• "Personal Data" - any information relating directly or indirectly to a specific or identifiable individual (Personal Data Subject);
• "Personal Data Subject" - an individual to whom personal data belongs, allowing them to be directly or indirectly identified;
• "Personal Data Permitted for Dissemination by the Personal Data Subject" - personal data, access to which is granted to an unrestricted circle of persons by the Personal Data Subject by giving consent to the processing of personal data permitted by them for dissemination in the manner prescribed by the Personal Data Law;
• "Operator" - Smart Logistics International Limited Liability Company (TIN 7805652234);
• "Processing of Personal Data" - any action (operation) or set of actions (operations) performed with or without the use of automation tools on personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion, and destruction of personal data;
• "Automated Processing of Personal Data" - processing of personal data using computer technology;
• "Dissemination of Personal Data" - actions aimed at disclosing personal data to an indefinite circle of persons;
• "Provision of Personal Data" - actions aimed at disclosing personal data to a specific person or a specific circle of persons;
• "Blocking of Personal Data" - temporary cessation of processing of personal data (except for cases where processing is necessary to clarify personal data);
• "Destruction of Personal Data" - actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and/or as a result of which the material carriers of personal data are destroyed;
• "Depersonalization of Personal Data" - actions as a result of which it becomes impossible, without using additional information, to determine the ownership of personal data to a specific Personal Data Subject;
• "Personal Data Information System" - a set of personal data contained in databases and information technologies and technical means ensuring their processing;
• "Cross-Border Transfer of Personal Data" - transfer of personal data to the territory of a foreign state to a foreign state authority, a foreign individual, or a foreign legal entity.

• confirmation of the fact of processing of personal data by the Operator;
• the legal grounds and purposes of personal data processing;
• the purposes and methods of personal data processing used by the Operator;
• the name and location of the Operator, information about persons (except for employees of the Operator) who have access to personal data or to whom personal data may be disclosed on the basis of an agreement with the Operator or on the basis of federal law;
• the processed personal data relating to the relevant Personal Data Subject, the source of their receipt, unless a different procedure for providing such data is provided for by federal law;
• the terms of processing of personal data, including the periods of their storage;
• the procedure for exercising the rights provided for by the Personal Data Law by the Personal Data Subject;
• the name or surname, first name, patronymic, and address of the person processing personal data on behalf of the Operator, if processing is or will be entrusted to such a person;
• information on how the Operator fulfills the obligations established by Art. 18.1 of the Personal Data Law;
• other information provided for by the Personal Data Law or other federal laws.

• independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of obligations provided for by the Personal Data Law and regulatory legal acts adopted in accordance with it, unless otherwise provided by this law or other federal laws;
• in the manner established by Part 3 of Art. 6 of the Federal Law on Personal Data, entrust the processing of personal data to another person with the consent of the Personal Data Subject, unless otherwise provided by federal law. The person processing personal data on behalf of the Operator is not obliged to obtain the consent of the Personal Data Subject for such processing;
• in the event of withdrawal of consent to the processing of personal data by the Personal Data Subject, continue such processing without the consent of the Subject if there are grounds specified in clauses 2 - 11 of Part 1 of Art. 6, Part 2 of Art. 10 and Part 2 of Art. 11 of the Personal Data Law.

• provide the Personal Data Subject, upon their request, with the information provided for in Part 7 of Art. 14 of the Personal Data Law;
• explain to the Personal Data Subject the legal consequences of refusing to provide their personal data and/or give consent to their processing, if, in accordance with federal law, the provision of personal data and/or obtaining the Operator's consent to their processing is mandatory;
• before starting the processing of personal data not received from the Personal Data Subject, provide the latter with the following information: the name or surname, first name, patronymic, and address of the Operator or its representative; the purpose of personal data processing and its legal basis; the list of personal data; the intended users of the personal data; the rights of the Personal Data Subject established by the Personal Data Law; the source of obtaining personal data. The Operator is exempt from the obligation to provide the Personal Data Subject with the specified information in cases provided for in Part 4 of Art. 18 of the Personal Data Law;
• ensure the recording, systematization, accumulation, storage, clarification (updating, modification), and extraction of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation, except for the cases specified in clauses 2, 3, 4, 8 of Part 1 of Art. 6 of the Personal Data Law.

• maintaining personnel and accounting records;
• ensuring compliance with the labor legislation of the Russian Federation;
• ensuring compliance with the tax legislation of the Russian Federation;
• ensuring compliance with the pension legislation of the Russian Federation;
• recruiting personnel (applicants) for vacant positions of the Operator;
• ensuring the completion of orientation, work placement, or pre-graduation internship based on an agreement with an educational institution;
• concluding and executing contracts with clients and counterparties who are personal data subjects;
• receiving applications from potential clients using the organization's website.

• the Constitution of the Russian Federation;
• the Civil Code of the Russian Federation;
• the Labor Code of the Russian Federation;
• the Tax Code of the Russian Federation;
• Federal Law No. 402-FZ of December 6, 2011 "On Accounting";
• Federal Law No. 167-FZ of December 15, 2001 "On Compulsory Pension Insurance in the Russian Federation";
• Federal Law No. 14-FZ of February 8, 1998 "On Limited Liability Companies";
• other federal laws and regulatory legal acts adopted on their basis governing relations related to the activities of the Operator;
• the charter of the Operator;
• contracts concluded between the Operator and Personal Data Subjects;
• the consent of the Personal Data Subject to the processing of their personal data (in cases not directly provided for by the legislation of the Russian Federation but corresponding to the powers of the Operator).

• surname, first name, patronymic, date and place of birth, gender, citizenship information;
• place of permanent and temporary registration, place of actual residence;
• type, series, number of identity document, date of issue, name of the issuing authority, department code;
• driver's license data;
• TIN (Taxpayer Identification Number);
• SNILS (Insurance Number of Individual Ledger Account);
• marital status information;
• employment history information;
• income information;
• bank card details, personal account number;
• military registration information, military ID details;
• education information, including details of education documents;
• phone number, email address;
• biometric personal data, namely: photographic and video image, voice recording of the Personal Data Subject. In this case, biometric personal data is processed only in the following cases: with the consent of the Personal Data Subject for marketing promotion of the company's services, informing about the company when posting/publishing on the company's social networks;

• surname, first name, patronymic, date of birth, gender, citizenship information;
• place of actual residence;
• employment history information;
• education information;
• phone number, email address;
• military registration information;
• biometric data.

• surname, first name, patronymic, date and place of birth, gender, citizenship information, degree of relationship;
• details of marriage certificate (for spouse), birth certificate (for child);
• SNILS (for child).

• surname, first name, patronymic, date and place of birth, gender, citizenship information;
• place of permanent registration;
• type, series, number of identity document, date of issue, name of the issuing authority;
• details of the document certifying authority to act on behalf of the client or counterparty of the Operator (for representatives of clients and counterparties of the Operator (individuals and legal entities));
• phone number, email address;
• TIN;
• driver's license data;
• personal account number.

• surname, first name, patronymic, gender;
• phone number, email address, cookies.

• processing must be limited to achieving specific, predetermined, and legitimate purposes, which must correspond to the content and scope of the processed personal data. Only personal data that meets the purposes of processing may be processed;
• during processing, the accuracy of personal data, their sufficiency, and, where necessary, relevance to the purposes of processing must be ensured. The Operator must take necessary measures to delete or clarify incomplete or inaccurate data or ensure that such measures are taken;
• personal data must be stored in a form that allows identification of the Personal Data Subject for no longer than required by the purposes of processing, unless the storage period is established by federal law or a contract to which the Personal Data Subject is a party, beneficiary, or guarantor. Processed personal data must be destroyed or depersonalized upon achievement of the processing purposes or if the need to achieve these purposes is lost, unless otherwise provided by federal law.

• processing of personal data incompatible with the purposes of collecting personal data;
• merging databases containing personal data, the processing of which is carried out for purposes incompatible with each other;
• redundancy of processed personal data in relation to the stated purposes of their processing.

• installation of lockable safes for storing material carriers with personal data;
• access to premises for storing material carriers with personal data is allowed only to those persons who are included in the list of persons having access to personal data for the purpose of performing their labor (official) duties.

• identification of threats to the security of personal data during their processing in personal data information systems (hereinafter referred to as the information system);
• application of organizational and technical measures to ensure the security of personal data during their processing in information systems, necessary to fulfill the requirements for the protection of personal data, the implementation of which ensures the levels of personal data protection established by the Government of the Russian Federation;
• application of information security means that have passed the conformity assessment procedure in the established manner;
• application for the destruction of personal data of information security means (which include the information destruction function) that have passed the conformity assessment procedure in the established manner;
• conducting an assessment of the effectiveness of measures taken to ensure the security of personal data before commissioning the information system;
• keeping records of machine media of personal data;
• ensuring detection of facts of unauthorized access to personal data and taking measures, including those for detecting, preventing, and eliminating consequences of computer attacks on information systems and for responding to computer incidents in them;
• ensuring the restoration of personal data modified or destroyed due to unauthorized access to them;
• establishing rules for access to personal data processed in the information system, as well as ensuring the registration and recording of all actions performed with personal data in the information system;
• monitoring the measures taken to ensure the security of personal data and the level of security of information systems.

• appointment of a person responsible for organizing the processing of personal data;
• approval of documents defining the policy regarding the processing of personal data, local acts on issues of personal data processing;
• use of passwords (codes) for access to personal computers and the local area network;
• use of access passwords to the personal data database;
• use of special personal data protection programs (antivirus programs, network and firewall protection, etc.);
• handing over premises for security (24-hour security of premises);
• use of electronic digital signature;
• identification and verification of the user's access rights when logging into the system;
• determination of the list of persons having access to personal data.

6. UPDATING (CLARIFICATION), DELETION AND DESTRUCTION OF PERSONAL DATA. RESPONSES TO REQUESTS OF SUBJECTS FOR ACCESS TO PERSONAL DATA.

6.1. Updating (clarification) of personal data

6.1.1. In case of confirmation of the fact of inaccuracy of personal data, the Operator, based on information provided by the Personal Data Subject or their representative or the authorized body for the protection of the rights of personal data subjects, or other necessary documents, is obliged to clarify the personal data or ensure their clarification (if the processing of personal data is carried out by another person acting on behalf of the Operator) within seven working days from the date of submission of such information and remove the blocking of personal data.

6.1.2. Updating (clarification) of personal data is carried out by requesting information from the personal data subject in writing.

6.2. Blocking of personal data

6.2.1. The Operator must block personal data or ensure their blocking (if the processing of personal data is carried out by another person acting on behalf of the Operator) in the following cases and within the following periods:

• if unlawful processing of personal data is detected upon the application of the Personal Data Subject or their representative or upon the request of the Personal Data Subject or their representative or the authorized body for the protection of the rights of personal data subjects — from the moment of such application or receipt of the said request for the period of verification;
• if inaccurate personal data is detected upon the application of the Personal Data Subject or their representative or upon their request or upon the request of the authorized body for the protection of the rights of personal data subjects — from the moment of such application or receipt of the said request for the period of verification, if blocking of personal data does not violate the rights and legitimate interests of the Personal Data Subject or third parties;
• if it is impossible to destroy personal data within the period specified in Part 3 - Part 5.1 of Art. 21 of the Personal Data Law — until the moment of destruction.

6.2.2. Blocking of personal data is carried out by stopping their processing, prohibiting editing, dissemination, and use, as well as prohibiting access to them in the system.

6.3. The Operator must also stop processing personal data or ensure the cessation of such processing by a person acting on behalf of the Operator in the following cases:

• if the reasons for which the processing of special categories of personal data was carried out in cases provided for in Part 2 and Part 3 of Art. 10 of the Personal Data Law have been eliminated, provided that otherwise is not established by federal law;
• if unlawful processing of personal data carried out by the Operator or a person acting on behalf of the Operator is detected — within a period not exceeding three working days from the date of this detection;
• if the purposes of processing personal data have been achieved;
• if the Personal Data Subject has withdrawn consent to the processing of their personal data;
• if the Personal Data Subject has applied to the Operator with a request to stop processing — within a period not exceeding ten working days from the date of receipt of the relevant request. This period may be extended, but by no more than five working days, if the Operator sends a reasoned notification to the Personal Data Subject indicating the reasons for extending the period.

6.4. Destruction of personal data

6.4.1. The Operator must destroy personal data, in particular, in the following cases and within the following periods:

• if the purposes of processing personal data have been achieved or the need to achieve them has been lost — within a period not exceeding thirty days from the date of achieving these purposes, unless otherwise provided by the contract to which the Personal Data Subject is a party, beneficiary, or guarantor, by another agreement between the Operator and the Personal Data Subject, or if the Operator is not entitled to process personal data without the consent of the Personal Data Subject on the grounds provided for by federal laws;
• if the Personal Data Subject or their representative has presented information confirming that such personal data was obtained illegally or is not necessary for the stated purpose of processing — within a period not exceeding seven working days from the date of submission of such information;
• if unlawful processing of personal data is detected, provided that it is impossible to ensure its lawfulness — within a period not exceeding ten working days from the date of detection of the unlawful processing;
• if the Personal Data Subject has withdrawn consent to the processing of their personal data, provided that the retention of such data is no longer required for the purposes of their processing — within a period not exceeding thirty days from the date of receipt of the withdrawal. This is possible provided that otherwise is not provided for by the contract to which the Personal Data Subject is a party, beneficiary, or guarantor, by another agreement between the Operator and the Personal Data Subject, or in the event that the Operator is not entitled to process personal data without the consent of the Personal Data Subject on the grounds provided for by federal laws.

6.4.2. Destruction is carried out by a commission specially created for this purpose by mechanically destroying personal data stored on material media and by destroying personal data from electronic media.

6.4.3. When processing personal data without the use of automation tools, the document confirming the destruction of personal data is the Act on the Destruction of Personal Data.

When processing personal data using automation tools, the documents confirming the destruction of personal data are the Act on the Destruction of Personal Data and the Export from the event log in the personal data information system (hereinafter referred to as the Export from the log).

When processing personal data simultaneously with the use of automation tools and without the use of automation tools, the documents confirming the destruction of personal data are the Act on the Destruction of Personal Data and the Export from the log.

The Act on the Destruction of Personal Data and the Export from the log are subject to storage for 3 years from the moment of destruction of the personal data.

6.5. Responses to requests and inquiries of Personal Data Subjects

6.5.1. Personal Data Subjects have the right to contact the Operator and send him requests on issues specified in the Personal Data Law. These may be, in particular, requests:

• for the provision of information specified in Part 7 of Art. 14 of the Personal Data Law;
• for the provision of information about the presence of personal data relating to the relevant Subject, and providing the opportunity to familiarize themselves with this personal data;
• to clarify their personal data, block or destroy them if the personal data is incomplete, outdated, inaccurate, illegally obtained, or not necessary for the stated purpose of processing;
• with a demand to stop processing personal data.

6.5.2. The Operator provides the information specified in Part 7 of Art. 14 of the Personal Data Law to the Personal Data Subject or their representative within ten working days from the date of application or receipt of the corresponding request of the Personal Data Subject or their representative. This period may be extended, but by no more than five working days, if the Operator sends a reasoned notification to the Personal Data Subject indicating the reasons for extending the period.

The Operator provides this information to the Personal Data Subject or their representative in the form in which the corresponding application or request was sent, unless otherwise specified in the application or request.

6.5.3. The request must contain:

• the number of the main identity document of the Personal Data Subject or their representative, information on the date of issue of the said document and the issuing authority;
• information confirming the participation of the Personal Data Subject in relations with the Operator (contract number, date of conclusion of the contract, conventional verbal designation and/or other information), or information otherwise confirming the fact of processing personal data by the Operator;
• the signature of the Personal Data Subject or their representative.

The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.

6.5.4. The Operator is obliged to inform, in the manner prescribed by Art. 14 of the Personal Data Law, the Personal Data Subject or their representative of the presence of personal data relating to the relevant Subject, and also provide the opportunity to familiarize themselves with this data upon application of the Personal Data Subject or their representative or within ten working days from the date of receipt of the request of the Personal Data Subject or their representative. This period may be extended, but by no more than five working days, if the Operator sends a reasoned notification to the Personal Data Subject indicating the reasons for extending the period.

In case of refusal to provide information about the presence of personal data about the relevant Subject or personal data to the Personal Data Subject or their representative upon their application or upon receipt of a request from the Personal Data Subject or their representative, the Operator is obliged to give a reasoned response in writing. Such a response must contain a reference to the provision of Part 8 of Art. 14 of the Personal Data Law or other federal law that is the basis for such refusal. The response must be given within a period not exceeding ten working days from the date of application of the Personal Data Subject or their representative or from the date of receipt of the request of the Personal Data Subject or their representative. This period may be extended, but by no more than five working days, if the Operator sends a reasoned notification to the Personal Data Subject indicating the reasons for extending the period.

7. FINAL PROVISIONS

7.1. The Policy comes into force on July 1, 2025, and applies to relations arising after its introduction. The Policy is valid indefinitely until it is replaced by a new version.

7.2. This Policy is freely available on the Operator's website at https://slogint.ru/.

7.3. In execution of this Policy, the Operator adopts local regulatory acts.

7.4. The Operator has the right to make changes to this Policy. The new version of the Policy is also posted on the Operator's website.

7.5. Control over the execution of this Policy is entrusted to the person responsible for organizing the processing of personal data.

7.6. Information about the Operator is entered into the register of operators carrying out the processing of personal data, under registration number No. 78-22-028183 dated September 27, 2022.