1. General Provisions

1.1. This Privacy Policy (hereinafter referred to as the “Policy”) defines the procedure for processing personal data and measures to ensure the security of personal data undertaken by LLC “LANIT-TERCOM”, registered address: 198504, Russian Federation, Saint Petersburg, Petergof, Chicherinskaya St., 2, lit. A, premises Part 5-N, Taxpayer Identification Number (INN): 7819035190 (hereinafter referred to as the “Operator”), and has been developed in accordance with paragraph 2 part 1 article 18.1 of Federal Law No. 152-FZ dated July 27, 2006 “On Personal Data”.

1.2. This Policy applies to personal data received by the Operator through the website https://smart-timber.com, the Smart Timber mobile application, Smart Timber web interfaces, as well as within the use of the Smart Timber system by users acting on behalf of the Operator’s clients and counterparties.

1.3. This Policy applies to the processing of personal data both with and without the use of automation tools.

1.4. The Operator publishes this Policy in free access on the Internet at:
https://smart-timber.com/privacypolicy

1.5. This Policy uses the basic terms in the meanings established by the legislation of the Russian Federation on personal data, including but not limited to: “personal data”, “operator”, “processing of personal data”, “automated processing of personal data”, “provision of personal data”, “blocking of personal data”, “destruction of personal data”, and “personal data information system”.

2. Legal Grounds for Personal Data Processing

2.1. The legal grounds for personal data processing are the aggregate of regulatory legal acts pursuant to and in accordance with which the Operator processes personal data.

2.2. The Operator processes personal data on the following legal grounds:

• Constitution of the Russian Federation;
• Civil Code of the Russian Federation;
• Labour Code of the Russian Federation, where processing involves the Operator’s employees;
• Tax Code of the Russian Federation;
• Federal Law No. 402-FZ dated December 6, 2011 “On Accounting”;
• Federal Law No. 149-FZ dated July 27, 2006 “On Information, Information Technologies and Information Protection”;
• other regulatory legal acts of the Russian Federation governing the Operator’s activities and personal data processing issues;
• the Operator’s charter and other local regulations;
• agreements concluded between the Operator and clients or counterparties, including agreements under which system user accounts are used;
• consent of the personal data subject where such consent is required under the legislation of the Russian Federation.

2.3. Federal Law No. 152-FZ “On Personal Data” does not constitute an independent legal basis for personal data processing.

3. Principles of Personal Data Processing

3.1. The Operator processes personal data based on the following principles:

• legality and fairness;
• limitation of processing to specific, predetermined, and legitimate purposes;
• prevention of processing incompatible with the purposes of data collection;
• prevention of combining databases containing personal data processed for incompatible purposes;
• processing only personal data relevant to the declared purposes;
• ensuring that the content and scope of processed personal data correspond to the stated purposes;
• prevention of excessive personal data processing;
• ensuring accuracy, sufficiency, and relevance of personal data;
• destruction or anonymization of personal data upon achievement of processing purposes or loss of necessity for achieving such purposes, unless otherwise provided by federal law.

4. Purposes of Personal Data Processing, Categories of Data Subjects, Types of Data, Storage Terms, and Destruction Procedures

4.1. Processing Requests Submitted Through the Website Feedback Form

Categories of data subjects:
Website visitors submitting inquiries to the Operator.

Personal data processed:

• email address;
• phone number;
• name;
• message content.

Processing operations:
Collection, recording, systematization, accumulation, storage, clarification, use for response preparation, deletion, and destruction.

Retention period:
Until the purpose of processing and responding to the inquiry is achieved, as well as for the period necessary to complete correspondence, unless a longer period is required by law or contractual relations.

Destruction procedure:
Deletion of personal data from the Operator’s information systems, email systems, and other storage media, or destruction of physical media in a manner preventing data recovery.

4.2. User Identification in the Smart Timber System

Categories of data subjects:
Users of the Smart Timber system acting on behalf of clients, counterparties, or employers granted access to the system under agreements with the Operator.

Personal data processed:
email address used as a login or other system identifier.

Processing operations:
Collection, recording, systematization, storage, clarification, use for identification and access provision, deletion, and destruction.

Retention period:
For the duration of user access to the system and thereafter until processing is no longer necessary, unless otherwise provided by applicable law or agreement.

Destruction procedure:
Deletion of the user account and associated identification data from the Operator’s information systems upon termination of access or loss of necessity for processing.

4.3. Ensuring System Functionality, Recording Shooting Results, Determining Conditions of System Use, Technical Support, and Production Process Maintenance

Categories of data subjects:

• Smart Timber system users;
• logging truck drivers;
• crew members whose information is entered into the system by users as part of fulfilling contractual obligations.

Personal data processed:

• geolocation of the shooting location;
• logging truck number;
• driver’s full name;
• crew composition (full names);
• device model used for operating the system.

Processing operations:
Collection, recording, systematization, accumulation, storage, clarification, extraction, use, provision to clients or their authorized representatives within system functionality, deletion, and destruction.

Retention period:
For the duration of use of the relevant system functionality and further within the periods necessary for contract performance, dispute resolution, confirmation of completed operations, and compliance with legal requirements where applicable.

Destruction procedure:
Deletion of relevant records and associated personal data from the Operator’s information systems upon achievement of processing purposes or expiration of retention periods in a manner preventing recovery without disproportionate effort.

4.4. The content and scope of personal data processed for each processing purpose shall correspond to the declared purposes. The Operator does not process personal data excessive in relation to the stated purposes.

5. Procedure and Conditions for Personal Data Processing

5.1. The Operator processes personal data using automation tools, without automation tools, and by mixed methods.

5.2. Personal data processing is carried out where appropriate legal grounds exist, including agreements concluded with clients or counterparties, and, where necessary, based on the consent of the personal data subject.

5.3. The Operator may provide personal data to third parties only in cases предусмотренных applicable legislation, contractual obligations, or other lawful grounds.

5.4. The Operator takes necessary legal, organizational, and technical measures to protect personal data against unauthorized or accidental access, destruction, modification, blocking, copying, provision, dissemination, and other unlawful actions.

5.5. The Operator stores personal data in a form allowing identification of the data subject no longer than required for processing purposes, unless otherwise established by federal law or agreement.

5.6. When collecting personal data of citizens of the Russian Federation, the Operator ensures recording, systematization, accumulation, storage, clarification, and extraction of personal data using databases located within the territory of the Russian Federation where such obligation applies.

6. Updating, Correction, Deletion, and Destruction of Personal Data; Requests from Data Subjects

6.1. Upon confirmation of inaccuracies in personal data, the Operator shall update such data.

6.2. If unlawful processing of personal data is identified, the Operator shall terminate such processing.

6.3. Personal data shall be destroyed upon achievement of processing purposes, loss of necessity for such purposes, expiration of retention periods, or withdrawal of consent by the data subject, unless otherwise provided by law or agreement.

6.4. The Operator shall provide the data subject or their representative with information regarding the processing of such personal data upon request within the procedure and time limits established by the legislation of the Russian Federation.

6.5. Requests and inquiries related to personal data processing may be sent to:
contact@lanit-tercom.ru or by postal mail to the Operator’s registered address.

7. Measures to Ensure Personal Data Security

7.1. The Operator implements measures предусмотренные Article 18.1(2) and Article 19 of the Federal Law “On Personal Data”, including:

• appointment of a person responsible for organizing personal data processing;
• adoption of internal regulations on personal data processing and protection;
• familiarization of employees with personal data legislation and internal regulations;
• restriction of access to personal data;
• implementation of necessary legal, organizational, and technical security measures;
• internal control and assessment of compliance with personal data legislation.

8. Final Provisions

8.1. This Policy is a publicly available document of the Operator.

8.2. The Operator reserves the right to amend this Policy. The new version shall become effective upon publication on the Operator’s website unless otherwise provided by the new version.

8.3. Control over compliance with this Policy shall be exercised by the person responsible for organizing personal data processing at the Operator.

9. Operator Details and Contact Information

LLC “LANIT-TERCOM”

Address:
198504, Russian Federation, Saint Petersburg, Petergof, Chicherinskaya St., 2, lit. A, premises Part 5-N

Taxpayer Identification Number (INN): 7819035190

Email:
contact@lanit-tercom.ru