Personal Data Processing Policy

1. General Provisions

2. Categories of personal data subjects

The Operator processes personal data of the following categories:

• website visitors;
• individuals submitting requests, inquiries, or requesting a callback;
• buyers, customers, order recipients, and other parties involved in the execution of contracts;
• subscribers to newsletters and recipients of advertising;
• counterparties and representatives of legal entities or individual entrepreneurs;
• persons submitting applications for cooperation, dealership, or partnership;
• visitors to the Operator's premises and persons ordering passes;
• persons interacting with the Operator by phone, online chat, or messengers.

3. Categories and list of processed personal data

The specific composition of data is determined by the function of the Site used and the corresponding purpose. The Operator may process:

• last name, first name, patronymic;
• phone number and email address;
• delivery address;
• website address, information about the organization and position, if they are specified by the representative or potential partner;
• date and time of the planned visit, state registration number of the vehicle;
• information about goods, orders, payment, delivery, returns, warranty and other requests;
• content of messages, comments, phone calls and attached files;
• information about subscription, selected communication channels, provision and withdrawal of consents, delivery and opening of messages;
• IP address, cookies and other identifiers, information about the browser, operating system and device;
• date and time of visit, addresses of viewed pages, referral source, advertising channel and campaign;
• information about actions and interaction with Site elements, duration and sequence of page visits;
• technical identifiers of the form, request, session, visitor, dialog or event;
• caller's phone number, date, time, duration and recording of the call — if recording is used and the user is notified before it starts;
• information generated when protecting the Site from automated requests: IP address, token and verification result, page address, referral source, information about the browser, device, operating system, language, time zone, and technical parameters of interaction with the form.

The Operator does not request or intentionally collect special categories of personal data and biometric personal data through public forms on the Site.

4. Purposes of personal data processing

• receipt, registration, and review of applications, inquiries, and messages;
• establishing feedback, organizing a callback, and maintaining interaction history;
• preparing cost estimates, commercial proposals, and reviewing cooperation requests;
• processing, concluding, and executing contracts, orders, payments, fulfillment, delivery, returns, and warranty service;
• organizing access for visitors and vehicles to the Operator's premises;
• processing and managing subscriptions, technical organization of mailings, and handling opt-outs;
• sending advertising via telecommunications networks — only with separate prior consent from the recipient;
• ensuring the operation of online chat, CRM, telephony, call tracking, and routing of inquiries;
• service quality control and resolution of disputes — when recording telephone conversations;
• analysis of traffic, user scenarios, and advertising campaign effectiveness — in compliance with applicable consent requirements for non-essential cookies;
• confirmation of the provision, modification, and withdrawal of consents, protection of the rights and legitimate interests of the Operator and data subjects;
• ensuring the security of the Site, preventing spam, fraud, abuse, and automated requests, including the use of Yandex SmartCaptcha to protect forms on all language versions of the Site.

5. Legal grounds for processing

Depending on the purpose, the Operator processes personal data on the following grounds:

• consent of the personal data subject;
• the necessity of processing for concluding a contract at the initiative of the data subject or for performing a contract to which the data subject is a party, beneficiary, or guarantor;
• fulfillment of obligations imposed on the Operator by the legislation of the Russian Federation;
• exercise of the rights and legitimate interests of the Operator or third parties, provided that the rights and freedoms of the data subject are not violated;
• other grounds provided for by Federal Law No. 152-FZ and other federal laws.

6. Procedure and conditions of processing. Engaged parties

• LLC "1C-Bitrix" (TIN 7717586110, OGRN 5077746476209; 109544, Moscow, Entuziastov Blvd., 2, floor 13, rooms 8–19) — cloud service "Bitrix24", CRM and online chat;
• LLC "Koltach Solutions" (TIN 7703388936, OGRN 1157746673040; 127018, Moscow, Skladochnaya St., 1, bldg. 9, room 3/1) — Calltouch, call tracking, callback requests, routing, and call statistics;
• LLC "YANDEX" (TIN 7736207543, OGRN 1027700229193; 119021, Moscow, Leo Tolstoy St., 16) — services "Yandex.Metrica" and "Webvisor", used to analyze traffic, referral sources, user actions, and advertising campaign effectiveness;
• LLC "Yandex.Cloud" (TIN 7704458262, OGRN 1187746678580; 119021, Moscow, Leo Tolstoy St., 16, room 528) — Yandex SmartCaptcha service, used on all language versions of the Site to protect forms from spam, bots, abuse, and automated requests;
• banks, payment organizations, telecom operators, email and mailing services, courier services, and carriers — to the extent necessary for payment, communication, sending messages, and fulfilling delivery.

6.5. The composition of engaged persons must correspond to the services actually used and contracts concluded. Before connecting a new processor, the Operator assesses legal grounds, security conditions, localization, and cross-border transfer, and updates the Policy if necessary.

7. Measures to protect personal data

The operator takes necessary organizational and technical measures, including:

• appointment of the person responsible for organizing the processing of personal data;
• adoption of local regulations and differentiation of access rights;
• application of organizational and technical protection measures, antivirus protection, and backup;
• accounting for actions with data, access control, and assessment of the effectiveness of security measures;
• training of employees and maintaining confidentiality;
• detection of incidents and sending notifications to Roskomnadzor within the timeframes prescribed by law, including an initial notification within 24 hours and the results of an internal investigation within 72 hours, when such an obligation arises.

8. Terms of processing and storage

8.1. Personal data is stored in a form that allows the subject to be identified, no longer than required by the purposes of processing, unless a different period is established by law, contract, or other legal basis.

• data of applications and inquiries that did not lead to a contract — until the completion of work with the inquiry and the subsequent period necessary for considering repeated inquiries and protecting rights;
• data of orders, contracts, payments, delivery, returns, warranties, and claims — within the terms of fulfillment of obligations and the terms established by civil, tax, accounting, and other applicable legislation;
• pass and visit data — until the visit is completed and the subsequent period necessary to ensure security and review possible incidents;
• subscription data — until consent is withdrawn or the mailing is discontinued; information confirming the receipt and withdrawal of consents — for the period necessary to confirm the lawfulness of actions;
• telephone conversation recordings — for the period established by the internal retention schedule, taking into account the purpose of the recording; in the event of a dispute, the recording may be stored until its final resolution;
• cookies — for the period determined by the purpose and settings of the relevant cookie, or until deleted by the user.

8.2. After achieving the purpose or withdrawing consent, the Operator ceases processing and destroys the data within a period not exceeding 30 days, unless other legal grounds exist. If destruction within this period is impossible, the data is blocked and destroyed within a period of no more than six months, unless a different period is established by law.

9. Localization and cross-border transfer

10. Rights of subjects and response deadlines

The data subject has the right:

• receive information about the processing of personal data;
• demand clarification, blocking, cessation of processing, or destruction of data when there are grounds;
• withdraw consent;
• object to exclusively automated decisions in cases provided for by law;
• appeal the actions or inaction of the Operator to Roskomnadzor or to court.

Information upon a subject's request is provided within 10 business days; the deadline may be extended by no more than 5 business days with a reasoned notice sent. Clarification of inaccurate data and destruction of data obtained unlawfully or not necessary for the stated purpose are carried out within the timeframes established by Articles 20 and 21 of Federal Law No. 152-FZ. A request to cease processing is fulfilled within 10 business days, with a possible extension of no more than 5 business days upon sending a reasoned notice, if there are no grounds for continuing processing.

11. Inquiries and withdrawal of consent

Inquiries, requests, and withdrawals of consent are sent:

• by email: [email protected];
• by postal address: 190020, St. Petersburg, internal territory of the municipal district Ekateringofsky, Obvodny Canal Embankment, 134, building 12, letter A, room 04-916.

The appeal must contain information sufficient to identify the applicant and determine the appropriate interaction. The operator may request only necessary and proportionate additional information.

12. Cookies, analytics, communication, and security services

13. Final Provisions

Revision dated July 30, 2026.
Version 2.1.