Privacy

This notice explains how BEZ KECŮ s.r.o. (IČO 23855185, Nové Sady 988/2, Brno, Czech Republic), trading as Kay in Norway (kayinnorway.com), uses personal data when you visit the site or buy The Emergency Pack.

Controller: BEZ KECŮ s.r.o., IČO 23855185, Nové Sady 988/2, Brno, Czech Republic. Email: kay@kayinnorway.com.

If the merchant of record later becomes a Norwegian company, we will update this notice (controller, address, and the authority you can complain to). Until then the controller is the Czech company above.

What we collect

• Name and email you type at checkout — to deliver the files, send a Stripe receipt/invoice, and handle a refund.
• Payment data — processed by Stripe. We do not store your full card number, CVC, or expiry. Stripe may keep what it needs to run the charge, invoices, and disputes.
• A signed access cookie (kay_pack_access) — so the thank-you page knows you paid. It lasts 14 days. Strictly necessary for the download.
• Server logs — IP address, browser, and the page requested, for security and debugging. We do not use this as a marketing profile.
• Meta Pixel — only if an ads pixel ID is configured on this domain. Then Meta may receive a page view, and a purchase event on the thank-you page (value and currency). This is a pixel for Kay in Norway on kayinnorway.com, not the Czech consumer shop on other domains.

Why we use it (legal bases)

• Contract — name, email, payment, and the access cookie, to sell and deliver the pack.
• Legal obligation — invoices and accounting records BEZ KECŮ s.r.o. must keep under Czech tax and accounting rules.
• Legitimate interests — security logs; a short service email about this pack (how to download, a reminder before the link expires). You can reply “stop” and we will.
• Consent — advertising measurement via the Meta Pixel when it is active. You can refuse it by blocking third-party scripts in your browser, using a tracker blocker, or Meta’s ad settings. We do not currently show a separate cookie banner; if we run ads we will keep this notice accurate. EU/UK rules may require prior consent for non-essential cookies — if a banner is added later, that control wins.

Who we share with

• Stripe — payments and invoices. Stripe acts as an independent controller / processor for card data. See stripe.com/privacy.
• Hosting / Vercel — the site and serverless functions that run checkout and downloads.
• Meta — only if the pixel is on, for ads measurement. Meta’s own privacy policy applies to what they receive.
• Accountants / tax tools — only what is required to book the sale (typically name, email, amount, invoice number).

We do not sell your list. We do not hand it to the Czech Instagram member area or Flixy.

How long we keep it

Checkout name and email: as long as we need them for delivery, refunds, accounting, and legal claims (Czech accounting records are typically kept for the statutory period, often several years). The access cookie: 14 days. Server logs: a short rolling window unless we must keep an incident record. Stripe keeps payment records under its own rules.

Transfers

Stripe, Vercel, and Meta are US-headquartered. Where they process EU/UK data, they use contracts (including Standard Contractual Clauses) and their published transfer tools. The site is meant for buyers in the UK and English-speaking Europe.

Your rights

You can ask for access, correction, erasure, restriction, objection, or a copy of your data (portability), and you can withdraw consent for the pixel by blocking it as above. Email kay@kayinnorway.com. You can complain to the Czech Office for Personal Data Protection (ÚOOÚ) or the supervisory authority in your EU/EEA/UK country of residence.

Children

The pack is for adult owners. We do not knowingly sell to children.

Changes

We will update this page if we change how we handle data, including a later change of controller to a Norwegian company. The date at the top is the latest version. Live notice: kayinnorway.com/privacy.