Накаток.kz Privacy Policy
Revision: 2026-10-10.
1. Controller and contact
Controller: Букин Максим Валериевич (Maksim Valerievich Bukin), individual entrepreneur, Russian Federation. OGRNIP 326680000039120, INN 682603708700, registered on September 16, 2026. Correspondence: 32/2 Naberezhnaya Street, Apt. 106, Tambov, Tambov Region, 392002, Russian Federation. Privacy contact: bukinapps@yandex.ru, +7 953 707-44-44.
This Policy covers nakatok.kz and its subdomains. It explains processing. It is not a blanket consent. Accepting the Terms, the registration declaration and optional analytics are separate choices.
2. Information and purposes
We process only information relevant to the functions you use:
- Username, email, password hash and verification state for accounts and access.
- Team membership, invitations, assigned rights and ownership transfers.
- Venue-management requests, contact details, evidence, verification results and their periods of validity.
- Submitted venue details, schedules, links, supported attachments and support correspondence. A submission is not automatically public.
- Outgoing email recipients, message type, text, lightweight HTML, sender, sending attempts, times and delivery results. Logs are restricted to authorised staff.
- IP address, browser information, request times, errors and security events for abuse prevention, troubleshooting and access protection.
- The exact Terms version accepted, date, language and minimum evidence of the action. Analytics choices and the citizenship declaration are recorded separately.
Information comes from you, team members and checked public sources about places. Do not submit unnecessary personal documents or other people's private details. At the free launch, we do not request subscription payment details, sell personal data or enable advertising mail.
3. Legal grounds and recipients
Processing needed for your account and requested actions supports the service contract. Other grounds may include legal obligations and lawful protection of rights and security. Consent is requested separately where required. The grounds depend on the purpose and applicable law, not merely on visiting a page.
Authorised team members receive only information needed for their work, not other users' passwords or private logs. Relevant information may be provided to a venue to verify authority. Infrastructure and email providers process the information necessary to provide their services. Lawful requests from authorities are assessed under applicable requirements.
4. Location of processing and international use
The main database, registered user data, uploaded files and recovery copies are hosted on a separate server in Kazakhstan. The Operator works from the Russian Federation and may access information remotely where needed to provide the service. Hosting in Kazakhstan does not mean that all processing takes place exclusively in Kazakhstan.
Service emails use configured Yandex mailboxes. Your receiving email provider also processes messages. Yandex provides maps and Google provides separately permitted analytics. External providers may process information in other countries. Any required legal grounds and transfer safeguards must be in place before the relevant processing starts. Team members receive only information needed for their permissions, not passwords or other users’ private logs. Relevant information may be given to a venue to verify authority. Hosting or provider changes will be reflected in this Policy before the corresponding processing begins.
5. Maps and location
Loading a map sends network, device and map-request information from your browser to Yandex. The Yandex Privacy Policy and Maps Terms apply.
Precise device location is requested only for a relevant function and with browser permission. You can withdraw permission and select a place manually. Map use is not consent to optional analytics.
6. Cookies and optional analytics
Necessary cookies and storage support sessions, sign-in, form security, language and your choices. Blocking them may prevent those functions from working.
Google Analytics is the selected optional provider and loads only after your separate permission. Google Ireland Limited, Ireland, is the identified contracting provider under the published terms. Processing locations may also include other countries described in Google's processing terms.
Before an optional counter is connected, the site offers “Accept all”, “Necessary only” and settings. “Accept all” permits the listed analytics, not advertising or session replay. No counter requests are permitted before an explicit choice. Refusal does not block registration. Permission lasts at most 180 days. Footer settings allow withdrawal. A change of provider requires a new choice.
Advertising, session replay, form contents, account identifiers, precise location, email addresses and security tokens are not included in this permission. For a future GA4 activation, user/event retention is limited to two months without resetting it on new activity. That limit does not cover aggregate reports.
Google Analytics also requires an explicit confirmation that you do not hold Russian Federation citizenship, including dual citizenship. After sign-in, only the confirmation saved in your account is used. You can change it in personal settings. For guests, confirmation is recorded with the cookie choice. Account confirmation alone does not permit analytics. Analytics permission alone does not replace the citizenship confirmation.
7. Retention
Account data is kept while the account is in use. After closure we delete or anonymise information no longer needed, subject to another lawful ground. Public venue facts are separate from the personal account.
Support correspondence is retained for up to three years after resolution. Email-delivery and security logs are retained for up to twelve months. Terms and authority evidence is retained during the relationship and for up to three years afterwards. Analytics-choice evidence is retained for three years from the event, not for the duration of an analytics permission.
Necessary records may be kept longer for a particular legal duty or dispute. The Operator reviews these periods. This Policy does not promise an implemented automatic deletion scheduler. Recovery copies follow a separate retention schedule and are not used for ordinary operations. Completed deletion requests must be respected again after a recovery.
8. Rights and requests
Depending on applicable law, you may request access and a copy, correction, erasure, restriction, objection, portability or withdrawal of consent. Withdrawal does not invalidate earlier lawful processing or another legal ground.
Write to bukinapps@yandex.ru, preferably from the account email. Explain your request without sending passwords or codes. We may request only information reasonably necessary to verify identity. Requests are handled by the Operator within applicable legal time limits. Refusals are explained. You may complain to the relevant data-protection authority or court, including Roskomnadzor where applicable.
9. Children, security and changes
Account users must satisfy the legal-capacity and guardian-authorisation rules applicable to them. Management features are for authorised representatives. Contact us if a child's information has been provided improperly.
Access controls, password protection, protected connections, request checks, rate limits and security logs reduce risk but do not guarantee absolute security.
The revision date appears above. Material changes are communicated, and any required new consent is requested separately. This Policy does not claim that one document automatically establishes compliance in every country.