Personal data policy — Накаток
Revision dated 2026-10-16.
1. Who processes data
The operator of nakatok.ru and its subdomains is Букин Максим Валериевич (Maksim Valerievich Bukin), individual entrepreneur, OGRNIP 326680000039120, INN 682603708700, registered on 16 September 2026. Correspondence address: 32/2 Naberezhnaya Street, Apt. 106, Tambov, Tambov Region, 392002, Russian Federation. Data contact: bukinapps@yandex.ru, telephone: +7 953 707-44-44.
This policy explains processing, not consent to every activity. Acceptance of the terms, analytics permission and other required consents are not combined in one checkbox.
2. Data and purposes
- Registration, sign-in and recovery: username, email, protected password representation, email verification and account status. Passwords are not intended for staff to read.
- Teams and venue management: membership, invitations, permissions, management transfers, applicant contacts, authority verification method and outcome.
- Suggestions, schedules and support: submitted text, links, contacts available in the form, attachments and review history. Submissions do not automatically become public.
- Email delivery: recipient, message type, text and lightweight HTML, time, sending mailbox, attempts and delivery result. Secret links expire. Only authorised staff see delivery records.
- Security: IP address, browser information, time and action outcomes, necessary error logs and automated-request restrictions.
- Evidence of choices: terms revision, language, acceptance date and minimal action details. Analytics choices are stored separately.
Data comes from users, team members and verifiable public venue sources. Do not publish others’ private contacts or documents without a basis. During the free launch we do not request subscription payment details, sell personal data or enable advertising mail.
3. Processing grounds
Necessary account and enquiry actions fulfil the agreement and the user’s requests. Law, lawful protection of rights and security may require other processing within legal limits. Where consent is required, it is requested separately with the purpose and data explained and can be withdrawn. A link to this policy alone is not consent.
4. Location and access
Initial main website data is stored in the Russian Federation and processed by a Russian operator. Access is limited to service tasks.
Service emails use configured Yandex mailboxes. The recipient’s own email provider also processes delivery. Data locations and new suppliers must appear in the current policy before the relevant processing starts.
Team members see only information needed for their assigned work and permissions, not passwords, internal logs or unrelated users’ data. Information needed to verify claimed authority may be shared with the venue. Lawful authority requests are handled under the prescribed procedure.
5. Maps and location
Maps connect the browser to Yandex and transfer IP address, browser and map-request information, processed under Yandex’s policy.
Precise location is requested only after a user action and browser permission. It is not required to browse the catalogue. Revoke permission in device settings or choose a location manually.
6. Cookies and optional analytics
Necessary cookies and similar storage support sign-in, form protection, language and saved settings. Blocking them may break features. They do not authorise an external analytics counter.
Only Yandex Metrica is chosen for optional analytics. Provider processing is described in Yandex’s policy. It loads only after separate permission. Publishing this policy does not itself enable it.
Before contacting providers, we offer “Accept all”, “Necessary only” and settings. “Accept all” permits the listed analytics, not advertising or session recording. Refusal does not prevent registration. Permission lasts no more than 180 days and can be withdrawn in footer cookie settings. Registration and map use do not replace this choice. Changing the provider requires a new choice.
Email, phone, passwords, verification links, form contents and precise coordinates must not enter analytics. This permission does not include session recording, advertising or tracking within personal accounts.
7. Retention
Account data is kept while the account is used. After closure, data no longer needed and lacking another lawful retention basis is deleted or anonymised. Venue facts are separate from personal accounts.
Support enquiries: up to three years after resolution. Email delivery and security logs: up to 12 months. Terms and authority evidence: during the relevant relationship and up to three years afterwards. Analytics-choice history: three years from the event, not the duration of permission.
Disputes or investigations may require longer retention on a separate lawful basis. The operator reviews periods. This revision does not promise scheduled automatic deletion. Recovery copies are not used in ordinary operations and follow a separate retention schedule. Completed deletion requests must be honoured again after restoration.
8. Rights and requests
You may request processing information, access and a copy, correction, an end to unlawful processing, deletion where provided for and withdrawal of consent. Withdrawal does not invalidate earlier lawful processing or end duties with another basis.
Write to bukinapps@yandex.ru from your account email and explain the request. If insufficient for safe identity verification, we ask only for minimal additional information. Never send passwords or sign-in codes. The operator handles requests manually within applicable legal deadlines and explains outcomes or refusals. A separate account button is not required.
You may contact Roskomnadzor or a court as applicable.
9. Children, security and updates
Accounts are intended for users aged 14 and over, subject to legal capacity and any required legal-representative authority. Contact us if a child’s data was obtained contrary to these conditions.
Access controls, password and connection protection, request checks, automated-attempt limits and logging are used. Absolute security is not promised. Report incidents to the contact email.
The revision date appears above. Material changes are communicated to users. New required consents are requested separately.