Legal documents

Personal Data Processing Policy

This English translation is provided for convenience. If it differs from the Russian version, the Russian version prevails.

Controller and enquiries

The personal data controller is the seller identified in the Contacts section. Requests may be sent to the published postal address, email address or telephone number.

People and data

Data subjects are visitors, customers, account users and representatives of organisations who provide information themselves. We process account details, contact details, company details and Tax ID (INN) when supplied, selected products or services, order and delivery details, comments and security information. Special-category and biometric data are not requested, and no solely automated decision with legal effects is made.

Technical protection data

An IP address is used briefly to protect the service from abuse. The rate-limit table stores a protected pseudonymous code rather than the source IP. Restricted error logs may temporarily contain network and technical information and are deleted under the log-rotation schedule.

Legal grounds and processing

Processing is based on the user’s separate consent, steps requested before entering into a contract, contract performance and the controller’s statutory duties under Russian law.

Storage and service providers

The primary customer database is stored in Russia. Service and security email is sent through SMTP2GO’s European infrastructure. New staff alerts contain only the order or request number and a link to the protected administration area; customer details remain in the Russian database. CDEK receives only the delivery information needed for a shipment selected by the customer.

Email retention

Completed message content is removed from TireTruck’s database immediately after delivery or final failure. SMTP2GO retains activity data under the account settings; its documentation states deletion after no more than 35 days by default unless extended storage or archiving is enabled.

Analytics

Yandex Metrica starts only after separate consent and only on approved public sections. It receives the page address, interaction events and technical browser or device data. Only predefined TireTruck campaign tags, ad numbers, advertising click identifiers, stock and price switches, sorting and page numbers are allowed. Public form anchors are supported. Search text, arbitrary URL parameters and private fragments block analytics. Only the origin of the referring page is sent. Account, administration, password reset, staff verification and order-confirmation pages are also excluded. Webvisor, click maps, automatic link tracking, page titles and form-content recording are disabled; form details, tokens and order numbers are not included in events. Google Analytics is technically disabled unless separate cross-border prerequisites are confirmed.

Cross-border processing

Email delivery through a foreign provider and any future use of Google Analytics may involve processing outside Russia. The controller must separately complete the notices and contractual documents required by Russian law; publishing this policy does not replace those steps.

Retention and deletion

Data is retained only for the applicable approved period or a longer mandatory accounting or legal period, then deleted or anonymised; backup copies are removed through scheduled rotation.

Your rights and response periods

You may request information, correction, restriction, termination of processing or deletion, and may withdraw consent. Information is normally supplied within 10 working days, with a reasoned extension of no more than 5 working days. Confirmed inaccuracies are corrected within 7 working days. Termination is handled within 10 working days, with a possible reasoned extension of up to 5, and destruction after purpose completion or consent withdrawal takes no more than 30 days unless law permits continued processing.