Privacy policy

1. Who handles your data

The data controller is Crnogorska Galerija Kosmosa, Rimski trg, 81000 Podgorica, Montenegro. For any privacy question, write to spacegallery.me@gmail.com or call +382 67 063 061.

2. What we collect

When you send a booking request:

• your first and last name;
• your phone number;
• your e-mail address — only if you choose to enter it;
• the chosen date and session, number and type of tickets, tariff (citizen / resident / non-resident) and audio-guide language.

We do not ask for any personal data about children — for them you only enter a number of tickets. We do not collect payment details: you pay at the desk.

3. Data created automatically

• IP address: used only to stop abuse of the form (at most 5 requests per 10 minutes from one address); kept for 10 minutes.
• Server logs (IP address, browser type, time of access) kept by the hosting provider for security and reliability.
• The NEXT_LOCALE cookie remembers the site language you picked. It is a strictly necessary cookie and is deleted when you close the browser.

We use no analytics, advertising or tracking cookies.

4. Why we process data and on what basis

• To receive, confirm or decline your booking and contact you about it — steps taken at your request before and for your visit.
• To protect the site from spam and abuse — our legitimate interest.
• To meet legal obligations, where they apply.

We do not use your data for marketing and will not send you promotional messages.

5. Who receives the data

We never sell your data or pass it to others for their own purposes. We use these service providers, who process data only on our behalf:

• Telegram — booking requests arrive in a private channel seen only by gallery staff;
• Vercel — website hosting;
• Upstash — the database that stores booking status and taken sessions.

These providers may store data on servers outside Montenegro and the European Union (e.g. in the USA), with the safeguards set out in their terms. The map on the site is an image made from OpenStreetMap data and served from our own server — the site sends no requests to OpenStreetMap. Links to Google/Apple Maps, Viber, WhatsApp, Telegram and Instagram take you to those services only when you click them — their own privacy rules then apply.

If sending the request through the site fails, the site offers to send it by e-mail from your own mail app — the data then travels through your e-mail provider to our address.

6. How long we keep data

• Booking data in our database is deleted automatically, at the latest about three months after the visit date.
• Booking messages in the Telegram channel are deleted by staff at the latest 12 months after the visit.
• IP address for spam protection — 10 minutes.

7. Your rights

At any time you can ask for:

• access to the data we hold about you;
• correction of inaccurate data;
• deletion of your data (for example if you cancel your visit);
• restriction of processing or to object to it;
• your data in a common, portable format.

Send your request to spacegallery.me@gmail.com; we reply within 30 days at the latest. If you believe your rights have been breached, you can complain to Montenegro's Agency for Personal Data Protection and Free Access to Information (azlp.me) or, if you live in the EU, to your national supervisory authority.

8. How we protect data

The site runs only over an encrypted connection (HTTPS). Only gallery staff can see booking requests, and the access keys for our services are kept separately and never reach the browser.

9. Changes to this policy

If we change how we process data, we will update this page and the date at the top.