Personal Data Processing Policy

Operator

Ildus Zaitovich Ganiev, Tax ID 023802825780

Status

professional income tax payer

Service

Overlapping

Websites

https://overlapping.ru

Contact

overlapping@mail.ru

This Policy determines the procedure for processing and protecting personal data of Overlapping users.

1. General provisions

1.1. This Policy governs processing and protection of personal data of Overlapping users.
1.2. The personal data operator is Ildus Zaitovich Ganiev, Tax ID 023802825780, professional income tax payer, Ufa, Republic of Bashkortostan, Russian Federation, email: overlapping@mail.ru, hereinafter the “Operator”.
1.3. The Policy applies to https://overlapping.ru and related Overlapping information systems.
1.4. The Policy is developed in accordance with the personal-data laws of the Russian Federation.

2. Main principles

2.1. The Operator processes only personal data necessary for specific, predetermined purposes.
2.2. Processing must not be excessive in relation to the stated purposes.
2.3. Personal data is not used for purposes incompatible with the purposes for which it was originally collected.
2.4. The Operator takes necessary legal, organizational and technical measures to protect personal data.

3. Data that may be processed

3.1. Depending on use of the Service, the Operator may process: User name; email address; Account identifier; authentication data including technical identifiers and password hash; email-confirmation information; information needed for one-time-code sign-in and access recovery; IP address; sign-in date and time; browser, operating-system and device information; technical Service logs; session identifiers; cookies and other technical identifiers; profile settings; content of tasks, plans, notes and other Account information created by the User; purchased Subscription information; payment date, amount and status; payment transaction identifier; support-request history; and website-visit and interface-use data collected through Yandex Metrica, including page URL and title, traffic source, visit date and time, interface events and actions, browser/device/operating-system data, cookie and JavaScript availability, and other technical identifiers used by the analytics service.
3.2. Task content and other User records are personal data to the extent they relate to an identified or identifiable individual. Schedule data is stored on the Overlapping server, including during the free period. Expiry alone does not delete previously stored data.
3.3. Overlapping does not receive or store the full bank-card number, CVC/CVV or other payment credentials sufficient to perform a transaction independently. Such data is processed by Robokassa and payment-infrastructure participants.
3.4. The Operator does not intentionally collect biometric personal data.
3.5. The User should not place special categories of personal data or third-party personal data in Overlapping without a lawful basis.

4. Purposes of processing

4.1. Personal data is processed for Account registration and operation; User identification and authentication; password or one-time-code sign-in; access recovery; providing Overlapping functionality; server storage and synchronization; entering into and performing agreements; accounting for Subscriptions and payments; generating and sending receipts; processing support requests; information security; prevention of abuse and unauthorized access; error diagnostics and Service stability improvement; web analytics; analysis of traffic sources and use of pages and functions; evaluation of promotion effectiveness; improvement of public pages, interface and Service usability; compliance with Russian-law obligations; and protection of lawful rights and interests of the Operator and Users.
4.2. Personal data is not used for advertising or marketing mailings without a separate lawful basis and, where required by law, separate prior consent.

5. Legal grounds

5.1. Processing is based on the User’s consent; the need to enter into and perform an agreement with the User; compliance with the Operator’s statutory obligations; and, where permitted by law, the Operator’s legitimate interests provided User rights and freedoms are respected.
5.2. Withdrawal of consent does not stop processing that the Operator may or must continue on another lawful basis.

6. Methods of processing

6.1. Processing may be automated and, where necessary, non-automated.
6.2. Operations with personal data may include collection, recording, systematization, accumulation, storage, clarification and updating, retrieval, use, transfer in cases provided by this Policy, anonymization, blocking, deletion and destruction.

7. Data retention

7.1. Account data is processed while the Account exists unless a longer period is necessary to comply with law or protect lawful claims of the parties.
7.2. With an active Subscription, tasks, plans and other synchronized User data are stored in the working PostgreSQL database on the Operator’s server equipment until the User deletes them, deletes the Account, or another lawful ground for ending processing occurs.
7.3. Expiration of a paid Subscription does not by itself automatically delete previously stored User data.
7.4. After Account deletion or achievement of the relevant purpose, data is deleted or destroyed within statutory periods unless continued retention is required on another lawful basis.
7.5. Payment, receipt, agreement and transaction data may be retained for the period necessary to comply with tax, civil and other applicable law.
7.6. Working-database backups are created on the second physical disk of the same Operator server. Backups are retained for up to 30 calendar days and then deleted or overwritten within the ordinary backup cycle. They are used for recovery after technical failures and are not a separate archive service for the User.

8. Personal-data localization

8.1. When personal data of Russian citizens is collected via the Internet, the Operator complies with Russian localization requirements.
8.2. Overlapping’s primary database is located on server equipment owned by the Operator and physically located in Ufa, Republic of Bashkortostan, Russian Federation. PostgreSQL is used for server data. No third-party cloud hosting is currently used for the primary database or backups.
8.3. When collecting personal data of Russian citizens via the Internet, recording, systematization, accumulation, storage, clarification and retrieval are carried out using the database located in the Russian Federation, except where Russian law expressly provides otherwise.

9. Transfer and processing by service providers

9.1. The following external services may be configured for individual functions and analytics: Robokassa for payments and refunds; Mail.ru for sending one-time codes, confirmation and access-recovery messages, service notifications, and receiving and processing User inquiries at overlapping@mail.ru; and Yandex Metrica, operated by Yandex LLC, for web analytics, analysis of traffic sources and use of pages and functions, and evaluation of promotion effectiveness.
9.2. Robokassa receives and processes payment information necessary for payment. Overlapping receives technical transaction information including identifier, amount, date and status. Mail.ru may process the User’s email address and content of sent or received service messages to the extent needed for email operation. The Yandex Metrica tag automatically transmits to Yandex information about site visits, browser and device, traffic source, actions and events on pages, cookies and other technical identifiers needed to produce analytics. Overlapping does not configure Yandex Metrica custom parameters to transmit the User’s name, email address, task or plan content, passwords or full payment credentials.
9.3. Data is transferred to, or processed on behalf of the Operator by, these external services only to the extent necessary for the relevant purpose and where a lawful basis exists. The Operator takes confidentiality and security requirements into account when using them.
9.4. Yandex Metrica is enabled separately with the User’s permission. Changes in connected services are reflected in this Policy.
9.5. Personal data may be provided to state authorities in cases and in the manner prescribed by Russian law.

10. Cross-border transfer

10.1. Before any cross-border transfer of personal data, the Operator must comply with Russian-law requirements applicable to that transfer.
10.2. Use of a foreign service does not itself exempt the Operator from localization requirements for the primary database of Russian citizens.
10.3. Overlapping’s main server storage and backups are located in the Russian Federation. If use of Mail.ru, Robokassa, Yandex Metrica or a future external service in a particular configuration leads to cross-border transfer, the Operator will comply with applicable requirements before it starts and, where required, update this Policy.

11. Cookies and technical data

11.1. Overlapping may use technically necessary cookies and other local identifiers to maintain authenticated sessions, provide security, save settings and operate the interface.
11.2. Technically necessary storage technologies are used for Service functionality.
11.3. Overlapping uses Yandex Metrica for web analytics. The tag may set cookies and use localStorage properties containing anonymous browser identifiers and may automatically transmit technical information about visits and use of pages to Yandex. Users may restrict cookies and other site data using browser settings; this may reduce the completeness and accuracy of analytics statistics.

12. Personal-data security

12.1. The Operator takes necessary and sufficient legal, organizational and technical safeguards, including access control; User authentication; HTTPS-protected transmission; Let’s Encrypt TLS certificates; backup to a second physical disk; security-event logging; restricted physical and network access to the Operator’s server equipment; software updates; vulnerability control; and data-recovery measures.
12.2. Server equipment belongs to the Operator and is physically located in Ufa, Republic of Bashkortostan, Russian Federation. The exact hardware address and public static IP are not published in this Policy for information-security reasons.
12.3. Absolute security of information systems cannot be guaranteed, but the Operator takes statutory measures to reduce relevant risks.

13. User rights

13.1. In the manner prescribed by law, the User may obtain information about processing; request correction of inaccurate or incomplete data; request blocking or deletion where grounds exist; withdraw previously given consent; require processing to stop in statutory cases; challenge the Operator’s actions; and protect rights and lawful interests by other lawful means.
13.2. Requests are sent to overlapping@mail.ru.
13.3. To prevent unauthorized access, the Operator may request reasonably necessary information to verify the requester’s identity.
13.4. Requests are considered within the periods prescribed by Russian law.

14. Account deletion

14.1. Overlapping provides a “Delete account” function. The User may also send a request to delete the Account and associated data to overlapping@mail.ru.
14.2. After deletion, data is removed from the working database within statutory and technically necessary periods, except information the Operator must or may retain on another lawful basis, including payment, receipt and contract-performance information.
14.3. Data included in backups before deletion may remain on the server’s second disk until the 30-day backup cycle ends. Such copies are not used for normal provision of the Service and are deleted or overwritten under the established cycle.

15. Users under 18

15.1. Overlapping is intended only for users aged 18 or over.
15.2. The Operator does not intentionally collect personal data from minors.
15.3. If an Account belonging to a person under 18 is identified, the Operator may restrict its use and take measures to stop processing in accordance with law.

16. Changes to the Policy

16.1. The Operator may update this Policy.
16.2. The current edition is published on the Overlapping websites.
16.3. If the personal-data processing procedure changes materially, the User may additionally be notified through the Service interface or by email.

17. Operator contacts

17.1. Ildus Zaitovich Ganiev; Tax ID 023802825780; professional income tax payer; place of business: Ufa, Republic of Bashkortostan, Russian Federation; email: overlapping@mail.ru; websites: https://overlapping.ru.

A minimal record of the email and the dates of free-period use or account deletion is retained separately after account deletion to prevent repeated free periods. It contains no tasks, schedules, password or other deleted account data. Email case and leading or trailing spaces are ignored.

Yandex Metrica is enabled only after a separate analytics choice in the website interface. Permission can be withdrawn in analytics preferences. Webvisor, click maps and link tracking are disabled.

After a new registration is confirmed, the Service creates an editable example family schedule once, with fictional participants, groups and events. These are sample data, not information about the User’s actual children, work or health. Names use the registration language; the one-time example date uses the specified time zone. Examples may be edited or deleted and are not restored on subsequent sign-in.

The registration language, time zone and one-time initialization marker are stored to prepare the starter schedule. These settings and examples are linked to the Account and deleted with it, except information retained on the other grounds stated in this Policy.