Privacy

This notice explains how BEZ KECŮ s.r.o. (IČO 23855185, Nové Sady 988/2, Brno, Czech Republic), trading as Kay in Norway (kayinnorway.com), uses personal data when you visit the site or buy The Business Owner's Emergency Toolkit.

Controller: BEZ KECŮ s.r.o., IČO 23855185, Nové Sady 988/2, Brno, Czech Republic. Email: kay@kayinnorway.com.

If the merchant of record later becomes a Norwegian company, we will update this notice (controller, address, and the authority you can complain to). Until then the controller is the Czech company above.

What we collect

• Name and email you type at checkout — to deliver the files or confirm a gathering ticket, send a Stripe receipt/invoice (for BOET the receipt includes a 14-day link back to the files), and handle a refund.
• Work-with-me enquiries — name, email, company or organisation, optional website, and the answers you tick about the business or a possible partnership, so Kay can prepare a conversation. Stored on our server. Not used for ads.
• Payment data — processed by Stripe. We do not store your full card number, CVC, or expiry. Stripe may keep what it needs to run the charge, invoices, and disputes.
• A signed access cookie (kay_pack_access, kay_hour_access, or kay_gathering_access) — so the thank-you page knows you paid for BOET, the hour, or a gathering ticket. It lasts 14 days. Strictly necessary for delivery.
• A consent cookie (kay_consent) — remembers whether you accepted analytics and marketing cookies. It lasts one year if you allow optional cookies, or about 182 days if you continue with necessary cookies only. Strictly necessary to honour that choice.
• Server logs — IP address, browser, and the page requested, for security and debugging. We do not use this as a marketing profile.
• Meta ads measurement — if you arrive from a Facebook or Instagram ad, the click id is in the URL. We send a server-side PageView to Meta (no marketing cookies) so the ad account can see that the landing happened. After you pay, we send Purchase from our server (hashed email, amount, currency), whether or not you accepted marketing cookies — that attributes a sale you made. The browser Meta Pixel still waits for marketing consent. After you agree, it may set cookies and send PageView, checkout, and purchase from the browser too.
• Google Analytics 4 — full cookie-based measurement only after you allow analytics cookies, and only if a measurement ID is configured. Page views, begin-checkout, and purchase. IP anonymization is on. Before consent, Consent Mode may send cookieless pings without identifiers.
• Microsoft Clarity — only after you accept analytics cookies, and only if a project ID is configured. Session recordings and heatmaps (clicks, scroll).

Why we use it (legal bases)

• Contract — name, email, payment, and the access cookie, to sell and deliver BOET.
• Legal obligation — invoices and accounting records BEZ KECŮ s.r.o. must keep under Czech tax and accounting rules.
• Legitimate interests — security logs; which BOET files were saved or opened (tool name and time, not your name or email), so we know which tools get used; a short service email about BOET (how to download, a reminder before the link expires); server-side ad measurement when you clicked a Meta ad (the click id in the URL) and server-side Purchase after you pay, so we can stop paying for ads that do not sell. You can reply “stop” on the email, or object to ads measurement via kay@kayinnorway.com.
• Consent — analytics cookies and the browser Meta Pixel (Google Analytics, Microsoft Clarity, Meta cookies). Those load only after you allow the matching category. Google Analytics 4 may send anonymous cookieless pings in Consent Mode v2 before that. You can agree to all, continue with necessary cookies only, or pick categories. Change or withdraw later via Cookie settings in the footer. A tracker blocker in your browser still wins.

Who we share with

• Stripe — payments and invoices. Stripe acts as an independent controller / processor for card data. See stripe.com/privacy.
• Hosting / Vercel — the site and serverless functions that run checkout and downloads.
• Meta — ads measurement (server-side events when you arrive from an ad or pay; browser pixel only after marketing consent). Meta’s own privacy policy applies to what they receive.
• Google — only if Analytics is on. See policies.google.com/privacy.
• Microsoft Clarity — only if Clarity is on. See clarity.microsoft.com/privacy.
• Accountants / tax tools — only what is required to book the sale (typically name, email, amount, invoice number).

We do not sell your list. We do not share it with other brands or websites we operate.

Cookies

A cookie is a small file stored on your device. On the first visit a cookie bar sits at the bottom of the page. You can still read the site. You can agree, continue with necessary cookies only, or set the choice by category (analytics / marketing). The browser Meta Pixel and Clarity start only after your choice. Server-side ad events from a click id in the URL do not wait on that bar. You can change cookies at any time in the footer via Cookie settings.

Necessary (always on, no consent required)

Without them the consent choice and payment would not work. They do not contain a profile of how you use the site.

• kay_consent (first-party) — stores I agree / necessary only / categories. About 182 days if you choose necessary only; one year if you allow analytics or marketing.
• kay_pack_access / kay_hour_access (first-party, 14 days, HttpOnly) — signed proof you paid, so we can show the files or the booking page.
• Stripe cookies on checkout.stripe.com — to take payment when you start checkout. Stripe’s policy applies there.
• Checkout button counts (first-party, no cookie) — landing, 20-second stay, Get BOET clicks, checkout started, and purchase confirmed. Counts only. No name, email, IP, or advertising click id.
• kay_attr (first-party, 30 days) — campaign, ad set, ad id, and UTM codes from the landing URL, so a later checkout can be attributed to that ad. No email, IP, or Meta click id.
• kay_fbc (first-party, 90 days) — stores the Meta click id from the ad URL so a later purchase can be matched to that click. No profile of how you browse the rest of the site.

Analytics (only with consent)

They help me understand how you use the site. Google Analytics 4 may send anonymous cookieless pings in Consent Mode v2 even before consent — without cookies and without identifiers. Full measurement with cookies starts only after you agree. Microsoft Clarity (session recordings and heatmaps) loads only after you allow analytics.

Marketing (only with consent)

The browser Meta Pixel measures whether an ad led to a visit or a purchase and may be used to show you more relevant ads. It loads only after you allow marketing cookies. Those providers then set their own cookies; duration is set by them. Withdraw via Cookie settings and they stop loading on the next visit. Server-side PageView and Purchase still run as described above.

Changing or withdrawing consent does not affect the contract to buy BOET.

How long we keep it

Checkout name and email: as long as we need them for delivery, refunds, accounting, and legal claims (Czech accounting records are typically kept for the statutory period, often several years). The access cookie: 14 days. Server logs: a short rolling window unless we must keep an incident record. Stripe keeps payment records under its own rules.

Transfers

Stripe, Vercel, Meta, Google, and Microsoft are US-headquartered. Where they process EU/UK data, they use contracts (including Standard Contractual Clauses) and their published transfer tools. The site is meant for buyers in the UK and English-speaking Europe.

Your rights

You can ask for access, correction, erasure, restriction, objection, or a copy of your data (portability), and you can withdraw consent for analytics and ads via Cookie settings in the footer. Email kay@kayinnorway.com. You can complain to the Czech Office for Personal Data Protection (ÚOOÚ) or the supervisory authority in your EU/EEA/UK country of residence.

Children

BOET is for adult owners. We do not knowingly sell to children.

Changes

We will update this page if we change how we handle data, including a later change of controller to a Norwegian company. The date at the top is the latest version. Live notice: kayinnorway.com/privacy.