Data Processing Policy

Operator and scope

Operator: Аскеров Тамерлан Октай Оглы. Address: г. Санкт-Петербург, ул. Верности, д. 12, кв. 66. Requests: hello@shisha-market.com.

The policy applies to Shisha Market, not to sites reached through external links. Until the details and processing scheme are filled in, public registration is closed. Synthetic data is used for local checks.

Data and purposes

For sign-in we process email, the internal account identifier, account name, email confirmation details, sessions, IP address and browser parameters required for authorization and protection. The one-time code is valid for five minutes; its value is stored as a hash. Email is not shown to visitors.

For publication we process details and photographs of the item, country and city, the chosen contact link, authorship, status and moderation decisions. The full name from the separate consent is stored only to record the declaration of will and is not shown in the listing.

For support we store the text of the request, the linked account and listing, time and decision. To confirm consents — the document version, time, selected conditions and details of the corresponding action. Do not send passports, payment details or sensitive information not necessary for the request.

The suggestion form on the requests page accepts the text of an idea and an optional contact without sign-in. A technical fingerprint of the request is stored to limit frequency. This is not registration and not publication of a listing.

Bases and methods

Separate consent is requested for voluntary processing for registration purposes. Actions necessary for the performance of the agreement with the user and for compliance with legal duties are carried out on the corresponding independent legal basis. Publication of contact and location requires separate consent to dissemination.

Processing is automated with the participation of authorized employees: collection, recording, systematization, storage, clarification, use, provision of access, blocking and deletion. The information is not used for advertising mailings. Complaint decisions are made by a human.

Where data is processed

Placement: Приложение, база и фотографии хранятся на VPS Hetzner в Фалькенштайне, Германия. Почта домена и коды входа — Resend. Счёт посещений ведёт Яндекс Метрика..

Persons engaged in processing, their addresses, countries and purpose: Hetzner (размещение сайта, базы и фотографий); Resend (почта hello@shisha-market.com и коды входа); Яндекс Метрика, счётчик 29210670 (статистика визитов)..

Cross-border transfer is not permitted by a single general checkbox. Localization, legal bases and notices are checked separately. VK ID is disabled in this pilot; an ordinary community link does not give it access to site accounts. With autoposting enabled, only approved listing data (photo, title, price, city and link) is posted in the project's VK community; the full name, email and form contacts are not transferred there.

Retention and termination

Approved retention periods by purpose and for backups: Код входа хранится до 5 минут, сессия — 7 дней. Объявление и фото доступны, пока автор их не снимет или не удалит аккаунт. Серверные резервные копии — 14 дней. Статистика Метрики хранится по правилам этого счётчика..

Withdrawing a listing closes publication and visitors' access to its photographs, but keeps the record for the owner and moderator. An account deletion request is processed separately: the operator verifies the requester and the necessary legal grounds for retention and reports the result. The site does not claim that account deletion is already performed automatically.

When consent to publication is withdrawn through the account area, all of the requester's listings are immediately removed from public access. Withdrawal of consent to processing, correction, access and deletion can be requested through the requests section or the operator's email. Necessary processing may continue only if there is an independent legal basis.

Protection and rights

Access to closed information is checked on the server. Photographs are not served to guests before publication or after withdrawal; image metadata is removed. Moderator rights are not granted on self-registration. These measures are not a promise of absolute security.

The user may request information about processing, correction, termination of unlawful processing and deletion, withdraw consent, and apply to a competent authority or court. Requests are fulfilled within the periods provided by applicable law. Mandatory rights cannot be revoked by these rules.