monkeymachine™ — COOKIE POLICY AND SIMILAR TECHNOLOGIES

for monkeymachine websites, web interfaces and applications

https://monkeymachine.ru/en/legal/cookies

Operator of monkeymachine's own resources

Individual entrepreneur Rabadan Ibragimovich Izabakarov

TIN 051127783109 · OGRNIP 316057100052211

1.1. This Policy explains the use of cookies and similar technologies on monkeymachine's own websites, web interfaces and applications.

1.2. Similar technologies include, in particular, localStorage, sessionStorage, session identifiers, SDKs, pixels, tags, technical device or application identifiers and other mechanisms that store or read information on the user's device, or that make it possible to link events within a single session.

1.3. Where such information makes it possible to identify a user directly or indirectly, it is processed in accordance with personal data legislation and the monkeymachine Privacy Policy.

1.4. This Policy is not in itself the user's consent. Where an optional technology requires consent, that consent is expressed by a separate action in the cookie banner or in the settings centre.

1.5. This Policy applies together with the Privacy Policy and other monkeymachine documents relating to a particular function.

2.1. monkeymachine may not automatically be treated as the operator of the cookie domain of every website a client has built in the builder. For their own website or application, clients normally determine the purposes themselves and connect analytics, forms, marketing and other functions.

2.2. In that case monkeymachine provides the technological environment, the mechanism for managing categories, the logging of the user's choice, and the generation or placement of the corresponding legal text within the limits of the implemented functionality.

2.3. Where a particular technology is used by monkeymachine itself for its own purpose, the role is determined separately on the basis of the actual process.

3.1. The category is determined by the actual function, not by the name of the cookie. A functional technology may be necessary where without it an action the user has requested cannot be performed.

3.2. An analytics or marketing technology does not become "necessary" merely because it is convenient for the owner of the resource.

• identify the active session and keep the user signed in;
• help protect the account and the service against abuse;
• store the user's choice regarding cookies;
• make a form, routing or another explicitly requested function work;
• may use localStorage or sessionStorage where this is required for the interface to operate.

4.1. Refusing such technologies may make the corresponding function impossible. Separate consent is therefore not used for them where the processing relies on another lawful ground.

4.2. This does not remove the obligation to minimise the retention period and the scope of the data stored.

5.1. Analytics, marketing and other optional technologies must not be launched before the user makes an active choice, where their use is based on consent.

5.2. Consent must be separate, specific, informed, deliberate and unambiguous. Pre-ticked toggles are not used for optional categories.

5.3. The user may accept all optional categories, refuse them, or configure each category individually.

5.4. Refusing optional technologies must not block ordinary access to the website or to a basic function, unless the technology is objectively necessary for that function.

5.5. Consent remains valid until it is withdrawn, or until the purposes or the composition of the technologies concerned change materially. In order to keep the record of choice meaningful in practice, monkeymachine may ask for it again once the retention period of that record has expired.

6.1. The 12-month period is a practical limit set by monkeymachine for persistent optional technologies, not a universal statutory period.

6.2. Where a particular external service technically sets a shorter period, the shorter period applies.

6.3. Once consent is withdrawn, new optional operations cease. Identifiers already stored are deleted or cease to be used within the limits of the technically applicable process.

7.1. monkeymachine may connect analytics, communication, advertising, payment, infrastructure and other external services.

7.2. The list of providers may change as the platform develops. Connecting a new provider does not automatically enable optional technologies for all users.

7.3. Before a third-party technology is enabled, its category, the scope of the data transferred, the recipient, the country, the legal role, the retention period and the need for consent are determined.

7.4. The specific list of active third-party technologies must be shown in the "Cookie Settings" centre or in the current list of monkeymachine external services.

8.1. Where a cookie, SDK or other identifier is linked to the personal data of citizens of the Russian Federation, the route concerned is handled in accordance with Russian legislation on data localisation and cross-border transfer.

8.2. Data may not be treated as anonymised merely because a cookie ID, device ID, session ID or other technical identifier is used instead of a name.

8.3. A foreign analytics or advertising service is not enabled until the actual recipient and the set of data transferred have been established and the applicable requirements for that route have been met.

9.1. On a first visit, where no choice has yet been stored, the user sees the banner before any optional category is launched.

9.2. The buttons to accept and to refuse optional technologies must be available at the same level of the interface. A user must not be required to open a separate page merely in order to refuse.

9.3. Until a choice is made, only strictly necessary technologies may be used.

10.1. A permanent "Cookie Settings" link is placed in the site footer and reopens this centre.

10.2. Changing or withdrawing a choice must be no more difficult than giving it.

10.3. Where the choice is changed, the new settings apply going forward, with no need to accept the Public Offer, the Terms of Use or any other document again.

• date and time;
• the session or account identifier, to the minimum extent necessary;
• the categories selected;
• the version of the banner or settings centre;
• the version of the Cookie Policy;
• any subsequent change or withdrawal event.

11.1. No more information should be collected to evidence consent than is necessary to confirm the act of choice itself.

12.1. When a website is published through the monkeymachine builder, the client receives not only a technical website but also a cookie domain corresponding to the functions activated on that website.

12.2. Before publication, or before a new optional technology is enabled, the client project must establish:

• the owner or operator of the website;
• which categories of technology are actually used;
• which analytics, advertising and other external services are connected;
• what data and identifiers they receive;
• whether the technology requires separate consent;
• the lifetime of the identifiers concerned.

12.3. monkeymachine must generate a tailored Cookie Policy for the client website on the basis of its legal profile and active modules, rather than simply copying monkeymachine's own details.

12.4. The client Cookie Policy is published on the client's website and names the client as the operator in those processes where it is the client that determines the purpose.

12.5. The basic cookie banner and settings centre inherit monkeymachine's general mechanics:

• necessary technologies — always available;
• optional technologies — switched off until consent is given;
• "Accept all / Necessary only / Customise";
• a permanent link to the settings;
• a log of the version and of the choice;
• automatic rebuilding of the categories when the active modules change.

12.6. Where a client manually connects a third-party script, pixel, SDK or other service outside the standard integration catalogue, the client must declare it in the settings and complete the legal configuration before publication.

12.7. monkeymachine must not automatically label analytics or advertising scripts added by a client as "necessary".

13.1. A mobile application may have no browser cookies in the literal sense, yet use SDKs, local storage, advertising or device identifiers, push tokens and other similar technologies. For the purposes of this Policy the same functional approach applies.

13.2. When a client application is released through monkeymachine, the system must carry over the legal configuration of the project concerned: technology categories, the operator, links to the policy, analytics controls and, where required, the consent mechanism.

13.3. Where the operating system or the app store provides its own system permission or consent mechanism, it is used together with the required legal information and does not automatically replace it.

13.4. Adding a new SDK or analytics provider must trigger a fresh review of the cookie and SDK domain and, where the change is material, an update of the policy and a new request for the user's choice.

14.1. The operator's name, the link to the policy and the set of available categories are taken from the legal profile of the particular project.

14.2. Where a project does not use, for example, marketing technologies, the corresponding category must not be displayed "just in case".

16.1. Users may also delete or restrict cookies through their browser settings, and application identifiers and permissions through their device settings, where the operating system offers that option.

16.2. Blocking strictly necessary technologies may cause the corresponding function to stop working.

16.3. Browser or device settings do not replace the built-in "Cookie Settings" control where the service itself provides a mechanism for consent and withdrawal.

17.1. The current version of monkeymachine's own Policy is published at the permanent address https://monkeymachine.ru/ru/legal/cookies.

17.2. Where only technical details change, without any new purpose or new optional category, the policy may be updated without asking for consent again.

17.3. Where the purposes, the set of optional categories or the composition of the data change materially and new consent is required, the user is asked to make a new choice.

17.4. For client websites and applications, an update to the active integrations must trigger a review and, where necessary, a new version of the client Cookie Policy.

The following, in particular, have been taken into account:

• Federal Law No. 152-FZ of 27 July 2006 "On Personal Data", including articles 5, 6, 9, 12, 18 and 18.1;
• the requirement, in force from 1 September 2025, that consent to the processing of personal data be obtained separately from other documents confirmed by the user;
• the Russian approach under which cookies, IP addresses and other identifiers fall within the personal data regime where they make it possible to identify a user directly or indirectly;
• the need to record demonstrable active consent to optional analytics and marketing technologies where the processing is based on consent.