Skip to content
OkayForm, home

Privacy policy

Version of 1 October 2026

This policy explains which personal data OkayForm (okayform.eu) processes, for what purpose, on which legal basis, who receives it, how long we keep it, and which rights you have (Art. 13 GDPR).

1. Controller

Alexander Seipel
Jeseniova 2829/20
130 00 Praha 3
Czech Republic
Email: hello@okayform.eu

OkayForm is run by one person. We have not appointed a data protection officer, because the conditions for one (Art. 37(1) GDPR) are not met.

2. The key points

  • Your answers stay in your browser. Your name, date of birth, passport details, address, employer, family and the other answers you give in the questions are saved only in your browser. We never store them on our server.
  • Your form is made in memory. To create your filled-in PDF, your browser sends your answers to our server, which fills in the form in memory and sends the PDF straight back. Nothing of it is stored or logged.
  • What we do store is your email address, the basic facts of your case (permit type, the expiry date of your current permit, your ministry office, which documents are on your checklist and which you have ticked, whether and when you filed) and your kit request.
  • Where: our servers are at Hetzner in Germany, our emails are sent through Brevo (EU).
  • No tracking cookies. We use no advertising or tracking cookies, which is why there is no cookie banner.
  • We don't sell data, and we never send anything to the Ministry of the Interior or any other authority: you submit your application yourself.

3. Visiting the website

3.1 Hosting

OkayForm runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres in Germany. Hetzner processes the data on our behalf under a data processing agreement (Art. 28 GDPR).

3.2 Server logs

When you open a page, our web server processes technically necessary data: your IP address, the date and time, the page requested, the status code and your browser's identification (user agent). The access log stores the IP address only in shortened form and is deleted after 7 days at the latest. The application itself logs technical errors; it never logs your answers, and email addresses and link tokens are removed from its logs. The purpose is the secure and stable operation of the website (legitimate interest, Art. 6(1)(f) GDPR).

3.3 Protection against abuse

To stop automated abuse of our forms, we count requests per IP address in the server's memory. These counters are never written to disk and disappear after one hour at the latest (legitimate interest, Art. 6(1)(f) GDPR).

4. Your answers and your form

4.1 Saved in your browser

The answers you give in the questions ("Is this kit for you?" and the steps after it) are saved in your browser's local storage on your device, with the date they were saved. We don't receive them. They are deleted automatically 90 days after you last saved them, or at once when you press "Delete my answers". Anyone who uses the same browser on the same device can see them, so on a shared computer delete them when you are done. If you download your answers as a file, the file is stored wherever you save it; we don't receive it either.

4.2 Creating your PDF

When you create your form on the kit page, your browser sends your answers to our server over an encrypted connection. The server checks that you are signed in and have access to a kit, fills in the application form in memory and sends the PDF back to your browser. Your answers and the PDF are not stored, not logged and not passed to anyone. The purpose is to give you the kit you requested (performance of a contract, Art. 6(1)(b) GDPR).

4.3 If the kit doesn't fit

If your answers show that the kit doesn't fit your situation, we count the reason (for example "permit expired"), without any information that could identify you (see 9.1).

5. Requesting a kit and your account

5.1 What we process

  • Your email address, which you enter when requesting your free kit.
  • Your case: permit type, the expiry date of your current permit and the last day to file, your ministry office, the list of document types on your checklist and which of them you have ticked, the form(s) in your kit, whether you have marked your application as submitted, with the date and the way you filed.
  • Your kit request: the date you requested access. No payment record is created.

5.2 Why, and on what legal basis

  • To give you your kit, your sign-in links, your checklist, your deadline reminders and the emails you ask for (performance of a contract, Art. 6(1)(b) GDPR).
  • To handle technical enquiries about your kit (legitimate interest, Art. 6(1)(f) GDPR).

5.3 Signing in

You sign in with a link we email you. The link works once and expires after 15 minutes. After you sign in, we set a session cookie ("__Host-okf_session"), which is strictly necessary for your kit to work. It is valid for 30 days or until you sign out.

5.4 Emails about your kit

We send you: the confirmation of your kit request with a sign-in link, sign-in links you ask for, deadline reminders until you mark your application as submitted, your checklist if you ask for it, and "What happens next" after you mark it as submitted. Reminder emails contain only dates, your permit type and links, never data from your form. Our emails contain no tracking pixels and no tracked links.

5.5 Deleting your account

"Delete my account" on the account page deletes your customer record, your cases and your reminders at once. No purchase record is created during the free offer.

6. No payments during the free offer

The complete kit is free for a limited time. We do not collect payment details, create purchase records or send your information to Stripe during this offer.

7. Free window reminders

If you ask us to email you when your filing window opens, we process your email address, your permit type, the expiry date of your current permit and the times you signed up and confirmed. Every sign-up must be confirmed through a link in a confirmation email (double opt-in); until then we send you nothing else.

  • Purpose: emails when your window opens and 30 days before your permit expires, each with a link to the kit.
  • Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
  • Unsubscribe: with the link in every email, or with your email program's unsubscribe button.
  • Deletion: unconfirmed sign-ups after 7 days; confirmed sign-ups 30 days after the last reminder, or at once when you unsubscribe.

8. Cookies and storage in your browser

  • Your answers in local storage (see 4.1) and the session cookie after you sign in (see 5.3). Both are strictly necessary for the service you asked for (§ 89(3) of the Czech Electronic Communications Act, Act No. 127/2005 Coll.).
  • Nothing else. The website sets no cookies and reads nothing from your device for statistics or advertising, which is why there is no cookie banner.

9. Statistics

9.1 Usage events in our database

We record a few events in our own database, for example that a filing window was checked, a step of the questions was completed, a kit was bought or a form was created. An event contains its name, the page path without any query string, the time and a few categories (for example the permit type, the status of the window, the step or the reason why the kit didn't fit). Events contain no names, email addresses, dates of birth, expiry dates, passport data, IP addresses or identifiers of your device or browser, and they are not linked to a person. They show us where people give up and whether OkayForm works. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). We delete events after 24 months.

9.2 Page statistics (Umami)

To see which pages are used, we run Umami, a statistics tool, on our own server at Hetzner in Germany. Our pages don't load Umami's script. Instead, public pages (not the questions, the kit, sign-in or the reminder links) send Umami only the address of the page (without other parameters than campaign tags such as "utm_source" and the Google click ID "gclid"), its title and our domain. With that request Umami also receives your IP address and user agent. From them it derives country, region and city, browser, operating system and device type, and it forms a visit identifier from IP address, user agent and a secret value that changes every month, so no long-term profile can be built. Umami does not store the IP address, sets no cookies and reads nothing from your device. The data is pseudonymous. The legal basis is our legitimate interest in knowing which pages are useful (Art. 6(1)(f) GDPR). We delete Umami data after 24 months.

10. Writing to us

If you write to hello@okayform.eu, we process your email address, your name if you give it, and the content of your message in order to reply (legitimate interest in answering enquiries, Art. 6(1)(f) GDPR; for requests about your rights, Art. 6(1)(c) GDPR; for questions about your kit, Art. 6(1)(b) GDPR). Please don't send us copies of your documents: we don't need them, and we can't advise on your individual situation. We delete emails once your enquiry has been dealt with, at the latest at the end of the third year after the last message, unless we must keep them longer by law.

11. Recipients

  • Processors (under a data processing agreement, Art. 28 GDPR): Hetzner Online GmbH (hosting, see 3.1), Sendinblue SAS (Brevo), Paris, France (sending our emails; Brevo stores the data in the EU). Where Brevo's group companies or sub-processors outside the EU can access data, for example for support, Brevo relies on the EU standard contractual clauses or the EU-US Data Privacy Framework (Art. 45, Art. 46(2)(c) GDPR).
  • Nobody else. We don't sell or rent personal data and don't pass it to anyone else, unless we are legally obliged to. We never send your data to the Ministry of the Interior or any other authority.

12. How long we keep data

  • Your answers: never on our server. In your browser until you delete them, at most 90 days after you last saved them.
  • Unconfirmed window reminders: 7 days.
  • Confirmed window reminders: 30 days after the last reminder, or until you unsubscribe.
  • Your account and cases: 24 months after your last kit request, or until you delete your account.
  • Sign-in links and sessions: deleted daily once they have expired (links after 15 minutes, sessions after 30 days).
  • Usage events: 24 months. Umami data: 24 months.
  • Server logs: 7 days at the latest. Abuse counters: one hour at the latest, in memory only.
  • Emails to us: until your enquiry is dealt with, at the latest the end of the third year after the last message.
  • Backups: we currently make no backup copies of the database, so deleted data is gone at once.

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on our legitimate interests (Art. 21). You can withdraw a consent at any time with effect for the future (Art. 7(3)); the easiest way for reminders is the unsubscribe link in every email. For everything else, write to hello@okayform.eu.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state where you live or work. The authority responsible for us is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 727/27, 170 00 Praha 7, Czech Republic, uoou.gov.cz.

14. Do you have to provide your data?

No, not by law. You can use the free parts of OkayForm without giving us any personal data. To request a kit, you need to give an email address, because that is how you sign in and receive your kit. The answers for your form are needed to fill it in, but they stay in your browser.

15. No automated decisions

The questions "Is this kit for you?" are checked in your browser and only decide whether the kit can help you. They have no legal effect on you, and we don't make decisions based solely on automated processing that have legal effects on you or affect you similarly (Art. 22 GDPR).

16. Changes

We update this policy when OkayForm or the law changes. The version published here applies.