PERSONAL DATA PROCESSING POLICY

PERSONAL DATA PROCESSING POLICY FOR USERS OF NAVIGO.RU Version dated 23 August 2026 This English-language version is provided for the convenience of English-speaking users and corresponds to the Russian-language Personal Data Processing Policy of NAVIGO LLC. In the event of any discrepancy between the Russian and English versions, the Russian-language version shall prevail to the extent permitted by applicable law.

1. GENERAL PROVISIONS

1.1.

This Personal Data Processing Policy of NAVIGO LLC (the “Policy”) describes how personal data of individuals using the website https://navigo.ru/ and its contact forms is collected, processed, stored and protected.

1.2. Personal Data Operator

The personal data operator is: NAVIGO LLC Russian name: ООО «НАВИГО» OGRN: 1185007002542 INN: 5042147734 Email: info@navigo.ru Phone: +7 (495) 928-78-78 hereinafter referred to as the “Operator”.

1.3.

This Policy applies to personal data processed in connection with:
  • visits to the website;
  • freight quotation requests;
  • enquiries submitted through website forms;
  • callback requests;
  • enquiries sent directly to the Operator by email, telephone or other contact channels indicated on the website.

1.4.

This Policy does not regulate the processing of personal data of the Operator’s employees, job applicants, representatives of existing counterparties or other persons whose data is processed outside the website under separate documents or other lawful grounds.

1.5.

Personal data is processed in accordance with applicable legislation of the Russian Federation, including Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”.

1.6.

Merely visiting or using the website does not constitute consent to processing that requires separate consent. Where consent is required, it is obtained through a separate affirmative action by the user, for example by selecting the relevant checkbox before submitting a form.

1.7.

Users should not provide through free-text fields:
  • special categories of personal data;
  • biometric data;
  • medical or health information;
  • information concerning political opinions;
  • religious or philosophical beliefs;
  • information concerning private or intimate life;
  • criminal record information;
  • personal data of third parties without an appropriate lawful basis.

2. PRINCIPLES OF PERSONAL DATA PROCESSING

The Operator processes personal data in accordance with the following principles:
  • processing is carried out lawfully and fairly;
  • personal data is collected for specific, predetermined and legitimate purposes;
  • personal data is not processed in a manner incompatible with the purposes for which it was collected;
  • the amount and nature of personal data processed must be relevant and not excessive;
  • reasonable measures are taken to maintain the accuracy and relevance of personal data;
  • personal data is retained only for as long as necessary for the purposes of processing or as required by applicable law;
  • personal data is deleted or destroyed when the purpose of processing has been achieved or when there is no longer a lawful basis for further processing.

3. CATEGORIES OF DATA SUBJECTS AND PERSONAL DATA

3.1. Categories of users

The Operator may process personal data relating to:
  • website visitors;
  • persons requesting freight quotations;
  • persons submitting questions or enquiries;
  • persons requesting a callback;
  • persons contacting the Operator directly by email, telephone or WhatsApp.

3.2. Data submitted through website forms

Depending on the form used, the Operator may process:
  • name;
  • telephone number;
  • email address;
  • company or business name;
  • message content;
  • cargo information;
  • route information;
  • requested logistics service;
  • shipment requirements;
  • other information voluntarily provided by the user.

3.3. Technical information

When a user visits the website, certain technical information may be processed automatically, including:
  • IP address;
  • date and time of access;
  • pages visited;
  • referring page;
  • browser information;
  • operating system;
  • device type and characteristics;
  • screen resolution;
  • information about user interaction with the website;
  • cookie and local storage identifiers;
  • server log data;
  • other technical information transmitted by the browser or website services.

3.4.

The Operator does not intentionally collect special categories of personal data or biometric personal data through the website.

4. PURPOSES AND LEGAL GROUNDS FOR PROCESSING

4.1. Processing enquiries and freight quotation requests

Personal data may be processed for the following purposes:
  • receiving and reviewing user enquiries;
  • preparing preliminary freight quotations;
  • clarifying routes, cargo characteristics, delivery times and shipment conditions;
  • providing information about the Operator’s services;
  • contacting the user;
  • preparing commercial proposals;
  • taking steps at the request of the user prior to entering into a contract.
Data processed may include:
  • name;
  • telephone number;
  • email address;
  • company name;
  • enquiry content;
  • cargo information;
  • route information;
  • shipment requirements;
  • other information voluntarily provided by the user.
Processing may be based on:
  • the user’s consent;
  • the need to take steps at the user’s request before entering into a contract;
  • the conclusion or performance of a contract where applicable;
  • other lawful grounds provided by applicable legislation.

Retention period

Information relating to enquiries and related correspondence may be retained for up to three years from the date of the last interaction with the user, unless another lawful ground requires or permits longer retention. If a contract is concluded, relevant information may continue to be processed for the duration of the contractual relationship and for statutory accounting, tax, legal or other mandatory retention periods.

4.2. Callback requests

Personal data may be processed for:
  • contacting the user by telephone;
  • clarifying the user’s logistics requirements;
  • providing information about the Operator’s services.
The data may include:
  • name, where requested;
  • telephone number;
  • other information voluntarily provided during the communication.
Such information may generally be retained for up to three years from the date of the last interaction unless another lawful basis applies.

4.3. Website operation and security

Technical information may be processed for:
  • ensuring the correct operation of the website;
  • maintaining website and information security;
  • preventing spam and automated submissions;
  • detecting malicious activity;
  • diagnosing technical errors;
  • preventing abuse of website services and forms.
The Operator may process:
  • IP address;
  • browser and operating system data;
  • device information;
  • access date and time;
  • requested URL;
  • server log information;
  • technical identifiers;
  • other information necessary to ensure website security.

4.4. Website analytics

The Operator may process technical information to:
  • understand website traffic;
  • analyse website performance;
  • improve website structure and content;
  • identify technical problems;
  • improve the quality and usability of the website.
Users may restrict or delete cookies using their browser settings.

4.5. Yandex Maps

The website may use interactive maps provided by Yandex Maps. When an interactive map is loaded, Yandex may receive technical information relating to the user’s device and visit, which may include:
  • IP address;
  • browser information;
  • operating system information;
  • device information;
  • cookie identifiers.
Where required, interactive third-party functionality is loaded only after the user has provided the relevant consent.

4.6. Cloudflare Turnstile

The Operator may use Cloudflare Turnstile, provided by Cloudflare, Inc., to protect website forms from spam, automated requests and abuse. Turnstile may perform automated technical checks and process signals such as:
  • IP address;
  • User-Agent information;
  • TLS-related technical signals;
  • website key;
  • domain and request source;
  • browser and device information;
  • network information;
  • other signals required to distinguish legitimate users from automated systems.
Cloudflare may process information for the purpose of providing its security service and improving mechanisms designed to detect automated activity. Certain technical information may be processed outside the Russian Federation. Any cross-border transfer of personal data is carried out only where the Operator has a lawful basis and has complied with applicable requirements of Russian law. Information about Cloudflare Turnstile privacy practices is available on Cloudflare’s website.

4.7. WhatsApp

The website may contain links enabling users to contact the Operator through WhatsApp. The Operator does not automatically transfer personal data entered into website forms to WhatsApp merely because such a link is displayed. When the user voluntarily follows a WhatsApp link, the user leaves the Operator’s website and interacts with a third-party service. WhatsApp processes information in accordance with its own terms and privacy policies. If a user voluntarily sends a message to the Operator through WhatsApp, the Operator may receive:
  • information contained in the message;
  • contact details;
  • profile information made available to the recipient through WhatsApp.

5. METHODS OF PERSONAL DATA PROCESSING

5.1.

Personal data may be processed:
  • using automated means;
  • without automated means;
  • using a combination of automated and non-automated methods.

5.2.

Processing may include:
  • collection;
  • recording;
  • organisation;
  • accumulation;
  • storage;
  • updating and correction;
  • retrieval;
  • use;
  • provision of authorised access where permitted by law;
  • restriction;
  • deletion;
  • destruction.

5.3.

The Operator does not publicly disclose personal data without an appropriate lawful basis.

5.4.

The Operator does not make decisions producing legal effects for users, or otherwise significantly affecting their rights and legitimate interests, solely on the basis of automated processing.

5.5.

Contact details submitted through website forms are not used for mass promotional email, advertising calls, SMS messages or promotional messenger communications without separate prior consent where such consent is required.

6. DISCLOSURE AND PROCESSING BY THIRD PARTIES

6.1.

Personal data may be accessed by employees and authorised representatives of the Operator only to the extent necessary for the performance of their duties.

6.2.

For the operation and maintenance of the website and related information systems, processing may involve service providers such as:
  • the Russian hosting provider Beget;
  • providers of email infrastructure hosted in the Russian Federation;
  • website developers;
  • system administrators;
  • Yandex LLC, including where Yandex Metrica or Yandex Maps is used;
  • Cloudflare, Inc., where Cloudflare Turnstile is used.

6.3.

Persons authorised to process personal data must maintain confidentiality and comply with applicable data protection requirements.

6.4.

Where personal data is processed on behalf of the Operator, contractual arrangements may specify:
  • categories of personal data;
  • purposes of processing;
  • permitted processing operations;
  • confidentiality obligations;
  • data security requirements;
  • incident notification procedures;
  • termination and deletion requirements.

6.5.

Personal data may be disclosed to government authorities or other authorised persons where disclosure is required or permitted by applicable law.

7. DATA LOCALISATION AND STORAGE

7.1.

Where required by Russian law, the recording, organisation, accumulation, storage, updating and retrieval of personal data of citizens of the Russian Federation collected through the website is carried out using databases located in the Russian Federation.

7.2.

The website is hosted by the Russian hosting provider Beget.

7.3.

Website enquiries submitted using Contact Form 7 are not intentionally stored in a separate Contact Form 7 database within WordPress and are sent to the Operator’s email infrastructure.

7.4.

The Operator does not intentionally configure website enquiry emails to be automatically forwarded to foreign email services.

8. COOKIES AND SIMILAR TECHNOLOGIES

8.1.

The website may use cookies and similar technologies for:
  • website operation;
  • storing technical settings;
  • protecting forms;
  • maintaining security;
  • analysing website traffic;
  • displaying interactive components.

8.2.

Cookies may include: Necessary cookies — required for security and basic website functionality. Analytics cookies — used to analyse website traffic and interaction, including through Yandex Metrica. Functional cookies — may be used for interactive maps or other external website components.

8.3.

Technologies that are objectively required for security or for functionality specifically requested by the user may be used without a separate opt-in where permitted by applicable law.

8.4.

Users may restrict or delete cookies using their browser settings. Disabling certain cookies may affect website functionality or the accuracy of analytics.

8.5.

Certain analytics cookies may remain on the user’s device for periods determined by their purpose and the settings of the relevant service.

9. RETENTION AND DELETION

9.1.

Information relating to enquiries, callback requests and correspondence with potential customers may be retained for up to three years from the date of the last interaction.

9.2.

Retention may continue for longer where:
  • a contract has been concluded;
  • the information is required to perform obligations;
  • retention is required by law;
  • the information is required for the establishment, exercise or defence of legal claims.

9.3.

Technical and server log data is retained only for the period reasonably necessary for security, incident investigation and stable website operation, subject to system configuration and applicable legal requirements.

9.4.

Cookies are retained for periods determined by their function and by the settings of the relevant browser or third-party service.

9.5.

When the purpose of processing has been achieved, the retention period has expired, or consent has been withdrawn, personal data is deleted or destroyed unless another lawful basis for continued processing exists.

10. PERSONAL DATA SECURITY

The Operator takes appropriate legal, organisational and technical measures designed to protect personal data against:
  • unauthorised access;
  • unlawful access;
  • accidental destruction;
  • alteration;
  • blocking;
  • copying;
  • disclosure;
  • distribution;
  • other unlawful processing.
Such measures may include:
  • access restrictions;
  • user authentication;
  • HTTPS encryption;
  • anti-virus and anti-spam protection;
  • backups;
  • software updates;
  • access monitoring;
  • appointment of persons responsible for personal data processing;
  • internal policies and procedures;
  • employee training;
  • incident response measures;
  • periodic review of security measures.

11. USER RIGHTS

Subject to applicable law, users may have the right to:
  • obtain information about the processing of their personal data;
  • request correction of inaccurate or incomplete data;
  • request restriction or deletion of personal data where applicable;
  • withdraw consent previously provided;
  • object to processing where permitted by law;
  • request termination of processing;
  • submit a complaint to the competent supervisory authority;
  • seek judicial protection of their rights;
  • exercise other rights provided by applicable legislation.
To exercise these rights, users may contact the Operator at: info@navigo.ru The Operator may request information reasonably necessary to identify the applicant and prevent unauthorised access to another person’s personal data.

12. WITHDRAWAL OF CONSENT

12.1.

A user may withdraw consent to personal data processing at any time.

12.2.

A withdrawal request may be sent to: info@navigo.ru The email subject may state: “Withdrawal of Consent to Personal Data Processing”

12.3.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal was received.

12.4.

After receiving a withdrawal request, the Operator will stop processing and delete or destroy the relevant personal data within the period required by applicable law, unless another lawful basis for continued processing exists.

13. THIRD-PARTY WEBSITES AND SERVICES

The website may contain links to third-party websites and services. The Operator does not control the data processing practices of third parties and is not responsible for their content, terms of use or privacy practices. Users are encouraged to review the relevant privacy notices and terms before using third-party services.

14. CHANGES TO THIS POLICY

14.1.

The Operator may amend this Policy where necessary, including due to:
  • changes in applicable legislation;
  • changes in the services used by the website;
  • changes in website functionality;
  • changes in personal data processing practices.

14.2.

An updated version becomes effective when published on the website unless another effective date is expressly stated.

14.3.

The current English-language version of this Policy is published on the NAVIGO website. Users are encouraged to review this page periodically.

15. OPERATOR CONTACT DETAILS

NAVIGO LLC Russian legal name: ООО «НАВИГО» OGRN: 1185007002542 INN: 5042147734 Email: info@navigo.ru Phone: +7 (495) 928-78-78 Website: navigo.ru