Privacy Policy

1. Data controller

• Controller: Tereza Koumarová, Business ID (IČO) 29874050, registered office at Andělova 825, 588 13 Polná, Czech Republic, entered in the Czech trade licensing register.
• Brand / service operated: The Sky Bureau (CZ Nebeský úřad, SK Nebeský úrad) — this is a fictional bureau, not a public authority; for GDPR purposes the controller is the real operating entity, not the “bureau”.
• Data protection contact: podatelna@nebeskyurad.cz (see the Contact page).
• Data Protection Officer (DPO): none is appointed — the controller’s activity does not fall under the mandatory appointment in Art. 37 GDPR (there is no large-scale systematic monitoring and no special categories of data).

2. What data we process about you

We keep to the minimum. For the filing office itself that is:

• Although we say publicly that “we collect only your e-mail”, for the demonstrability of consent we technically also record the timestamps of sign-up and confirmation. That is standard for double opt-in and we say so. The IP address serves the short-lived protection of the forms and is never stored permanently — with one exception: if you have consented to advertising measurement, it stays with the file of your application for entry only until the payment is reported to Meta and is then erased; if no payment follows, no later than 90 days after the application (article 8).
• We do not process in the filing office: name, telephone, address, location, payment data or special categories of data (Art. 9 GDPR). Those arrive only with a purchase — see articles 10 and 11.

3. Purpose and legal basis

Double opt-in = after you enter your e-mail address a verification e-mail arrives; only clicking the link activates the sign-up and the consent to commercial messages. Until confirmation the address is not activated for mailing.

4. How long we keep the data

• Until consent is withdrawn (unsubscribed), and at most 24 months from sign-up, unless the sign-up becomes a customer relationship sooner, or
• until transfer into the customer records upon purchase (the purchase policy then applies).
• Records of the consent given (the times of sign-up and confirmation) are kept for the duration of the consent and for 3 years after its withdrawal for the defence of legal claims.

5. Who we pass the data to (processors)

The data are processed by our suppliers (processors under Art. 28 GDPR) on the basis of processing agreements:

• The database runs in the EU (Supabase, Frankfurt region). For US providers (Vercel, Stripe, Anthropic and, where applicable, Resend) the transfer relies on the EU–U.S. Data Privacy Framework adequacy decision for certified suppliers, otherwise on standard contractual clauses (SCC). We keep the list of processors up to date.
• Meta and Google are not our processors. They receive data from advertising measurement only if you consent on the census bar (article 8). They are jointly responsible with the Bureau for collecting the data on the site and passing it on; what they do with it afterwards is governed by their own privacy policies. They may transfer it to their parent companies in the USA (Meta Platforms, Inc., Google LLC), which rely on the same EU–U.S. Data Privacy Framework.

6. Rights of the data subject

You have the right:

• of access to your data (Art. 15) — you know what we keep about you;
• to rectification (Art. 16) — e.g. a typo in your e-mail address;
• to erasure (“to be forgotten”, Art. 17) — we delete you from the filing office;
• to restriction of processing (Art. 18);
• to data portability (Art. 20) — we will hand over the e-mail address in a machine-readable form;
• to object to the processing (Art. 21);
• to withdraw consent at any time (Art. 7(3)) — without affecting the lawfulness of processing before withdrawal;
• to lodge a complaint with a supervisory authority: the Czech Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, Prague 7, www.uoou.gov.cz. Slovak applicants: the Office for Personal Data Protection of the Slovak Republic, www.dataprotection.gov.sk — or with the supervisory authority of the EU member state of your habitual residence, place of work or of the alleged infringement (Art. 77 GDPR).

We handle requests without undue delay and within one month at the latest (Art. 12(3) GDPR). The contact address is on the Contact page.

7. How to withdraw consent and unsubscribe

• Click “Unsubscribe” in the footer of every e-mail — mailing stops immediately.
• Or send an e-mail to the filing office asking to be erased from the records.
• Consent to advertising measurement (the census bar) is withdrawn through “Measurement settings” in the footer of the site; for an application already submitted, the filing office cancels it on request — details in article 8.

Withdrawing consent is free of charge and carries no penalty. After withdrawal we stop sending messages immediately. The record of the consent given (the e-mail address and the sign-up times) is kept for a further 3 years for the defence of legal claims and is then deleted (see article 4).

8. Cookies, analytics and security

The Bureau measures in two ways and keeps them apart. Without consent it counts visits with no cookies and no personal data (Plausible and its own official trail). Only with your consent does it load advertising measurement by Meta and Google — and only to measure campaigns, never to target advertising. The filing office and the application for entry work the same whether you consent or not.

• Counting visits (Plausible). Visits are counted by the Plausible service, with no cookies, no consent and no profiling of visitors. It receives the address of the page opened (for addresses carrying a key, such as a gift link, the checkout or the payment confirmation, always without the key), the site you came from and measured actions (for example “opened the application form”) with the language, the chosen edition and the campaign code if you came through a link that carries one. Your e-mail, name, dedication, letter or any key are never sent to it. Your browser connects to Plausible directly, so Plausible sees the IP address of the request; under its own policy it does not store it and does not link visits across days. Legal basis: the Bureau’s legitimate interest in running and improving the site — Art. 6(1)(f) GDPR.
• The base map is loaded by your browser directly from the servers of the tile provider (currently the OpenStreetMap Foundation); that provider sees your IP address, as with any image loaded from the internet. No cookies arise in the process.
• Location for the viewer and the parcel survey. If you have the sky above you worked out, your browser sends your location to the Bureau’s server — it is what the hexagon above you is calculated from. It is used for that calculation only, is stored nowhere (no database, no record holding a location) and is passed to no one.
• Aircraft overhead. By day the viewer can show the aircraft flying above you; the data come from the open network adsb.lol (licensed under the ODbL). Your browser sends the Bureau’s server only a cell of your location rounded to roughly 50 km, never an exact point. The query into the network is sent by the Bureau’s server, so the operator of the network sees neither your IP address nor your identity. The answer is shared briefly (15 s) on the server between visitors of the same region and is not stored. No personal data arise from it — the Bureau sees only aircraft that announce themselves.
• The Bureau keeps its own short-lived record of which pages were opened — with no cookies. In your browser it keeps one thing only: the case numbers of files whose payment the confirmation page has already recorded (the last twenty at most, `sb-zaplaceno`), so as not to record them twice. Instead of your IP address and browser string, only a one-way fingerprint of them is stored, and its salt changes at every midnight, so two days cannot be linked. Page addresses are stored cleaned (tokens and query parameters are discarded) and the whole record is deleted after 14 days. Alongside the pages opened and the steps taken, it also records choices from an approved list — the form of entry chosen, which form field was missing, whether a place was found on the map, whether and to whom a consignment by post should go — and a device class based on the window width (phone, tablet or computer); never any text you typed, never the browser type or your IP address. The only exception is the exit survey: the record also stores your answer to it — the option chosen from the list and, for “Other…”, a short text of up to 200 characters that you wrote yourself; the Bureau automatically removes e-mail addresses, telephone numbers, web addresses and numbers longer than six digits from it. The answer has no link to a person and the text is deleted with the record after 14 days; the Bureau cannot recognise names in the text, so please do not write any. If you submit an application for entry, your case identifier is attached to the record so the Bureau can tell whether a payment failed or you simply left. The answer to the exit survey is never attached to your case.
• The extended official trail (from 24 October 2026) — what it now records. So that the Bureau can tell where people stop reading and where they pause, the trail additionally records for a visit: reading by page section (which named sections were visible, how many active seconds on each, how many times the visit returned to it, how far it read and in which section it copied text — not what); taps (which element and which cell of a coarse 10 × 10 grid of the section, whether the tap hit nothing or was repeated; never exact coordinates); behaviour in the form without the contents of the fields (which field the visit entered and left, how many seconds it spent there, whether it typed, deleted, pasted or used autofill, the length of the text only in bands, whether an error appeared at the field and which field was the last before leaving — never any text you typed); changes of edition (from which to which, whether the comparison was open) and the return from the payment gateway (cancelled, paid, unknown); places only coarsely (the kind of place searched for or chosen — town, village, mountain, castle, park, lake, street, address …; the name only for public places, never for a street, house or address; the area rounded to 0.1°, roughly 10 km; never the text you searched for or exact coordinates); technology in bands (the kind of browser — the in-app browser of Instagram, Facebook or TikTok, Safari, Chrome, other —, the kind of device, the window width and loading speed only in bands, the number of script errors; never the full browser string or the screen resolution); video (start, quarters reached, pause, sound, skip, replay); going back (by the browser button or by a link, between which cleaned addresses) and, if you came from an advertisement, the placement and name of the advertisement from its link (for example Reels or Stories; it marks the advertisement, not you). The same rules apply as to the rest of the trail: no cookie, no IP address, no text you typed, and deletion after 14 days. Recipients of a gift (the ceremony, the viewer, collection) are measured no more than before.
• Summaries without personal data, experiments and the weekly review (from 24 October 2026). From the raw trail the Bureau compiles aggregate figures every day (how many visits, reading of sections, fields, editions, coarse places, channels and advertisements, video and technology per day, by source and kind of device). The summaries carry no visit mark, no case number and nothing by which a person could be recognised; they are therefore kept for 2 years, while the raw trail is deleted after 14 days. A/B experiments: the Bureau sometimes tries two versions of one thing (for example the wording of the main button) and randomly assigns one to each visit; the browser remembers the variant in the cookie `urad-pokus` for 30 days and it is recorded in the trail as a word, with no identity. The weekly review: the Bureau passes the aggregate figures for the week (without personal data; from the exit survey only the counts of answers, never the texts under “Other…”) to the Claude service of Anthropic, which as a processor writes a short review for the Bureau from them; every figure in it is checked by machine against the summaries. Nothing from the raw trail or from the files is passed to it. Meta advertisements: the Bureau downloads from Meta’s interface aggregate data about its own advertisements (spend, impressions, clicks, placement, name of the advertisement) — data about the advertisements, not about people. The legal basis is the same as for the trail: the Bureau’s legitimate interest in running and improving the site — Art. 6(1)(f) GDPR.

The “Census under the open sky” bar and the cookie holding your choice. If the Bureau uses advertising measurement, it asks through a bar at the bottom of the page. The bar appears after your first action on the page (scrolling, a tap, a key press), wherever you came from, advertisements included. If the exit survey appears as you are leaving, the bar steps aside for that time and returns once you answer or close the survey; this neither gives nor refuses consent. While a gift is being received (the ceremony opened from the gift link, the viewer, and collection by the number on the summons) the bar does not appear; advertising measurement loads there only if you gave your consent earlier. The “COUNTED” and “leave me out” buttons are the same size and nothing is preselected. Until you choose, no advertising measurement is loaded. The site remembers your choice in the cookie `urad-souhlas` with the value “ano” or “ne” for 180 days; after that the Bureau asks again. The cookie carries nothing else and is passed to no one. On the Bureau’s own workstations (addresses beginning with `/urad-`) neither the bar nor any advertising script appears.

Advertising measurement — only with your consent (Meta pixel and Google tag). If you tap “COUNTED”, the site loads scripts from Meta (Facebook, Instagram) and Google (Google Ads). Without consent they are not loaded at all. With consent:

• The Meta pixel reports to Meta the opening of a page, the viewing of a parcel’s detail in the register, the opening of the application form, the start of payment and the start of the trial ceremony (choosing a place, at most once per tab). The events carry only general data: the kind of event, the amount of the administrative fee, the currency and the number of items. They carry no parcel number, place, name or dedication. Meta’s library itself adds the page address and the page you came from; on pages with a key in the address (gift link, checkout, payment confirmation) the pixel is not loaded even with consent. Automatic reading of buttons and page content is switched off.
• The Google tag reports to Google the pages opened (the address always without a key) and, on the payment confirmation page, the paid application (below). Ad personalisation is switched off in the tag, even when you consent.
• The providers’ cookies. Both libraries store their own cookies in your browser; Meta and Google decide their names and lifetimes. You can find and delete them in your browser settings.
• What for — measurement only, not targeting. So that the Bureau can tell which advertisement brought a visit and an entry, and stop paying for one that brings no one. Meta and Google use the same data to assess the results of the Bureau’s campaign and to deliver it accordingly (campaign optimisation). The Bureau builds no audiences from website visitors and does not show you advertising again based on what you looked at on the site (remarketing).
• Who receives the data: Meta Platforms Ireland Limited and Google Ireland Limited (article 5). They are jointly responsible with the Bureau for collecting the data on the site and passing it on; what they do with it afterwards is governed by their own privacy policies. They may transfer the data to the USA.
• Legal basis: your consent — Art. 6(1)(a) GDPR; storing and reading cookies in the browser — § 89(3) of Czech Act No. 127/2005 Coll.

A paid application: the purchase reported by the Bureau’s server. If you consented to advertising measurement before submitting your application for entry, the file records that consent was given and, with it, your IP address and browser string. Once payment is confirmed, the Bureau’s server sends Meta one single message about the purchase:

• Google receives from the tag on the payment confirmation page — only if it was loaded in a browser with consent — the amount, the currency, a hash of the case number and a one-way hash of your e-mail address (so-called enhanced conversions). The hash is computed on the Bureau’s server; the readable address never reaches the page.
• What the hash is for: Meta and Google compare it with the hashes of their users’ addresses and attribute the paid application to the advertisement that brought it. It cannot be turned back into an e-mail address.
• What goes nowhere: the readable e-mail, the name, the holder, “Registered by”, the dedication, the letter, the parcel, the recipient’s e-mail or the delivery address.
• Without consent on the file nothing is sent — not even a hash. The Bureau’s own test entries are never reported.
• How long the Bureau keeps the IP address and browser string: only until this single report. Straight after the message is sent to Meta, the Bureau erases them from the file — whether Meta accepted it or not; the message is not repeated. If no payment follows, they are erased no later than 90 days after the application, when the Bureau sets the unpaid file aside (article 12); a discarded or shredded file takes them with it at once. The record that consent was given stays on the file as evidence (Art. 7(1) GDPR).

How to withdraw consent to advertising measurement.

• Through “Measurement settings” in the footer. The site deletes the cookie holding your choice, reloads the page and the bar asks again. From then on the Meta and Google scripts are not loaded. Cookies that Meta and Google have already stored stay in your browser until they expire; you can delete them in your browser settings.
• For an application already submitted. Consent is recorded with the application at the moment it is submitted, and the footer link does not change it — it has no way of knowing which application is yours. If you write to the filing office (article 1), the Bureau cancels the consent on your file: the payment is then not reported to Meta, the payment confirmation page does not pass the purchase to Google, and the IP address and browser string are erased at once. The cancellation is recorded in the Bureau’s records. For an application already paid, the report was sent at the moment of payment and cannot be taken back; you can ask Meta and Google directly to erase what they have already received.
• Withdrawal carries no fee and does not affect the lawfulness of anything that happened before it.

The Bureau’s own cookies. Regardless of consent, the site sets only these cookies of its own; no third party reads them:

• `sb_ab` — a random assignment of the landing-page variant, 180 days;
• `sb_ref` — a campaign code, if you arrive through a creator’s link or through a Bureau campaign link (for example from an advertisement), 30 days; a newer link overwrites it. The code is attached to your application (filing office, entry, voucher, satellite-pass subscription, company enquiry) and to the measured actions in Plausible, so the Bureau knows which campaign brought an entry. It marks the link, not you;
• `sky-jazyk-volba` — the language you explicitly chose, 180 days;
• `urad-claim` — the authorisation from the “Entries open” e-mail for those on the waiting list, 30 days; it carries the key to your application and serves only for priority access;
• `urad-pokus` — the randomly assigned variant of an A/B experiment (for example the wording of the main button), 30 days; it carries only the name of the experiment and of the variant, no identifier, and is set only while an experiment is running;
• `urad-souhlas` — your choice on the census bar (above), 180 days.

Browser storage. Some things you have started writing are kept by the site only in your browser, so that they are not lost on the way. None of it goes to the server or into measurement until you submit the application yourself:

• An application for entry being written (tab storage, `sb_objednavka_koncept`). What you write into the application form — the holder’s name, “Registered by”, the dedication, the parcel name, the enclosed letter, your e-mail, the recipient’s e-mail and delivery date, the delivery address of a printed copy and the options chosen — is kept by the form in the tab so that it is not lost by reloading the page or going back. It saves itself as you write. It disappears when the application is submitted or the tab is closed; after 24 hours the form no longer restores it and deletes it. Only the submitted application reaches the Bureau’s server.
• Hand-over from the trial ceremony to the application (tab storage, `sb_predani`). If you move from the trial ceremony to the application for entry, the ceremony passes the form the place, the holder’s name, the dedication, “Registered by” and the date of entry within the same tab — never through the page address. It disappears when the tab is closed; after 24 hours it is not used.
• A draft from a gift page (browser storage, `nebe.navrh`). If you choose a sentence or write a name on a gift page and move to the trial ceremony, your browser keeps this draft so that the ceremony can take it over. It is deleted when taken over; a draft older than 24 hours is not used and is deleted.
• The “census bar already shown” note (tab storage, `urad-lista-ohlasena`). When the census bar appears, the tab notes only “1”, so that its display is counted only once. No identifier, no campaign code. It disappears when you answer the bar or close the tab. The count of answers to the bar in Plausible receives only when the bar appeared (after the first action).
• The note “start of ceremony already reported” (tab storage, `sb_meta_start_trial`, only with consent) — the value “1”, so that Meta receives the start of the trial ceremony at most once per tab.
• The note “ceremony preview already played to the end” (tab storage, `sb_film_videl`). When the ceremony preview reaches its last page (it plays through, or you skip it), the tab notes only which preview it was (language and the gift page you came from) and the time, so that going back or reloading the page shows the last page straight away instead of replaying the preview from the seal. No name, sentence or place. It disappears when the tab is closed; after 6 hours it is not used.
• The note “ceremony preview played a moment ago” (browser storage, `sb_film_nedavno`). The same preview mark and time once more, this time beyond this tab as well: if you return to the same preview within 30 minutes — for instance from the advertisement again or in a new window — its last page appears straight away instead of the whole preview. A note older than 30 minutes is not used and is deleted on your next visit to the preview. Measurement receives only that the last page was shown straight away — nothing from the note.
• The note “exit survey already shown” (browser storage, `urad-anketa-odchodu`). If the exit survey is shown to you, your browser notes only the time it appeared, so that it is not shown again on the same device for 30 days. No answer, name or identifier. An older note is not used.
• The tab note “path for the exit survey” (tab storage, `urad-anketa-relace`). So that the survey appears only to someone who has clicked further into the website, and after going back, the tab notes when you arrived, how many pages you have seen, the addresses of at most the last 20 pages of the website, the time spent on the order form and whether you submitted the application. None of it is sent anywhere; it disappears when the tab is closed.
• A file you explicitly ask the Bureau to hold during the trial ceremony is described in article 10.

The gift link, the collection code and the unsubscribe link work like keys: whoever holds them can open the page they lead to. Treat them like the key to a letterbox and do not post them publicly. The Bureau never publishes them.

9. Automated decision-making and profiling

We carry out no automated decision-making with legal effect and no profiling within the meaning of Art. 22 GDPR. The allotment of a case number is purely sequential.

10. Purchase and keeping of the entry

When you buy an entry we process:

Notices from the Bureau — the second purpose of the buyer’s address. Since 17 August 2026 the e-mail the buyer enters in the order serves two purposes: delivering the order (the first row of the table) and notices from the Bureau about its own similar services (the last row). Each has its own legal basis, and the second can be refused at any time — on its own, without changing anything about the order.

• Who receives them: only someone who has bought an entry from the Bureau, and only at the address they entered themselves when buying. Never the recipient’s address — that has its own, stricter regime and belongs to no mailing whatsoever (article 12).
• What is sent: notices about the Bureau’s own similar services — new editions of entries and seasonal allotments. A few times a year at most. Nothing on behalf of other companies; we neither pass on nor sell addresses.
• Legal basis: legitimate interest — Art. 6(1)(f) GDPR (direct marketing to one’s own customers, recital 47), together with § 7(3) of Czech Act No. 480/2004 Coll., which permits commercial communications to an address obtained in connection with one’s own sale for as long as the customer does not refuse them.
• Refusing is free and always possible: in the order itself, by ticking “I do not wish to receive notices from the Bureau about new editions and seasonal allotments” — and thereafter with one click in every such message (the unsubscribe link in the footer and the List-Unsubscribe header). A refusal takes effect immediately and permanently.
• Refusing has no bearing on the delivery of your order. The Decision on Allotment, the gift link, the certificate of title, the consignment to the recipient and the handling of the refund guarantee are all performance of the contract — they are delivered whether you refused the notices or not.
• Retention for this purpose: we keep the address on the mailing until it is refused, and at most 3 years from the last order; after that it drops off the mailing even if you refused nothing. The other processing of the buyer’s e-mail (the first row of the table) is unaffected.
• We never add anyone retroactively. Only orders placed from the moment the Bureau started asking in the order form belong to the mailing. Anyone who bought earlier gave their address under a narrower promise — nobody asked them, and so they receive no notices. The Bureau distinguishes three states: did not refuse · refused · was never asked — and only the first of them belongs to the mailing.

Notice to complete a filing in progress — once and no more. Anyone who creates an order and does not pay receives one single notice from the Bureau: 24 hours after the file is opened, a message stating that the proceedings are held as being in progress, what is missing from the file and when the file will be shelved. The only link it carries leads to the recapitulation of that same file, where the payment can be completed.

• Who receives it: the buyer alone, at the address they themselves gave in the order. Never the recipient — the recipient knows nothing of the gift and the notice would give it away (article 12).
• How many times: exactly once per file. No second notice follows for the same file; anyone who has paid in the meantime, or discarded the file, receives none at all, and after 90 days from the opening of the file the Bureau sends no reminder whatsoever — at that point it shelves the file and erases the recipient's address from it.
• Legal basis: legitimate interest — Art. 6(1)(f) GDPR (completion of proceedings the buyer began themselves). The message offers and promotes nothing and concerns solely the file the buyer opened.
• Refusing takes one click in every such message (the unsubscribe link in the footer and the List-Unsubscribe header). It is the same link as for the Bureau's notices, so a single click stops both. Anyone who already ticked in the order that they want no notices from the Bureau receives no such reminder at all.

A file in progress from the trial ceremony — “the Bureau will hold your file”. Anyone who goes through the trial ceremony (proceedings in dry run) on the Bureau website and on its promotional pages gives the Bureau nothing: a dry run is recorded nowhere, holds no parcel and creates no entry in the register. Data come into being only when the visitor asks for it themselves, with a tap — on three separate tiers, each of them voluntary.

• Tier one — the file stays on your telephone. The place, the name of the holder, the dedication, the “entered by” line, the date of entry and the time of saving are stored solely in the storage of your own browser. The Bureau knows nothing of that file, does not hold it in the register and has no address for you. A location chosen with the location button is evaluated by the browser; the exact position never leaves your device. All that goes to the Bureau’s server is a coarse slice of the region (rounded to roughly 50 km), used to ask which aircraft are overhead at that moment — with no file, no address, no identity and nothing stored (article 8, aircraft overhead). The file can be discarded at any time with the discard button, or by clearing your browser data.
• Tier two — a key to the file by e-mail, on request only. The Bureau receives an address only if you enter it yourself and tap the button that sends the key. One single message then arrives, carrying your own file (the parcel, the holder, the dedication), a link that opens the file on any telephone, and one path to an entry: the price of the entry and a link to the order. Because the message offers a service of the Bureau’s own, it is a commercial communication within the meaning of § 2(f) of Czech Act No. 480/2004 Coll., and the Bureau therefore sends it only on prior consent under § 7(2) of that Act and Art. 6(1)(a) GDPR. The customer exemption (§ 7(3)) cannot be relied upon: anyone who went through the trial ceremony and did not buy is not a customer — the same holds for the reminders of tier three. Consent is given by tapping the button that sends the key; the exact wording of the sentence that stood beside the button is recorded with the file, together with the time, as evidence under Art. 7(1) GDPR. That sentence states expressly that the message also carries the price of the entry and a link to the order — consent to the key alone would not suffice for sending an offer. The message carries the identification of the operator, an unsubscribe link written as text, and the List-Unsubscribe header (§ 7(4)). One single message per file remains, as do the period of 30 days and the genuine erasure of the row and the address on unsubscribing. A discount, a coupon, a countdown or a “today only” never appear in it.
• Tier three — reminders before the occasion. The tick box is empty by default and is never pre-ticked. Whoever ticks it enters the kind of occasion and its date, and receives at most two reminders for one occasion (seven days and two days beforehand; at Christmas, 15 and 22 December). There is no third message. Legal basis: consent — Art. 6(1)(a) GDPR and § 7(2) of Czech Act No. 480/2004 Coll.
• For how long: the Bureau holds the file for 30 days from the moment it is saved and then erases it. Where a reminder has been agreed, it holds the file until then and for seven days after the last reminder; never sooner. Once the period ends, the row of the file and the address are erased — not archived, erased. All that remains in the operational overview is an anonymous tally mark carrying not one personal datum.
• Evidence of consent: for the tick the Bureau records the time and the exact wording of the sentence that stood beside the box — as it does for the filing office (article 4).
• An address from here never enters the mailing of notices from the Bureau (article 10 above). Anyone who had a file held is not a customer and does not enter the mailing even after a purchase, until the Bureau asks them separately in the order. And it is never the address of the recipient — the trial ceremony does not collect one and must not (article 12).
• The dedication is personal data. The sentence you write is never shown at the official counter beside other files, never enters any statistics and is never quoted in marketing — not even in an edited form.
• Unsubscribing takes a text link carried by every such message — the key to the file and both reminders alike (plus the List-Unsubscribe header). It takes effect immediately and permanently; the file stays on your telephone and erases itself when its period runs out.

What is public: the public register shows, for each entry, the case number, the parcel name, the location (hexagon), the holder’s name or designation and any gold badge. Nothing more — e-mails, the dedication, the letter and the price are never public. The holder may be a first name or an alias; the Bureau does not require a full name. At the holder’s request we anonymise the name in the public extract; the parcel and the case number remain.

The dedication and the letter: the Bureau does not read, evaluate, copy or ever publish them; technically they are stored in the records and appear solely in the ceremony behind the gift link. Access to the records is limited to the system and, where strictly necessary (a complaint, a fault), the controller.

11. Special proceedings

Icon auctions (the applicant’s e-mail and offer), the silent resale (the applicant’s e-mail and offer), company enquiries (company, contact name, e-mail) and vouchers for an allotment (the recipient’s e-mail and name): in every case this is negotiation of a contract or its performance — Art. 6(1)(b) GDPR; data from unsuccessful offers and enquiries are erased no later than 24 months after the proceedings close. E-mails from these proceedings are never added to any mailing list.

The Bureau uses the e-mail and name of the recipient of a voucher for an allotment only in the proceedings on that allotment: to despatch the voucher, for at most one reminder, for the notice of the time limit for redemption and for at most one notice of urgency. It will use them for nothing else and pass them to no one.

If the Bureau voids a voucher for an allotment (as a rule because the recipient did not redeem it even within the time limit notified in writing), we erase the recipient’s e-mail and name in the same act; only the allotment code, the dates and the Bureau’s internal note are kept.

12. The recipient's e-mail (delivery by the Bureau)

If the buyer chooses delivery by the Bureau in the order, they enter the recipient's e-mail address. It is the only item of data that the data subject does not give us themselves, and we therefore handle it more strictly than the buyer's address:

• Purpose: solely the delivery of the gift. Exactly two messages, both to that same one purpose, go to the recipient's address: ① a notice to collect the consignment, containing the gift link, at the time the buyer specifies, and ② the certificate of title issued, which goes out only after the ceremony is complete — that is, once the recipient has opened their gift. No third message, no commercial communications, no addition to any mailing.
• Why there are two: both carry the same single performance. The first announces the gift and gives nothing away (neutral subject, no attachment); the second merely supplies the document the recipient has already seen in the ceremony, so that it stays in their inbox as well. Anyone who does not complete the ceremony never receives the second message.
• Legal basis: legitimate interest — Art. 6(1)(f) GDPR (delivering an ordered gift to its intended recipient). It is not a commercial communication within the meaning of § 7 of Czech Act No. 480/2004 Coll. — neither message offers or promotes anything.
• Source of the data: the buyer (Art. 14 GDPR). The recipient receives the processing information in the delivered message itself — in each of the two — including a link to this policy.
• We never publish it in the public register, in any public interface, on the certificate of title or on a sharing card.
• Retention — a hard limit: we erase the address no later than 180 days after the consignment is despatched — whether the ceremony has taken place or not. No exception, no extension. We erase the address only: the entry, the case number, the parcel, the holder and the dedication all stay on the records. At the recipient's request we erase the address sooner, without further ado (contact details on the Contact page).
• An unpaid order — 90 days: if payment never comes, the consignment is never despatched and the limit above would never start to run. In an unpaid order we therefore erase the recipient's address no later than 90 days after the order was created — the Bureau shelves the file and the third party's contact details disappear from it, even though the proceedings were never completed. Here too we erase the recipient's address only.
• What that means in practice: once the address is erased the Bureau has no way of sending anything to it — the certificate of title included. Anyone who opens the ceremony more than 180 days after the consignment was delivered will not receive the second message. The certificate itself does not disappear: the gift link remains valid and will produce it in the ceremony and as a download, as many times as needed.
• Anyone who wants to keep hearing from the Bureau — that a satellite is passing over their parcel, for instance — subscribes themselves on their parcel's page in the public register; that is their own consent with their own way out, not a continuation of this address, and it has nothing to do with delivering the gift.

12a. The postal address for the consignment (Premium Entry — Gold Edition)

The Premium Entry — Gold Edition includes a consignment by post. In the order the buyer states where the Bureau should send it — to their own address or straight to the recipient — anywhere in the world. The consignment may be declined (“No consignment — electronic only”); the Bureau then keeps no postal address at all.

• What the Bureau keeps: the name on the envelope, street and house number, town, postcode and country — and the choice of who it goes to. Nothing else: no telephone number, no notes for the courier.
• Purpose: solely to despatch the consignment and to deal with a complaint should it be lost (the Bureau will then despatch it again on request, at no charge).
• Legal basis: performance of the contract — Art. 6(1)(b) GDPR. Where the consignment goes straight to the recipient, the Bureau processes an address the recipient did not give it themselves on the basis of legitimate interest — Art. 6(1)(f) (delivering an ordered gift to its intended recipient).
• Who receives the address: only the postal carrier delivering the consignment (for consignments abroad also the postal administration of the country of destination), and only to the extent that it appears on the envelope.
• Where it never goes: into the public register, onto the deed, onto the share card, into the e-mail to the recipient, into a web page address, into the Bureau’s trace of visits, or into measurement and advertising (Plausible, Meta, Google). The consignment address is not saved in the draft application kept in the browser tab.
• Retention: the Bureau erases the address 60 days after the consignment is despatched, and at the latest 180 days after the file was opened — even if nothing was despatched. If payment is never made, it is erased 90 days after the order was created. Only the address is erased; the fact that there was a consignment and when it left stays on the records.
• On request the Bureau will erase the address sooner (contact details on the Contact page) — before despatch, however, that means the consignment will not be sent.