I have a folder (/var/www/test7.com), which must be readable/writable by www-data AND test7 users.
test7 user should not have access to other websites.
How can I do that?
most confusing way would be to use 'acl' (apt-get install acl) tool to create advanced control lists, where you can allow/disallow access to files using advanced rules.
for example, you have directory owned by root and 3 other users, using acl you can set that direcotry owner is still root with 700 rights, but then set acl that will allow one user to read files, and other 2 read/write files in the directory.
All of that can be done using setfacl (to set up permissions) getfacl (to read permissions). Directories can have default settings what to assign to files/folders.
If not used with care you can mess up permissions pretty good.