Privacy Policy

1. Data controller

• Controller: Tereza Koumarová, Business ID (IČO) 29874050, registered office at Andělova 825, 588 13 Polná, Czech Republic, entered in the Czech trade licensing register.
• Brand / service operated: The Sky Bureau (CZ Nebeský úřad, SK Nebeský úrad) — this is a fictional bureau, not a public authority; for GDPR purposes the controller is the real operating entity, not the “bureau”.
• Data protection contact: podatelna@nebeskyurad.cz (see the Contact page).
• Data Protection Officer (DPO): none is appointed — the controller’s activity does not fall under the mandatory appointment in Art. 37 GDPR (there is no large-scale systematic monitoring and no special categories of data).

2. What data we process about you

We keep to the minimum. For the filing office itself that is:

• Although we say publicly that “we collect only your e-mail”, for the demonstrability of consent we technically also record the timestamps of sign-up and confirmation. That is standard for double opt-in and we say so. The IP address serves only the short-lived protection of the forms and is never stored permanently.
• We do not process in the filing office: name, telephone, address, location, payment data or special categories of data (Art. 9 GDPR). Those arrive only with a purchase — see articles 10 and 11.

3. Purpose and legal basis

Double opt-in = after you enter your e-mail address a verification e-mail arrives; only clicking the link activates the sign-up and the consent to commercial messages. Until confirmation the address is not activated for mailing.

4. How long we keep the data

• Until consent is withdrawn (unsubscribed), and at most 24 months from sign-up, unless the sign-up becomes a customer relationship sooner, or
• until transfer into the customer records upon purchase (the purchase policy then applies).
• Records of the consent given (the times of sign-up and confirmation) are kept for the duration of the consent and for 3 years after its withdrawal for the defence of legal claims.

5. Who we pass the data to (processors)

The data are processed by our suppliers (processors under Art. 28 GDPR) on the basis of processing agreements:

• The database runs in the EU (Supabase, Frankfurt region). For US providers (Vercel, Stripe and, where applicable, Resend) the transfer relies on the EU–U.S. Data Privacy Framework adequacy decision for certified suppliers, otherwise on standard contractual clauses (SCC). We keep the list of processors up to date.

6. Rights of the data subject

You have the right:

• of access to your data (Art. 15) — you know what we keep about you;
• to rectification (Art. 16) — e.g. a typo in your e-mail address;
• to erasure (“to be forgotten”, Art. 17) — we delete you from the filing office;
• to restriction of processing (Art. 18);
• to data portability (Art. 20) — we will hand over the e-mail address in a machine-readable form;
• to object to the processing (Art. 21);
• to withdraw consent at any time (Art. 7(3)) — without affecting the lawfulness of processing before withdrawal;
• to lodge a complaint with a supervisory authority: the Czech Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, Prague 7, www.uoou.gov.cz. Slovak applicants: the Office for Personal Data Protection of the Slovak Republic, www.dataprotection.gov.sk — or with the supervisory authority of the EU member state of your habitual residence, place of work or of the alleged infringement (Art. 77 GDPR).

We handle requests without undue delay and within one month at the latest (Art. 12(3) GDPR). The contact address is on the Contact page.

7. How to withdraw consent and unsubscribe

• Click “Unsubscribe” in the footer of every e-mail — mailing stops immediately.
• Or send an e-mail to the filing office asking to be erased from the records.

Withdrawing consent is free of charge and carries no penalty. After withdrawal we stop sending messages immediately. The record of the consent given (the e-mail address and the sign-up times) is kept for a further 3 years for the defence of legal claims and is then deleted (see article 4).

8. Cookies, analytics and security

• The filing-office form works without marketing cookies.
• Analytics run cookie-free and without profiling visitors.
• The site sets two of its own technical cookies: `sb_ab` (a random assignment of the landing-page variant, 180 days) and — if you arrive through a creator’s link — `sb_ref` (a campaign marker, 30 days). Neither identifies you, tracks your behaviour, or is read by third parties.
• The base map is loaded by your browser directly from the servers of the tile provider (currently the OpenStreetMap Foundation); that provider sees your IP address, as with any image loaded from the internet. No cookies arise in the process.
• The Bureau keeps its own short-lived record of which pages were opened — with no cookies and nothing stored in your browser. Instead of your IP address and browser string, only a one-way fingerprint of them is stored, and its salt changes at every midnight, so two days cannot be linked. Page addresses are stored cleaned (tokens and query parameters are discarded) and the whole record is deleted after 14 days. If you submit an order, your case identifier is attached to the record so the Bureau can tell whether a payment failed or you simply left.

The gift link, the collection code and the unsubscribe link work like keys: whoever holds them can open the page they lead to. Treat them like the key to a letterbox and do not post them publicly. The Bureau never publishes them.

9. Automated decision-making and profiling

We carry out no automated decision-making with legal effect and no profiling within the meaning of Art. 22 GDPR. The allotment of a case number is purely sequential.

10. Purchase and keeping of the entry

When you buy an entry we process:

Notices from the Bureau — the second purpose of the buyer’s address. Since 17 August 2026 the e-mail the buyer enters in the order serves two purposes: delivering the order (the first row of the table) and notices from the Bureau about its own similar services (the last row). Each has its own legal basis, and the second can be refused at any time — on its own, without changing anything about the order.

• Who receives them: only someone who has bought an entry from the Bureau, and only at the address they entered themselves when buying. Never the recipient’s address — that has its own, stricter regime and belongs to no mailing whatsoever (article 12).
• What is sent: notices about the Bureau’s own similar services — new editions of entries and seasonal allotments. A few times a year at most. Nothing on behalf of other companies; we neither pass on nor sell addresses.
• Legal basis: legitimate interest — Art. 6(1)(f) GDPR (direct marketing to one’s own customers, recital 47), together with § 7(3) of Czech Act No. 480/2004 Coll., which permits commercial communications to an address obtained in connection with one’s own sale for as long as the customer does not refuse them.
• Refusing is free and always possible: in the order itself, by ticking “I do not wish to receive notices from the Bureau about new editions and seasonal allotments” — and thereafter with one click in every such message (the unsubscribe link in the footer and the List-Unsubscribe header). A refusal takes effect immediately and permanently.
• Refusing has no bearing on the delivery of your order. The Decision on Allotment, the gift link, the certificate of title, the consignment to the recipient and the handling of the refund guarantee are all performance of the contract — they are delivered whether you refused the notices or not.
• Retention for this purpose: we keep the address on the mailing until it is refused, and at most 3 years from the last order; after that it drops off the mailing even if you refused nothing. The other processing of the buyer’s e-mail (the first row of the table) is unaffected.
• We never add anyone retroactively. Only orders placed from the moment the Bureau started asking in the order form belong to the mailing. Anyone who bought earlier gave their address under a narrower promise — nobody asked them, and so they receive no notices. The Bureau distinguishes three states: did not refuse · refused · was never asked — and only the first of them belongs to the mailing.

Notice to complete a filing in progress — once and no more. Anyone who creates an order and does not pay receives one single notice from the Bureau: 24 hours after the file is opened, a message stating that the proceedings are held as being in progress, what is missing from the file and when the file will be shelved. The only link it carries leads to the recapitulation of that same file, where the payment can be completed.

• Who receives it: the buyer alone, at the address they themselves gave in the order. Never the recipient — the recipient knows nothing of the gift and the notice would give it away (article 12).
• How many times: exactly once per file. No second notice follows for the same file; anyone who has paid in the meantime, or discarded the file, receives none at all, and after 90 days from the opening of the file the Bureau sends no reminder whatsoever — at that point it shelves the file and erases the recipient's address from it.
• Legal basis: legitimate interest — Art. 6(1)(f) GDPR (completion of proceedings the buyer began themselves). The message offers and promotes nothing and concerns solely the file the buyer opened.
• Refusing takes one click in every such message (the unsubscribe link in the footer and the List-Unsubscribe header). It is the same link as for the Bureau's notices, so a single click stops both. Anyone who already ticked in the order that they want no notices from the Bureau receives no such reminder at all.

What is public: the public register shows, for each entry, the case number, the parcel name, the location (hexagon), the holder’s name or designation and any gold badge. Nothing more — e-mails, the dedication, the letter and the price are never public. The holder may be a first name or an alias; the Bureau does not require a full name. At the holder’s request we anonymise the name in the public extract; the parcel and the case number remain.

The dedication and the letter: the Bureau does not read, evaluate, copy or ever publish them; technically they are stored in the records and appear solely in the ceremony behind the gift link. Access to the records is limited to the system and, where strictly necessary (a complaint, a fault), the controller.

11. Special proceedings

Icon auctions (the applicant’s e-mail and offer), the silent resale (the applicant’s e-mail and offer), company enquiries (company, contact name, e-mail) and vouchers for an allotment (the recipient’s e-mail and name, for a single despatch): in every case this is negotiation of a contract or its performance — Art. 6(1)(b) GDPR; data from unsuccessful offers and enquiries are erased no later than 24 months after the proceedings close. E-mails from these proceedings are never added to any mailing list.

12. The recipient's e-mail (delivery by the Bureau)

If the buyer chooses delivery by the Bureau in the order, they enter the recipient's e-mail address. It is the only item of data that the data subject does not give us themselves, and we therefore handle it more strictly than the buyer's address:

• Purpose: solely the delivery of the gift. Exactly two messages, both to that same one purpose, go to the recipient's address: ① a notice to collect the consignment, containing the gift link, at the time the buyer specifies, and ② the certificate of title issued, which goes out only after the ceremony is complete — that is, once the recipient has opened their gift. No third message, no commercial communications, no addition to any mailing.
• Why there are two: both carry the same single performance. The first announces the gift and gives nothing away (neutral subject, no attachment); the second merely supplies the document the recipient has already seen in the ceremony, so that it stays in their inbox as well. Anyone who does not complete the ceremony never receives the second message.
• Legal basis: legitimate interest — Art. 6(1)(f) GDPR (delivering an ordered gift to its intended recipient). It is not a commercial communication within the meaning of § 7 of Czech Act No. 480/2004 Coll. — neither message offers or promotes anything.
• Source of the data: the buyer (Art. 14 GDPR). The recipient receives the processing information in the delivered message itself — in each of the two — including a link to this policy.
• We never publish it in the public register, in any public interface, on the certificate of title or on a sharing card.
• Retention — a hard limit: we erase the address no later than 180 days after the consignment is despatched — whether the ceremony has taken place or not. No exception, no extension. We erase the address only: the entry, the case number, the parcel, the holder and the dedication all stay on the records. At the recipient's request we erase the address sooner, without further ado (contact details on the Contact page).
• An unpaid order — 90 days: if payment never comes, the consignment is never despatched and the limit above would never start to run. In an unpaid order we therefore erase the recipient's address no later than 90 days after the order was created — the Bureau shelves the file and the third party's contact details disappear from it, even though the proceedings were never completed. Here too we erase the recipient's address only.
• What that means in practice: once the address is erased the Bureau has no way of sending anything to it — the certificate of title included. Anyone who opens the ceremony more than 180 days after the consignment was delivered will not receive the second message. The certificate itself does not disappear: the gift link remains valid and will produce it in the ceremony and as a download, as many times as needed.
• Anyone who wants to keep hearing from the Bureau — that a satellite is passing over their parcel, for instance — subscribes themselves on their parcel's page in the public register; that is their own consent with their own way out, not a continuation of this address, and it has nothing to do with delivering the gift.