Personal Data Processing Policy

Version No. 2 dated August 30, 2025

This Privacy Policy defines the terms for processing personal data by URAL CAR RENTAL LLC (TIN/KPP 2540160475 / 254301001; OGRN 1102540001431) as a personal data operator.

When this Policy uses the words “we”, “us”, “our” and similar terms, they refer to the Operator — URAL CAR RENTAL LLC (TIN/KPP 2540160475 / 254301001; OGRN 1102540001431). In this Policy, we address you as users of our website: https://autopilotrent.ru/

This document defines our principles and rules regarding the processing of personal data of website users. Please read this Policy before using the website or entering data into feedback forms. If you have any questions, please contact us by email.

What is this Policy about?

In this Policy, we explain how we process users’ personal data and ensure its security and confidentiality. This Policy explains what personal data we receive and how we use it.

What is personal data?

Personal data means any information relating directly or indirectly to an identified or identifiable individual. The processing of such data imposes certain legal obligations on us. We process only the personal data listed in this Policy that identifies you as a user of our website, service and program.

To whom does this Policy apply?

This Policy applies only to users of the website and its subdomains. This Policy does not apply to websites linked to our website or otherwise connected with it. “Website” means the Operator’s website located on the Internet at: https://autopilotrent.ru/

Principles of Personal Data Processing

We process personal data based on the principles of necessity, lawfulness, fairness, purpose limitation, data minimization, accuracy, sufficiency, relevance, reliability, proportionality and reasonable necessity.

Personal data shall not be processed if such processing is not required. Personal data shall be processed only for specific, predetermined and lawful purposes. We do not combine databases containing personal data processed for incompatible purposes. We process only personal data that corresponds to the purposes of processing. The content and scope of processed personal data must correspond to the declared purposes of processing.

Personal data is stored in a form that allows identification of the data subject no longer than required by the purposes of processing or the term of consent. Processed personal data shall be destroyed or anonymized without delay in the cases specified in this Policy.

Your Rights

Right of Access

You may request a copy of your personal data.

Right to Rectification

You may ask us to correct inaccurate or incomplete data.

Right to Withdraw Consent

You may withdraw your consent to the processing of personal data.

Right to Erasure

You may request deletion of your data, and we will delete it within thirty (30) days from receipt of the request, except where we are required to retain such data by law.

Right to Disable Cookies

If you wish to restrict or block all cookies set by our websites, please use the tool available on the relevant website or refer to your browser help section to learn how to manage browser settings.

If personal data is destroyed or consent to its processing is withdrawn, the service may become unavailable to you. Withdrawal of consent to personal data processing may result in deletion of your account, making use of the service impossible.

What We Do Not Verify

We cannot verify and therefore rely on you confirming that:

• you have full legal capacity and competence;

• you have provided your own accurate personal data;

• you understand Russian at a level sufficient to read and understand the meaning and significance of this Policy;

• you have the right to drive vehicles in accordance with applicable Russian law and have no contraindications for driving vehicles under applicable Russian law;

• you comply with other requirements established by the Operator in the Terms of Use, License Agreement and Vehicle Rental Agreement.

How We Process Data

We process personal data by automated means.

Our actions with data include:

• collection;

• systematization;

• accumulation;

• storage;

• clarification, including updating and modification;

• anonymization;

• destruction;

• transfer, including provision.

How We Ensure Data Security

We protect personal data against disclosure, complete or partial loss and unauthorized access by third parties. For this purpose, we use all necessary technical and organizational measures to ensure security and confidentiality.

If a personal data breach occurs, we:

• notify Roskomnadzor within twenty-four (24) hours;

• conduct an internal investigation within seventy-two (72) hours and notify Roskomnadzor of its results.

1. General Provisions

The Operator has developed this Policy in order to:

• protect the rights and freedoms of the User during the processing of personal data;

• strictly comply with the requirements of Russian legislation on personal data, including Federal Law No. 152-FZ “On Personal Data” dated July 27, 2006.

The Operator processes personal data on the basis of:

• the Public Offer for the provision of vehicle rental services published at: https://autopilotrent.ru/rentalterms/;

• consent to personal data processing provided by clicking the relevant button on the website expressing the User’s consent and by completing feedback forms;

• consent to advertising mailings provided by clicking the relevant button on the website expressing the User’s consent.

2. Purposes of Processing

The Operator processes personal data for the following purposes:

3. Categories and List of Processed Personal Data

3.1. Personal data processed by the Operator is not biometric and does not belong to special categories of personal data.

3.2. The Operator processes the following personal data:

3.3. The User may change browser settings and refuse storage of cookies.

3.4. To ensure service functionality and to maintain statistics and analyze the operation of the service, the Operator processes personal data using the Yandex Metrica analytics service.

3.5. Yandex Metrica:

• is available at: https://api.yandex.com/metrika;

• belongs to Yandex LLC, registered at 16 Lev Tolstoy Street, Moscow, 119021, Russia;

• stores cookie information on Yandex servers;

• receives data from the Operator based on the User’s consent to processing and transfer of data to Yandex;

• may be blocked by the User by downloading and installing the relevant browser add-on.

If Yandex Metrica is blocked, some service functions may become unavailable.

4. Personal Data Processing

4.1. Processing includes collection, recording, systematization, accumulation, storage, clarification, including updating and modification, extraction, use, transfer, including dissemination, provision and access, blocking, deletion and destruction.

4.2. The User agrees to this Policy when submitting personal data to the Company, including when registering for the service or completing forms on the service.

Collection of Personal Data

4.3. The Operator collects personal data:

• through use of the website and website forms completed by the User;

• through communication channels, including phone, email, website chat, messengers and other means;

• automatically using technologies, web protocols, cookies and web beacons, which are activated only when the User enters their data.

Storage of Personal Data

4.4. The Operator stores personal data:

• only on properly protected electronic media;

• using databases located in the Russian Federation;

• on the service using automated processing, except where non-automated processing is required to comply with Russian law;

• for all purposes from the moment consent is given until consent is withdrawn or for as long as required by the purposes of processing.

Access to Personal Data

4.5. The Operator provides access to personal data only to its authorized employees.

4.6. The Operator does not disseminate or provide Users’ personal data to third parties without their written consent, except in the following cases:

• transfer to separate, independently functioning elements that are part of the website and databases;

• prevention and suppression of unlawful actions by the User and protection of the legitimate interests of the Operator and third parties, as well as in cases established by Russian law;

• upon a justified request from courts, state security authorities, prosecutors, police, investigative authorities and other authorities and organizations in cases established by mandatory legal regulations.

4.7. The User consents to the processing of their personal data on behalf of the Operator.

4.8. We may also transfer your data to third parties that help us provide services. They will process your personal data as processors only on our behalf. Such recipients may include providers of web analytics, data processing, advertising, email and messenger mailings, payment processing, order fulfillment and other services.

Updating and Destruction of Personal Data

4.9. The Operator updates personal data if its inaccuracy is confirmed.

4.10. The Operator destroys personal data in the following cases:

• there is a threat to the security of the service;

• the personal data retention period has expired;

• the purposes of personal data processing have been achieved;

• upon the User’s request.

4.11. The Operator destroys all information received from the User if the User withdraws consent to processing. From that moment, the right to use the service terminates.

4.12. The Operator may store the following personal data until the expiry of the limitation period established by Russian law to protect the Operator’s rights, security and interests: surname, name, patronymic, phone number, email address, date of birth, education documents, qualification and professional training documents, delivery address or city.

4.13. The Operator destroys personal data by erasure.

5. Feedback and Details

Feedback

If a personal data subject wishes to know what personal data the Operator holds about them, or wishes to supplement, correct, anonymize or delete incomplete, inaccurate or outdated personal data, or wishes to stop the Operator’s processing of their personal data, or has other lawful requests, such person may exercise the relevant right by contacting the Operator in accordance with the procedure established by law.

In some cases, for example where the personal data subject requests deletion of personal data or termination of processing, such request may mean that the Operator will no longer be able to provide services or sell goods to that subject.

To fulfill requests from personal data subjects, the Operator may require identity verification and request additional information confirming the subject’s relationship with the Operator or otherwise confirming the fact of personal data processing by the Operator.

Applicable law may also establish restrictions and other conditions regarding the above rights of personal data subjects.

The procedure for submitting requests for information by a personal data subject is determined by Federal Law No. 152-FZ “On Personal Data” dated July 27, 2006. In particular, such request must contain:

• series and number of the identity document of the personal data subject or their representative;

• information on the date of issue of the document and the issuing authority;

• information confirming the subject’s participation in relations with the Operator, including agreement number, date of agreement, reference designation and/or other information, or other information confirming the fact of personal data processing by the Operator;

• signature of the personal data subject or their representative.

If the request is submitted by a representative of the personal data subject, the request must include a document or copy of a document confirming the representative’s authority.

Other Provisions

This Policy may be amended or supplemented if new legal requirements appear or at our initiative. A new version of the Policy becomes effective from the moment it is published on the website.

How to Contact Us

URAL CAR RENTAL LLC
OGRN: 1102540001431
TIN/KPP: 2540160475 / 254301001

Registered address:
Office 205, 34 Snegovaya Street, Vladivostok, Primorsky Krai, 690074, Russian Federation

Actual address:
Office 205, 34 Snegovaya Street, Vladivostok, Primorsky Krai, 690074, Russian Federation

Phone: 8 (800) 444 48 48
Website: https://autopilotrent.ru/

For any questions regarding personal data processing, you may contact us by email: rent@autopilotrent.ru

Please include your name and contact details for feedback in your message. We will respond to your request no later than ten (10) calendar days after receiving it.