PERSONAL DATA PROCESSING POLICY OF OOO “SORTAVALSKY LESOZAVOD” (SORTAVALA TIMBER MILL)
1. GENERAL PROVISIONS
1.1. This Personal Data Processing Policy of OOO SORTAVALSKY LESOZAVOD (the “Policy”) defines the purposes, scope and procedures for processing personal data received through the Operator’s website and in connection with related enquiries, and establishes the principal measures taken to ensure the security of personal data.
1.2. This Policy has been developed in accordance with the Constitution of the Russian Federation, Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”, and other applicable laws and regulations of the Russian Federation.
1.3. The personal data operator is:
OOO “SORTAVALSKY LESOZAVOD” (ООО «СОРТАВАЛЬСКИЙ ЛЕСОЗАВОД»), a limited liability company incorporated under the laws of the Russian Federation (brand name: Sortavala Timber Mill)
Address: 8 Rautakangas settlement, Sortavala, Republic of Karelia, 186760, Russian Federation
Taxpayer Identification Number (INN): 1001276733
Tax Registration Reason Code (KPP): 100701001
Primary State Registration Number (OGRN): 1131001014539
Telephone: +7 (921) 727-45-27
Email address for enquiries concerning personal data processing: sortavala.timber@inbox.ru
1.4. This Policy applies to personal data processing carried out through the website sortavala-timber.ru, its pages and subdomains, as well as the domains sortavala-timber.com and sortavala-sawmill.ru where the Operator’s pages are hosted or where those domains redirect users to the principal website.
1.5. This Policy also applies to enquiries received by telephone or email using the contact details published on the website where such enquiries concern products, supplies, cooperation, vacancies or the exercise of personal data subjects’ rights.
1.6. This Policy applies to the personal data of:
— website visitors;
— persons submitting enquiries and requests through website forms;
— prospective and existing customers, buyers and partners;
— individual entrepreneurs;
— representatives of legal entities and other counterparties;
— persons contacting the Operator by telephone or email;
— job applicants once a vacancy application form has been published on the website.
1.7. This Policy does not apply to the processing of the Operator’s employees’ personal data in the context of employment relationships unless expressly stated otherwise herein.
1.8. This Policy is made publicly available on the website. Access to it is provided from every page on which personal data are collected.
1.9. Use of the website without submitting an enquiry, completing a form or taking another action requiring separate consent does not constitute consent to personal data processing.
1.10. Consent to personal data processing is requested separately from this Policy and from any other documents acknowledged by the user.
1.11. This English-language version is a translation of the Russian-language Policy and is provided for the information and convenience of English-speaking website users. In the event of any discrepancy or difference in interpretation, the Russian-language version shall prevail unless otherwise required by mandatory applicable law.
2. KEY TERMS
2.1. Personal data means any information relating directly or indirectly to an identified or identifiable individual.
2.2. Operator means OOO SORTAVALSKY LESOZAVOD, which independently determines the purposes of personal data processing, the personal data to be processed and the operations performed on such data.
2.3. Personal data subject means the individual to whom the personal data relate.
2.4. Personal data processing means any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organisation, accumulation, storage, updating, retrieval, use, transfer, provision, access, anonymisation, blocking, deletion and destruction.
2.5. Automated processing means the processing of personal data using computer technology.
2.6. Provision of personal data means actions aimed at disclosing personal data to a specified person or specified group of persons.
2.7. Dissemination of personal data means actions aimed at disclosing personal data to an indefinite group of persons.
2.8. Blocking of personal data means the temporary suspension of personal data processing, except where processing is necessary to update the data.
2.9. Destruction of personal data means actions that render it impossible to restore the content of personal data in an information system or that destroy the physical media on which personal data are stored.
2.10. Cookies mean small pieces of data stored by a user’s browser on the user’s device when visiting the website.
3. PRINCIPLES AND LEGAL BASES OF PROCESSING
3.1. Personal data are processed lawfully and fairly.
3.2. Processing is limited to specific, predetermined and legitimate purposes.
3.3. Personal data must not be processed in a manner incompatible with the purposes for which they were collected.
3.4. Only personal data necessary to achieve the relevant purpose are processed.
3.5. The content and volume of the personal data processed must correspond to the stated purposes and must not be excessive.
3.6. The Operator takes reasonable measures to ensure that personal data are accurate, sufficient and up to date.
3.7. Personal data are retained in a form that permits identification of the data subject for no longer than required by the purposes of processing, applicable law or a contract.
3.8. The legal bases for processing are:
— the personal data subject’s consent;
— the need to take steps at the data subject’s request before entering into a contract;
— entering into and performing a contract to which the personal data subject is a party, beneficiary or guarantor;
— compliance with legal obligations imposed on the Operator;
— the exercise of the rights and legitimate interests of the Operator or third parties, provided that the rights and freedoms of the personal data subject are not infringed;
— other grounds provided for by the laws of the Russian Federation.
3.9. The Operator does not intentionally collect through the website special categories of personal data concerning health, racial or ethnic origin, political opinions, religious or philosophical beliefs, or intimate life.
3.10. The Operator does not collect biometric personal data through the website and does not use images or other information to identify a person on the basis of biometric characteristics.
3.11. Users should not include special-category or biometric personal data, criminal-record information, passport details or other excessive information in free-text form fields.
3.12. The website is not intended for the intentional collection of minors’ personal data. If such data are identified, the Operator will cease processing them unless an appropriate legal basis exists.
3.13. The Operator does not disseminate personal data to an indefinite group of persons without a separate lawful basis.
3.14. The Operator does not send advertising communications without the recipient’s separate prior consent.
4. PURPOSES, CATEGORIES AND CONDITIONS OF PERSONAL DATA PROCESSING4.1. PROCESSING ENQUIRIES AND REQUESTS
Categories of data subjects:
— website visitors;
— prospective customers, buyers and partners;
— individual entrepreneurs;
— representatives of legal entities.
Purposes of processing:
— receiving and considering an enquiry;
— providing information about products, production, cooperation and supply terms;
— preparing a commercial proposal;
— agreeing preliminary order specifications;
— establishing contact and providing feedback;
— taking steps before entering into a contract.
Personal data processed:
— name;
— telephone number;
— email address;
— message content;
— information about the company, position, country, product, anticipated volumes or supply terms where voluntarily provided by the user;
— other information voluntarily included by the user in the enquiry;
— date and time of submission;
— address of the page from which the enquiry was submitted;
— technical information concerning form submission automatically recorded by the platform used.
Legal bases:
— the personal data subject’s consent;
— the need to take steps at the data subject’s request before entering into a contract.
Operations performed on personal data:
collection, recording, organisation, accumulation, storage, updating, retrieval, use, transfer to persons processing data on the Operator’s instructions, provision of access, blocking, deletion and destruction.
Method of processing:
automated and mixed processing, including transmission over the Internet.
Processing period:
until the enquiry and related communication have been completed, but for no longer than one year from the last substantive interaction, unless a contract has been concluded or another lawful basis exists for continued processing.
After this period expires, the personal data will be deleted or destroyed within 30 days.
4.2. PREPARING, ENTERING INTO AND PERFORMING CONTRACTS
Categories of data subjects:
— individual entrepreneurs;
— representatives of customers, buyers, suppliers, carriers and other counterparties;
— individuals who are parties, beneficiaries or guarantors under contracts.
Purposes of processing:
— conducting negotiations;
— preparing and entering into contracts;
— verifying representatives’ authority;
— performing contractual obligations;
— arranging supplies and business communications;
— maintaining accounting, tax and other mandatory records;
— handling claims;
— protecting the Operator’s rights and legitimate interests.
Personal data processed:
— surname, given name and patronymic, where applicable;
— position and place of employment;
— telephone number;
— email address;
— information concerning a representative’s authority;
— details of powers of attorney;
— individual entrepreneur registration and business details;
— information contained in contracts, appendices, business correspondence and supporting documents.
Legal bases:
— preparing, entering into and performing a contract;
— compliance with statutory obligations;
— the exercise of the Operator’s rights and legitimate interests.
Operations and method of processing:
collection, recording, organisation, accumulation, storage, updating, retrieval, use, provision, transfer, blocking, deletion and destruction through automated, non-automated and mixed processing.
Processing period:
for the duration of contract preparation and performance and, following termination, for the periods required by applicable limitation, accounting, tax and archival retention rules and the Operator’s records-retention schedule.
Once the applicable periods expire, the data will be destroyed unless another lawful basis exists for their processing.
4.3. WEBSITE OPERATION AND SECURITY
Categories of data subjects:
— website visitors;
— users of website forms and other website functions.
Purposes of processing:
— loading and ensuring the proper functioning of website pages;
— ensuring the security of the website and information systems;
— protection against automated attacks and misuse;
— diagnosing technical errors;
— monitoring website availability and stability;
— investigating technical incidents.
Personal data processed:
— IP address;
— date and time of access;
— address of the requested page;
— address of the referring page;
— browser information;
— operating system and device-type information;
— technical identifiers;
— technical event logs;
— strictly necessary technical cookies.
Legal bases:
— the Operator’s legitimate interests in ensuring the security and operability of the website;
— compliance with statutory obligations concerning the security of personal data.
Operations and method of processing:
automated collection, recording, accumulation, storage, retrieval, use, blocking, deletion and destruction.
Processing period:
for the period necessary to ensure website operation, diagnose the relevant event or investigate an incident. The specific duration depends on the purpose of the technical data, information-system settings and the terms of the services used.
Once the purpose of processing has been achieved, personal data will be deleted or destroyed within the periods established by law.
4.4. WEBSITE ANALYSIS AND IMPROVEMENT
Categories of data subjects:
— website visitors who have consented to the use of analytics cookies.
Purposes of processing:
— obtaining website traffic statistics;
— analysing referral sources;
— evaluating website usability;
— analysing actions on website pages;
— improving the website’s structure, content and technical operation.
Personal data processed:
— IP address;
— approximate location determined from the IP address;
— browser, operating system and device information;
— referral source;
— pages viewed;
— sequence of actions on the website;
— duration of the visit;
— technical and analytics identifiers;
— analytics cookies;
— information about interactions with page elements.
Legal basis:
the user’s consent to the use of analytics cookies.
Operations and method of processing:
automated collection, recording, organisation, accumulation, storage, retrieval, use, anonymisation, deletion and destruction.
Tilda’s internal statistics and Yandex Metrica may be used for analytics.
Non-essential analytics technologies must be activated only after the user has provided consent.
The lifetime of individual analytics cookies depends on their purpose and the settings of the relevant service and may range from the duration of a single session to two years. Exact information is provided through the cookie management interface and in the documentation of the services used.
Processing ceases when consent is withdrawn, the relevant cookie category is disabled, the analytics tag is removed or use of the analytics service is discontinued. Statistical information that has been properly anonymised and no longer permits identification of the user may subsequently be processed as non-personal information.
The Operator must not transmit form-field contents, telephone numbers, email addresses or other information that directly identifies users to analytics systems.
4.5. CONSIDERING JOB APPLICATIONS
This clause applies once a vacancy page and a job application form have been published on the website.
Categories of data subjects:
— applicants for vacant positions.
Purposes of processing:
— considering an applicant’s candidacy;
— contacting the applicant;
— conducting interviews;
— assessing education, experience, qualifications and professional skills;
— deciding on possible employment.
Personal data processed:
— surname, given name and patronymic, where applicable;
— telephone number;
— email address;
— education information;
— information about work experience, qualifications and professional skills;
— information contained in a CV and cover message;
— links to professional materials where voluntarily provided by the applicant.
Legal basis:
the applicant’s separate consent to personal data processing.
Operations and method of processing:
collection, recording, organisation, accumulation, storage, updating, retrieval, use, provision of access to authorised employees, blocking, deletion and destruction through automated and mixed processing.
Processing period:
until consideration of the application has been completed and a decision has been made. If no employment or other contract is concluded, the data will be deleted or destroyed no later than 30 days after consideration of the application is completed.
Data may be retained for a talent pool only on the basis of the applicant’s separate consent specifying an independent processing period.
The application form must not require special-category personal data, criminal-record information, passport details or biometric personal data.
4.6. RECORDING CONSENT AND DEMONSTRATING COMPLIANCE
Categories of data subjects:
— persons who have provided consent through website forms or the cookie management interface.
Purposes of processing:
— confirming the fact, content and conditions of the consent provided;
— fulfilling the Operator’s obligations;
— considering possible enquiries and claims;
— protecting the Operator’s rights and legitimate interests.
Personal data processed:
— information entered in the relevant form;
— the status of the consent checkbox;
— date and time consent was provided;
— the versions of the consent wording and this Policy;
— form name and page address;
— technical information automatically generated by the information system, where recorded by the platform used.
Legal bases:
— compliance with the Operator’s obligations;
— the exercise of the Operator’s rights and legitimate interests.
Processing period:
for the processing period applicable to the data covered by the consent and, following cessation of that processing, for the period necessary to demonstrate the lawfulness of the processing and protect the Operator’s rights, but for no longer than three years unless a different period is established by law.
4.7. HANDLING REQUESTS FROM PERSONAL DATA SUBJECTS
Categories of data subjects:
— persons submitting a request, application, demand or complaint concerning personal data;
— representatives of such persons.
Purposes of processing:
— considering the request;
— verifying the identity and authority of the applicant;
— providing information about processing;
— updating or blocking data, ceasing processing, or destroying data;
— complying with statutory requirements.
Personal data processed:
— surname, given name and patronymic, where applicable;
— contact details;
— content of the request;
— information confirming the applicant’s interaction with the Operator;
— information necessary to verify the applicant’s identity and authority;
— information concerning the outcome of the request.
Legal basis:
compliance with obligations established by the laws of the Russian Federation.
Processing period:
for the duration of the request and for three years following its completion, unless a different period is established by law or the Operator’s records-retention schedule.
5. GENERAL PROCESSING PROCEDURES
5.1. The Operator carries out automated, non-automated and mixed processing of personal data.
5.2. Personal data may be obtained:
— directly from the user through website forms;
— by telephone;
— by email;
— through business correspondence;
— from contracts and related documents;
— automatically when the website is visited and cookies are used;
— from a representative of the data subject or a counterparty where a lawful basis exists.
5.3. Where personal data have not been obtained directly from the data subject, the Operator will provide the data subject with the required information before processing begins, except where this obligation does not apply under applicable law.
5.4. The Operator maintains the confidentiality of personal data and does not disclose them to third parties without a lawful basis.
5.5. Access is granted only to employees and engaged persons who require it to perform their employment or contractual duties.
5.6. The Operator does not make decisions that produce legal consequences for a data subject or otherwise significantly affect the data subject’s rights solely on the basis of automated processing.
5.7. The Operator does not sell personal data or provide them to third parties for those parties’ independent advertising purposes.
5.8. Consent is confirmed by an affirmative action taken by the user, including independently selecting a checkbox that has not been preselected and submitting the form.
5.9. The Operator retains information sufficient to demonstrate the fact that consent was provided, its content and the version in force at the relevant time.
6. PERSONS INVOLVED IN PROCESSING
6.1. The Operator may appoint other persons to process personal data under a contract, provided that they comply with confidentiality and security requirements.
6.2. JSC Tilda Publishing (АО «Тильда Паблишинг»)
Address: premises 4/1, 2 Petrovskie Linii Street, Moscow, 107031, Russian Federation.
Purposes of processing:
— website hosting;
— operation of forms;
— transmission of enquiries;
— use of Tilda CRM;
— internal statistics;
— technical support and platform security.
JSC Tilda Publishing processes personal data collected through the Tilda platform on the Operator’s instructions.
6.3. JSC Selectel (АО «Селектел»)
Address: Lit. A, 21 Tsvetochnaya Street, Saint Petersburg, 196006, Russian Federation.
Purpose of processing:
providing server infrastructure for hosting and storing Tilda platform data.
6.4. Yandex Cloud LLC (ООО «Яндекс.Облако»)
Address: premises 528, 16 Lva Tolstogo Street, Moscow, 119021, Russian Federation.
Purpose of processing:
providing cloud infrastructure for hosting and storing Tilda platform data.
JSC Selectel and Yandex Cloud LLC are engaged by JSC Tilda Publishing in connection with the performance of its personal data processing instructions.
6.5. Yandex LLC (ООО «Яндекс»)
Address: 16 Lva Tolstogo Street, Moscow, 119021, Russian Federation.
Purposes of processing:
— providing the Yandex Metrica service;
— collecting and processing technical and analytics data after the required consent has been obtained;
— providing the Yandex Maps service on the contact page.
When Yandex Metrica is used, Yandex LLC processes visitors’ data on the instructions of the tag owner to the extent provided for by the service terms.
6.6. VK LLC (ООО «ВК»)
Address: building 79, 39 Leningradsky Prospekt, Moscow, 125167, Russian Federation.
Purpose of processing:
providing the email service on the inbox.ru domain through which the Operator receives and stores messages and enquiries.
6.7. The services used depend on the website’s actual configuration. Before connecting a new service that affects personal data processing, the Operator will verify the lawful basis for its use and, where necessary, update this Policy and the information submitted to Roskomnadzor, the Russian data protection authority.
6.8. The Operator may provide personal data to government authorities, courts and other authorised persons in the cases and according to the procedures established by law.
6.9. Persons involved in processing receive only the data necessary to perform the relevant function.
7. DATA LOCALISATION AND CROSS-BORDER TRANSFERS
7.1. When personal data of citizens of the Russian Federation are collected, the recording, organisation, accumulation, storage, updating and retrieval of such data are carried out using databases located in the Russian Federation, unless otherwise expressly provided by law.
7.2. The Tilda project uses a profile whose country setting is “Russia”. Form data and Tilda CRM data are hosted on Russian server infrastructure provided by JSC Selectel and Yandex Cloud LLC.
7.3. As at the publication date of this version, the Operator does not intentionally transfer personal data across national borders.
7.4. Receipt of an enquiry directly from a person located outside the Russian Federation does not constitute a cross-border transfer by the Operator where the data are submitted by that person directly to an information system located in Russia. Users located outside the Russian Federation should be aware that personal data submitted through the website are transmitted to and processed in the Russian Federation.
7.5. The availability of an English-language version of the website does not, in itself, constitute a cross-border transfer of personal data.
7.6. Before commencing any cross-border transfer, the Operator will comply with applicable legal requirements, including assessing the transfer conditions and submitting a separate notification to Roskomnadzor.
7.7. Granting access to the Tilda project to a user with a foreign profile, transferring the project to an overseas account or connecting a foreign service is permitted only after a separate legal assessment.
8. COOKIES, ANALYTICS AND MAPS
8.1. The website may use strictly necessary technical cookies and non-essential analytics cookies.
8.2. Strictly necessary technical cookies are required for:
— protecting the website against distributed denial-of-service attacks and other threats;
— loading and ensuring the proper functioning of website pages;
— storing technical settings;
— operating forms and other website functions.
8.3. Strictly necessary technical cookies are used regardless of the user’s analytics preferences because some website functions may not operate properly or securely without them.
8.4. Analytics cookies are used only after the user has provided consent.
8.5. Cookies used by the Tilda platform and Yandex Metrica may be used for analytics, including identifiers needed to distinguish visits, determine referral sources and generate statistical reports.
8.6. The lifetime of analytics cookies depends on their purpose and may range from the duration of a single session to two years.
8.7. Users may accept or reject non-essential cookies and change their choice through the website’s cookie management interface.
8.8. Users may also restrict or delete cookies through their browser settings. Restricting strictly necessary cookies may affect website operation.
8.9. Yandex Maps may be used on the contact page. When the map is loaded, Yandex LLC may receive technical information concerning the user’s device, connection and interactions with the map in accordance with the service terms.
8.10. Withdrawal of consent to analytics cookies stops the further collection of the relevant data. Previously generated anonymised statistical indicators that do not permit identification of the user may be retained.
9. PERSONAL DATA SECURITY
9.1. The Operator takes the necessary legal, organisational and technical measures to protect personal data against unauthorised or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful actions.
9.2. These measures include:
— appointing a person responsible for organising personal data processing;
— adopting internal documents governing personal data processing and protection;
— establishing access rules and periods;
— restricting the number of persons authorised to process personal data;
— familiarising employees with applicable legal and internal requirements;
— using authentication measures and protecting user accounts;
— using a secure connection for data transmission;
— ensuring backup and recovery through the services used;
— monitoring operations involving personal data;
— evaluating the sufficiency of the measures applied;
— identifying and investigating incidents;
— ceasing processing and destroying data once the purposes have been achieved.
9.3. Employees and other persons granted access to personal data must maintain their confidentiality.
9.4. If the Operator identifies an unlawful or accidental transfer of personal data that has resulted in an infringement of data subjects’ rights, the Operator will notify Roskomnadzor:
— within 24 hours, of the incident, its suspected causes, the possible harm and the measures taken;
— within 72 hours, of the results of the internal investigation.
10. RIGHTS OF PERSONAL DATA SUBJECTS
10.1. A personal data subject has the right to:
— obtain information about the processing of their personal data;
— access the personal data being processed;
— require the data to be updated, blocked or destroyed where they are incomplete, outdated, inaccurate, unlawfully obtained or no longer necessary for the stated purpose;
— withdraw consent;
— request the cessation of processing;
— object to processing carried out on the basis of legitimate interests;
— lodge a complaint concerning the Operator’s actions or inaction with Roskomnadzor or bring a claim before a court;
— exercise other rights provided for by law.
10.2. A request may be submitted:
— by email to: sortavala.timber@inbox.ru;
— by post to: 8 Rautakangas settlement, Sortavala, Republic of Karelia, 186760, Russian Federation.
10.3. To obtain the information provided for in Article 14 of Federal Law No. 152-FZ, a request must contain the information required by law, including information sufficient to verify the applicant’s identity and interaction with the Operator, and must bear the signature of the applicant or their representative.
10.4. An electronic request for which a signature is required by law must be signed with an electronic signature.
10.5. Where reasonable doubt exists, the Operator may request additional information necessary to verify the applicant’s identity without requiring excessive data.
10.6. Information concerning processing will be provided within 10 business days of receipt of a valid request. This period may be extended by no more than five business days, provided that a reasoned notice is sent to the applicant.
11. CESSATION OF PROCESSING AND DESTRUCTION OF DATA
11.1. Consent may be withdrawn by sending a statement to the Operator’s email or postal address.
11.2. The statement should preferably include:
— the applicant’s surname, given name and patronymic, where applicable;
— the contact details used in the original enquiry;
— a description of the request;
— information sufficient to identify the form, enquiry or relationship in connection with which the data were provided.
11.3. After consent is withdrawn, the Operator will cease processing and, where no other lawful basis exists, destroy the data within a period not exceeding 30 days.
11.4. Once the purpose of processing has been achieved, the data will be destroyed within a period not exceeding 30 days unless their continued retention is required by law or contract.
11.5. At a data subject’s request to cease processing, the Operator will cease processing within 10 business days where no lawful basis exists for it to continue. This period may be extended by no more than five business days, provided that a reasoned notice is sent to the applicant.
11.6. Where data are confirmed to be inaccurate, the Operator will update them or arrange for them to be updated within seven business days.
11.7. If unlawful processing is identified, the Operator will cease such processing within a period not exceeding three business days. If the processing cannot be made lawful, the data will be destroyed within 10 business days of the infringement being identified.
11.8. If destruction cannot be completed within the required period, the Operator will block the data and ensure their destruction within no more than six months unless a different period is established by law.
11.9. Destruction is carried out in a manner that prevents the content of the personal data from being restored.
11.10. Destruction is documented by a destruction certificate and, for automated processing, by an extract from the information system’s event log. Supporting documents are retained for three years from the date of destruction.
11.11. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal was received.
11.12. The Operator may continue processing without consent where a legal basis provided by law exists, including for the performance of a contract, compliance with a statutory obligation or protection of rights and legitimate interests.
12. FINAL PROVISIONS
12.1. The Operator may amend this Policy following changes in applicable law, the purposes and methods of processing, the categories of personal data processed, the structure of the website, the forms used or the connected services.
12.2. A new version takes effect when it is published on the website unless a different effective date is stated therein.
12.3. The Operator ensures that the version of the Policy in force during the relevant period of personal data processing can be identified.
12.4. The current Russian-language version is published at sortavala-timber.ru/policy, and this English-language version is published at sortavala-timber.ru/en-policy. The Policy is available through a permanent link from pages on which personal data are collected.
12.5. Questions concerning the processing and protection of personal data may be sent to sortavala.timber@inbox.ru.
Version No. 1
Publication and effective date of this version: 26 October 2026.
1. GENERAL PROVISIONS
1.1. This Personal Data Processing Policy of OOO SORTAVALSKY LESOZAVOD (the “Policy”) defines the purposes, scope and procedures for processing personal data received through the Operator’s website and in connection with related enquiries, and establishes the principal measures taken to ensure the security of personal data.
1.2. This Policy has been developed in accordance with the Constitution of the Russian Federation, Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”, and other applicable laws and regulations of the Russian Federation.
1.3. The personal data operator is:
OOO “SORTAVALSKY LESOZAVOD” (ООО «СОРТАВАЛЬСКИЙ ЛЕСОЗАВОД»), a limited liability company incorporated under the laws of the Russian Federation (brand name: Sortavala Timber Mill)
Address: 8 Rautakangas settlement, Sortavala, Republic of Karelia, 186760, Russian Federation
Taxpayer Identification Number (INN): 1001276733
Tax Registration Reason Code (KPP): 100701001
Primary State Registration Number (OGRN): 1131001014539
Telephone: +7 (921) 727-45-27
Email address for enquiries concerning personal data processing: sortavala.timber@inbox.ru
1.4. This Policy applies to personal data processing carried out through the website sortavala-timber.ru, its pages and subdomains, as well as the domains sortavala-timber.com and sortavala-sawmill.ru where the Operator’s pages are hosted or where those domains redirect users to the principal website.
1.5. This Policy also applies to enquiries received by telephone or email using the contact details published on the website where such enquiries concern products, supplies, cooperation, vacancies or the exercise of personal data subjects’ rights.
1.6. This Policy applies to the personal data of:
— website visitors;
— persons submitting enquiries and requests through website forms;
— prospective and existing customers, buyers and partners;
— individual entrepreneurs;
— representatives of legal entities and other counterparties;
— persons contacting the Operator by telephone or email;
— job applicants once a vacancy application form has been published on the website.
1.7. This Policy does not apply to the processing of the Operator’s employees’ personal data in the context of employment relationships unless expressly stated otherwise herein.
1.8. This Policy is made publicly available on the website. Access to it is provided from every page on which personal data are collected.
1.9. Use of the website without submitting an enquiry, completing a form or taking another action requiring separate consent does not constitute consent to personal data processing.
1.10. Consent to personal data processing is requested separately from this Policy and from any other documents acknowledged by the user.
1.11. This English-language version is a translation of the Russian-language Policy and is provided for the information and convenience of English-speaking website users. In the event of any discrepancy or difference in interpretation, the Russian-language version shall prevail unless otherwise required by mandatory applicable law.
2. KEY TERMS
2.1. Personal data means any information relating directly or indirectly to an identified or identifiable individual.
2.2. Operator means OOO SORTAVALSKY LESOZAVOD, which independently determines the purposes of personal data processing, the personal data to be processed and the operations performed on such data.
2.3. Personal data subject means the individual to whom the personal data relate.
2.4. Personal data processing means any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organisation, accumulation, storage, updating, retrieval, use, transfer, provision, access, anonymisation, blocking, deletion and destruction.
2.5. Automated processing means the processing of personal data using computer technology.
2.6. Provision of personal data means actions aimed at disclosing personal data to a specified person or specified group of persons.
2.7. Dissemination of personal data means actions aimed at disclosing personal data to an indefinite group of persons.
2.8. Blocking of personal data means the temporary suspension of personal data processing, except where processing is necessary to update the data.
2.9. Destruction of personal data means actions that render it impossible to restore the content of personal data in an information system or that destroy the physical media on which personal data are stored.
2.10. Cookies mean small pieces of data stored by a user’s browser on the user’s device when visiting the website.
3. PRINCIPLES AND LEGAL BASES OF PROCESSING
3.1. Personal data are processed lawfully and fairly.
3.2. Processing is limited to specific, predetermined and legitimate purposes.
3.3. Personal data must not be processed in a manner incompatible with the purposes for which they were collected.
3.4. Only personal data necessary to achieve the relevant purpose are processed.
3.5. The content and volume of the personal data processed must correspond to the stated purposes and must not be excessive.
3.6. The Operator takes reasonable measures to ensure that personal data are accurate, sufficient and up to date.
3.7. Personal data are retained in a form that permits identification of the data subject for no longer than required by the purposes of processing, applicable law or a contract.
3.8. The legal bases for processing are:
— the personal data subject’s consent;
— the need to take steps at the data subject’s request before entering into a contract;
— entering into and performing a contract to which the personal data subject is a party, beneficiary or guarantor;
— compliance with legal obligations imposed on the Operator;
— the exercise of the rights and legitimate interests of the Operator or third parties, provided that the rights and freedoms of the personal data subject are not infringed;
— other grounds provided for by the laws of the Russian Federation.
3.9. The Operator does not intentionally collect through the website special categories of personal data concerning health, racial or ethnic origin, political opinions, religious or philosophical beliefs, or intimate life.
3.10. The Operator does not collect biometric personal data through the website and does not use images or other information to identify a person on the basis of biometric characteristics.
3.11. Users should not include special-category or biometric personal data, criminal-record information, passport details or other excessive information in free-text form fields.
3.12. The website is not intended for the intentional collection of minors’ personal data. If such data are identified, the Operator will cease processing them unless an appropriate legal basis exists.
3.13. The Operator does not disseminate personal data to an indefinite group of persons without a separate lawful basis.
3.14. The Operator does not send advertising communications without the recipient’s separate prior consent.
4. PURPOSES, CATEGORIES AND CONDITIONS OF PERSONAL DATA PROCESSING4.1. PROCESSING ENQUIRIES AND REQUESTS
Categories of data subjects:
— website visitors;
— prospective customers, buyers and partners;
— individual entrepreneurs;
— representatives of legal entities.
Purposes of processing:
— receiving and considering an enquiry;
— providing information about products, production, cooperation and supply terms;
— preparing a commercial proposal;
— agreeing preliminary order specifications;
— establishing contact and providing feedback;
— taking steps before entering into a contract.
Personal data processed:
— name;
— telephone number;
— email address;
— message content;
— information about the company, position, country, product, anticipated volumes or supply terms where voluntarily provided by the user;
— other information voluntarily included by the user in the enquiry;
— date and time of submission;
— address of the page from which the enquiry was submitted;
— technical information concerning form submission automatically recorded by the platform used.
Legal bases:
— the personal data subject’s consent;
— the need to take steps at the data subject’s request before entering into a contract.
Operations performed on personal data:
collection, recording, organisation, accumulation, storage, updating, retrieval, use, transfer to persons processing data on the Operator’s instructions, provision of access, blocking, deletion and destruction.
Method of processing:
automated and mixed processing, including transmission over the Internet.
Processing period:
until the enquiry and related communication have been completed, but for no longer than one year from the last substantive interaction, unless a contract has been concluded or another lawful basis exists for continued processing.
After this period expires, the personal data will be deleted or destroyed within 30 days.
4.2. PREPARING, ENTERING INTO AND PERFORMING CONTRACTS
Categories of data subjects:
— individual entrepreneurs;
— representatives of customers, buyers, suppliers, carriers and other counterparties;
— individuals who are parties, beneficiaries or guarantors under contracts.
Purposes of processing:
— conducting negotiations;
— preparing and entering into contracts;
— verifying representatives’ authority;
— performing contractual obligations;
— arranging supplies and business communications;
— maintaining accounting, tax and other mandatory records;
— handling claims;
— protecting the Operator’s rights and legitimate interests.
Personal data processed:
— surname, given name and patronymic, where applicable;
— position and place of employment;
— telephone number;
— email address;
— information concerning a representative’s authority;
— details of powers of attorney;
— individual entrepreneur registration and business details;
— information contained in contracts, appendices, business correspondence and supporting documents.
Legal bases:
— preparing, entering into and performing a contract;
— compliance with statutory obligations;
— the exercise of the Operator’s rights and legitimate interests.
Operations and method of processing:
collection, recording, organisation, accumulation, storage, updating, retrieval, use, provision, transfer, blocking, deletion and destruction through automated, non-automated and mixed processing.
Processing period:
for the duration of contract preparation and performance and, following termination, for the periods required by applicable limitation, accounting, tax and archival retention rules and the Operator’s records-retention schedule.
Once the applicable periods expire, the data will be destroyed unless another lawful basis exists for their processing.
4.3. WEBSITE OPERATION AND SECURITY
Categories of data subjects:
— website visitors;
— users of website forms and other website functions.
Purposes of processing:
— loading and ensuring the proper functioning of website pages;
— ensuring the security of the website and information systems;
— protection against automated attacks and misuse;
— diagnosing technical errors;
— monitoring website availability and stability;
— investigating technical incidents.
Personal data processed:
— IP address;
— date and time of access;
— address of the requested page;
— address of the referring page;
— browser information;
— operating system and device-type information;
— technical identifiers;
— technical event logs;
— strictly necessary technical cookies.
Legal bases:
— the Operator’s legitimate interests in ensuring the security and operability of the website;
— compliance with statutory obligations concerning the security of personal data.
Operations and method of processing:
automated collection, recording, accumulation, storage, retrieval, use, blocking, deletion and destruction.
Processing period:
for the period necessary to ensure website operation, diagnose the relevant event or investigate an incident. The specific duration depends on the purpose of the technical data, information-system settings and the terms of the services used.
Once the purpose of processing has been achieved, personal data will be deleted or destroyed within the periods established by law.
4.4. WEBSITE ANALYSIS AND IMPROVEMENT
Categories of data subjects:
— website visitors who have consented to the use of analytics cookies.
Purposes of processing:
— obtaining website traffic statistics;
— analysing referral sources;
— evaluating website usability;
— analysing actions on website pages;
— improving the website’s structure, content and technical operation.
Personal data processed:
— IP address;
— approximate location determined from the IP address;
— browser, operating system and device information;
— referral source;
— pages viewed;
— sequence of actions on the website;
— duration of the visit;
— technical and analytics identifiers;
— analytics cookies;
— information about interactions with page elements.
Legal basis:
the user’s consent to the use of analytics cookies.
Operations and method of processing:
automated collection, recording, organisation, accumulation, storage, retrieval, use, anonymisation, deletion and destruction.
Tilda’s internal statistics and Yandex Metrica may be used for analytics.
Non-essential analytics technologies must be activated only after the user has provided consent.
The lifetime of individual analytics cookies depends on their purpose and the settings of the relevant service and may range from the duration of a single session to two years. Exact information is provided through the cookie management interface and in the documentation of the services used.
Processing ceases when consent is withdrawn, the relevant cookie category is disabled, the analytics tag is removed or use of the analytics service is discontinued. Statistical information that has been properly anonymised and no longer permits identification of the user may subsequently be processed as non-personal information.
The Operator must not transmit form-field contents, telephone numbers, email addresses or other information that directly identifies users to analytics systems.
4.5. CONSIDERING JOB APPLICATIONS
This clause applies once a vacancy page and a job application form have been published on the website.
Categories of data subjects:
— applicants for vacant positions.
Purposes of processing:
— considering an applicant’s candidacy;
— contacting the applicant;
— conducting interviews;
— assessing education, experience, qualifications and professional skills;
— deciding on possible employment.
Personal data processed:
— surname, given name and patronymic, where applicable;
— telephone number;
— email address;
— education information;
— information about work experience, qualifications and professional skills;
— information contained in a CV and cover message;
— links to professional materials where voluntarily provided by the applicant.
Legal basis:
the applicant’s separate consent to personal data processing.
Operations and method of processing:
collection, recording, organisation, accumulation, storage, updating, retrieval, use, provision of access to authorised employees, blocking, deletion and destruction through automated and mixed processing.
Processing period:
until consideration of the application has been completed and a decision has been made. If no employment or other contract is concluded, the data will be deleted or destroyed no later than 30 days after consideration of the application is completed.
Data may be retained for a talent pool only on the basis of the applicant’s separate consent specifying an independent processing period.
The application form must not require special-category personal data, criminal-record information, passport details or biometric personal data.
4.6. RECORDING CONSENT AND DEMONSTRATING COMPLIANCE
Categories of data subjects:
— persons who have provided consent through website forms or the cookie management interface.
Purposes of processing:
— confirming the fact, content and conditions of the consent provided;
— fulfilling the Operator’s obligations;
— considering possible enquiries and claims;
— protecting the Operator’s rights and legitimate interests.
Personal data processed:
— information entered in the relevant form;
— the status of the consent checkbox;
— date and time consent was provided;
— the versions of the consent wording and this Policy;
— form name and page address;
— technical information automatically generated by the information system, where recorded by the platform used.
Legal bases:
— compliance with the Operator’s obligations;
— the exercise of the Operator’s rights and legitimate interests.
Processing period:
for the processing period applicable to the data covered by the consent and, following cessation of that processing, for the period necessary to demonstrate the lawfulness of the processing and protect the Operator’s rights, but for no longer than three years unless a different period is established by law.
4.7. HANDLING REQUESTS FROM PERSONAL DATA SUBJECTS
Categories of data subjects:
— persons submitting a request, application, demand or complaint concerning personal data;
— representatives of such persons.
Purposes of processing:
— considering the request;
— verifying the identity and authority of the applicant;
— providing information about processing;
— updating or blocking data, ceasing processing, or destroying data;
— complying with statutory requirements.
Personal data processed:
— surname, given name and patronymic, where applicable;
— contact details;
— content of the request;
— information confirming the applicant’s interaction with the Operator;
— information necessary to verify the applicant’s identity and authority;
— information concerning the outcome of the request.
Legal basis:
compliance with obligations established by the laws of the Russian Federation.
Processing period:
for the duration of the request and for three years following its completion, unless a different period is established by law or the Operator’s records-retention schedule.
5. GENERAL PROCESSING PROCEDURES
5.1. The Operator carries out automated, non-automated and mixed processing of personal data.
5.2. Personal data may be obtained:
— directly from the user through website forms;
— by telephone;
— by email;
— through business correspondence;
— from contracts and related documents;
— automatically when the website is visited and cookies are used;
— from a representative of the data subject or a counterparty where a lawful basis exists.
5.3. Where personal data have not been obtained directly from the data subject, the Operator will provide the data subject with the required information before processing begins, except where this obligation does not apply under applicable law.
5.4. The Operator maintains the confidentiality of personal data and does not disclose them to third parties without a lawful basis.
5.5. Access is granted only to employees and engaged persons who require it to perform their employment or contractual duties.
5.6. The Operator does not make decisions that produce legal consequences for a data subject or otherwise significantly affect the data subject’s rights solely on the basis of automated processing.
5.7. The Operator does not sell personal data or provide them to third parties for those parties’ independent advertising purposes.
5.8. Consent is confirmed by an affirmative action taken by the user, including independently selecting a checkbox that has not been preselected and submitting the form.
5.9. The Operator retains information sufficient to demonstrate the fact that consent was provided, its content and the version in force at the relevant time.
6. PERSONS INVOLVED IN PROCESSING
6.1. The Operator may appoint other persons to process personal data under a contract, provided that they comply with confidentiality and security requirements.
6.2. JSC Tilda Publishing (АО «Тильда Паблишинг»)
Address: premises 4/1, 2 Petrovskie Linii Street, Moscow, 107031, Russian Federation.
Purposes of processing:
— website hosting;
— operation of forms;
— transmission of enquiries;
— use of Tilda CRM;
— internal statistics;
— technical support and platform security.
JSC Tilda Publishing processes personal data collected through the Tilda platform on the Operator’s instructions.
6.3. JSC Selectel (АО «Селектел»)
Address: Lit. A, 21 Tsvetochnaya Street, Saint Petersburg, 196006, Russian Federation.
Purpose of processing:
providing server infrastructure for hosting and storing Tilda platform data.
6.4. Yandex Cloud LLC (ООО «Яндекс.Облако»)
Address: premises 528, 16 Lva Tolstogo Street, Moscow, 119021, Russian Federation.
Purpose of processing:
providing cloud infrastructure for hosting and storing Tilda platform data.
JSC Selectel and Yandex Cloud LLC are engaged by JSC Tilda Publishing in connection with the performance of its personal data processing instructions.
6.5. Yandex LLC (ООО «Яндекс»)
Address: 16 Lva Tolstogo Street, Moscow, 119021, Russian Federation.
Purposes of processing:
— providing the Yandex Metrica service;
— collecting and processing technical and analytics data after the required consent has been obtained;
— providing the Yandex Maps service on the contact page.
When Yandex Metrica is used, Yandex LLC processes visitors’ data on the instructions of the tag owner to the extent provided for by the service terms.
6.6. VK LLC (ООО «ВК»)
Address: building 79, 39 Leningradsky Prospekt, Moscow, 125167, Russian Federation.
Purpose of processing:
providing the email service on the inbox.ru domain through which the Operator receives and stores messages and enquiries.
6.7. The services used depend on the website’s actual configuration. Before connecting a new service that affects personal data processing, the Operator will verify the lawful basis for its use and, where necessary, update this Policy and the information submitted to Roskomnadzor, the Russian data protection authority.
6.8. The Operator may provide personal data to government authorities, courts and other authorised persons in the cases and according to the procedures established by law.
6.9. Persons involved in processing receive only the data necessary to perform the relevant function.
7. DATA LOCALISATION AND CROSS-BORDER TRANSFERS
7.1. When personal data of citizens of the Russian Federation are collected, the recording, organisation, accumulation, storage, updating and retrieval of such data are carried out using databases located in the Russian Federation, unless otherwise expressly provided by law.
7.2. The Tilda project uses a profile whose country setting is “Russia”. Form data and Tilda CRM data are hosted on Russian server infrastructure provided by JSC Selectel and Yandex Cloud LLC.
7.3. As at the publication date of this version, the Operator does not intentionally transfer personal data across national borders.
7.4. Receipt of an enquiry directly from a person located outside the Russian Federation does not constitute a cross-border transfer by the Operator where the data are submitted by that person directly to an information system located in Russia. Users located outside the Russian Federation should be aware that personal data submitted through the website are transmitted to and processed in the Russian Federation.
7.5. The availability of an English-language version of the website does not, in itself, constitute a cross-border transfer of personal data.
7.6. Before commencing any cross-border transfer, the Operator will comply with applicable legal requirements, including assessing the transfer conditions and submitting a separate notification to Roskomnadzor.
7.7. Granting access to the Tilda project to a user with a foreign profile, transferring the project to an overseas account or connecting a foreign service is permitted only after a separate legal assessment.
8. COOKIES, ANALYTICS AND MAPS
8.1. The website may use strictly necessary technical cookies and non-essential analytics cookies.
8.2. Strictly necessary technical cookies are required for:
— protecting the website against distributed denial-of-service attacks and other threats;
— loading and ensuring the proper functioning of website pages;
— storing technical settings;
— operating forms and other website functions.
8.3. Strictly necessary technical cookies are used regardless of the user’s analytics preferences because some website functions may not operate properly or securely without them.
8.4. Analytics cookies are used only after the user has provided consent.
8.5. Cookies used by the Tilda platform and Yandex Metrica may be used for analytics, including identifiers needed to distinguish visits, determine referral sources and generate statistical reports.
8.6. The lifetime of analytics cookies depends on their purpose and may range from the duration of a single session to two years.
8.7. Users may accept or reject non-essential cookies and change their choice through the website’s cookie management interface.
8.8. Users may also restrict or delete cookies through their browser settings. Restricting strictly necessary cookies may affect website operation.
8.9. Yandex Maps may be used on the contact page. When the map is loaded, Yandex LLC may receive technical information concerning the user’s device, connection and interactions with the map in accordance with the service terms.
8.10. Withdrawal of consent to analytics cookies stops the further collection of the relevant data. Previously generated anonymised statistical indicators that do not permit identification of the user may be retained.
9. PERSONAL DATA SECURITY
9.1. The Operator takes the necessary legal, organisational and technical measures to protect personal data against unauthorised or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful actions.
9.2. These measures include:
— appointing a person responsible for organising personal data processing;
— adopting internal documents governing personal data processing and protection;
— establishing access rules and periods;
— restricting the number of persons authorised to process personal data;
— familiarising employees with applicable legal and internal requirements;
— using authentication measures and protecting user accounts;
— using a secure connection for data transmission;
— ensuring backup and recovery through the services used;
— monitoring operations involving personal data;
— evaluating the sufficiency of the measures applied;
— identifying and investigating incidents;
— ceasing processing and destroying data once the purposes have been achieved.
9.3. Employees and other persons granted access to personal data must maintain their confidentiality.
9.4. If the Operator identifies an unlawful or accidental transfer of personal data that has resulted in an infringement of data subjects’ rights, the Operator will notify Roskomnadzor:
— within 24 hours, of the incident, its suspected causes, the possible harm and the measures taken;
— within 72 hours, of the results of the internal investigation.
10. RIGHTS OF PERSONAL DATA SUBJECTS
10.1. A personal data subject has the right to:
— obtain information about the processing of their personal data;
— access the personal data being processed;
— require the data to be updated, blocked or destroyed where they are incomplete, outdated, inaccurate, unlawfully obtained or no longer necessary for the stated purpose;
— withdraw consent;
— request the cessation of processing;
— object to processing carried out on the basis of legitimate interests;
— lodge a complaint concerning the Operator’s actions or inaction with Roskomnadzor or bring a claim before a court;
— exercise other rights provided for by law.
10.2. A request may be submitted:
— by email to: sortavala.timber@inbox.ru;
— by post to: 8 Rautakangas settlement, Sortavala, Republic of Karelia, 186760, Russian Federation.
10.3. To obtain the information provided for in Article 14 of Federal Law No. 152-FZ, a request must contain the information required by law, including information sufficient to verify the applicant’s identity and interaction with the Operator, and must bear the signature of the applicant or their representative.
10.4. An electronic request for which a signature is required by law must be signed with an electronic signature.
10.5. Where reasonable doubt exists, the Operator may request additional information necessary to verify the applicant’s identity without requiring excessive data.
10.6. Information concerning processing will be provided within 10 business days of receipt of a valid request. This period may be extended by no more than five business days, provided that a reasoned notice is sent to the applicant.
11. CESSATION OF PROCESSING AND DESTRUCTION OF DATA
11.1. Consent may be withdrawn by sending a statement to the Operator’s email or postal address.
11.2. The statement should preferably include:
— the applicant’s surname, given name and patronymic, where applicable;
— the contact details used in the original enquiry;
— a description of the request;
— information sufficient to identify the form, enquiry or relationship in connection with which the data were provided.
11.3. After consent is withdrawn, the Operator will cease processing and, where no other lawful basis exists, destroy the data within a period not exceeding 30 days.
11.4. Once the purpose of processing has been achieved, the data will be destroyed within a period not exceeding 30 days unless their continued retention is required by law or contract.
11.5. At a data subject’s request to cease processing, the Operator will cease processing within 10 business days where no lawful basis exists for it to continue. This period may be extended by no more than five business days, provided that a reasoned notice is sent to the applicant.
11.6. Where data are confirmed to be inaccurate, the Operator will update them or arrange for them to be updated within seven business days.
11.7. If unlawful processing is identified, the Operator will cease such processing within a period not exceeding three business days. If the processing cannot be made lawful, the data will be destroyed within 10 business days of the infringement being identified.
11.8. If destruction cannot be completed within the required period, the Operator will block the data and ensure their destruction within no more than six months unless a different period is established by law.
11.9. Destruction is carried out in a manner that prevents the content of the personal data from being restored.
11.10. Destruction is documented by a destruction certificate and, for automated processing, by an extract from the information system’s event log. Supporting documents are retained for three years from the date of destruction.
11.11. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal was received.
11.12. The Operator may continue processing without consent where a legal basis provided by law exists, including for the performance of a contract, compliance with a statutory obligation or protection of rights and legitimate interests.
12. FINAL PROVISIONS
12.1. The Operator may amend this Policy following changes in applicable law, the purposes and methods of processing, the categories of personal data processed, the structure of the website, the forms used or the connected services.
12.2. A new version takes effect when it is published on the website unless a different effective date is stated therein.
12.3. The Operator ensures that the version of the Policy in force during the relevant period of personal data processing can be identified.
12.4. The current Russian-language version is published at sortavala-timber.ru/policy, and this English-language version is published at sortavala-timber.ru/en-policy. The Policy is available through a permanent link from pages on which personal data are collected.
12.5. Questions concerning the processing and protection of personal data may be sent to sortavala.timber@inbox.ru.
Version No. 1
Publication and effective date of this version: 26 October 2026.
© 2026 Sortavala Timber Mill. All rights reserved.
Personal Data Processing Policy · Consent to the Processing of Personal Data · Cookie Policy
Cookie Settings
Personal Data Processing Policy · Consent to the Processing of Personal Data · Cookie Policy
Cookie Settings
Cookie Settings
Cookie Settings
Essential cookies are required for the proper and secure operation of the website and are always enabled. Analytics and other non-essential cookies are used only with your consent. You can choose which categories to allow and change your choice at any time.