Personal Data Processing Policy

Novorossiysk
Russian-language source revision date: 12.05.2026

1. General provisions

1.1. This Personal Data Processing Policy (the Policy) has been developed in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” and other regulatory legal acts of the Russian Federation concerning personal data protection.

1.2. The Policy defines the procedures for processing personal data and the measures taken to ensure their security by Alkonta Logistics Limited Liability Company (the Operator).

1.3. Operator details:

Full name: Alkonta Logistics Limited Liability Company (Общество с ограниченной ответственностью «Альконта Логистикс»).
Abbreviated name: ООО «Альконта Логистикс».
INN (taxpayer identification number): 2310208443.
KPP (tax registration reason code): 231101001.
OGRN (primary state registration number): 1182375058832.
Registered address: 350012, Krasnodar Territory, Krasnodar, 35 Zapolyarnaya Street, building 4/1, premises 1103.
Business address: 353900, Russia, Krasnodar Territory, Novorossiysk, 42 Kommunisticheskaya Street, office 6.
Branches: Krasnodar, Novorossiysk and Rostov-on-Don.
Website: https://alkonta.com/; English-language version: https://en.alkonta.com/.
Contact telephone: 8 800 222 5390, +7 928 241 4920.
Email for general enquiries: info@alkonta.com.
Email for personal data processing enquiries: info@alkonta.com.

1.4. This Policy applies to all of the Operator's processes involving the collection, recording, systematisation, accumulation, storage, clarification, retrieval, use, transfer (dissemination, provision, access), anonymisation, blocking, deletion and destruction of personal data, carried out with or without automated means.

1.5. The Policy is a publicly accessible document published on the Operator's website at https://en.alkonta.com/personal-data-processing-policy.html. The Russian-language policy is available at https://alkonta.com/personal-data-processing-policy.html.

2. Principal terms used in the Policy

The following principal terms are used for the purposes of this Policy:

Personal data: any information relating directly or indirectly to an identified or identifiable individual (personal data subject).
Operator: ООО «Альконта Логистикс», which independently or jointly with other persons organises and/or carries out personal data processing and determines its purposes, the data to be processed and the actions to be performed with those data.
Personal data processing: any action or set of actions performed on personal data, with or without automated means, including collection, recording, systematisation, accumulation, storage, clarification, retrieval, use, transfer, anonymisation, blocking, deletion and destruction.
Automated personal data processing: processing using computing equipment.
Dissemination of personal data: actions aimed at disclosing personal data to an indefinite group of persons.
Provision of personal data: actions aimed at disclosing personal data to a particular person or a defined group of persons.
Cross-border transfer of personal data: transfer of personal data to the territory of a foreign state, to a foreign public authority or a foreign individual or legal entity.
Cookies: small text files stored on a user's device when visiting a website and used to identify the device and collect statistics.
User: an individual visiting https://alkonta.com/, including its English-language version https://en.alkonta.com/, or using its services.
Personal data subject: an individual whose personal data are processed by the Operator.

3. Principles and legal grounds for personal data processing

3.1. Processing principles

The Operator processes personal data in accordance with the following principles:

Lawfulness and fairness.
Limiting processing to specific, predetermined and lawful purposes.
Prohibiting processing incompatible with the purposes of collection.
Prohibiting the combination of databases containing personal data processed for mutually incompatible purposes.
Processing only personal data relevant to the purposes of processing.
Ensuring that the content and volume of personal data processed are consistent with the stated processing purposes.
Prohibiting the processing of data excessive in relation to the stated purposes.
Ensuring the accuracy, sufficiency and currency of personal data in relation to the processing purposes.
Destroying or anonymising personal data once the processing purposes have been achieved or the need to achieve them no longer exists.

3.2. Legal grounds for processing

The legal grounds for the Operator's personal data processing are:

Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”.
The Civil Code of the Russian Federation.
The Labour Code of the Russian Federation, in relation to employees' personal data.
The Tax Code of the Russian Federation.
Federal Law No. 402-FZ of 6 December 2011 “On Accounting”.
Federal Law No. 115-FZ of 7 August 2001 “On Combating the Legalisation (Laundering) of Criminal Proceeds and the Financing of Terrorism”, in relation to payment agent services.
Federal Law No. 103-FZ of 3 June 2009 “On the Activity of Accepting Payments from Individuals Carried Out by Payment Agents”.
The Customs Code of the Eurasian Economic Union and Federal Law No. 289-FZ of 3 August 2018 “On Customs Regulation in the Russian Federation”.
Data subjects' consent to the processing of their personal data.
Agreements concluded between the Operator and data subjects, including freight forwarding, carriage and service agreements.
The Articles of Association of ООО «Альконта Логистикс».

4. Categories of data subjects and personal data processed

4.1. Categories of data subjects

The Operator processes the personal data of the following categories of data subjects:

The Operator's individual customers who have entered into, or intend to enter into, an agreement with the Operator.
Representatives of corporate customers: managers, employees, contact persons and persons acting under a power of attorney.
Consignors and consignees whose data are provided by customers in connection with the performance of carriage and freight forwarding agreements, including persons located outside the Russian Federation.
Payers and payment recipients in connection with payment agent services.
Applicants for the Operator's vacancies.
The Operator's employees and successful candidates.
The Operator's counterparties and their representatives: sea, rail, air and road carriers, customs brokers, freight forwarders, warehouse operators, banks and payment systems.
Visitors to https://alkonta.com/ and its language and regional versions.

4.2. Personal data processed

Depending on the category of data subject and the processing purpose, the Operator may process the following personal data:

Individual customers and representatives of corporate customers

Surname, first name and patronymic.
Contact telephone number.
Email address.
Position and organisation name, for representatives of legal entities.
Region of enquiry and postal address.
INN, where required to document the provision of services.
The content of an enquiry and other information voluntarily provided by the data subject.

Consignors, consignees and other participants in the transport chain

Surname, first name and patronymic, or organisation name.
Cargo collection and delivery addresses.
Contact details: telephone number and email.
Details of documents relating to the cargo and its customs clearance, to the extent required by law.

Payers and payment recipients in connection with payment agent services

Surname, first name and patronymic.
Identity document details to the extent required by Federal Law No. 115-FZ.
Registered residential address.
Payment details.
INN, where available.
Information about payments and transactions.

Job applicants

Surname, first name and patronymic.
Date of birth.
Contact details: telephone number and email.
Education details.
Employment history and work experience.
Other information voluntarily included in the applicant's CV.

Website visitors

Device IP address.
Browser and operating system information.
Source of referral to the website.
Information about actions on the website, including pages viewed, visit time and navigation.
Cookies.
Device identifiers.

The Operator does not process special categories of personal data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, health or intimate life, or biometric personal data.

5. Purposes of personal data processing

The Operator processes personal data for the following purposes:

Concluding, performing, amending and terminating agreements with the Operator's customers, including freight forwarding, carriage and service agreements.
Providing international and domestic cargo transport services by all modes of transport: sea, rail, road and air.
Providing freight forwarding services at the Port of Novorossiysk, customs clearance and warehousing services.
Providing payment agent services in accordance with Federal Law No. 103-FZ.
Identifying customers and beneficiaries to comply with Federal Law No. 115-FZ “On Combating the Legalisation (Laundering) of Criminal Proceeds and the Financing of Terrorism”.
Providing customer information and advice, including cargo status information, service cost calculations and responses to enquiries.
Sending messages about the performance of contractual obligations.
Providing information about new services, special offers and other commercial communications, only where the data subject has separately consented to receiving advertising communications.
Processing enquiries received through feedback forms on the Operator's website.
Recruiting staff, reviewing job applications and maintaining personnel records.
Performing employer obligations in relation to the Operator's employees.
Maintaining accounting, tax and statistical records.
Protecting the Operator's rights and legitimate interests before litigation and in disputes before courts and other competent authorities.
Improving the quality of the Operator's website, analysing traffic and conducting statistical and other research using anonymised data.

6. Processing procedures and retention periods

6.1. Personal data are processed both with and without automated means.

6.2. The Operator processes personal data where at least one of the following conditions applies:

The data subject has consented to the processing of their personal data.
Processing is necessary to achieve purposes provided for by an international treaty of the Russian Federation or by law, and to exercise and perform the functions, powers and duties imposed on the Operator by Russian legislation.
Processing is necessary to perform an agreement to which the data subject is a party, beneficiary or guarantor.
Processing is necessary to protect the data subject's life, health or other vital interests where consent cannot be obtained.
Processing is necessary to exercise the rights and legitimate interests of the Operator or third parties, provided that the data subject's rights and freedoms are not infringed.

6.3. Personal data processing periods:

Customers' and counterparties' personal data are processed for the duration of the agreement and for the statutory retention period for contractual documents: five years after the agreement ends, unless another period is prescribed.
Personal data processed in connection with payment agent services are retained for five years after the relationship with the customer ends, as required by Federal Law No. 115-FZ.
Accounting and tax documents are retained for the periods established by the Tax Code of the Russian Federation and Federal Law No. 402-FZ.
The personal data of unsuccessful job applicants are retained for no more than six months after receipt of the CV, unless another period has been agreed with the applicant.
Employees' personal data are retained for the duration of the employment relationship; personnel records are also retained for 50 or 75 years in accordance with archival legislation.
On this English-language website, the optional-service preference is stored in localStorage until the user changes it or clears the website's stored data. Details of this English-language website's optional Yandex maps and storage choices are provided in Cookie Information and Choices.
Data processed on the basis of a data subject's consent are processed until the purpose is achieved or that consent is withdrawn.

6.4. Once the processing purposes have been achieved, the need to achieve them has ceased, or the established retention periods have expired, personal data must be destroyed or anonymised, unless otherwise provided by law.

7. Transfer of personal data to third parties

7.1. The Operator may transfer personal data to third parties only where the transfer:

Is necessary to perform an agreement to which the data subject is a party or beneficiary.
Is required by Russian legislation.
Is based on the data subject's consent.

7.2. Categories of persons to whom personal data may be transferred:

Sea, rail, road and air carriers engaged to perform carriage and freight forwarding agreements.
Customs brokers and other persons engaged for cargo customs clearance.
Port operators, stevedoring and warehousing companies.
Insurance companies when cargo is insured.
Banks and payment systems when payments are made and payment agent services are provided.
Fiscal data operators and electronic document management operators.
The Operator's auditors, tax and legal advisers.
The website hosting provider.
Operators of CRM systems, IP telephony systems, email distribution systems and other software solutions used in the business.
Public authorities and officials legally entitled to receive information.

7.3. Transfers of personal data to third parties are carried out under agreements entrusting personal data processing to those persons, concluded in accordance with Article 6 of Federal Law No. 152-FZ.

7.4. The Operator monitors third parties' compliance with personal data protection legislation.

8. Cross-border transfer of personal data

8.1. As the Operator provides international cargo transport services, personal data processing may include cross-border transfers of the personal data of consignors, consignees, representatives of counterparties and other participants in the transport chain to countries through which the cargo is transported or in which participants in the transport operation are located.

8.2. The list of foreign states to which personal data may be transferred is determined by the geographical scope of the Operator's activities and includes, among others:

The People's Republic of China.
The Republic of Türkiye.
The Republic of India.
The Islamic Republic of Iran.
Countries of Southeast Asia.
Member states of the European Union.
The United States of America.
Countries of Africa.
Countries of South America.
Member states of the Eurasian Economic Union.

8.3. Before commencing cross-border transfers of personal data, the Operator notifies the authority responsible for protecting data subjects' rights, Roskomnadzor, of its intention to carry out such transfers in accordance with Article 12 of Federal Law No. 152-FZ.

8.4. Using messengers such as WhatsApp, Telegram and others whose servers are located outside the Russian Federation to communicate with customers and counterparties may also constitute a cross-border data transfer. Such communication channels are used only where the data subject has independently initiated the interaction or has provided the relevant consent.

8.5. Cross-border transfers of personal data are carried out in compliance with all requirements of Russian legislation and subject to the foreign recipient ensuring adequate protection of data subjects' rights.

9. Measures to ensure personal data security

9.1. The Operator takes the necessary legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful actions.

9.2. Legal measures include:

Adopting internal regulations governing personal data processing.
Appointing a person responsible for organising personal data processing.
Familiarising the Operator's employees with personal data legislation and the Operator's internal regulations.

9.3. Organisational measures include:

Determining the persons authorised to access personal data.
Restricting access to premises where personal data are processed.
Establishing a personal data confidentiality regime.
Monitoring compliance with personal data protection requirements.
Regularly assessing the effectiveness of the measures taken.

9.4. Technical measures include:

Using information protection tools that have undergone conformity assessment.
Using antivirus protection.
Using firewalls.
Using secure data transmission protocols (HTTPS) on the website.
Backing up data.
Password protection and access-right segregation.

10. Cookies and optional maps

10.1. This English-language website uses localStorage to remember the user's choice about optional cookies. Detailed information about cookies, similar technologies and the website's optional-service settings is provided in Cookie Information and Choices.

10.2. This English-language website uses optional Yandex maps, loaded only after the user selects “Accept optional cookies”. When loaded, the map service receives technical information, including the IP address, and may use cookies or similar technologies in accordance with Yandex's privacy policy.

10.3. Optional Yandex maps are not loaded before acceptance. The user may select “Reject optional cookies” and may later change the choice through “Cookie settings”. Continuing to browse or enabling cookies or JavaScript in the browser does not itself constitute consent. The map choice is separate from consent to process an enquiry and from optional advertising consent.

11. Data subjects' rights

11.1. A data subject has the right to:

Obtain information concerning the processing of their personal data, including confirmation of processing and information about its purposes, methods, periods and conditions.
Require the Operator to rectify, block or destroy personal data that are incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated processing purpose.
Withdraw previously given consent to personal data processing.
Require unlawful personal data processing to cease.
Challenge the Operator's actions or omissions before Roskomnadzor, the authority responsible for protecting data subjects' rights, or in court.
Seek damages and compensation for non-pecuniary harm through the courts if their rights are infringed.

11.2. These rights may be exercised by sending a written request to the Operator at 353900, Russia, Krasnodar Territory, Novorossiysk, 42 Kommunisticheskaya Street, office 6, or by emailing info@alkonta.com.

11.3. A request must include the data subject's surname, first name and patronymic, or those of their representative together with documents confirming the representative's authority; an email or postal address for the reply; the substance of the request; and the date and signature for written requests.

11.4. Requests for information about personal data processing and access to those data are handled within 10 working days of receipt, in accordance with Articles 14 and 20 of Federal Law No. 152-FZ. This period may be extended by no more than five working days if the Operator sends the data subject a reasoned notice explaining the extension. The general period for considering other requests is no more than 30 calendar days from receipt, unless another period is prescribed by law. Requests for rectification, cessation of processing or erasure are handled within the applicable statutory periods.

12. Person responsible for organising personal data processing

12.1. The person responsible for organising personal data processing at ООО «Альконта Логистикс» is appointed by an order of the head of the organisation.

12.2. Contact details for personal data processing enquiries:

Email: info@alkonta.com.
Postal address: 353900, Russia, Krasnodar Territory, Novorossiysk, 42 Kommunisticheskaya Street, office 6.
Contact telephone: 8 800 222 5390.

13. Final provisions

13.1. This Policy is subject to amendment and supplementation when new legislation and specific regulatory documents on personal data processing and protection are adopted or when the Operator's internal processes change.

13.2. Compliance with this Policy is monitored by the person responsible for organising personal data processing at ООО «Альконта Логистикс».

13.3. The liability of the Operator's officers who have access to personal data for failure to comply with this Policy is determined in accordance with Russian legislation and the Operator's internal documents.

13.4. The current version of this Policy is publicly accessible on the Operator's website at https://en.alkonta.com/personal-data-processing-policy.html. The Russian-language policy is available at https://alkonta.com/personal-data-processing-policy.html.

13.5. This revision of the Policy takes effect upon its approval and publication on the Operator's website.

Effective date stated in the Russian-language source: 12.05.2026.