Policy on Personal Data Processing and Confidentiality

Pultika service. Revision of October 26, 2026

This is a translation for convenience; the Russian text prevails. The binding version is published at https://pultika.autos/policy/.

This document is the formal policy of the personal data operator, published pursuant to Part 2 of Article 18.1 of Federal Law No. 152-FZ of 27 July 2006 "On Personal Data". A plain-language summary is on the Privacy Policy page; how to delete an account is explained on the Delete account page. This Policy is part of the set of service documents together with the Public Offer and the User Agreement.

1. General provisions

1.1. This Policy on Personal Data Processing and Confidentiality (the "Policy") sets out how Tabix Limited Liability Company (OGRN 1187746090740, registered on January 29, 2018; INN 9705114726; KPP 771901001; address: 105425, Moscow, Shchyolkovsky proezd, 11, bldg. 1, apt. 8; the "Operator" or "Rights Holder") processes personal data in connection with the Pultika service, and the measures taken to keep personal data secure. The Operator is entered in the register of personal data operators maintained by Roskomnadzor (the notification under Article 22 of the Personal Data Law has been filed).

1.2. The Policy applies to all personal data the Operator receives through the App, the Website and the server side of the Service, and through support requests sent to support@lisik.tech.

1.3. The Policy is drawn up in accordance with Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" (the "Personal Data Law"), Federal Law No. 149-FZ of 27 July 2006 "On Information, Information Technologies and Information Protection" and other regulations of the Russian Federation.

1.4. The Policy is an integral part of the Public Offer for a Licence Agreement (the "Offer") and the User Agreement (the "Agreement"). The terms defined in Section 2 have the same meaning in all three documents. Personal data processing is governed solely by the Policy; the Offer and the Agreement do not alter it. In all other matters, in case of conflict the Offer prevails, then the Agreement, then the Policy.

1.5. The Privacy Policy and Delete account pages are a plain-language summary of certain provisions of the Policy and the Agreement addressed to the User and do not contradict them. Where wording differs, this Policy applies; the specific lists of data collected and retention periods given on those pages are deemed part of the Policy.

1.6. Anyone who does not agree with the Policy may not use the Service. A User who disagrees with the Policy must stop using the Service and delete the Account as described on the Delete account page.

2. Definitions

2.1. Pultika service, Service — the App and the server side owned by the Operator, which together let the User obtain information about the state of the Vehicle and send Commands to it.

2.2. App — the Pultika computer program (identifier tech.pultika.autos) for mobile devices running iOS and Android, distributed through app stores.

2.3. Website — the Operator's website at https://pultika.autos.

2.4. User — an individual who has signed in to the App with a phone number (Number Verification). In the Offer the User is also called the Licensee; in the Policy, the data subject.

2.5. Account — the User's record in the Service, created automatically on Registration and identified by a phone number.

2.6. Session — an authorised connection of the App on a particular User device to the server side of the Service, confirmed by tokens.

2.7. Vehicle — an electric vehicle fitted with an Onboard Module and connected to the Service.

2.8. Onboard Module — the onboard software installed in the Vehicle by the Rights Holder or a third party that transmits Vehicle Data to the Service and receives Commands.

2.9. Vehicle Data — information the Vehicle itself reports through the Onboard Module: the vehicle identification number (VIN), charge level, range, the state of doors, windows, locks, climate system and tyres, the Vehicle's location and trips, and the log of the Vehicle's connections to the server (the "connectivity log").

2.10. Command — an instruction sent by the User from the App to the Vehicle (lock or unlock, turn on climate, etc.). Command Log — records of Commands sent and the Vehicle's replies to them.

2.11. Vehicle Owner, Owner — the User to whom the Vehicle is assigned in the Service and who may grant and revoke other Users' access to the Vehicle. Trusted User — a User to whom the Owner has granted access to the Vehicle.

2.12. Verification Code — a one-time code sent to the User's phone number via a messenger or by SMS for Number Verification.

2.13. Number Verification — the action by which the User proves control of the phone number they provided: (a) entering in the App a Verification Code received via a messenger or by SMS, or (b) making an outgoing call from that number to the number shown in the App; the call is disconnected as soon as it is connected, is normally free of charge, and control of the number is proven by the fact of the call as recorded by the telephony provider.

2.14. Registration — the first Number Verification, upon which the Account is created.

2.15. The terms "personal data", "processing of personal data", "operator", "anonymisation", "destruction" and "cross-border transfer" have the meaning given in the Personal Data Law.

3. Processing principles

3.1. The Operator processes personal data lawfully and fairly; limits processing to specific, predetermined and legitimate purposes; does not process data in a manner incompatible with the purposes of collection and does not merge databases processed for incompatible purposes; processes only data that serves the purposes of processing and no more than is needed; ensures the data is accurate, sufficient and up to date; and destroys or anonymises data once the purposes of processing are achieved, unless the law provides otherwise.

3.2. The Operator does not make decisions that produce legal effects for the User or otherwise affect the User's rights and legitimate interests solely on the basis of automated processing of personal data.

3.3. The Operator does not profile Users, does not analyse behaviour, does not show advertising and does not use cookies, advertising identifiers or trackers in the App or on the Website.

4. Data subjects and categories of personal data

4.1. The Operator processes personal data of the following categories of data subjects:

4.1.1. Users — Owners and Trusted Users;

4.1.2. people who contact support, including those who are not Users;

4.1.3. people who drive or are in the Vehicle without being Users — as regards the Vehicle's location and trips, which may indirectly relate to them (see 4.5).

4.2. The User's personal data comprises:

4.2.1. mobile phone number;

4.2.2. Account ID, Session tokens, device and App version as a single string "device model · App version", and the date, time and method of each Number Verification; for Number Verification by call — also the number the call was made from, the number dialled and the time of the call, as reported by the telephony provider;

4.2.3. Vehicle Data of the Vehicle assigned to or accessible by the User, including the VIN, location and trips of the Vehicle;

4.2.4. the Command Log of Commands sent by the User and the Vehicle's replies;

4.2.5. information about access to Vehicles granted and received;

4.2.6. the content of support requests and the email address they were sent from.

4.3. The Operator collects no other data from the User's device (for map loading see 6.8): the App does not read contacts, photos or the microphone and does not collect advertising or other device identifiers. For Number Verification by call, the App opens the system phone app with the number pre-filled; it does not read the call log, contacts or other device data and requests no permissions to access them. The App may ask for the system permission to access the device's approximate location solely to display the map; the User grants that permission explicitly in the operating system settings and may withdraw it at any time. The current state of this feature is described on the Privacy Policy page.

4.4. The Operator does not process special categories of personal data (racial or ethnic origin, political opinions, religious or philosophical beliefs, health, intimate life) or biometric personal data. Biometric confirmation of Commands is performed by the operating system on the User's device; biometric data is not sent to the Operator.

4.5. The Vehicle's location and trips are Vehicle Data, but while a particular person is driving the Vehicle they may indirectly relate to that person. By connecting the Vehicle to the Service and granting access to Trusted Users, the Owner undertakes to inform anyone they let use the Vehicle that the Vehicle's location and trips are recorded by the Service and visible to the Owner and Trusted Users (clause 4.5 of the Agreement).

4.6. The Operator does not verify the information provided by the User and assumes that the User is an adult with full legal capacity who provides a phone number belonging to them.

5. Purposes, legal grounds and retention

5.1. The Operator processes personal data for the following purposes and on the following grounds:

5.2. The Operator does not use personal data for marketing mailings, market research, sale or transfer for advertising purposes.

5.3. After the Account is deleted, the phone number, Account ID, Sessions and tokens are destroyed, access to Vehicles is revoked, and entries in the Command Log and connectivity log are anonymised within 30 days, except for the information specified in 5.4. Vehicle Data, which relates to the Vehicle rather than the User, continues to be processed for as long as the Vehicle is connected to the Service (see Delete account).

5.4. After the Account is deleted, the Operator keeps the phone number, the dates of conclusion (acceptance of the Offer) and termination of the licence agreement and the record of Number Verification at Registration (method, date and time; for a call — the calling number, the dialled number and the time as recorded by the telephony provider) for 3 years from the day the Account is deleted — to confirm that the agreement was concluded and terminated and to protect the rights of the Operator and the User (item 7, part 1, Article 6 of the Personal Data Law; clause 3.3 of the Offer) — and support correspondence for 3 years after it ends (5.1). This information is not used for any other purpose and is destroyed when the period expires.

6. Conditions of processing

6.1. Processing is carried out by automated means and includes collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer (provision, access) within the limits set by the Policy, anonymisation, blocking, deletion and destruction. The Operator does not disseminate personal data (disclose it to an indefinite circle of persons).

6.2. Collection, recording, systematisation, accumulation, storage, updating and retrieval of personal data of citizens of the Russian Federation are carried out using databases located in the Russian Federation (part 5, Article 18 of the Personal Data Law).

6.3. Users located in the Russian Federation may complete Number Verification by a call through a Russian telephony provider, by a Verification Code via the Russian messenger MAX, or by SMS; no cross-border transfer of such Users' personal data takes place. A User located outside the Russian Federation may choose Number Verification by call (through the same Russian telephony provider, which records the caller's number), a Verification Code via the Telegram messenger, or SMS; if Telegram is chosen, the phone number is transferred to the operator of that messenger, located outside the Russian Federation, solely to deliver the Verification Code. The Operator carries out no other cross-border transfers of personal data.

6.4. The Operator may entrust processing of personal data to third parties under an agreement containing the conditions required by part 3 of Article 6 of the Personal Data Law, solely in the following cases:

6.4.1. to providers that deliver Verification Codes (messenger, SMS) — only the phone number and the Verification Code, without Vehicle Data;

6.4.2. to the telephony provider that receives calls for Number Verification — the number the call was made from, the number dialled and the time of the call; the Verification Code and Vehicle Data are not transferred to it;

6.4.3. to hosting providers of the server infrastructure in the Russian Federation — to the extent needed to host the server side of the Service; such providers do not gain access to the content of the data beyond what is technically unavoidable.

6.5. Personal data is not transferred to any other third parties, except in the cases specified in 6.3 and 6.8 and except to state bodies, courts and other authorised persons in the cases and manner prescribed by law. The Operator does not transfer personal data to the Vehicle's manufacturer, its dealers or any entities affiliated with them.

6.6. Access to Vehicle Data by other Users (the Owner and Trusted Users) is a feature of the Service provided at the Owner's discretion and is not a transfer of personal data to third parties within the meaning of 6.4–6.5. The Owner may revoke a Trusted User's access at any time by means of the Service or by contacting support.

6.7. The app stores through which the App is distributed are independent operators of the data they collect when the App is downloaded and updated; their processing is governed by their own documents, for which the Operator is not responsible.

6.8. The map in the App is loaded from the server of a third-party map data provider located in the Russian Federation. When the map is loaded, the provider receives the IP address of the User's device and the coordinates of the requested map tiles (the area around the displayed location of the Vehicle); the Operator transfers no other data to it, and the provider receives no information about the Account, the phone number or the Vehicle.

7. Consent to personal data processing

7.1. The User's personal data needed to conclude and perform the licence agreement (the Offer) and to exercise the Operator's rights and legitimate interests is processed without the User's consent on the basis of items 5 and 7, part 1, Article 6 of the Personal Data Law (5.1). A link to the Policy is shown on the App's sign-in screen and on the Website; completing Number Verification (entering the Verification Code or calling from the number) after that link is shown means that the User has read the Policy and is not consent to personal data processing.

7.2. Consent to personal data processing is required only for processing not covered by the agreement or the law — in particular, for handling requests from persons who are not Users. Such consent is given by a separate specific action — sending a request to support@lisik.tech — in respect of the data stated in the request, and is valid until the purpose of processing is achieved or consent is withdrawn.

7.3. Consent may be withdrawn by sending a request to support@lisik.tech. Withdrawal applies only to processing based on consent and does not affect processing provided for by the agreement and the law. Processing of data linked to the Account is ended by deleting the Account as set out in Section 10 of the Agreement and on the Delete account page, with the consequences described in 5.3–5.4.

7.4. By granting a Trusted User access to the Vehicle, the Owner confirms that they are entitled to dispose of Vehicle Data to that extent; by accepting access, the Trusted User confirms that they have read the Policy, and their data is processed on the same grounds as the Owner's data (5.1, 7.1).

8. Rights of the data subject

8.1. The User may:

8.1.1. obtain the information about the processing of their personal data provided for in part 7 of Article 14 of the Personal Data Law;

8.1.2. demand that personal data be updated, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose of processing;

8.1.3. withdraw consent to personal data processing where processing is based on consent (7.3);

8.1.4. delete the Account themselves in the App (Profile → Delete account) or by email, as described on the Delete account page;

8.1.5. appeal the Operator's actions or inaction to the authorised body for the protection of data subjects' rights (Roskomnadzor) or to a court.

8.2. Requests are sent to support@lisik.tech or in writing to: 105425, Moscow, Shchyolkovsky proezd, 11, bldg. 1, apt. 8. To identify the User, the request must quote the phone number linked to the Account; the Operator may additionally request Number Verification from that number. The Operator does not disclose Account information to anyone who has not proven control of the phone number.

8.3. The Operator reviews the request and responds within 10 business days of receipt; this period may be extended by no more than 5 business days with a reasoned notice to the User.

8.4. The User changes the phone number linked to the Account by contacting support after proving control of both the old and the new number.

9. Security measures

9.1. The Operator takes the legal, organisational and technical measures needed to protect personal data from unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful actions, including:

9.1.1. appointing a person responsible for organising personal data processing and limiting the staff who have access to personal data;

9.1.2. encrypting the connection between the App and the server side (TLS);

9.1.3. confirming Sessions with regularly rotated tokens and granting access to a Vehicle only with its Owner's permission;

9.1.4. requiring lock Commands to be confirmed with a PIN or biometrics on the User's device;

9.1.5. not writing tokens, precise coordinates or the full VIN to logs in clear text beyond what the Service needs to operate;

9.1.6. detecting unauthorised access and restoring data modified or destroyed as a result of it;

9.1.7. internally monitoring compliance of processing with the law and the Policy.

9.2. If an incident results in an unlawful transfer of personal data, the Operator notifies the authorised body within the time limits set by part 3.1 of Article 21 of the Personal Data Law, and the affected Users through the App, by SMS, via a messenger or by publication on the Website.

9.3. The User must keep the Verification Code and PIN secret, not hand a signed-in device to third parties, and immediately inform the Operator of any suspected unauthorised access to the Account or loss of the phone number.

10. Confidentiality

10.1. The Operator keeps personal data confidential and does not disclose it to third parties except as provided in Section 6.

10.2. The Operator is not liable for disclosure of information that became public through no fault of the Operator, was disclosed by the User (including by granting others access to the Vehicle) or was obtained by a third party as a result of the User's breach of 9.3.

11. Minors

11.1. The Service is not intended for persons under 18. The Operator does not knowingly collect personal data of minors. On learning that an Account was created by a minor, the Operator blocks the Account and destroys the data in accordance with 5.3.

12. Changes to the Policy

12.1. The Operator may amend the Policy. A new revision is published on the Website at https://pultika.autos/policy/ with the revision date. The Operator notifies Users through the App, by SMS, via a messenger or by publication on the Website of changes affecting the categories of data, purposes or recipients at least 7 calendar days before the new revision takes effect.

12.2. Continued use of the Service after the new revision takes effect constitutes the User's agreement to it. A User who disagrees stops using the Service and deletes the Account.

13. Governing law

13.1. The Policy and any relationship arising from its application are governed by the law of the Russian Federation. Disputes are resolved in the manner set out in Section 12 of the Agreement, without prejudice to the User's right to apply to Roskomnadzor or a court in accordance with the law.

14. Operator's details

Tabix Limited Liability Company (Tabix LLC)
OGRN 1187746090740, registered on January 29, 2018
INN 9705114726, KPP 771901001
Address: 105425, Moscow, Shchyolkovsky proezd, 11, bldg. 1, apt. 8
Email: support@lisik.tech
Website: https://pultika.autos

Service documents: Public Offer · User Agreement · Privacy Policy (summary) · Delete account.