Site owner and operator
Гордійчук В.Ю., Kharkiv, Ukraine. The owner/operator operates https://maka.com.ua, including accounts, catalogue, search, VIN requests, technical security and analytics.
Privacy policy
This page describes how the website actually works: which data is needed for an account, order or VIN request, what is stored in the browser and what is sent to external services.
Participants in data processing
This is a draft legal version. The confirmed practical roles of the participants are described below; the final legal classification and mandatory registration details are still being established.
Goods seller
ФОП Ткаченко Борис Ігорович, a Ukrainian sole proprietor. The seller accepts payment and is responsible for order placement and processing, delivery and returns. The seller uses a separate authorised account in the administrative area to work with orders and can access buyers’ orders. Login credentials are not shared with the site owner/operator.
The precise legal roles of both participants, the form of their relationship, and the seller’s official registry spelling and details still require confirmation. This draft does not describe them as joint controllers, controller and processor, or parties to another unverified arrangement.
Privacy contact: privacy@maka.com.ua
Data processed by the website
The data involved depends on the feature you use.
Registration and account
First and last name, phone number, email, password while it is being entered, customer number, pricing group, account status and last sign-in time. The server stores a cryptographic password hash rather than the plain-text password. Password recovery processes an email or customer number and a one-time token.
Cart, orders and delivery
Cart and item identifiers, articles, quantities, prices, checkout session, order number and status, recipient first and last name, optional middle name, phone, optional email, collection method, settlement and selected Nova Poshta branch or parcel locker, comment, tracking number, returns and status history. A VIN is attached to the order if you request a compatibility check. Through a separate administrative account, the seller receives access to the information that becomes part of the submitted order, but not to the cart token or preliminary checkout session.
VIN requests
Vehicle make, VIN, request text, guest name and phone or account data, VIN-chat messages, manager replies, request status and recommended products. Phone verification through Telegram may be processed for a registered customer.
Search, product views and technical operation
For MAKA's internal statistics, the server may store the entered and normalised search query, search rule and outcome, language, time, products and offers returned by search, their articles, prices, quantity, source, supplier, warehouse and response position. This is a snapshot of the search response, not a separate measurement that each price was actually visible on screen. It also records product views and successful funnel stages: add to cart, checkout start, order creation and VIN-request creation. Events may include a random first-party browser identifier, user-agent, approximate city and country, and a hash of the IP address; for a signed-in account the server adds the verified user identifier, while a guest has no user_id. The random identifier itself contains no name or contact details and is not sent to GA4. Request logs, a session cookie, cart identifiers and a guest-cart token are also used to operate the service.
Communications and notifications
Email is used for password recovery. If you choose to connect Telegram, the website processes the Telegram chat/user ID, username, Telegram first name, preferred language and, during verification, the phone number you share. Telegram may deliver order-status or VIN-request notifications.
Why the data is used
- to create and protect an account, sign you in, show customer pricing and order history;
- to give the seller access to order data so the seller can accept payment, process the order, arrange delivery and handle returns;
- to check VIN compatibility, answer a request and support a conversation with a manager;
- to return search results, maintain security, prevent abuse and improve the catalogue and search;
- to keep MAKA's internal statistics about searches, returned offers and prices, product views and stages in fulfilling a request or order;
- to measure website use through Google Analytics 4 — only after separate consent.
Functional processing for accounts, carts, orders, VIN requests and security does not depend on Google Analytics consent. MAKA's internal statistics also operate technically independently of the GA4 choice. If a required form field is not provided, the website or seller, as applicable to that function, cannot perform the requested action. The participants still need to confirm the legal basis for every purpose and whether internal statistics require separate consent, together with retention and an objection mechanism; this draft does not assign an unconfirmed legal basis.
Google Analytics 4 and your consent
The website is prepared to use GA4 measurement ID G-S17PTRJV6B. The Google tag is not loaded and no Google Analytics request is sent until you explicitly allow analytics. Declining does not prevent search, cart, registration or checkout.
After consent, Google may receive
- a general page type and language without the real search string, URL fragment or article in the address;
- product-view, cart-add/removal, checkout-start and confirmed-purchase events;
- product and offer IDs, articles, prices, quantities, value and the MAKA transaction number;
- a search category (part number, article list or text), but not the entered query;
- ordinary connection, browser and device information received by Google with the network request.
The MAKA integration does not add to GA4
- names, phone numbers, email addresses, addresses or recipient details;
- VINs, order comments, messages or any form contents;
- the MAKA account identifier or user_id;
- raw search text or an external referrer.
Important: the setting below controls Google Analytics only. MAKA's internal statistics about searches, returned offers and prices, product views and funnel stages operate independently of allowing, declining or making no GA4 choice. Its random first-party identifier is not sent to Google. Do not enter a phone number, email or other contact details into ordinary search; use the dedicated VIN form for a VIN.
The choice is kept in this browser for up to 180 days. You can allow or withdraw consent at any time. Withdrawal stops future dispatch, disables the tag and attempts to remove _ga cookies from this browser, but it does not automatically delete data already received by Google.
Cookies and browser storage
The website uses a cookie and local browser storage for sign-in, cart, checkout and its own statistics. Google Analytics cookies appear only after consent.
autohub_tokenNecessary HttpOnly cookie for an authenticated session.Up to 7 days; removed on sign-out.
Cart and checkout datalocalStorage/sessionStorage: cart ID and token, selected items, last recipient profile, delivery point, brief successful-order details and VIN-request draft.Until overwritten or removed by the website or the user/browser; short-lived sessionStorage data lasts until the tab session ends.
maka.analytics.consent.v1Stores the Google Analytics choice and the time it was made.Up to 180 days.
autohub_search_session_idRandom first-party identifier in localStorage used to link internal searches, product views and funnel stages in one browser. It is created independently of the GA4 choice and is not an account identifier.Kept until the user/browser or website clears the site data; declining GA4 does not remove it.
_ga, _ga_*Google Analytics cookies used to distinguish the browser and preserve analytics-session state.Configured by MAKA for up to 180 days; a browser may limit them further, and the website removes them from this browser on withdrawal as far as technically possible.
Who may receive or access data
Owner/operator and authorised staff
They have technical access to data needed to operate accounts, catalogue, search, VIN requests, security and website support.
Sole-proprietor seller
ФОП Ткаченко Борис Ігорович signs in through a separate authorised account. The current administrative routes expose the complete order list without assignment by manager, customer records, contact and delivery details, items and prices, comments and any VIN attached to an order, tracking numbers, statuses and returns. Both possible roles, ADMIN and MANAGER, also have technical access to all VIN requests, including registered and guest customer data, VINs, request text and conversations, and can process them. They can see other buyers’ data and pricing information, create customer accounts and initiate password resets; changing a customer’s pricing group may require a separate permission. The exact production role still needs confirmation: MANAGER does not manage staff accounts, roles or the main site settings, while ADMIN has that broader access.
Google Analytics
Receives the analytics events described above only after consent. Advertising storage, user data and advertising personalisation are denied by the integration; Google Signals and advertising personalisation are disabled in the client configuration.
NHTSA vPIC
When a registered user starts VIN decoding, the VIN is sent to the public vPIC service of the U.S. National Highway Traffic Safety Administration to retrieve basic vehicle details.
Telegram
When the Telegram integration is configured, it processes connection data and delivers notifications. Staff notifications about a VIN request may include the name, phone, VIN and request or message text needed for a manager to respond.
Nova Poshta
When choosing a delivery point, the server queries the Nova Poshta directory with the settlement search text, settlement identifier and branch/locker query. The MAKA system separately stores the recipient details and chosen point with the order.
IP2Location
If the website infrastructure does not supply an approximate city and the service is enabled, a public IP address may be sent to IP2Location.io to determine the city and country for a search event.
The owner/operator still needs to confirm the hosting, database, backup and email providers. The seller must confirm the actual process and data set sent to the carrier when a shipment is created. The production role assigned to the seller’s account also needs to be recorded. This version does not invent recipients or access restrictions.
Retention
The exact periods for the analytics choice, cookies and browser data are shown above. A cookie lifetime is not the same as retention of events on Google Analytics servers; the GA4 property owner must separately confirm that setting.
The available configuration does not provide one confirmed public period that can honestly cover accounts, orders, returns, VIN requests, messages, search statistics, logs and backups. The owner must approve a schedule by data category and a deletion process for the primary database and backups.
Until those periods are approved, a user can contact MAKA about specific data. Some information may need to remain for an unfinished order, accounting, the defence of claims or duties under applicable law; the owner must confirm the specific grounds and periods.
How data is protected
The current implementation hashes passwords, uses an HttpOnly session cookie, marks it Secure in production and SameSite=Lax, checks access to private APIs and does not add contact or VIN data to GA4. No transmission or storage method offers an absolute guarantee; the owner must separately confirm organisational controls, access management, backups and the incident-response process.
Your choices and data requests
- ask what data is processed about you and request access to it;
- report inaccurate data and request correction;
- request deletion or restriction where allowed by applicable law and record-keeping duties;
- disconnect Telegram in the account settings;
- withdraw Google Analytics consent at any time using the controls above or the Cookies item in the footer.
The website does not yet provide a separate self-service button to delete an account or export all data. Send the request to privacy@maka.com.ua and provide enough information for MAKA to verify safely that the request concerns you. The identity-check process, responsible participant and response period still need approval.
Policy changes
An updated version will be published at this same URL. The owner must set an effective date, decide how material changes will be announced and retain earlier versions where required.