Privacy policy

1. Controller and contact

1. 1.1The controller for any personal data connected with this website is Williwaw Studios OOD (Виливау Студиос ООД), UIC/EIK 206530664, 51 Business Park Sofia, Building 11A, floor 4, Sofia 1766, Bulgaria.
2. 1.2All data protection questions, requests and complaints go to [email protected]. We answer within one month of receipt, as Article 12(3) GDPR requires, and tell you if we need the further two months that Article allows.
3. 1.3We are not required to appoint a data protection officer under Article 37 GDPR, because we carry out no large-scale processing and no systematic monitoring. The address above reaches the person responsible.

2. Scope

1. 2.1This policy covers the website at stratosphynx.com and nothing else. It does not cover any site you reach through a link from here.
2. 2.2Personal data means information relating to an identified or identifiable natural person, as defined in Article 4(1) GDPR. For visitors in Australia the equivalent term is personal information under section 6 of the Privacy Act 1988 (Cth).

3. What we do not collect

1. 3.1We do not collect your name, your email address, your date of birth, your location, your device identifiers or any behavioural profile through ordinary use of the site.
2. 3.2We run no analytics of any kind, no advertising, no advertising identifiers, no remarketing pixels, no social plugins, no heat mapping, no session recording and no fingerprinting.
3. 3.3We do not read the Accept-Language header of your request and we do not read navigator.language in your browser. Language is taken only from a URL parameter you clicked or a cookie you caused to be set.
4. 3.4We do not buy, enrich, append or otherwise obtain data about you from any third party.

4. What is stored in your browser

1. 4.1One cookie, sz_lang, holds a two-letter language code so that a page can be delivered in your language before any script runs. It expires after one year and is written only when you press a language button.
2. 4.2The remaining items are held in localStorage under keys beginning sz_: your age confirmation, your storage choice, your points, your entry setting, the one-time top-up flag, any optional account and any removal request you lodged. The Cookie Policy lists every key, its content and how to erase it.
3. 4.3None of this is transmitted to us and we have no technical means of reading it. It is data on your device, not data in our possession.

5. Data our hosting provider processes

1. 5.1Like every website, this one is reached over the internet. The hosting provider records standard server access logs containing an IP address, a timestamp, the resource requested, the response status and a user-agent string.
2. 5.2Those logs exist to keep the service available and secure. We do not link them to any identity, do not build profiles from them, and do not use them for measurement or advertising.
3. 5.3The hosting provider acts as a processor under Article 28 GDPR and is bound by a written processing agreement that restricts it to acting on our instructions.

6. Purposes and legal bases

1. 6.1Delivering a page in your language and remembering that you confirmed your age: storage strictly necessary to provide the service you requested, and processing on the basis of our legitimate interest in a working site, Article 6(1)(f) GDPR. Under Article 5(3) of Directive 2002/58/EC, as implemented in Bulgaria by the Electronic Communications Act, storage strictly necessary to provide a service explicitly requested does not require consent.
2. 6.2Remembering your points, your entry setting and any optional account: not strictly necessary, and therefore stored only with your consent, Article 6(1)(a) GDPR and Article 5(3) of Directive 2002/58/EC. You give or withhold that consent in the storage notice and may change it at any time on the Cookie Policy page, with no effect on processing already carried out.
3. 6.3Keeping server access logs for security and availability: our legitimate interest, Article 6(1)(f) GDPR. We have carried out the balancing exercise that basis requires and consider the impact on you minimal, because the logs are never linked to an identity.
4. 6.4Answering an email you send us: performance of steps taken at your request and our legitimate interest in responding, Articles 6(1)(b) and 6(1)(f) GDPR.

7. Recipients

1. 7.1We do not sell, rent, licence, share or transfer personal data. There is no data broker, no advertising network and no analytics vendor in this picture, because there is no data store to draw from.
2. 7.2The only recipients are our hosting provider, acting as a processor, and Google, which serves two font files. No other third party receives anything.
3. 7.3We would disclose data if compelled by a valid legal order. We have never received one. If we do, we will tell you unless the order forbids it.

8. Google Fonts

1. 8.1Two font files are loaded from fonts.googleapis.com and fonts.gstatic.com. Making any request to a third-party host necessarily discloses your IP address to that host, and Google may process it under its own privacy terms.
2. 8.2This is the only outbound request the site makes on load. If you would rather avoid it, a browser extension that blocks third-party font hosts prevents it, and the site remains fully usable with your system fonts. No feature depends on the fonts.

9. International transfers

1. 9.1Because we collect no personal data ourselves, we make no transfer of personal data outside the European Economic Area.
2. 9.2The font request described above may involve processing outside the EEA by Google. Where that occurs it is covered by the European Commission adequacy decision for the EU-US Data Privacy Framework or by standard contractual clauses adopted under Article 46(2)(c) GDPR, depending on the receiving entity.
3. 9.3Our hosting provider processes data within the European Economic Area.

10. Retention

1. 10.1We retain nothing, because we store nothing. There is no record to delete on our side and no account to close.
2. 10.2Data in your browser stays until you clear it. Clearing your browser storage, choosing essential-only storage, or using the reset button on the Cookie Policy page removes it immediately and permanently.
3. 10.3Server access logs held by the hosting provider are kept for that provider's standard security retention period and are then deleted.

11. Security

1. 11.1The site is served over HTTPS with HTTP Strict Transport Security. Response headers set X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy. Private server-side includes are blocked from direct HTTP access and directory listing is disabled.
2. 11.2Passwords for an optional account never leave your browser and are stored there only as a hash. We cannot read them, which also means we cannot leak them.
3. 11.3These measures are appropriate to the risk under Article 32 GDPR, and the risk is low precisely because there is almost nothing to protect.

12. Your rights under the GDPR

1. 12.1You have the right of access (Article 15), rectification (16), erasure (17), restriction of processing (18), notification of rectification or erasure (19), data portability (20), objection (21) and the right not to be subject to a decision based solely on automated processing (22).
2. 12.2Where processing rests on consent you may withdraw it at any time under Article 7(3), as easily as you gave it, without affecting processing already carried out. The Cookie Policy page carries the controls.
3. 12.3To exercise any right, write to [email protected]. We do not ask for identity documents; we ask only for enough information to locate anything we might hold. In practice the honest answer to an access request will usually be that we hold nothing about you, and that answer is itself the response required by Article 15.
4. 12.4Exercising a right is free. We may charge a reasonable fee or refuse only where a request is manifestly unfounded or excessive, as Article 12(5) permits, and we would explain why.

13. Automated decision-making and profiling

1. 13.1We carry out no automated decision-making producing legal or similarly significant effects, and no profiling, within the meaning of Article 22 GDPR.
2. 13.2The outcome of any board is produced by a random number generator in your own browser. It is not a decision about you, it is not based on anything about you, and it has no effect outside the page.

14. Children

1. 14.1The site is for adults aged eighteen or over and is not directed at children. We do not knowingly hold data about anyone, children included.
2. 14.2Because we collect no personal data, the conditions in Article 8 GDPR for a child's consent to information society services do not arise.
3. 14.3If you are a parent or guardian with a concern, write to [email protected]. If you would rather the site were not reachable on a device at home, any standard content filter or browser blocklist will handle it.

15. Personal data breaches

1. 15.1If a breach of personal data occurs and is likely to result in a risk to your rights and freedoms, we will notify the Bulgarian Commission for Personal Data Protection within seventy-two hours of becoming aware of it, as Article 33 GDPR requires.
2. 15.2Where a breach is likely to result in a high risk to you, we will also inform affected people without undue delay under Article 34 GDPR, using the only channel available to us, which is a notice on this site.
3. 15.3Because we hold no store of personal data, the realistic breach scenarios are limited to the hosting provider's access logs.

16. Complaints

1. 16.1You may complain to the Bulgarian Commission for Personal Data Protection, our lead supervisory authority: 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, Bulgaria, www.cpdp.bg.
2. 16.2You may also complain to the supervisory authority of the EU member state where you live, where you work, or where the alleged infringement took place, under Article 77 GDPR, and you have a right to an effective judicial remedy under Articles 78 and 79.
3. 16.3We would rather hear from you first at [email protected], but you are not required to contact us before going to a regulator.

17. Visitors in Australia

1. 17.1For visitors in Australia, this policy also serves as our Australian Privacy Policy under Australian Privacy Principle 1.3 of the Privacy Act 1988 (Cth).
2. 17.2We do not collect personal information through ordinary use of the site (APP 3), do not use or disclose it for direct marketing (APP 7), and do not disclose it to overseas recipients beyond the font request described in section 8 (APP 8).
3. 17.3You may seek access to, and correction of, any personal information we hold under APP 12 and APP 13 by writing to [email protected]. In practice we will confirm that we hold none.
4. 17.4We are not aware of any eligible data breach and would notify the Office of the Australian Information Commissioner and affected individuals under Part IIIC of the Act if one occurred. The Commissioner can be reached at www.oaic.gov.au.

18. Digital Services Act transparency

1. 18.1The site displays no advertising, presents no recommender system, operates no online marketplace and hosts no user content, so the corresponding obligations in Regulation (EU) 2022/2065 do not apply to it.
2. 18.2The order in which boards appear is fixed by the catalogue and is not personalised, not influenced by payment and not affected by anything about you.

19. Changes to this policy

1. 19.1If this policy changes, the version date at the top of the page changes with it.
2. 19.2A change that affects how storage is used also resets the storage notice, so that a fresh choice can be made before anything not strictly necessary is written again.