Personal Data Processing Policy

Authoritative version

This is a translation provided for convenience. In case of any discrepancy between this translation and the Russian original, the Russian version shall prevail.

1. General provisions

This Policy on the processing of personal data (the “Policy”) sets out the procedure for processing and protecting the personal data of users of the website tranzit3.ru (the “Website”), whose operator is ООО «Каргов Лоджистикс» (Cargov Logistics LLC) (the “Operator”).

The Policy has been drawn up in pursuance of Part 2 of Article 18.1 of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (“Law No. 152-FZ”) and other regulatory legal acts of the Russian Federation in the field of personal data protection, including Roskomnadzor Order No. 18 of 24 February 2021 and Roskomnadzor Order No. 179 of 28 October 2022.

The Policy is a publicly available document and is subject to publication on the Website at tranzit3.ru/legal/privacy in accordance with Part 2 of Article 18.1 of Law No. 152-FZ.

The Operator is entered in the register of operators processing personal data maintained by the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor).

2. Terms and definitions

“Personal data” means any information relating to a directly or indirectly identified or identifiable natural person (the personal data subject).

“Processing of personal data” means any action or set of actions performed with personal data, with or without the use of automation, including collection, recording, systematisation, accumulation, storage, clarification, retrieval, use, transfer, depersonalisation, blocking, deletion and destruction.

“User” means a person who uses the Website, including by filling in feedback forms, requests for a price quote or cargo tracking forms, or by registering a personal account.

3. Personal data processed

The Operator processes personal data that the User provides voluntarily when filling in forms on the Website, submitting a request for a price quote, registering a personal account, using the cargo tracking service or sending an enquiry.

Data provided by the User: surname, first name and patronymic; contact telephone number (including one used in messengers); e-mail address; name of the organisation and position; addresses of dispatch and receipt of the cargo; information on the nature, weight, volume and value of the cargo; other data voluntarily entered by the User in form fields or in the text of an enquiry.

Data obtained automatically when the Website is used: IP address; information about the browser and operating system; data from cookies and other device identifiers; date and time of access; the address of the page from which the User came; information on actions on the Website collected by web analytics systems. The Operator proceeds on the basis that such information, taken together, may be classified as personal data and processes it on the terms of this Policy.

The Operator does not request or process special categories of personal data (concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, health or intimate life), nor biometric personal data. The Operator does not process personal data of minors: the Website is intended for legal entities and individual entrepreneurs.

The Operator does not process personal data authorised by the data subject for dissemination under Article 10.1 of Law No. 152-FZ.

4. Purposes of processing

Personal data are processed solely for the following purposes: calculating the preliminary cost and time of cargo delivery; preparing and sending a commercial offer; concluding, performing and terminating a freight forwarding contract; informing the User of the status of the request and the location of the cargo; handling enquiries and providing feedback; maintaining the client’s personal account; fulfilling obligations imposed on the Operator by the legislation of the Russian Federation, including accounting and tax records; ensuring the operability and security of the Website; statistical analysis of Website traffic in depersonalised form.

Advertising and informational messages are sent only with the User’s prior consent, given separately from the consent to the processing of personal data, in accordance with Part 1 of Article 18 of Federal Law No. 38-FZ of 13 March 2006 “On Advertising”. The User may opt out of such messages at any time.

Personal data are processed on a lawful and fair basis and are limited to the achievement of specific, predetermined and lawful purposes. Processing of personal data incompatible with the purposes of their collection is not permitted, nor is the merging of databases processed for mutually incompatible purposes.

The personal data processed correspond to the purposes of processing and are not excessive in relation to them. The Operator does not take decisions producing legal consequences for the User solely on the basis of automated processing of personal data.

5. Legal grounds for processing

The legal grounds for processing personal data are: the consent of the personal data subject to the processing of his or her personal data (clause 1 of Part 1 of Article 6 of Law No. 152-FZ); the need to perform a contract to which the personal data subject is a party, beneficiary or guarantor, and to conclude a contract on the initiative of the data subject (clause 5 of Part 1 of Article 6 of Law No. 152-FZ); the need to perform the functions and duties imposed on the Operator by law (clause 2 of Part 1 of Article 6 of Law No. 152-FZ).

The legal grounds also include: the Civil Code of the Russian Federation; Federal Law No. 87-FZ of 30 June 2003 “On Freight Forwarding Activities”; Federal Law No. 402-FZ of 6 December 2011 “On Accounting”; the Tax Code of the Russian Federation; the Operator’s constituent documents and the contracts it concludes.

6. Procedure and conditions of processing. Location of databases

Personal data are processed with and without the use of automation. Processing includes the collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer, depersonalisation, blocking, deletion and destruction of personal data.

The Operator ensures compliance with the requirements of Part 5 of Article 18 of Law No. 152-FZ concerning the location of databases containing personal data of citizens of the Russian Federation. The list of information systems and technical platforms used is determined by the Operator’s internal documents; information about them is provided upon a reasoned request of the competent authority.

The Operator takes the necessary legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, provision or dissemination, and against other unlawful actions, including: appointing a person responsible for organising the processing of personal data; identifying security threats and applying protective measures in accordance with Decree of the Government of the Russian Federation No. 1119 of 1 November 2012; restricting the number of employees with access to personal data and recording such access; using a secure data transfer protocol (HTTPS/TLS); regular back-ups; monitoring the measures taken and the level of security of information systems.

The Operator may entrust the processing of personal data to another person on the basis of a contract concluded with that person, subject to the consent of the personal data subject (Part 3 of Article 6 of Law No. 152-FZ). Such a contract specifies the list of actions with personal data, the purposes of processing, and the obligation to maintain confidentiality and comply with data protection requirements. The Operator is liable to the personal data subject for the actions of such person.

Personal data may be transferred to third parties where this is necessary for the performance of a contract with the User, to the minimum extent necessary to achieve the purpose of the transfer: to carriers and their agents; customs representatives; insurance companies; warehouse operators; credit institutions — as regards payment details. Personal data are transferred to state authorities in the cases and in the manner established by the legislation of the Russian Federation, on the basis of a reasoned request.

The Operator does not sell Users’ personal data and does not transfer them to third parties for advertising purposes.

7. Cross-border transfer of personal data

The Operator informs the User that the Website and the handling of enquiries rely on services whose operator may be located outside the territory of the Russian Federation. The use of such services entails the cross-border transfer of certain personal data within the meaning of Article 12 of Law No. 152-FZ.

Categories of data transferred and purposes of transfer: web analytics services — IP address, cookie identifiers, information on actions on the Website, for the purpose of analysing traffic in depersonalised and aggregated form; e-mail delivery services — e-mail address, name and message content, for the purpose of sending notifications on the status of a request; messengers — information voluntarily provided by the User in correspondence, for the purpose of prompt communication regarding the request.

Before starting the cross-border transfer of personal data, the Operator, in accordance with Part 3 of Article 12 of Law No. 152-FZ, notifies Roskomnadzor of its intention to carry out such transfer and obtains information on the protective measures taken by the foreign recipients. Transfers to states that do not ensure adequate protection of the rights of personal data subjects are made only where there are grounds provided for by Part 4 of Article 12 of Law No. 152-FZ, including the written consent of the personal data subject.

The User may refuse the transfer of data to web analytics services by not giving consent to analytical cookies in the consent banner or by disabling cookies in the browser settings. Such refusal does not affect the ability to submit a request.

8. Periods of processing and storage of personal data

Personal data are processed until the purposes of processing are achieved or until the personal data subject withdraws consent, unless another period is established by the legislation of the Russian Federation or by contract.

Personal data contained in primary accounting documents are stored for the periods established by the legislation on accounting and archiving (not less than five years). Data of Users who submitted a request but did not conclude a contract are stored for no more than one year from their last enquiry. Personal account data are processed for the lifetime of the account and for three years after its deletion.

When the purposes of processing have been achieved, the storage period has expired or consent has been withdrawn, personal data are destroyed or depersonalised within a period not exceeding thirty days from the date of the relevant event, unless otherwise provided by law or by contract.

9. Procedure for the destruction of personal data

Personal data are destroyed in a manner that excludes their further processing and recovery, with a certificate of destruction of personal data drawn up in accordance with the requirements of Roskomnadzor Order No. 179 of 28 October 2022 “On Approval of the Requirements for Confirming the Destruction of Personal Data”.

When personal data processed with the use of automation are destroyed, an extract from the event log of the personal data information system is also generated. The certificate and the extract are kept by the Operator for three years from the date of destruction.

If personal data cannot be destroyed within the established period, the Operator blocks such data and ensures their destruction within no more than six months, unless another period is established by law.

10. Action in the event of security incidents

If an unlawful or accidental transfer (provision, dissemination, access) of personal data resulting in a violation of the rights of personal data subjects is established, the Operator, in accordance with Part 3.1 of Article 21 of Law No. 152-FZ, notifies Roskomnadzor: within twenty-four hours of detecting the incident — of the incident itself, its presumed cause, the presumed harm and the measures taken; within seventy-two hours — of the results of the internal investigation and of the persons whose actions caused the incident.

The Operator cooperates with the State System for Detection, Prevention and Elimination of Consequences of Computer Attacks (GosSOPKA) in the cases provided for by law.

11. Rights of the personal data subject

The personal data subject has the right to: obtain information concerning the processing of his or her personal data to the extent provided for by Part 7 of Article 14 of Law No. 152-FZ; demand the clarification, blocking or destruction of personal data if they are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing; withdraw consent to the processing of personal data; object to processing for the purpose of promoting services on the market; appeal against the actions or inaction of the Operator to Roskomnadzor or in court.

A request from the personal data subject must contain the information provided for by Part 3 of Article 14 of Law No. 152-FZ: the number of the main identity document of the data subject or his or her representative, the date of issue and the issuing authority; information confirming the data subject’s participation in relations with the Operator (request or contract number) or other information confirming the fact of processing; the signature of the data subject or his or her representative.

The Operator considers the request and replies within ten working days of its receipt; this period may be extended by no more than five working days by sending the data subject a reasoned notice. A demand for clarification, blocking or destruction of data is fulfilled within a period not exceeding seven working days.

Withdrawals of consent and other enquiries are sent to privacy@tranzit3.ru or to the Operator’s postal address. If consent is withdrawn, the Operator may continue to process personal data without consent where there are grounds provided for by Part 2 of Article 9 and Part 2 of Article 11 of Law No. 152-FZ, in particular for the performance of a concluded contract and compliance with accounting legislation.

12. Cookies and web analytics

The Website uses cookies — small text files stored in the User’s browser. The Operator uses two categories of cookies. Strictly necessary cookies ensure the operation of the Website, remember the selected language and quote parameters and protect forms from automated submission; their use is based on the Operator’s legitimate interest and does not require separate consent. Analytical cookies are used by web analytics systems to measure traffic and service quality; they are set only after the User has given consent.

On the first visit to the Website, the User is shown a notice allowing him or her to accept analytical cookies or to limit cookies to strictly necessary ones. Web analytics scripts are not loaded until consent is given. The User may change the choice at any time using the “Cookie settings” link at the bottom of any page of the Website.

The User may also disable or delete cookies using the browser. Disabling strictly necessary cookies may restrict access to some functions of the Website.

13. Person responsible for organising the processing of personal data

In accordance with Article 22.1 of Law No. 152-FZ, the Operator has appointed a person responsible for organising the processing of personal data.

Enquiries concerning the processing of personal data, including requests from personal data subjects and withdrawals of consent, are sent to privacy@tranzit3.ru or to the Operator’s postal address marked “For the attention of the person responsible for organising the processing of personal data”.

14. Operator details

Operator: Limited Liability Company «Каргов Лоджистикс» (ООО «Каргов Лоджистикс», Cargov Logistics LLC).

INN 5906181468, OGRN 1245900014007, KPP 590601001.

Registered address: 614056, Perm Krai, Perm, ul. Solikamskaya, bldg 283, floor 4, office 413 V, Russian Federation.

Telephone: +7 916 120-10-87. E-mail: info@tranzit3.ru. E-mail for personal data matters: privacy@tranzit3.ru. Telegram: @transit3ru.

Supervisory authority: Roskomnadzor, 109074, Moscow, Kitaigorodsky proezd 7, bldg 2; website rkn.gov.ru.

15. Amendments to the Policy

The Operator may amend this Policy. The current version is always available at tranzit3.ru/legal/privacy with the date of the last update.

Material changes affecting the rights of personal data subjects are brought to the attention of Users by posting a notice on the Website at least ten days before the changes take effect.