push delivery; Firebase Crashlytics or analogous service for crash analytics; Google Maps and/or OpenStreetMap tile providers; SMS, email and payment processors; content-moderation tools; and legal, tax and audit advisers under professional confidentiality. We share data with Partners only with your explicit consent (e.g. when you tap to share contact info with a Partner). We do not sell personal data in the sense of CCPA.

7. International transfers

Our servers are primarily located in the Russian Federation; certain services (push, analytics, maps) involve transfers to other jurisdictions. For EU/EEA/UK users, transfers rely on EU Standard Contractual Clauses where applicable. For Thai users, transfers comply with Section 28 of the PDPA. For Russian users, primary processing complies with Article 18(5) of Federal Law 152-FZ.

8. Security

We apply industry-standard technical and organisational measures: TLS in transit, encryption of sensitive data at rest, role-based access controls, audit logging, regular patching, backups and confidentiality undertakings by personnel and contractors. In case of a personal data breach likely to result in significant risk to your rights, we will notify the competent supervisory authority within 72 hours (where GDPR applies) and you without undue delay where required by law.

9. Your rights

Depending on your jurisdiction you have the right to access, rectify, erase, restrict or object to processing of your data, to data portability, to withdraw consent, and to lodge a complaint with the competent supervisory authority. Submit requests to BalmForUsers@gmail.com; we respond within 30 days (extendable by 60 days for complex requests). We may require additional information to verify your identity.

10. Cookies (website only)

balm.rentals uses strictly necessary, functional, analytics and marketing cookies. We request your consent for non-essential cookies via a cookie banner. You can change your choice at any time via the “Cookie settings” link in the footer or via your browser settings. Mobile apps do not use cookies; they use local device identifiers and push tokens.

11. Children

The Service is intended for users aged 18 or above and is not directed to children under 16. For users in Thailand, processing of data of minors under 20 generally requires their legal representative’s consent, in accordance with Section 20 of the PDPA.

12. Updates to this Policy

Each version of this Policy is archived at balm.rentals/<lang>/privacy/versions and dated. We will notify you of material changes at least 14 days in advance through the app, by email or by another reasonable channel. Continued use of the Service after the effective date means you accept the updated Policy.

13. Contact

Individual Entrepreneur Sergey N. Vikhlyaev, TIN 682004283576, OGRNIP 323680000023219. Privacy contact: BalmForUsers@gmail.com (with BalmForUsers@yandex.ru as backup). Effective date: 26 May 2026. Version 3.0.

Balm Privacy Policy and Personal Data Processing Notice