This Privacy Policy explains how we process personal data when you visit the cities on unfolds.city, contact us, use the client area to buy advertising, or appear in an advertisement shown in a city. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR").
1. Controller
1.1. The controller is Mihalič Group s.r.o., Company ID (IČO) 07187891, Tax ID (DIČ) CZ07187891, with its registered office at Žižkova 320/13, Stará Boleslav, 250 01 Brandýs nad Labem-Stará Boleslav, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 296222 ("we" or "us").
1.2. Contact for all privacy matters: info@unfolds.city. We have not appointed a data protection officer.
1.3. The supervisory authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, uoou.gov.cz. You may lodge a complaint with it, or with the supervisory authority in your EU member state, at any time.
1.4. We act as controller for all processing described here. We do not process personal data on behalf of advertisers, and advertisers receive no data about individual visitors.
2. Where your data come from
2.1. Most data come directly from you: when you create an account, fill in your organization's details, configure an order, upload a creative or write to us.
2.2. If an organization invites you to the client area, the organization gives us your e-mail address and your role. The invitation e-mail links to this policy.
2.3. If you appear in an advertisement, we receive your image or other data from the customer who uploaded the advertisement (Article 7).
2.4. Stripe tells us whether and when a payment was made, failed or was refunded. The European Commission's VIES system tells us whether a VAT ID is valid.
2.5. Technical data (for example IP address, browser type, session records and security logs) are generated when you use our websites.
3. What is mandatory
3.1. To create an account you must give your name, e-mail address and a password, and verify the e-mail address. Without them we cannot create an account.
3.2. To pay for an order, the organization must give its billing name, address, country and a Company ID or VAT ID. An organization established in an EU member state other than the Czech Republic must give a VAT ID that is confirmed as valid in the European Commission's VIES system (Terms of Purchase, Article 3.3). Without these details an order cannot be placed. We need them to issue an invoice with the details required by law, which is why providing them is a condition of the contract.
3.3. Everything else is voluntary, in particular two-factor authentication and consent to measurement on the city pages.
4. Purposes, data, legal bases and retention
4.1. The table below summarises our processing. "Legitimate interest" means Article 6(1)(f) GDPR; "contract" means Article 6(1)(b); "legal obligation" means Article 6(1)(c); "consent" means Article 6(1)(a).
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| User accounts in the client area: registration, sign-in, password reset, two-factor authentication, organization membership and invitations | name, e-mail, password hash, two-factor secret and backup codes, role, invitations (e-mail of the invited person) | contract, where you are yourself the customer (for example a sole trader); otherwise legitimate interest in providing the client area to the business you act for | while the account exists; invitations expire after 7 days and are deleted 7 days after they expire; on deletion see Article 4.3 |
| Sessions | session records with IP address and browser type (user agent) | legitimate interest in keeping you signed in securely | while the session is valid; expired session records are deleted no later than 30 days after expiry |
| Security audit log | actions in the client area recorded for security and accountability (for example sign-ins, account changes, data exports, orders, payments, refunds, invoices and content decisions) with time, account and IP address | legitimate interest in protecting accounts and the service, investigating incidents and defending legal claims | 3 years from the event, including after the account is closed, then deleted. Only audit entries needed to support the retained order records (orders, payments, refunds, invoices and content decisions) are kept with those records for 10 years, based on our legitimate interest in defending legal claims; the IP address is removed from them after 3 years. Other audit data are deleted after 3 years unless needed for a specific incident or claim, in which case they are kept until it is resolved and the limitation period has expired |
| Rate limiting | IP address | legitimate interest in preventing abuse | held only in a temporary rate-limit store for the duration of the limit window (up to one minute on the city pages, up to one hour for sign-up and password reset in the client area); not written to our main database |
| Orders, payments, refunds and complaints | organization's billing details (name, address, country, Company ID, VAT ID), details of the person who placed the order, the confirmation of business purpose given before payment (who gave it and when), order content, payment status from Stripe, Stripe customer identifier | contract with the customer; for individuals acting for a business, legitimate interest in concluding and performing the contract with that business | for the duration of the contract, then as accounting records (next row) |
| Invoices, credit notes and accounting records | buyer details as captured at payment, order lines, refunds, accepted Terms version | legal obligation: invoices that are tax documents for 10 years from the end of the tax period of the supply (Section 35 of Act No. 235/2004 Coll., on Value Added Tax); other accounting records for 5 years from the end of the accounting period (Section 31 of Act No. 563/1991 Coll., on Accounting); beyond the statutory minimum, legitimate interest in keeping complete, verifiable records together | we keep all invoices, credit notes and the related order and refund records for 10 years, including after the organization is deleted |
| Disclosure under advertising law | identity of the advertiser, of the creator of the advertisement and of the person who ordered it | legal obligation under Sections 6b(2) and 7a(4) of Act No. 40/1995 Coll., on the Regulation of Advertising (disclosure to supervisory authorities and to persons with a legitimate interest) | kept with the order records (row above) |
| Checking a VAT ID | VAT ID, result and time of the check; for checks made when you place an order, also the consultation number and the name and address returned by VIES. If a payment arrives later than expected, we check the VAT ID again and keep that check separately | legitimate interest in correct invoicing and in being able to prove that the customer was a business registered for VAT at the time of the supply (Article 18 of Council Implementing Regulation (EU) No 282/2011) | with the organization record; checks made for an order are kept as described in the next row |
| Evidence that a customer is a business (orders) | organization name, VAT ID or company registration or tax number, country; for customers outside the EU also the IP address from which the order was placed and the country of the bank that issued the payment card (provided by Stripe) | legitimate interest in being able to prove to the tax authorities where the service was supplied (Article 18 of Council Implementing Regulation (EU) No 282/2011) | collected when the order is placed; for orders for which we received any payment kept until the end of the tenth calendar year after the year of the last payment, invoice or credit note for the order; for orders that were never paid deleted 90 days after our payment provider has confirmed that the order can no longer be paid (until then we keep them) |
| Creatives and their review | image, label, description, destination link, result of the human review of every ordered creative | contract with the customer; legitimate interest in keeping unlawful content off the service | see Article 4.4 |
| Notices of illegal content and requests for review | name, e-mail, content of the notice or request | legal obligation under Regulation (EU) 2022/2065 (Digital Services Act) | as long as needed to handle the matter and any related claims |
| Transactional e-mails (verification, password reset, invitations, order and review notifications) | e-mail address, name, order details | as for accounts and orders above | as for accounts and orders above |
| Advertising inquiries from the public website | e-mail, label, description, link you enter | legitimate interest in responding to a business inquiry | 180 days |
| E-mail correspondence with us | e-mail address, name, content of the message | legitimate interest in responding and keeping a record of communication | as long as needed to handle the matter and any related claims |
| Optional measurement on the city pages | see Article 6 | consent | see Article 6 |
| Remembering your consent choice | consent record and its identifier | legitimate interest in being able to demonstrate consent and respect your choice | 180 days |
| Operation and troubleshooting | technical logs of the application | legitimate interest in running the service securely | short-term logs that are rotated and overwritten as they fill up |
4.2. We do not sell personal data and do not use it for marketing. E-mails to account holders are operational and contractual only.
4.3. Deleting an account. When you delete your account in the client area, we replace your name and e-mail address with neutral values and delete your sessions, two-factor data and organization memberships. Accounting records may keep the identifying details required by law, for example the name and address of a sole trader on an invoice. Other retained records, such as the audit log, are kept only for the periods in Article 4.1 and are minimised and pseudonymised where feasible. The owner of an organization must first transfer ownership or delete the organization.
4.4. Creatives. Uploads that are never used in an order are deleted by our routine clean-up (unused uploads after 1 day, uploads left in abandoned carts after up to 7 days). Creatives are kept while the organization exists. When an organization is deleted, its members, invitations, open carts and uploaded creatives are deleted, and we ask Stripe to delete the customer record we created there (Stripe may retain data under its own policy as an independent controller). A copy of a creative that was rejected or removed is kept as evidence for 90 days after the decision, also if the organization is deleted in the meantime. The label, description and destination link of ordered creatives, and the result of the review, remain part of the order records.
4.5. Backups. Database backups are kept for up to 7 days (hourly backups) and up to 30 days (daily backups). Deleted data may remain in backups until they expire; they are not used for any other purpose.
5. Recipients
5.1. The public. Approved advertisements, including any personal data they contain, are shown publicly to visitors of the relevant city, who may access them from anywhere, including outside the EEA, and may make their own copies. Within a customer's organization, users can see the organization's orders and creatives according to their roles.
5.2. We use the following providers:
| Recipient | Role | What they process | Location and transfer safeguards |
|---|---|---|---|
| DigitalOcean | processor: servers, storage, database backups | all data stored in the service | database backups are stored in DigitalOcean's Frankfurt (Germany) region. For any transfer outside the EEA, DigitalOcean's data processing agreement relies on its certification under the EU-U.S. Data Privacy Framework (adequacy decision, Article 45 GDPR), with the European Commission's Standard Contractual Clauses as a fallback |
| Resend | processor: sending transactional e-mails | e-mail address, name, content of the e-mail | primarily United States; Standard Contractual Clauses under Resend's data processing agreement (Article 46 GDPR); Resend also states in that agreement that it complies with the EU-U.S. Data Privacy Framework |
| Seznam.cz, a.s. (Seznam Email Profi) | processor: hosting of the mailbox info@unfolds.city | e-mail address, name and content of messages you send to or receive from us at that address | Czech Republic (EEA) |
| Anthropic | processor: AI-based assistant that helps us prepare and send replies, confirmations and routine operational messages, and process notices | content of the messages and notices the assistant handles, including any personal data in them | primarily United States; Standard Contractual Clauses under Anthropic's data processing agreement (Article 46 GDPR) |
| Stripe | independent controller for payment data | card and payment details you enter on Stripe's payment page, billing details, payment status; Stripe tells us the country of the bank that issued the card | Stripe processes payment data under its own privacy policy; for transfers outside the EEA, Stripe states that it relies on the EU-U.S. Data Privacy Framework and on Standard Contractual Clauses |
| European Commission (VIES) | independent recipient | VAT ID | European Union |
| Public authorities and persons with a legitimate interest | independent recipients | identity of the advertiser and of the creator of an advertisement; other data only where the law requires | as required by law |
5.3. Transfers outside the EEA. Where data are transferred to a country without an adequacy decision of the European Commission, the transfer relies on the safeguards stated in the table: the adequacy decision for the EU-U.S. Data Privacy Framework (Article 45 GDPR) for recipients certified under it, or Standard Contractual Clauses (Article 46 GDPR). You can ask for more information or a copy of the relevant safeguards at info@unfolds.city.
6. Visitors to the cities
6.1. You can explore the cities without an account. We do not use third-party analytics or advertising tools. If we ever wanted to introduce them, we would ask for your consent first and update this policy.
6.2. Optional measurement. Only if you agree, we measure how the cities are used with our own tool. We do not store your IP address or browser type for this purpose. Your browser receives a random identifier, and we store only a keyed hash of it. We record the following events: city view, camera pan, camera zoom, opening an interior, opening an advertisement, clicking an advertisement and opening the purchase offer. Advertisers receive only daily aggregate counts of opens and clicks of their advertisement, never data about individual visitors. If you click an advertisement, you leave our site; the destination website is operated by the advertiser under its own privacy policy.
6.3. Retention for measurement: records of individual browsers 180 days from the last visit; daily keys 35 days; raw event batches 2 days; aggregate statistics, which contain no personal data, 395 days.
6.4. You can withdraw consent at any time in "Cookie settings", available in the city information and in the footer of the city pages. Withdrawal immediately stops measurement and removes the browser identifier, and the measurement records linked to it are erased from our active database. Copies in backups expire under Article 4.5. Aggregate statistics that no longer relate to you are kept. The record of your consent choice is kept as described in Article 4.1. Withdrawal does not affect the lawfulness of processing before it.
Cookies and similar storage
| Name | Purpose | Type | Lifetime |
|---|---|---|---|
| `cs_consent` | stores your consent choice as a signed record | first-party, strictly necessary | 180 days |
| `cs_visitor` | random signed browser identifier for measurement | first-party, set only after consent | up to 180 days |
| `__Secure-better-auth.session_token` | keeps you signed in to the client area | first-party, strictly necessary | 7 days, extended while you use the client area; deleted when you sign out |
| `__Secure-better-auth.two_factor` | links the two steps of signing in with two-factor authentication | first-party, strictly necessary | 10 minutes |
Strictly necessary cookies do not require consent (Section 89(3) of Act No. 127/2005 Coll., on Electronic Communications).
In the client area we also use your browser's session storage (deleted when you close the tab) to keep the identifier of your draft cart, to restore an order in progress after a page reload and to remember that a creative check timed out. These items contain no personal data beyond these identifiers.
7. People shown in advertisements
7.1. An advertisement may show a recognisable person or contain a name or other personal data. We receive these data from the customer who uploads the advertisement. The customer is responsible for having that person's consent or another legal basis for using their data in advertising. Our Terms do not allow advertisements that reveal health data, religious or political beliefs or other special categories of personal data about identifiable people.
7.2. We process such data to review the advertisement and display it under the customer's order, based on our legitimate interest in performing the contract with the customer and in keeping unlawful content off the service. The data are shown publicly (Article 5.1) and kept as described in Article 4.4.
7.3. Because we have no means of contacting people shown in advertisements, we provide this information publicly (Article 14(5)(b) GDPR).
7.4. If you are shown in an advertisement and object, or believe your data are used unlawfully, write to info@unfolds.city. We will assess your request and may remove the advertisement while we clarify the matter with the customer.
8. No automated decision-making
8.1. We do not check the content of creatives by automated means. Every ordered creative is approved or rejected by a person before display, and decisions to remove displayed content are also taken by a person.
8.2. When a creative is uploaded, we only check that the file meets our technical requirements (file format, file size, dimensions, aspect ratio, no transparency and no animation). This check does not assess the content of the advertisement or the person who uploads it.
8.3. We do not use automated decision-making or profiling.
9. Your rights
9.1. You have the right to access your data, to have it rectified or erased, to restrict its processing, to data portability, and to withdraw consent at any time where processing is based on consent.
9.2. Right to object. Where we process your data on the basis of legitimate interest (Article 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation (Article 21 GDPR). This covers in particular processing for users and representatives of business customers, people shown in advertisements, account security and the audit log, inquiries and correspondence. Write to info@unfolds.city. We will then stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless we need the data to establish, exercise or defend legal claims.
9.3. How to exercise your rights. In the client area you can download an export of your account's personal data and, if you are the owner of an organization, of your organization's data, and you can delete your account or organization (Articles 4.3 and 4.4). For anything else, write to info@unfolds.city. We respond without undue delay and within one month at the latest; in complex cases this can be extended by two further months, of which we will inform you within the first month. If we have reasonable doubts about your identity, we may ask for information needed to confirm it.
9.4. Erasure does not apply to data we must keep by law or need for legal claims; such data are kept only for the periods in Article 4.1.
10. Security
10.1. Data are transmitted over encrypted connections. Passwords are stored only as hashes. Access to the client area can be protected with two-factor authentication. Card details are entered only on Stripe's payment page and never reach our servers.
11. Changes to this policy
11.1. We may update this policy when our processing or the law changes. The current version is always available at unfolds.city/legal/privacy with the date of the last update. We will inform account holders of material changes by e-mail before they take effect. An update of this policy does not by itself create a new legal basis; where a change requires your consent, we will ask for it.
See also our Terms of Purchase, About and business information.