Personal data processing policy

Status: This document is published for information and applies until approved by the General Director in its final form.

Published: 11 August 2026

The Russian version of this Policy is the primary text. Other language versions are provided for convenience and must be interpreted in line with the Russian text.

1. General

This Policy sets out how Fineco Logistics LLC (the Operator) processes and protects personal data when you use flgs.ru and related services (including the client account and application forms).

The Policy is prepared under the Constitution of the Russian Federation, Federal Law No. 152-FZ of 27 July 2006 on personal data, other applicable Russian laws, and guidance of the competent authority.

By using the site and/or submitting personal data to the Operator, you confirm that you have read this Policy. Certain actions (such as non-essential cookies and widgets) are performed only with consent given through the site interface.

2. Operator and responsible person

Fineco Logistics LLC
197183, St. Petersburg, Dibunovskaya St., 50, lit. A, pom. 96N, office 219
INN 7838451090, KPP 781401001, OGRN 1107847359950
Email: manager@flgs.ru
Phone: +7 812 958 07 27, +7 812 703 52 80

Person responsible for organising personal data processing: General Director Alexey Vladimirovich Fedorov. Send personal data requests to manager@flgs.ru or via the contacts page.

3. Scope

This Policy covers processing by the Operator with and without automation means, including when you:

visit public pages of the site;
submit a guest online application, the contact-page feedback form, or other forms;
register for and use the client account and application workflows;
exchange messages, documents and attachments while applications and instructions are performed;
use cookies and similar technologies (see the cookie policy).

4. Categories of data subjects

website visitors;
representatives of clients and counterparties (contact persons) who submit applications or use the account;
registered account users;
other persons whose data are provided to the Operator in connection with an application or contract, to the extent needed to provide services.

5. Categories of personal data

Depending on how you use the site, the Operator may process:

identity and contact data: name, email, phone, organisation name, position;
organisation and user registration data: INN, KPP, OGRN (if any), legal address and other details you provide;
application data for forwarding/transport: routes, delivery terms, cargo description, documents and files you voluntarily upload;
technical data: IP address, cookies and local storage, browser/device data, request time, security logs as needed for site operation;
account credentials: login (email), password hash, session data.

The Operator does not deliberately collect special categories of personal data (health, biometrics, etc.). Please do not submit such data via site forms.

6. Purposes

receiving, reviewing and performing logistics applications and related instructions; reviewing contact messages submitted via the website form;
entering into, performing and supporting contracts with clients and counterparties;
creating and maintaining the client account, authentication and security;
communicating about applications, contracts and technical support;
keeping the site operational, storing preferences, preventing abuse;
complying with Russian law (accounting/tax, lawful requests);
cookies and widgets — as described in the cookie policy.

7. Legal bases

The Operator processes personal data on the following bases (Article 6 of Federal Law No. 152-FZ):

Contract performance and pre-contractual steps. Processing is necessary to perform a contract to which the data subject (or the organisation they represent) is a party, or to take steps prior to entering into a contract at the data subject's request — including online applications, account registration and use, and correspondence/documents for an application.
Consent. Used where another basis does not apply or where the Operator requests consent separately (including non-essential cookies and widgets such as the Yandex Maps widget). Consent is obtained separately from other documents or ticks the subject confirms. Consent may be withdrawn.
Legal duties of the Operator. Processing required to comply with duties under Russian law.
Legitimate interests of the Operator. To the extent permitted by law: site and account security, fraud and abuse prevention — provided the rights and freedoms of the data subject are respected.

8. Processing operations

The Operator may collect, record, organise, accumulate, store, update, retrieve, use, transfer (disclose/provide access), anonymise, block, delete and destroy personal data as needed for the purposes in this Policy.

Processing uses automation (site, database, file storage for attachments, authentication systems) and may include non-automated processing (for example printed application documents).

9. Cookies and similar technologies

The site uses technical preferences (including theme), client-account session cookies and — only after consent — the Yandex Maps widget. Details are in the cookie policy.

10. Sharing with third parties and processors

The Operator does not sell personal data. Disclosure/access may occur:

to contractors, carriers, agents, forwarders and other persons whose involvement is necessary to perform client applications, instructions and contracts — to the extent required for the service;
to infrastructure providers (hosting, databases and file storage in the Russian Federation, telecom and email services) as needed to operate the services;
to organisation details lookup/suggestion providers (for example when filling organisation data in the account) for the data you request;
to Yandex LLC — if you consent to loading the maps widget/preview, under Yandex terms;
to public authorities where required by Russian law.

Where processing is entrusted to another person, it is done under a contract requiring confidentiality, security and processing only within the Operator's purposes and scope, in line with Federal Law No. 152-FZ.

11. Cross-border transfer

The Operator does not systematically transfer personal data of Russian citizens abroad via the site. If a specific application requires transfer to a counterparty outside the Russian Federation, it is limited to what is needed to perform the contract/application and complies with Article 12 of Federal Law No. 152-FZ.

12. Storage location (localisation)

Recording, organisation, accumulation, storage, updating and retrieval of personal data of Russian citizens collected via the site are performed using databases located in the Russian Federation.

13. Retention

Personal data are kept no longer than needed for the processing purposes, unless a longer period is set by federal law or a contract. As a rule:

application data and related materials — for the performance period and three years after completion (or longer if required by Russian archival, accounting or tax rules);
account data — until the account is deleted by the subject or the Operator, and for periods needed to protect the Operator's rights and comply with law;
data processed on the basis of consent — until the purpose is achieved, consent is withdrawn, or the consent term expires, unless law requires otherwise;
technical and security logs — for periods needed to keep the site operational and secure.

When purposes are achieved, consent is withdrawn (if no other legal basis remains), or a lawful erasure request is made, the Operator blocks, deletes or destroys the data unless retention is required by law.

14. Data subject rights

You have the right to:

obtain information about processing of your data;
request rectification, blocking or destruction of data that are incomplete, outdated, inaccurate, unlawfully obtained or not needed for the stated purpose;
withdraw consent to processing;
complain to Roskomnadzor or a court about the Operator's acts or omissions;
exercise other rights under Russian personal data law.

15. How to exercise rights

Send a request to manager@flgs.ru with a subject line identifying it as a personal data matter, or use the contacts page. The Operator may ask for information needed to verify your identity. Response times follow Federal Law No. 152-FZ.

Withdrawal of consent does not affect processing lawfully carried out before withdrawal and does not prevent processing on other Article 6 bases (for example contract performance).

16. Security measures

The Operator takes legal, organisational and technical measures appropriate to the nature of processing to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, disclosure and other unlawful acts, including access controls, HTTPS, account controls and backups.

17. Changes

The Operator may update this Policy. The current version is published on this page with the publication date. Continued use of the site after changes means you have reviewed the new version where separate consent is not required. Material changes that require consent will be communicated through the site interface.