Personal data policy — Накаток.by
Revision dated 2026-10-05.
1. Who processes data
The operator of nakatok.by and its subdomains is Букин Максим Валериевич (Maksim Valerievich Bukin), individual entrepreneur, Russian Federation, OGRNIP 326680000039120, INN 682603708700, registered on 16 September 2026. Correspondence address: 32/2 Naberezhnaya Street, Apt. 106, Tambov, Tambov Region, 392002, Russian Federation. Data contact: bukinapps@yandex.ru, telephone: +7 953 707-44-44.
This policy explains processing, not consent to every activity. Acceptance of the terms, analytics permission and other required consents are not combined in one checkbox.
2. Data and purposes
- Registration, sign-in and recovery: username, email, protected password representation, email verification and account status. Passwords are not intended for staff to read.
- Teams and venue management: membership, invitations, permissions, management transfers, applicant contacts, authority verification method and outcome.
- Suggestions, schedules and support: submitted text, links, contacts available in the form, attachments and review history. Submissions do not automatically become public.
- Email delivery: recipient, message type, text and lightweight HTML, time, sending mailbox, attempts and delivery result. Secret links expire. Only authorised staff see delivery records.
- Security: IP address, browser information, time and action outcomes, necessary error logs and automated-request restrictions.
- Evidence of choices: terms revision, language, acceptance date and minimal action details. Analytics choices are stored separately.
- Eligibility for analytics: optional confirmation of not holding Russian citizenship, the text shown and decision time. Its absence does not prevent registration.
Data comes from users, team members and verifiable public venue sources. Do not publish others’ private contacts or documents without a basis. During the free launch we do not request subscription payment details, sell personal data or enable advertising mail.
3. Processing grounds
Necessary account and enquiry actions fulfil the agreement and the user’s requests. Law, lawful protection of rights and security may require other processing within legal limits. Where consent is required, it is requested separately with the purpose and data explained and can be withdrawn. A link to this policy alone is not consent.
Applicable Belarusian personal data protection requirements are taken into account. Choosing a foreign operator does not remove user rights.
4. Location and access
Initial main website data is stored in the Russian Federation and processed by a Russian operator. Access is limited to service tasks. For users in Belarus, this means transfer to a Russian operator and processing outside Belarus.
Service emails use configured Yandex mailboxes. The recipient’s own email provider also processes delivery. Data locations and new suppliers must appear in the current policy before the relevant processing starts.
Team members see only information needed for their assigned work and permissions, not passwords, internal logs or unrelated users’ data. Information needed to verify claimed authority may be shared with the venue. Lawful authority requests are handled under the prescribed procedure.
5. Maps and location
Maps connect the browser to Yandex and transfer IP address, browser and map-request information, processed under Yandex’s policy.
Precise location is requested only after a user action and browser permission. It is not required to browse the catalogue. Revoke permission in device settings or choose a location manually.
6. Cookies and optional analytics
Necessary cookies and similar storage support sign-in, form protection, language and saved settings. Blocking them may break features. They do not authorise an external analytics counter.
Optional analytics uses Google Analytics and Yandex Metrica only after separate permission. Google Analytics’ recipient is Google Ireland Limited, Ireland. Google infrastructure may also be in other countries. See Google’s processing terms. Yandex Metrica’s recipient is ООО «ЯНДЕКС» (YANDEX LLC), Russian Federation. See Yandex’s policy.
Before contacting providers, we offer “Accept all”, “Necessary only” and settings. “Accept all” permits the listed analytics, not advertising or session recording. Refusal does not prevent registration. Permission lasts no more than 180 days and can be withdrawn in footer cookie settings. Registration and map use do not replace this choice. A changed provider set requires a new choice.
Email, phone, passwords, verification links, form contents and precise coordinates must not enter analytics. This permission does not include session recording, advertising or tracking within personal accounts.
Google Analytics additionally requires explicit confirmation that the user does not hold Russian citizenship, including dual citizenship. For signed-in users, the account confirmation is used, not the cookie-dialog checkbox, and can be changed in personal settings. Guest confirmation is saved with cookie choices. Without it Google Analytics stays disabled even when analytics is permitted. Yandex Metrica does not require that declaration, but still requires separate analytics permission.
7. Retention
Account data is kept while the account is used. After closure, data no longer needed and lacking another lawful retention basis is deleted or anonymised. Venue facts are separate from personal accounts.
Support enquiries: up to three years after resolution. Email delivery and security logs: up to 12 months. Terms and authority evidence: during the relevant relationship and up to three years afterwards. Analytics-choice history: three years from the event, not the duration of permission.
Disputes or investigations may require longer retention on a separate lawful basis. The operator reviews periods. This revision does not promise scheduled automatic deletion. Recovery copies are not used in ordinary operations and follow a separate retention schedule. Completed deletion requests must be honoured again after restoration.
8. Rights and requests
You may request processing information, access and a copy, correction, an end to unlawful processing, deletion where provided for and withdrawal of consent. Withdrawal does not invalidate earlier lawful processing or end duties with another basis.
Write to bukinapps@yandex.ru from your account email and explain the request. If insufficient for safe identity verification, we ask only for minimal additional information. Never send passwords or sign-in codes. The operator handles requests manually within applicable legal deadlines and explains outcomes or refusals. A separate account button is not required.
You may contact the Belarusian National Personal Data Protection Centre, Roskomnadzor or a court as applicable.
9. Children, security and updates
Accounts are intended for users aged 14 and over, subject to legal capacity and any required legal-representative authority. Contact us if a child’s data was obtained contrary to these conditions.
Access controls, password and connection protection, request checks, automated-attempt limits and logging are used. Absolute security is not promised. Report incidents to the contact email.
The revision date appears above. Material changes are communicated to users. New required consents are requested separately.