Personal data processing policy

Status: Approved by Fineco Logistics LLC General Director order No. 1/1808 dated 18 August 2026. Published on flgs.ru for public access.

Published: 24 October 2026

The Russian version of this Policy is the primary text. Other language versions are provided for convenience and must be interpreted in line with the Russian text.

1. General

This Policy sets out how Fineco Logistics LLC (the Operator) processes and protects personal data when you use flgs.ru and related services (including the client account and application forms).

The Policy is prepared under the Constitution of the Russian Federation, Federal Law No. 152-FZ of 27 July 2006 on personal data, other applicable Russian laws, and guidance of the competent authority.

By using the site and/or submitting personal data to the Operator, you confirm that you have read this Policy. Certain actions (such as non-essential cookies and widgets) are performed only with consent given through the site interface.

2. Operator and responsible person

Fineco Logistics LLC
197183, St. Petersburg, Dibunovskaya St., 50, lit. A, pom. 96N, office 219
INN 7838451090, KPP 781401001, OGRN 1107847359950
Email: manager@flgs.ru
Phone: +7 (812) 703-52-80

Person responsible for organising personal data processing and for technical security of personal data on the company server: logistics manager Alexandra Rostislavovna Timofeeva (order No. 1/1808 dated 18 August 2026). Send personal data requests to manager@flgs.ru or via the contacts page.

The Operator is entered in the Russian register of personal data operators under registration No. 78-25-081251 (pd.rkn.gov.ru).

3. Scope

This Policy covers processing by the Operator with and without automation means, including when you:

visit public pages of the site;
submit a guest online application, the contact-page feedback form, or other forms;
register for and use the client account and application workflows;
exchange messages, documents and attachments while applications and instructions are performed;
chatting with the Operator via its chatbots in Telegram and MAX;
representatives (contact persons) of carriers, agents and other contractors of the Operator;
use cookies and similar technologies (see the cookie policy).

4. Categories of data subjects

website visitors;
representatives of clients and counterparties (contact persons) who submit applications or use the account;
registered account users;
users of the Operator’s chatbots in Telegram and MAX;
other persons whose data are provided to the Operator in connection with an application or contract, to the extent needed to provide services.

5. Categories of personal data

Depending on how you use the site, the Operator may process:

identity and contact data: name, email, phone, organisation name, position;
organisation and user registration data: INN, KPP, OGRN (if any), legal address and other details you provide;
application data for forwarding/transport: routes, delivery terms, cargo description, documents and files you voluntarily upload;
technical data: IP address, cookies and local storage, browser/device data, request time, security logs as needed for site operation;
account credentials: login (email), password hash, session data.

The Operator does not deliberately collect special categories of personal data (health, biometrics, etc.). Please do not submit such data via site forms.

6. Purposes

receiving, reviewing and performing logistics applications and related instructions; reviewing contact messages submitted via the website form;
entering into, performing and supporting contracts with clients and counterparties;
creating and maintaining the client account, authentication and security;
communicating about applications, contracts and technical support;
keeping the site operational, storing preferences, preventing abuse;
complying with Russian law (accounting/tax, lawful requests);
collecting traffic statistics for the public pages of the site with Yandex Metrica — only with the data subject's consent;
preparing replies, email drafts and reference search with an assistant based on language models (Yandex AI Studio) and Yandex Search API; replies are reviewed by the Operator’s staff, and no decisions with legal effect are made solely by automated processing;
cookies and widgets — as described in the cookie policy.

7. Legal bases

The Operator processes personal data on the following bases (Article 6 of Federal Law No. 152-FZ):

Contract performance and pre-contractual steps. Processing is necessary to perform a contract to which the data subject (or the organisation they represent) is a party, or to take steps prior to entering into a contract at the data subject's request — including online applications, account registration and use, and correspondence/documents for an application.
Consent. Used where another basis does not apply or where the Operator requests consent separately (including non-essential cookies and widgets such as the Yandex Maps widget and Yandex Metrica). Consent is obtained separately from other documents or ticks the subject confirms. Consent may be withdrawn.
Legal duties of the Operator. Processing required to comply with duties under Russian law.
Legitimate interests of the Operator. To the extent permitted by law: site and account security, fraud and abuse prevention — provided the rights and freedoms of the data subject are respected.

8. Processing operations

The Operator may collect, record, organise, accumulate, store, update, retrieve, use, transfer (disclose/provide access), anonymise, block, delete and destroy personal data as needed for the purposes in this Policy.

Processing uses automation (site, database, file storage for attachments, authentication systems) and may include non-automated processing (for example printed application documents).

9. Cookies and similar technologies

The site uses technical preferences (including theme), client-account session cookies and — only after consent — the Yandex Maps widget and the Yandex Metrica web analytics service. Details are in the cookie policy.

10. Sharing with third parties and processors

The Operator does not sell personal data. Disclosure/access may occur:

to contractors, carriers, agents, forwarders and other persons whose involvement is necessary to perform client applications, instructions and contracts — to the extent required for the service;
to infrastructure providers (hosting, databases and file storage in the Russian Federation, telecom and email services) as needed to operate the services;
to organisation details lookup/suggestion providers (for example when filling organisation data in the account) for the data you request;
to YANDEX LLC — if you consent to loading the maps widget/preview, under Yandex terms;
to YANDEX LLC (Yandex Metrica) — if you consent by clicking «Accept» in the cookie banner: cookie identifiers, technical browser and device data, IP address, public pages visited and links followed; purpose — site traffic statistics; data is stored on YANDEX LLC servers in the Russian Federation and processed under Yandex terms;
to Yandex.Cloud LLC (Yandex AI Studio and Yandex Search API) — on the Operator’s instruction, to run the staff assistant and the chatbot assistant: text of messages and queries, including contact details and application data they contain; contact details (emails, phone numbers, INN) are not sent in search queries; purpose — preparing replies and reference search; data is processed on servers in the Russian Federation;
to public authorities where required by Russian law.

Where processing is entrusted to another person, it is done under a contract requiring confidentiality, security and processing only within the Operator's purposes and scope, in line with Federal Law No. 152-FZ.

11. Cross-border transfer

The Operator does not systematically transfer personal data of Russian citizens abroad via the site. If a specific application requires transfer to a counterparty outside the Russian Federation, it is limited to what is needed to perform the contract/application and complies with Article 12 of Federal Law No. 152-FZ.

12. Storage location (localisation)

Recording, organisation, accumulation, storage, updating and retrieval of personal data of Russian citizens collected via the site are performed using databases located in the Russian Federation. The site and database servers are located in Saint Petersburg (Timeweb JSC).

13. Retention

Personal data are kept no longer than needed for the processing purposes, unless a longer period is set by federal law or a contract. As a rule:

application data and related materials — for the performance period and three years after completion (or longer if required by Russian archival, accounting or tax rules);
account data — until the account is deleted by the subject or the Operator, and for periods needed to protect the Operator's rights and comply with law;
data processed on the basis of consent — until the purpose is achieved, consent is withdrawn, or the consent term expires, unless law requires otherwise;
site traffic statistics (Yandex Metrica) — no more than 5 years from collection, or until consent is withdrawn if earlier;
assistant request logs (call metadata, model, volume and cost, without message text) — no more than 1 year;
technical and security logs — for periods needed to keep the site operational and secure.

When purposes are achieved, consent is withdrawn (if no other legal basis remains), or a lawful erasure request is made, the Operator blocks, deletes or destroys the data unless retention is required by law.

14. Data subject rights

You have the right to:

obtain information about processing of your data;
request rectification, blocking or destruction of data that are incomplete, outdated, inaccurate, unlawfully obtained or not needed for the stated purpose;
withdraw consent to processing;
complain to Roskomnadzor or a court about the Operator's acts or omissions;
exercise other rights under Russian personal data law.

15. How to exercise rights

Send a request to manager@flgs.ru with a subject line identifying it as a personal data matter, or use the contacts page. The Operator may ask for information needed to verify your identity. Response times follow Federal Law No. 152-FZ.

Withdrawal of consent does not affect processing lawfully carried out before withdrawal and does not prevent processing on other Article 6 bases (for example contract performance).

Consent can be withdrawn (1) in the client account — the "Withdraw personal data consent" button in the profile editing window, with confirmation; or (2) by email to manager@flgs.ru with the subject "Withdrawal of personal data consent" and the account email. The Operator records the date, time and method of withdrawal and disables the client account. Personal data processed solely on the basis of consent is no longer processed and is destroyed within 30 days of receipt of the withdrawal (Article 21(5) of Federal Law No. 152-FZ), unless a contract or law provides otherwise.

16. Security measures

The Operator takes legal, organisational and technical measures appropriate to the nature of processing to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, disclosure and other unlawful acts, including access controls, HTTPS, account controls and backups.

17. Changes

The Operator may update this Policy. The current version is published on this page with the publication date. Continued use of the site after changes means you have reviewed the new version where separate consent is not required. Material changes that require consent will be communicated through the site interface.