Personal Data Policy

1. Controller and scope

1.1. Personal data controller: Индивидуальный предприниматель Ягирская Ольга Валентиновна, INN 780622378983, OGRNIP 319784700226367.

1.2. Contact for personal data requests: +79219526128, booking@yaolya.ru.

1.3. This Policy applies to the site, booking request forms, payment forms if online payment is available, user messages, and other YAOLYA services related to accommodation booking.

1.4. Browsing, closing the banner and submitting forms do not constitute analytics consent. Consent required for a particular action is requested separately.

2. Definitions

2.1. ‘Personal data’ means any information relating to a directly or indirectly identified individual.

2.2. ‘User/Guest’ means a person who uses the site, submits a request, pays an advance or prepayment, or contacts the controller.

2.3. ‘Personal data processing’ means any operation involving personal data, including collection, recording, organization, storage, clarification, use, transfer, anonymization, blocking, deletion, and destruction.

2.4. ‘Site/Service’ means the public YAOLYA site and interfaces used to select accommodation, submit a request, and make payment.

3. Data categories

3.1. When submitting a request, the following data may be processed: full name, phone number, e-mail address, stay dates, number of guests, selected apartment, comments, and wishes.

3.2. If online payment is available on the site and used, payment-related information may be processed: amount, currency, payment status, order or operation number, and information needed for fiscal receipt processing.

3.3. Card data is processed by the payment provider. The site operator does not store the full card number, CVV/CVC, or other sensitive card credentials.

3.4. Technical data may be processed automatically: IP address, cookies, browser and device data, visit time, site actions, and referral source.

3.5. When a user contacts the operator by messenger, phone, or e-mail, message content and contact details needed to handle the request may be processed.

4. Purposes of processing

4.1. Receiving and processing booking requests.

4.2. Communicating with the guest about dates, apartment, stay terms, payment, check-in, and check-out.

4.3. If online payment is available on the site, receiving prepayments, processing payments and refunds, and forming fiscal receipts where applicable.

4.4. Confirming a booking only after availability check and operator or service confirmation.

4.5. Compliance with legal, accounting, and tax obligations.

4.6. Support, claims handling, security, abuse prevention, diagnostics, and site improvement.

4.7. If a separate voluntary consent exists, sending YAOLYA news, information about available accommodation options, and special offers by email.

5. Legal basis and necessary data

5.1. Processing may be based on user consent, conclusion or performance of an agreement, legal requirements, and the controller's legitimate interest in operating and securing the service.

5.2. If the user does not provide necessary data, request processing, check-in, receipt issuance, or, if online payment is available, payment processing may be impossible.

5.3. Marketing subscription is not necessary for booking and is activated only after double opt-in confirmation through the email link.

6. Processors and third parties

6.1. Data may be transferred only to the extent needed for the processing purposes.

6.2. If online payment is available and used, data may be transferred to payment providers, banks, fiscal receipt providers, fiscal data operators, and other payment participants for payment, receipt, and refund processing.

6.3. Data may be transferred to booking management systems, calendar services, CRM, communication services, messengers, and technical contractors if needed to process the request and support the guest.

6.4. Data may be transferred to public authorities where required by law.

6.5. Marketing use is allowed only when the required consent exists.

7. Cookies and technical data

7.1. The site may use cookies and similar technologies for booking session operation, security, user preferences, analytics, and service improvement.

7.2. The user may restrict cookies in browser settings, but this may affect correct site and booking flow operation.

7.3. The site must not expose protected session identifiers used for secure cookie-session operation.

7.4. Unless a refusal is saved, the site automatically loads Yandex Metrica (tag 110018399): visit and source statistics, goals, Session Replay, click and scroll maps and link tracking on ordinary public pages. Metrica is used to understand website usage regardless of whether advertising campaigns are active. Technical browser, visit and safe action information is sent to Yandex to evaluate offers and enquiries. During checkout, field contents are excluded together with the dynamic form area and summaries; safe events measure steps. Payment widgets, bank pages, administration and secret links are excluded from recording. YAOLYA event code does not send names, phone numbers, e-mails, stay dates, booking identifiers, payment links or payment-provider data to Yandex.

7.5. A saved refusal or ‘Turn off statistics’ disables Metrica and Session Replay; actions are not retained for later transmission. ‘OK’ only dismisses the notice; absence of a choice is not stored as explicit consent. Available browser checkout diagnostics, attribution and the interactive map follow the same analytics eligibility model. Analytics preferences are independent of booking and email marketing consent.

7.6. The necessary yaolya_booking_bootstrap cookie lasts 15 minutes; the roomba_session_token booking cookie lasts for the browser session. The yaolya_analytics_consent cookie stores your preference for up to 180 days; a localStorage copy synchronizes refusal between tabs. It is not a visitor identifier. The signed yaolya_analytics_window cookie stores the current collection boundary for up to 180 days; it is not explicit consent and is deleted when refusal is saved. The yaolya_cookie_notice cookie stores notice dismissal for up to 180 days separately from the analytics preference. The yaolya_csrftoken_v2 request-protection cookie lasts up to 364 days and the service sessionid cookie up to 14 days. The roomba_lang language preference in localStorage remains until changed or cleared by the browser.

7.7. With analytics enabled, Metrica may store _ym_uid and _ym_d cookies for 1 year, _ym_isad for 20 hours, _ym_visorc_* for 30 minutes and _ym_metrika_enabled for 60 minutes, plus _ym* identifiers and technical state in localStorage and __ym_tab_guid in the current tab’s sessionStorage. The exact set depends on the browser and Metrica mode. Yandex documents other cookies and durations at https://yandex.ru/support/metrica/en/general/cookie-usage .

7.8. Change your choice through ‘Cookie settings’ in the footer. Refusal stops analytics, removes Metrica cookies and stored identifiers accessible to this site and, where needed, reloads the page with refusal preserved. This control does not delete data already sent to Yandex or cookies on Yandex domains that this site cannot access. Necessary features, contacts, booking and payment remain available.

7.9. The interactive Yandex map loads when analytics is on, including by default without a saved refusal: its SDK may also store shared identifiers on Yandex domains. Displaying the map sends technical browser requests to Yandex, including the IP address and device information. After refusal or when the map is unavailable, apartments remain accessible through the catalogue.

7.10. First-party YAOLYA analytics follows the same existing collection eligibility and refusal, independently of Metrica availability. YAOLYA receives random browser and visit identifiers, a cleaned page path, source and permitted campaign tags, coarse device information, safe actions, contact channel and button placement. Search observations include chosen dates, guest count, apartment and linked server request identifiers; arbitrary field contents, passwords and payment credentials are not recorded. The identifiers do not contain a name and link actions from the same browser. This channel does not send data to an external analytics service.

7.11. The signed HttpOnly yaolya_analytics_visitor cookie lasts no more than seven days from first observation; yaolya_analytics_visit lasts up to 30 minutes of inactivity, with a visit identifier copy in tab sessionStorage.

7.12. Ordinary detailed history and contact clicks are kept for seven days. Important cases saved separately may be kept longer, until preservation is released; the copies are then deleted after seven days. Long-term aggregates are disabled. Refusal stops new observations and clears the browser queue without later transmission; received records expire under the retention limit. A contact click is not proof of an enquiry.

Cookie settings

8. Storage and security

8.1. The controller takes organizational and technical measures to protect personal data from unauthorized access, alteration, disclosure, destruction, and other unlawful actions.

8.2. Access is provided only to people and services that need it for their functions.

8.3. Storage periods are determined by processing purposes, legal, accounting, and tax requirements, and possible claims or inquiries.

8.4. When processing purposes are achieved or legal grounds require it, data is deleted, anonymized, or archived according to the applicable procedure.

8.5. For voluntary email subscription, YAOLYA stores the normalized address, safe contact hash, status, purpose, channel, language, source, consent text version and SHA-256, request/confirmation/revocation timestamps, and an event ledger. Subscription data is retained until withdrawal and afterwards only as needed to evidence withdrawal and maintain suppression.

9. User rights

9.1. The user has the right to receive information about processing of personal data.

9.2. The user may request correction, blocking, or deletion of personal data where provided by law.

9.3. The user may withdraw consent if processing is based on consent.

9.4. Requests regarding personal data may be sent to booking@yaolya.ru.

9.5. A user can withdraw the marketing email subscription using the signed link in a message or the unsubscribe page. Withdrawal immediately blocks future advertising messages.

10. Minors

10.1. The service is not intended for independent use by minors without participation of their legal representatives.

10.2. If data of minor guests is included in a request, such data is provided by an adult user who has the right to act as a legal representative or accompanying person.

11. Changes and language

11.1. The controller may update this Policy. The new version applies from publication unless stated otherwise.

11.2. Users are advised to check the current Policy periodically.

11.3. This English version is provided for convenience. In case of discrepancies, the Russian version prevails.

12. Controller legal details

12.1. Индивидуальный предприниматель Ягирская Ольга Валентиновна.

12.2. INN: 780622378983; OGRNIP: 319784700226367.

12.3. Postal address: 197136, г. Санкт-Петербург, ул. Ленина, д. 52, кв. 12.

12.4. Phone: +79219526128; e-mail: booking@yaolya.ru.