Consent to personal data processing

for the “Moya Bron” online booking service

Version dated 16 September 2026. Effective upon publication.

I, an individual with full legal capacity using the “Moya Bron” online booking service (the “User”), acting freely, of my own will and in my own interests, by taking an action on moyabron.ru or in the “Moya Bron” mobile application (jointly, the “Service”) that expresses consent — by selecting the checkbox “I consent to the processing of my personal data” or by clicking “Register”, “Book”, “Submit” or another equivalent button immediately next to a statement that clicking it constitutes consent and a link to this document — hereby consent to the processing of my personal data (the “Consent”) on the terms set out below.

1. Personal data controller

1.1. This Consent is given to Moya Bron Limited Liability Company (OGRN 1247700470566, INN 9717165404), address: premises 3/7, building 1, 102 Prospekt Mira, Moscow, 129626, Russia, email: support@moyabron.ru (the “Operator”).

1.2. The Operator owns the Service and provides an information technology platform for searching, comparing, selecting, booking and paying for accommodation services provided by Providers (accommodation properties), in accordance with the User Agreement for the “Moya Bron” online booking service (https://moyabron.ru/docs/user-agreement) (the “User Agreement”).

1.3. Capitalised terms used in this Consent (Service, User, Guest, Provider, Booking, Offer, Account) have the meanings given to them in the User Agreement and the Personal Data Processing Policy for the “Moya Bron” online booking service (https://moyabron.ru/docs/privacy-policy) (the “Policy”).

2. Purposes of personal data processing

2.1. Consent is given to the processing of personal data for the following purposes:

creating, maintaining and protecting the User’s Account in the Service, identifying and authenticating the User;
providing Offer search functionality and personalising search results (saving search parameters, favourites and selected settings);
processing a Booking, concluding and performing an accommodation services contract between the User (Guest) and the Provider, including transferring to the Provider the information necessary for the stay;
accepting online payments, processing settlements and refunds, and generating receipts and other financial documents;
sending service messages: Booking confirmations, changes and reminders, payment and refund notifications, and responses to enquiries;
handling enquiries, complaints and disputes, and providing support to the User;
ensuring the security of the Service and preventing and investigating fraud, abuse and violations of the User Agreement;
fulfilling obligations imposed on the Operator by the laws of the Russian Federation, including requests from authorised state bodies.

2.2. This Consent does not cover advertising messages or the use of analytics cookies: the Operator obtains separate consent for these purposes (sections 9 and 10 of this document). Refusal does not restrict access to the Service or the ability to make Bookings.

3. Categories of personal data

3.1. Consent is given to the processing of the following personal data of the User:

first and last name;
mobile phone number;
email address;
Account information: login, User identifier, authentication information, Service settings and favourites;
search and Booking parameters: the selected accommodation property, check-in and check-out dates, the number and composition of guests, accommodation preferences and Booking history;
payment information: payment method, amount and status, masked card number and card type, and refund information (the Operator does not collect or store full bank card details — these are processed by the payment provider);
the content of support enquiries, complaints and correspondence with the Operator, and information that the User voluntarily includes in them;
technical data obtained automatically when using the Service: IP address, browser and device information, device and application identifiers, access date and time, information about actions in the Service, approximate location (based on the IP address or, with permission on the device, geolocation data), and cookies classified by the Policy as necessary and functional.

3.2. When making a Booking for other persons (Guests), the User provides the Operator with their first and last names and, where required by the Provider, contact details and other information about the Guests necessary for their stay. The User confirms that they are entitled to transfer Guests’ data to the Operator and the Provider, have obtained the Guests’ consent to do so (and, in the case of a minor Guest, are their legal representative or another duly authorised adult), and undertake to inform the Guests about the Operator and the processing terms contained in this Consent and the Policy.

3.3. The Operator does not request or intend to process special categories of personal data (concerning health, ethnicity, political opinions, religious or philosophical beliefs, intimate life or criminal convictions), biometric personal data, passport details or full bank card details. The User undertakes not to include such information in Booking comments or enquiries.

4. Processing operations and methods

4.1. Consent is given to the following operations with personal data: collection, recording, systematisation, accumulation, storage, clarification (updating and amendment), retrieval, use, transfer (provision and access) to the persons specified in section 5 of this Consent, depersonalisation, blocking, deletion and destruction.

4.2. Processing is carried out using a combination of automated means (in the Operator’s information systems located in the Russian Federation) and non-automated means, with data transmitted over the Internet information and telecommunications network using the safeguards provided for in the Policy.

4.3. The collection, recording, systematisation, accumulation, storage, clarification and retrieval of personal data of citizens of the Russian Federation are carried out using databases located in the Russian Federation.

5. Transfer of personal data to third parties

5.1. To the extent necessary to achieve the purposes specified in section 2, Consent is given to the transfer (provision) of personal data to the following persons, each of whom independently determines the purposes and methods of further processing:

the Provider — the accommodation property selected by the User — and the authorised supplier of the Offer, if the Offer is listed through that supplier (the Provider’s name and address are specified in the Offer and the Booking Confirmation);
payment providers, banks and payment system operators facilitating payments and refunds;
the fiscal data operator that generates and transmits receipts;
state bodies, courts and other persons — in the cases and to the extent established by the laws of the Russian Federation.

5.2. Consent is given to entrusting personal data processing to persons acting on the Operator’s instructions who are not entitled to use the data for their own purposes: Russian providers of hosting and cloud infrastructure, email, SMS and push notification services, technical support, backup and information security services. An up-to-date list of recipients and persons processing personal data on the Operator’s instructions, including their names and addresses, is published in section 6 of the Policy and is provided upon the User’s request through the channels specified in clause 7.2 of this Consent.

6. Cross-border transfer of personal data

6.1. If the User selects an accommodation property outside the Russian Federation, by selecting the additional checkbox “I consent to the transfer of my data and Guests’ data to a foreign accommodation property” when making that Booking, the User consents to the Operator transferring the User’s first and last name and contact details, Guests’ data and Booking parameters to the foreign Provider (authorised supplier) in the country where the accommodation property is located, solely for the purpose of concluding and performing the accommodation services contract.

6.2. The Operator carries out cross-border transfers in compliance with Article 12 of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”, including after submitting a notification to Roskomnadzor, and informs the User of the recipient’s country in the Offer. Booking a foreign accommodation property is not possible without such a transfer.

7. Duration and withdrawal of Consent

7.1. This Consent is valid from the time it is given until the purposes of processing have been achieved or the User withdraws it, whichever occurs first. Personal data retention periods for each purpose, as well as mandatory statutory retention periods (in particular, for payment and Booking documents — generally no more than 5 years after the end of the calendar year in which the Booking was completed), are set out in section 4 of the Policy.

7.2. The User may withdraw this Consent in full or in part at any time by sending a request to the Operator: by email to support@moyabron.ru from the address specified in the Account, or by post to: premises 3/7, building 1, 102 Prospekt Mira, Moscow, 129626, Russia. The request must allow the User to be identified and contain a description of the request and contact details for a response.

7.3. The Operator stops processing personal data and destroys them within no more than 30 (thirty) days of receiving the withdrawal, unless otherwise provided by law. Withdrawal of Consent does not affect the lawfulness of processing carried out before it was received, nor does it terminate processing for which the Operator retains another legal basis: performance of an active Booking and the contract with the User, mandatory document retention periods, handling a dispute, or protecting the rights of the Operator and third parties.

7.4. Deleting the Account through the Service interface is treated as withdrawal of Consent in respect of Account data; after deletion, Account data are destroyed within 30 days, except for information that must be retained by law or in connection with active Bookings.

8. User rights and final provisions

8.1. The User has the rights provided for in Articles 14–17 of the Federal Law “On Personal Data” and section 12 of the Policy: to obtain information about the processing of their personal data and access to those data; to request their clarification, blocking or destruction; to object to processing; and to challenge the Operator’s actions or omissions before Roskomnadzor or a court. Requests are submitted through the channels specified in clause 7.2 of this Consent; the Operator responds within the statutory time limits.

8.2. The User confirms that they have read the Policy, that processing personal data for the purposes specified in section 2 is necessary to provide the Service to them, and that this Consent is given separately from the User Agreement and other documents, knowingly and unambiguously.

8.3. The Operator records the granting of Consent (date and time, User identifier, the form and action by which Consent was given, and the version of the text) in an electronic log. Consent given electronically by selecting a checkbox or clicking a button in the manner specified in the preamble is recognised as equivalent to consent on paper bearing the User’s handwritten signature.

8.4. The Operator may publish new versions of this Consent at https://moyabron.ru/docs/consent. A new version applies to Users who give Consent after its publication; changes to purposes or data categories that require new consent are confirmed by selecting the checkbox again.

9. Consent to receive advertising messages

9.1. By selecting the separate checkbox “I want to receive offers and news from Moya Bron”, the User freely, of their own will and in their own interests, consents to receiving advertising and informational messages from the Operator about the Service, Offers, promotions, discounts and news from the Operator and Providers by email, phone (SMS and messengers) and push notifications in the mobile application, in accordance with Article 18(1) of Federal Law No. 38-FZ of 13 March 2006 “On Advertising”.

9.2. For the purpose of promoting goods, works and services on the market (Article 15 of the Federal Law “On Personal Data”), the Operator processes the User’s name, email address, phone number, device and application identifiers, search and Booking history, and settings and preferences in the Service through collection, recording, systematisation, accumulation, storage, clarification, use, depersonalisation, blocking, deletion and destruction, using a combination of automated and non-automated means and engaging mailing service providers listed in the Policy to act on the Operator’s instructions.

9.3. Consent to receive advertising messages remains valid until withdrawn. The User may withdraw it at any time without giving reasons: in Account settings, through the unsubscribe link in each email, by replying “СТОП” (“STOP”) to an SMS, by disabling notifications in the application, or by sending a request to support@moyabron.ru. The Operator stops sending such messages immediately upon receiving the refusal. Withdrawal does not affect service messages concerning active Bookings, payments and enquiries that the Operator sends to perform the contract.

9.4. Consent to receive advertising messages is not a condition for using the Service or making a Booking.

10. Consent to the use of analytics cookies

10.1. By clicking “Accept analytics cookies” in the cookie settings window on moyabron.ru, the User consents to the Operator processing technical data — cookie identifiers, IP address, browser and device information, referral source and actions on Service pages — for statistical analysis of traffic and improvement of the Service, and to transferring those data to YANDEX LLC (OGRN 1027700229193, address: 16 Lva Tolstogo Street, Moscow, 119021, Russia), the operator of the Yandex Metrica service.

10.2. The Operator does not transfer first or last names, phone numbers, email addresses, Guests’ data or payment information to YANDEX LLC. Data operations: collection, recording, systematisation, accumulation, storage, use, transfer, depersonalisation, blocking, deletion and destruction; processing method: automated.

10.3. Consent to the use of analytics cookies remains valid until withdrawn or until the cookie lifetime specified in section 8 of the Policy expires. The User may withdraw consent at any time in the website’s cookie settings (the “Cookie settings” link at the bottom of the pages) or by deleting cookies in the browser; analytics cookies are not set after withdrawal. Refusing analytics cookies does not restrict access to the Service: necessary and functional cookies are used on the basis of the User Agreement and do not require consent.

11. Consent of an accommodation property representative

11.1. An individual submitting an application to connect an accommodation property to the Service through the form at https://moyabron.ru/join, by selecting the checkbox “I consent to the processing of my personal data” or by clicking the application submission button next to a statement that consent is being given and a link to this document, freely, of their own will and in their own interests, consents to the Operator processing their personal data on the terms of this section.

11.2. Processing purposes: reviewing the application to connect an accommodation property; contacting the representative regarding connection and the conclusion and performance of a contract between the Operator and the accommodation property (Provider); and maintaining records of the Operator’s partners.

11.3. Data categories: contact person’s name; phone number; email address; position and name of the accommodation property represented; the property’s website address; information about the channel management system used; correspondence; and technical data obtained when the form is submitted (IP address, date and time).

11.4. Operations and methods: collection, recording, systematisation, accumulation, storage, clarification, retrieval, use, transfer (provision) to the Operator’s employees and persons acting on its instructions (hosting, CRM and communications service providers listed in the Policy), blocking, deletion and destruction; using a combination of automated and non-automated means, with databases located in the Russian Federation.

11.5. Duration: until a contract is concluded with the accommodation property (after which data are processed under the contract) or, if no contract is concluded, for 1 (one) year from the last interaction regarding the application, and subject to withdrawal of consent. Withdrawal procedure: a request to support@moyabron.ru or a letter sent to the Operator’s address; the Operator stops processing and destroys the data within 30 days of receiving the withdrawal, unless retention is required by law or a concluded contract.

11.6. The representative confirms that they have read the Policy, are providing their own contact details, and are authorised to represent the specified accommodation property.

12. Operator details

Moya Bron LLC, OGRN 1247700470566, INN 9717165404. Address: premises 3/7, building 1, 102 Prospekt Mira, Moscow, 129626, Russia. Email: support@moyabron.ru.