This is a translation. If the Russian and English versions differ, the Russian version prevails. Русская версия
OffMaps mobile app
This section supplements the Policy and applies to the OffMaps mobile app for Android (ru.offmaps.app).
What the app sends to our server
- account data: email, name, phone number (if provided), username, avatar;
- routes and tracks that the User uploads or publishes;
- photos, reviews and ratings;
- meetups: title, place, time, participants;
- reports about content;
- search queries for places and meetups.
Device location is used only to show the User on the map and to find routes and meetups nearby. Recorded tracks stay on the phone until the User publishes them.
The app has no ads and no analytics or crash-reporting SDKs. It does not use device identifiers (IMEI, MAC address, Android ID, advertising ID).
Maps
Map tiles are loaded from MapTiler servers (maptiler.com). As with any web request, this reveals the device IP address and the map area being viewed to MapTiler. MapTiler acts as a service provider of the Operator.
Data transmission
Data between the app and the server is transmitted over HTTPS.
Account deletion
You can delete your account in the app (Profile → Delete account) or without the app by following the instructions at https://docs.offmaps.ru/account-deletion. Published routes are transferred to OffMaps. Reviews and ratings stay published under the user’s first and last name (without the profile photo); all other personal data of the account is erased.
Questions: support@offmaps.ru.
Offmaps Policy on the Processing and Protection of Personal Data
This Policy on the Processing and Protection of Personal Data (the “Policy”) sets out the procedure for processing personal data and the measures taken to ensure its security by Ilya Ivanovich Malakhov (the “Operator”, “we”) in connection with the use of the Offmaps service.
The Policy has been developed in accordance with the Constitution of the Russian Federation, the Civil Code of the Russian Federation, Federal Law No. 152-FZ of 27.07.2006 “On Personal Data”, Federal Law No. 149-FZ of 27.07.2006 “On Information, Information Technologies and Protection of Information”, Federal Law No. 38-FZ of 13.03.2006 “On Advertising”, and other regulatory legal acts of the Russian Federation.
The Policy shall be published, with unrestricted access to it, on the Site/in the Service.
1. Definitions
1.1. Personal data means any information relating directly or indirectly to an identified or identifiable natural person.
1.2. Service/Site means the Offmaps information resource available at https://offmaps.ru/ (including subdomains) or any other domain officially used by the Operator to provide access to the Offmaps service.
1.3. User means a person who uses the Service.
1.4. Route data means coordinates, tracks, GPX/KML files, route points, marks of terrain, surface, difficulty, comments and other information uploaded or created in the Service.
1.5. Geolocation data means coordinates, GPS/GLONASS data, information about the location of a device and other data about the position of the User or a route, where access to such data has been permitted by the User on the device, in the browser or in the Service interface.
1.6. Cookies means small text files and similar technologies used to remember settings, for authentication, analytics and to ensure the operation of the Service.
1.7. Processing of personal data means any action or set of actions performed with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer, depersonalization, blocking, deletion and destruction.
2. Legal grounds and principles of processing
2.1. The Operator processes personal data on the basis of the consent of the personal data subject and/or without such consent in cases expressly provided for by the legislation of the Russian Federation.
2.2. The legal grounds for processing may include: the conclusion and performance of contracts with the User, the User’s consent, legal requirements, and the protection of the rights and legitimate interests of the Operator to the extent permitted by law.
2.3. The Operator is guided by the principles of lawfulness, good faith, data minimization, purpose limitation, accuracy, storage limitation and security of personal data.
2.4. The Operator does not intentionally process special categories of personal data or biometric personal data, unless otherwise expressly provided for by the functionality of the Service and a separate legal ground.
3. Categories of data subjects and personal data processed
The Operator may process personal data of the following categories of data subjects: users of the Service, representatives of users that are organizations, counterparties and their representatives, persons contacting support, newsletter subscribers, as well as employees/job applicants — to the extent applicable.
- account data: email, phone number, password/password hash, username, name, photo/avatar, registration confirmation details, session history, information on roles and access rights;
- technical data: IP address, device ID, cookies, user agent, language, time zone, browser and OS information, event and security logs;
- route and geolocation data: coordinates, route points, GPX/KML files, tracks, route metadata, marked objects, device geolocation — where access has been permitted by the User;
- content and communications: photos, videos, reviews, comments, chat messages, the content of support requests, data on meetups/trips, dates, time, place, list of participants;
- payment and contractual data: information on the order, plan, amount and payment status, accounting document data, but without storing full bank card details where they are processed by a payment partner;
- newsletter data: email, phone number, username/name and information on consent given to or refusal of newsletters;
4. Purposes of personal data processing
| No. | Purpose | Data categories | Retention period |
|---|---|---|---|
| 1 | Registration, authorization, account management | email, phone number, username, name, password/hash, confirmation codes, IP, cookies, session information | until the account is deleted and/or the periods necessary to protect rights and fulfil obligations expire |
| 2 | Providing the functionality of routes, the map, filters, downloading and uploading files | route data, GPX/KML, coordinates, transport information, difficulty, descriptions, photos/videos, IP, device data | for the period of use of the Service and thereafter — within the selected settings and contractual and statutory periods |
| 3 | Creating meetups/trips, participating in them, communicating in chats | profile data, messages, meetup place and time, participants, files, notifications | for the lifetime of the meetup and thereafter — within the periods necessary for the operation of the service, dispute resolution and compliance with the law |
| 4 | Technical support and handling of requests | full name (if provided), email, phone number, content of the request, IP, technical logs | the period of handling the request + up to 3 years |
| 5 | Security of the Service, prevention of abuse, investigation of incidents | IP, device data, activity logs, sessions, information on violations, abuse reports | for the period necessary for the relevant purpose and for the protection of the Operator’s rights |
| 6 | Analytics, improvement of the interface and product quality | cookies, IP, device data, interface actions, depersonalized/aggregated metrics | within the periods set by the settings of the respective tools |
| 7 | Fulfilment of payment and accounting obligations | full name, email, information on payments, receipts, acts, invoices and other documents | within the periods established by the legislation of the Russian Federation on accounting and tax records |
| 8 | Advertising and information newsletters (subject to separate consent) | email, phone number, username/name, information on the communication channel and consent | until consent is withdrawn or the relevant newsletter is discontinued |
5. Procedure and conditions of processing
5.1. The Operator processes personal data both with and without the use of automation tools.
5.2. The Operator decides on the scope of data collected based on the principle of data minimization and collects only the data necessary for the stated purposes.
5.3. When collecting personal data via the Internet, the Operator ensures that the recording, systematization, accumulation, storage, clarification and retrieval of personal data of citizens of the Russian Federation are carried out using databases located in the territory of the Russian Federation.
5.4. The Operator may entrust the processing of personal data to third parties (hosting providers, mapping and navigation services, analytics, communication, message delivery and file storage services, payment services, support contractors and other persons) where this is necessary for the purposes of processing and provided that they comply with the requirements of the legislation of the Russian Federation and with contractual data protection obligations.
5.5. The Operator does not disclose personal data to third parties or disseminate it without the consent of the data subject, except in cases expressly provided for by law or where necessary to perform a contract with the User.
5.6. Cross-border transfer of personal data is carried out only where there are legal grounds, in compliance with the legislation of the Russian Federation and, where necessary, after the mandatory notification procedures have been completed.
5.7. The Operator does not guarantee the accuracy of the data provided by the User and assumes that the User provides it voluntarily, in good faith and in an up-to-date form.
6. Cookies, metrics and geolocation
6.1. The Service may use strictly necessary cookies, functional cookies, analytics tools and other technologies needed for authorization, remembering settings, statistics, protection against abuse and product improvement.
6.2. The User may restrict the use of cookies in the browser settings; however, some functions of the Service may not work correctly.
6.3. Geolocation data is processed only to the extent that the User has permitted access to it through the device, the browser or the Service interface, and to the extent related to routes and meetups uploaded by the User.
6.4. If the User publishes a route, a meeting point, coordinates or other geodata, the User understands that such information may become available to other Users within the privacy settings and functionality of the Service.
7. Storage, updating and destruction of data
7.1. The Operator stores personal data no longer than required by the purposes of processing, the terms of the contract and mandatory statutory retention periods.
7.2. Once the purposes of processing have been achieved, the need to achieve them has ceased, or consent has been withdrawn, personal data shall be deleted, depersonalized or destroyed, unless there are other legal grounds for continuing the processing.
7.3. The Operator may keep archive, backup and log copies of data for a reasonable period necessary to ensure security and infrastructure resilience, resolve disputes and comply with legal requirements.
7.4. The User may update, correct and supplement data through the account interface or by contacting the Operator.
8. Rights of the personal data subject
- to receive information about the processing of their personal data to the extent provided for by the legislation of the Russian Federation;
- to demand clarification, blocking or destruction of personal data where there are legal grounds;
- to withdraw previously given consent to the processing of personal data;
- to object to processing in the cases and in the manner provided for by law;
- to appeal against actions or omissions of the Operator to Roskomnadzor (the Russian data protection authority) or to a court.
To exercise these rights, the data subject may send a request to the Operator using the contact details given in this Policy. The Operator considers requests within the periods established by the legislation of the Russian Federation.
9. Security measures
- appointment of responsible persons and differentiation of access to data;
- use of accounts, roles, event logs, authentication and access control mechanisms;
- application of legal, organizational and technical information protection measures;
- backup, incident monitoring, protection against unauthorized access and malicious activity;
- staff training and internal control of compliance with legislation and internal regulations.
10. Minors
10.1. The Operator does not seek to intentionally collect, without appropriate grounds, personal data of persons whose use of the Service requires the consent of their legal representatives.
10.2. If the Operator becomes aware that data has been obtained from such a person without the necessary grounds, the Operator may restrict access, request confirmation of legal representation, or delete the relevant data within a reasonable time.
11. Changes to the Policy
11.1. The Operator may amend this Policy unilaterally.
11.2. A new version of the Policy takes effect from the moment it is posted in the Service, unless a different date is specified in the new version.
12. Operator contact details
- Offmaps service
- https://offmaps.ru/ (including subdomains) or any other domain officially used by the Operator to provide access to the Offmaps service
- Personal data operator
- Ilya Ivanovich Malakhov
- Status
- individual, rights holder of the Offmaps service
- Address for legally significant communications
- 31 Zhukovskogo St., Zhukovsky, Zhukovsky urban district, Moscow Region, 140181, Russian Federation
- support@offmaps.ru
- Phone
- +7 993 588-41-53