Privacy Policy

1. GENERAL PROVISIONS This Privacy Policy (the “Policy”) explains how Limited Liability Company “5D Regeneration” (Ukrainian legal name: ТОВАРИСТВО З ОБМЕЖЕНОЮ ВІДПОВІДАЛЬНІСТЮ “5D Регенерація”; the “Company”, “we”, “us” or “our”) collects, receives, uses, stores, transfers and protects the personal data of website users, Purchasers, Students, parents and legal representatives of minors, and other persons who interact with our services. This Policy applies when you: • visit our website; • use website features; • complete electronic forms; • submit an application; • place an order; • purchase a digital educational product; • gain access to an educational platform; • participate in an educational programme; • contact customer support; • undergo identity verification for certain programmes; • interact with our advertising; • subscribe to marketing communications; • otherwise interact with the Company. Reading this Policy does not in itself constitute consent where applicable law requires separate explicit consent. Where particular processing is based on consent, that consent is requested separately and given through an affirmative action by the user. Continued use of the website does not in itself constitute consent to the use of optional analytics or advertising cookies. 2. PERSONAL DATA CONTROLLER The personal data controller (the personal data holder under Ukrainian law) is: Limited Liability Company “5D Regeneration” Email: team@5d-regeneration.com Website: 5d-regeneration.com The Company determines the main purposes and means of processing personal data in connection with the website, digital educational products and other services described in this Policy. Certain third-party providers may independently determine the purposes and means of particular processing operations in accordance with their own terms, privacy policies and applicable law. 3. NATURE OF OUR PRODUCTS AND SERVICES The Company's principal activities include providing digital educational wellness products, including videos, texts, images, assignments and other educational materials available through an educational platform or other digital resources. These products cover bodily self-observation, mindful movement, awareness of sensations, relaxation, breathing patterns, visual aesthetics and general wellbeing within the author's educational model. Our digital products: • are informational and educational in nature; • do not constitute medical care; • do not constitute medical diagnosis; • do not constitute treatment; • do not constitute medical therapy; • do not constitute medical rehabilitation; • do not constitute an individual medical prescription; • do not replace professional medical or dental care. 4. PERSONAL DATA WE MAY PROCESS Depending on the nature of the interaction, we may process: Identification and contact data • first name; • last name; • email address; • telephone number; • Telegram username; • WhatsApp details or details of another messenger used; • country of residence; • citizenship, where objectively necessary; • age; • date of birth; • tax residence, where objectively necessary. Order and product usage data • selected Course or Pricing Plan; • order details; • payment amount and currency; • payment method; • transaction identifier; • instalment payment information; • refund information; • details of digital access provided; • date of registration on the Platform; • Course usage and progress information, if the Platform used provides such features; • customer support history. Electronic communications • email content; • messages in Telegram or other channels used; • customer support requests; • other messages sent by the user to the Company. Identity verification data for certain programmes  In the circumstances provided for in this Policy: • passport or other document number; • country of issue; • expiry date; • electronic signature; • date and time of signing; • information about identity verification completed. Technical data • IP address; • device type; • browser; • operating system; • approximate location; • pages viewed; • date and time of visit; • referral source; • cookie identifiers; • advertising identifiers; • form submission information; • form or order identifier; • information about electronic acceptance; • information about the granting or withdrawal of consent. We seek to process only data that is objectively necessary and proportionate to the relevant purpose.

5. PAYMENTS Payments may be made through third-party banks, payment systems, acquirers, payment providers or other lawful payment intermediaries. When a third-party payment provider is used, some personal and payment data may be provided directly to that provider. The Company does not normally receive or store the full bank card number, CVV/CVC or other complete card authentication details where the transaction is processed through an external payment interface. We may receive information from the payment provider that is necessary for: • confirming that a payment has been successful; • identifying the order; • accounting; • issuing refunds; • preventing fraud; • handling a dispute or chargeback; • confirming that payment has been made. Such information may include: • payer's name; • email address; • country; • amount; • currency; • transaction date; • transaction identifier; • payment status; • limited payment instrument details; • other information provided by the relevant payment provider. 6. ELECTRONIC FORMS AND TALLY We use Tally and may use other electronic form services. Depending on the purpose of a particular form, it may collect: • first and last name; • email address; • telephone number; • country; • Telegram or other contact details; • selected product; • information about the Purchaser and the Student; • answers to questions; • electronic confirmations and checkboxes; • electronic signature; • submission identifier; • date and time of submission; • technical information. Do not submit photographs, medical documents, diagnoses, examination results or other sensitive information through our forms. 7. EDUCATIONAL PLATFORM AND SENDPULSE We may use SendPulse and other educational or communications platforms to provide digital Courses. These services may technically process: • name; • email address; • account data; • selected Course; • registration date; • information about access provided; • technical information about use of the Platform; • information about lessons viewed or assignments completed, if the relevant feature is used; • service messages. These data are used to provide the digital product purchased, provide technical support and document performance of the contract. 8. IDENTITY VERIFICATION FOR PARTICIPANTS IN THE 5D REGENERATION METHOD EXPERT COURSE The actual Student of the “5D Regeneration Method Expert” course may be required to undergo identity verification before personal access is activated. The procedure may require: • full first and last name; • date of birth; • citizenship; • country of residence; • tax residence, where objectively necessary; • document number; • country of issue; • expiry date; • email address; • electronic signature; • date and time of the electronic action; • version of the terms accepted; • technical information evidencing the electronic action. The purposes of such processing may include: • verifying the Student's identity; • confirming that access is personal; • preventing the transfer of access; • documenting electronic acceptance; • issuing a certificate; • applying lawful contractual, sanctions-related or payment restrictions; • preventing fraud; • protecting intellectual property; • resolving disputes. As a general rule, identity verification is not required for other Courses. 9. IDENTITY VERIFICATION INFORMATION Identity verification information is used only for the relevant stated purpose. We do not use this information for advertising profiling or creating marketing audiences. We do not create biometric templates or use automated facial recognition. 10. SPECIAL CATEGORIES OF PERSONAL DATA We do not request photographs, medical documents, diagnoses, examination results or other health information in connection with our digital products. Do not include such information in forms, assignments or support messages. If such information is sent to us without being requested, we do not use it to assess appearance or health, provide medical advice or perform medical activities. Any handling of such information is limited to what is necessary and lawful, including deletion where appropriate, and is subject to the additional requirements applicable to special categories of personal data.

11. PURPOSES OF PROCESSING Personal data may be processed for: • processing applications; • responding to enquiries; • entering into and performing contracts; • processing orders; • processing payments; • providing digital content; • providing personal access; • managing the educational platform; • documenting the provision of access; • providing technical support; • verifying the identity of participants in certain programmes; • documenting electronic acceptance; • issuing certificates; • processing refunds; • handling chargebacks and other payment disputes; • preventing fraud; • protecting personal access; • accounting and tax recordkeeping; • complying with the law; • applying sanctions-related and payment restrictions; • protecting intellectual property; • defending legal claims; • ensuring information security; • maintaining necessary business records; • analysing website use; • improving the website and services; • advertising analytics where an appropriate legal basis exists; • direct marketing where an appropriate legal basis exists. 12. LEGAL BASES FOR PROCESSING Depending on the circumstances, personal data may be processed on the following bases under Article 11 of the Law of Ukraine “On Personal Data Protection”: • consent; • entering into or performing a contract to which the data subject is a party or which is concluded for the data subject's benefit; • taking steps at the user's request before entering into a contract; • complying with statutory obligations; • protecting the legitimate interests of the Company or a third party receiving the data, unless the need to protect the data subject's fundamental rights and freedoms overrides those interests; • other grounds provided for by applicable law. Fraud prevention, security, protection of contractual and intellectual property rights, and the establishment or defence of legal claims may be pursued under an applicable legal basis listed above; they do not in themselves constitute separate legal bases. Special categories of personal data are processed only where a separate condition permitting such processing under applicable law is satisfied. 13. COOKIES AND SIMILAR TECHNOLOGIES We may use: • cookies; • pixels; • tags; • scripts; • local storage; • other similar technologies. Necessary technologies  These are used for: • operation of the website; • security; • operation of forms; • saving user preferences; • providing the selected language version; • performing functions directly requested by the user. Optional technologies  These may be used for: • analytics; • measuring advertising conversions; • remarketing; • analysing advertising effectiveness. Where applicable law requires consent, these technologies are activated only after the user has made the relevant choice. 14. GOOGLE ANALYTICS With the user's consent, we may use Google Analytics. Google may receive: • IP address; • device information; • browser data; • approximate location; • pages visited; • referral source; • visit duration; • cookie identifiers; • other technical analytics information. 15. GOOGLE ADS Where an appropriate legal basis exists, we may use Google Ads for: • placing advertisements; • measuring conversions; • optimising advertising; • creating advertising audiences; • remarketing. We do not intend to transmit through Google Ads: • passport details; • copies of documents; • health data; • sensitive user responses. 16. META PIXEL With the relevant consent, we may use Meta Pixel for: • measuring advertising effectiveness; • analysing conversions; • creating advertising audiences; • remarketing; • optimising advertising campaigns. We do not intend to transmit special categories of personal data or identity documents through Meta Pixel. 17. WEGLOT We use Weglot to provide different language versions of the website. Weglot may technically process: • the address of the page visited; • selected language; • language settings; • IP address; • browser and device information; • page content being translated; • other technical information necessary for the service to function. 18. LINKTREE AND OTHER EXTERNAL SERVICES We may use Linktree and other third-party platforms to publish links to our resources. After navigating to a third-party platform, the user interacts directly with that service, which may process data under its own privacy policy.

19. DIRECT MARKETING Advertising and marketing messages are sent only where an appropriate legal basis exists and, where required, separate consent has been obtained. Messages may be sent via: • email; • SMS; • Telegram; • WhatsApp; • another channel selected by the user. The user may opt out of direct marketing at any time. Opting out does not affect necessary service messages relating to: • an order; • payment; • provision of access; • security; • technical support; • changes to terms; • performance of the contract. 20. PUBLIC AND MARKETING USE OF TESTIMONIALS Purchasing a Course or submitting a testimonial does not automatically constitute consent to public use of the testimonial. Testimonials and other identifying written feedback may be used publicly or for marketing only with separate voluntary consent where such consent is required. Such consent: • is not a condition of purchasing a digital product; • is given separately; • cannot be pre-ticked; • may be withdrawn in accordance with the law. 21. RECIPIENTS OF PERSONAL DATA To the extent necessary for the relevant function, personal data may be made available to: • SendPulse; • Tally; • Telegram; • educational platform providers; • hosting providers; • cloud services; • email providers; • banks; • payment systems; • acquirers; • other payment providers; • Google; • Meta; • Weglot; • Linktree; • IT providers; • technical contractors; • accountants; • auditors; • lawyers; • public authorities in the circumstances provided for by law; • other recipients where an appropriate legal basis exists. Employees and contractors are given access only to data that are objectively necessary to perform their relevant functions. 22. TELEGRAM AND SENDPULSE COMMUNICATIONS If you contact us through Telegram, your messages are technically processed by Telegram's infrastructure. If the relevant Telegram bot or communications process operates through SendPulse or another technical provider, that provider may also technically process the data to the extent necessary. 23. INTERNATIONAL TRANSFERS The use of international platforms and technical services may result in data being processed outside Ukraine. This may occur, in particular, when using: • SendPulse; • Telegram; • Tally; • Google; • Meta; • Weglot; • Linktree; • international payment providers; • other international cloud services. International transfers are carried out in accordance with Article 29 of the Law of Ukraine “On Personal Data Protection”, subject to the applicable requirements concerning adequate protection or another legally permitted ground for transfer, and any other mandatory requirements of applicable law. 24. RETENTION PERIODS We do not retain personal data longer than is objectively necessary for the relevant purpose, unless longer retention is required by law or supported by an independent lawful basis. When determining retention periods, we consider: • the purpose of processing; • the category of data; • the sensitivity of the data; • the duration of the contractual relationship; • the period for which access is provided; • accounting and tax requirements; • limitation periods; • the need to defend legal claims; • information security requirements. Digital orders and access  Information about payments, orders, provision of digital access and electronic acceptance may be retained for the period necessary to perform the contract, maintain accounting records, handle payment disputes and protect legal rights. Identity verification records  A record that identity verification has been completed may be retained for the necessary period. 25. SECURITY We take reasonable technical and organisational measures to protect personal data against: • unauthorised access; • loss; • unlawful disclosure; • alteration; • destruction; • unlawful copying; • other forms of unlawful processing. Measures may include: • access controls; • password protection; • secure connections; • organisational rules; • limiting the permissions of employees and contractors; • backups; • security monitoring; • incident response procedures. No electronic method of storage or transmission guarantees absolute security.

26. RIGHTS OF DATA SUBJECTS Under Ukrainian law, including Article 8 of the Law of Ukraine “On Personal Data Protection”, and other applicable law, data subjects may exercise the following rights, subject to the relevant statutory conditions: • find out whether we process their data; • obtain information about the purposes and legal bases of processing; • obtain information about the sources and location of their data and the location of the controller or processor; • obtain access to their data; • obtain a copy of their data; • correct inaccurate data; • request deletion in the circumstances provided for by law; • request restriction of processing where provided for by applicable law; • submit a reasoned objection to processing; • withdraw consent; • opt out of direct marketing; • obtain information about recipients and the conditions of access to their data; • obtain information about international transfers; • specify restrictions on processing when giving consent; • know how automated processing works and obtain protection against automated decisions having legal consequences; • obtain protection against unlawful processing and accidental loss, destruction or damage of their data; • lodge a complaint with the competent supervisory authority; • seek judicial protection and other available legal remedies. To exercise your rights, contact: team@5d-regeneration.com Email subject: Personal Data Request To prevent disclosure of data to an unauthorised person, we may request information necessary to verify the requester's identity. 27. WITHDRAWAL OF CONSENT Where processing is based on consent, the user may withdraw that consent in accordance with the law. Withdrawal: • does not affect the lawfulness of processing before withdrawal; • ends further processing based exclusively on the relevant consent. Withdrawal of marketing consent does not affect processing necessary to perform a contract or pursue another independent lawful purpose. 28. MINORS Certain digital educational products may be intended for minors with the involvement of a parent or other legal representative. When processing a child's data, we take into account: • age; • the purpose of processing; • the sensitivity of the data; • the need for parental consent; • the best interests of the child; • other mandatory requirements of applicable law. 29. GDPR If the General Data Protection Regulation (GDPR) applies to particular processing, the data subject is afforded the additional rights and safeguards provided for by the GDPR. These may include: • the right of access; • rectification; • erasure; • restriction of processing; • data portability; • objection; • withdrawal of consent; • lodging a complaint with the relevant supervisory authority. The applicability of the GDPR is determined by the particular circumstances of the processing concerned. 30. AUTOMATED DECISION MAKING As a general rule, we do not use solely automated decisions that produce legal or similarly significant effects for the user. If such processing is introduced in the future, the user will be given the necessary information and the safeguards required by law. 31. THIRD PARTY WEBSITES The website may contain links to third-party websites and services. After following an external link, the user interacts with the relevant third-party service. We do not control all independent actions of such third parties and recommend reviewing their own privacy policies. 32. CHANGES TO THIS POLICY We may update this Policy from time to time. Reasons may include: • changes to products; • changes to the website; • adding or discontinuing technical services; • changes to processing methods; • changes in the law; • changes to security requirements; • changes to identity verification processes. The current version is published on the website with the date of the last update. 33. COMPLAINTS Questions or complaints about the processing of personal data may be sent to: info@5d-regeneration.com 34. CONTACT DETAILS Limited Liability Company “5D Regeneration” Email: info@5d-regeneration.com Website: 5d-regeneration.com 35. APPLICABLE LAW This Policy is governed by the laws of Ukraine, including the Law of Ukraine “On Personal Data Protection” No. 2297-VI of 1 June 2010 and other applicable Ukrainian personal data protection legislation. If the GDPR or other mandatory foreign personal data protection legislation applies to particular processing, that processing is also carried out in compliance with the relevant mandatory requirements.