Home / Privacy Policy

Privacy Policy

I.

Basic Provisions

 

  1. The controllers of personal data within the meaning of Art. 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter “GDPR”), and in accordance with Act No. 110/2019 Coll., on the Processing of Personal Data, are:
    1. ArtMoment s.r.o., Company ID: 14104156, VAT ID: CZ14104156, registered office at Tusarova 791/31, 170 00 Prague 7-Holešovice (service provider),
    2. ArtMoment Events s.r.o., Company ID: 21726850, VAT ID: CZ21726850, registered office at Tusarova 791/31, 170 00 Prague 7-Holešovice (portal operator),
    hereinafter jointly the “controllers”.
  2. With regard to the processing of personal data described in these conditions, both entities act as joint controllers within the meaning of Art. 26 GDPR. Their respective responsibilities are set out in a separate arrangement, the essence of which is available on request. You may exercise your rights under the GDPR and these conditions with either of the controllers.
  3. Contact details of the controllers:
    1. address: Tusarova 791/31, 170 00 Prague 7-Holešovice
    2. e-mail: info@artmoment.cz
    3. phone: +420 212 24 05 05
  4. Billing and payment details of the controllers:
    1. Service provider – ArtMoment s.r.o.
      Tusarova 791/31, 170 00 Prague 7-Holešovice
      Company ID: 14104156 | VAT ID: CZ14104156
      Bank account: 2202092037/2010
      IBAN: CZ1720100000002202092037
      BIC / SWIFT: FIOBCZPP
      If you invoice us, please use these details.
    2. Portal operator – ArtMoment Events s.r.o.
      Tusarova 791/31, 170 00 Prague 7-Holešovice
      Company ID: 21726850 | VAT ID: CZ21726850
      Bank account: 2303403324/2010
      IBAN: CZ2120100000002303403324
      BIC / SWIFT: FIOBCZPPXXX
      You will receive payment instructions for your experience booking by e-mail.
  5. Personal data means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
  6. The controllers have not appointed a data protection officer.

 

II.

Sources and Categories of Processed Personal Data

 

  1. The controllers process personal data that you have provided to them or that the controllers have obtained in connection with fulfilling your order:
    1. first name and surname
    2. e-mail address
    3. phone number
  2. The controllers process your identification and contact details and the data necessary for the performance of the contract, i.e. for handling the booking and holding the event.
  3. If you answer the optional question “How did you hear about us?” after completing an order, we store your answer with the order number. We use it to evaluate where our customers come from, based on the controllers’ legitimate interest under Art. 6(1)(f) GDPR, and keep it for as long as the order data.
  4. In your My ArtMoment profile you can save your loved ones to the gift calendar: first name, day and month of birth and their relationship to you. We use this data only to remind you of their birthdays, name days and other occasions. We send nothing to your loved ones and do not share their data with anyone. The legal basis is the provision of the service you set up in your profile under Art. 6(1)(b) GDPR and, with regard to your loved ones, the controllers’ legitimate interest under Art. 6(1)(f) GDPR. We keep the data until you delete it in your profile; you can delete it at any time.
  5. Photos you upload in your My ArtMoment profile with consent to publication may, after our review, be published on the controllers’ website (customer photo gallery). The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw your consent or delete the photo in your profile at any time; we will then remove it from the website.

 

III.

Legal Basis and Purpose of Personal Data Processing

 

  1. The legal basis for processing personal data is
    1. the performance of a contract between you and the controllers under Art. 6(1)(b) GDPR,
    2. compliance with a legal obligation of the controllers under Art. 6(1)(c) GDPR,
    3. the controllers’ legitimate interest in direct marketing to their own customers under Art. 6(1)(f) GDPR in conjunction with Section 7(3) of Act No. 480/2004 Coll., on Certain Information Society Services,
    4. your consent to processing for direct marketing purposes under Art. 6(1)(a) GDPR in conjunction with Section 7(2) of Act No. 480/2004 Coll., where no goods or services have been ordered.
  2. The purpose of processing personal data is
    1. handling your booking and exercising the rights and obligations arising from the contractual relationship between you and the controllers; a booking requires the personal data necessary to complete it (name and contact details). Providing personal data is a necessary requirement for concluding and performing the contract; without it the contract cannot be concluded or performed by the controllers,
    2. compliance with legal obligations towards the state,
    3. sending commercial communications and carrying out other marketing activities.
  3. The controllers do not carry out automated individual decision-making within the meaning of Art. 22 GDPR.

 

IV.

Data Retention Period

 

  1. The controllers keep personal data
    1. for the duration of the contractual relationship and thereafter for the period necessary to establish or defend legal claims, usually for the limitation period (generally 3 years, but no longer than 10 years after the end of the contractual relationship),
    2. for tax and accounting documents, for the period required by tax and accounting regulations (up to 10 years),
    3. where personal data are processed on the basis of consent, until the consent is withdrawn, but no longer than 5 years.
  2. After the retention period expires, the controllers delete the personal data.

 

V.

Recipients of Personal Data and Transfers to Third Countries

 

  1. Recipients of personal data are persons
    1. involved in delivering services and processing payments under the contract,
    2. providing website operation services and other services related to running the website,
    3. providing marketing services.
  2. The controllers may transfer personal data to recipients in third countries (outside the EU and EEA), in particular to providers of cloud, mailing, analytics and marketing services based in the United States of America. Such transfers take place only under the conditions of Art. 44 et seq. GDPR, i.e. on the basis of a European Commission adequacy decision (in particular the EU-US Data Privacy Framework) or standard contractual clauses under Art. 46 GDPR.

 

VI.

Personal Data Processors

 

  1. Personal data are processed by the controllers; however, the following processors may also process personal data on their behalf:
    1. the Ecomail service provider,
    2. Hotjar, Google, Facebook, Microsoft,
    3. where applicable, other providers of processing software, services and applications that the controllers do not currently use.

 

VII.

Cookies and Third-Party Tools

 

  1. The controllers’ websites use cookies and similar technologies (in particular tracking codes and pixels). Necessary (technical) cookies, without which the website cannot operate properly, are used without consent under Section 89(3) of Act No. 127/2005 Coll., on Electronic Communications.
  2. Analytics, statistical and marketing cookies and third-party tools (in particular Google, Meta/Facebook, Microsoft and Hotjar) are used only on the basis of your prior demonstrable consent given via the cookie bar, under Section 89(3) of Act No. 127/2005 Coll. in conjunction with Art. 6(1)(a) GDPR.
  3. We measure website traffic with Matomo, which we run ourselves on our own server in the EU (data centre in Germany). We do not share this data with any other company except the server provider. Without your consent, Matomo stores no cookies on your device, shortens your IP address (removes the last 16 bits) and records only basic visit data: pages visited, where you came from, device and browser type, approximate location based on the shortened IP address and, for a completed order, its number and amount. The legal basis is the controllers’ legitimate interest in measuring traffic and improving the website under Art. 6(1)(f) GDPR. If you consent to analytics cookies, Matomo also stores the cookies _pk_id (13 months), _pk_ses (30 minutes) and _pk_ref (6 months) to recognise repeat visits. Records of individual visits are deleted after 180 days; only aggregated statistics are kept. You can object to this measurement at any time by e-mail to the address in Art. I.
  4. You can withdraw or change your consent at any time in the cookie settings on the website. Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.
  5. Some of these tools may transfer data to third countries; information on transfers and safeguards is provided in Art. V.

 

VIII.

CCTV

 

  1. The premises where events take place (ArtLab Prague, ArtLab Brno, ArtHub) may be monitored by a CCTV system with video recording operated by the controller ArtMoment s.r.o. to protect property, prevent damage and ensure the safety of persons.
  2. Cameras are placed in common and working areas; they are not installed in areas intended for private purposes, in particular toilets and changing areas.
  3. The legal basis for processing is the controller’s legitimate interest in protecting property and persons under Art. 6(1)(f) GDPR. Before monitoring began, a proportionality (balancing) test was carried out taking into account the rights and freedoms of the persons concerned.
  4. Recordings are kept for no longer than 30 days, unless longer retention is necessary in a specific case (in particular when dealing with an incident). Only authorised persons bound by confidentiality have access to the recordings.
  5. Areas monitored by CCTV are marked with a visible notice on the processing of personal data. The rights of data subjects in relation to this processing, including the right to object under Art. 21 GDPR, are set out in Art. IX of these conditions.

 

IX.

Your Rights

 

  1. Under the conditions set out in the GDPR, you have
    1. the right of access to your personal data under Art. 15 GDPR,
    2. the right to rectification of personal data under Art. 16 GDPR or, where applicable, restriction of processing under Art. 18 GDPR,
    3. the right to erasure of personal data under Art. 17 GDPR,
    4. the right to object to processing under Art. 21 GDPR,
    5. the right to data portability under Art. 20 GDPR, and
    6. the right to withdraw your consent to processing in writing or electronically to the address or e-mail of the controllers given in Art. I of these conditions. Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.
  2. You also have the right to lodge a complaint with the Office for Personal Data Protection (Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz) if you believe that your right to the protection of personal data has been infringed, or to turn to a court.

 

X.

Security of Personal Data

 

  1. The controllers declare that they have adopted all appropriate technical and organisational measures to secure personal data.
  2. The controllers have adopted technical measures to secure data repositories and repositories of personal data in paper form, in particular antivirus programs, data encryption, regular backups, locked document storage, and password-protected work computers and programs.
  3. The controllers declare that only persons authorised by them have access to personal data.

 

XI.

Final Provisions

 

  1. By submitting an order via the online order form, you confirm that you have read the personal data protection conditions and accept them in full.
  2. You agree to these conditions by ticking the consent box in the online form. By ticking it, you confirm that you have read the personal data protection conditions and accept them in full.
  3. The controllers are entitled to amend these conditions. They will publish the new version of the personal data protection conditions on their website together with the date from which it is effective.
  4. These conditions are a translation of the Czech version; in case of any discrepancy, the Czech version prevails.

 

These conditions take effect on 15 October 2026.

Subscribe to newsletter