Privacy policy

Controller Contact Details:

Name: ARCHA+ o.p.s.

Registered office: Na Poříčí 1047/26, Praha 1, 110 00

Phone: +420 734 622 897

E-mail: gdpr@archa-plus.cz

Website: www.archa-plus.cz

("ARCHA+" or "Controller")

1 Introductory Provisions

1.1 These Privacy Policy principles ("Policy") relate to the processing of personal data of visitors to ARCHA+ and users of our website www.archa-plus.cz. We have created them to inform you about the manner in which we collect, use, and protect your personal data during the operation of ARCHA+.

1.2 You acknowledge that visiting ARCHA+, as well as our website, may involve the use of your personal data by the Controller. With regard to protecting your privacy and security, we hereby assure you that your data will never be processed differently or for purposes other than those stated in this Policy, and every processing activity will always strictly comply with high protection standards under applicable legal regulations.

2 Sources of Personal Data

2.1 We process your personal data to the extent that you provide it to us in connection with your activity on our website or in connection with using our services. In justified cases, we also obtain personal data from publicly accessible registries, lists, and records.

2.2 In some cases, we need to use a third-party service for our operations. In such cases, we also obtain personal data from this third party through a specific linked service. We undertake that the collection of your personal data through third-party services will never occur without your knowledge.

3 What Data We Process

3.1 In order to ensure the proper provision of our services, we process your personal data. We also process personal data in situations where you do not yet use our services but are interested in them. For these purposes, we process specifically the following categories of personal data:

  1. name, surname;

  2. contact and/or delivery address, e-mail, phone number;

  3. details about provided services;

  4. photographs, visual recordings;

  5. payment data.

3.2 In addition to the above, we also store information regarding how you use our website. We process your MAC address, IP address (when using a browser), and operating system. At the same time, we use cookies.

4 Purpose and Scope of Processing

Performance of a Contract

4.1 We process your personal data primarily for the purpose of performing the contract you have concluded with us or in connection with taking steps necessary prior to entering into such a contract. In this context, we may process your personal data, for example, to make a reservation and purchase tickets, to organize performances, handle complaints, etc. The legal basis for processing in such cases is Art. 6(1)(b) of the GDPR. For these purposes, we process mainly the following data:

  1. name, surname;

  2. contact and/or delivery address, e-mail, phone number;

  3. details about provided services;

  4. payment data.

4.2 We must process these personal data; otherwise, the performance of the contract between you and ARCHA+ would become impossible for us. However, we process personal data only to the minimum extent necessary and exclusively for the duration of the relevant contractual relationship. In justified cases, the retention period of personal data may exceed the duration of the contractual relationship, particularly for the purpose of asserting our legal claims arising from already terminated contracts. ARCHA+ undertakes that the processing period of personal data in this case will never exceed the statutory limitation period of 10 years.

Legitimate Interest

4.3 Furthermore, we process your personal data for the purpose of protecting and asserting our legitimate interests. In this context, we may process your personal data for audio-visual documentation of our performances and presentation on the website and social media networks of ARCHA+, as well as for purposes related to optimizing and improving the quality of our services and website, sending non-personalized commercial communications, and ensuring security and the protection of health and property, e.g., in the form of CCTV footage from ARCHA+ premises. The legal basis for processing in such cases is Art. 6(1)(f) of the GDPR. For these purposes, we process mainly the following personal data:

  1. name, surname;

  2. contact and/or delivery address, e-mail, phone number;

  3. details about provided services;

  4. photographs, visual recordings;

  5. payment data;

  6. IP address;

  7. MAC address;

  8. functional (or technical) cookies;

  9. type of operating system of your device.

4.4 The processing of the personal data concerned for these purposes is based on our legitimate interests, except where such interests are overridden by your interests or fundamental rights and freedoms. We process the personal data concerned for a period proportionate to the duration of our legitimate interest. ARCHA+ undertakes that the processing period of personal data in this case will never exceed 10 years.

Compliance with Legal Obligations

4.5 ARCHA+ has an obligation to comply with the legal framework of the Czech Republic, in particular laws governing the billing of our services, accounting, and tax record-keeping. The legal basis for processing in such cases is Art. 6(1)(c) of the GDPR. Providing your personal data is therefore a legal requirement in these cases. Failure to provide the required personal data on your part may be penalized under applicable legal regulations. For these purposes, we process mainly the following personal data:

  1. name, surname;

  2. contact and/or delivery address, e-mail, phone number;

  3. details about provided services;

  4. payment data;

  5. IP address;

  6. MAC address;

  7. type of operating system of your device.

4.6 ARCHA+ also has an obligation to transmit your personal data to relevant public administration authorities, either in fulfillment of a legal obligation or upon request. The transfer of personal data in such cases takes place only within the framework established by the relevant legal regulation or decision of the given authority. For the specified purposes, we process personal data for the period set by applicable legal regulations.

Consent to Processing

4.7 Lastly, we process your personal data for the purpose of providing some of our services based on your consent. The legal basis for processing in such cases is Art. 6(1)(a) of the GDPR. In this context, we may process your personal data for the purposes stated in the specific consent you grant us, particularly for sending and distributing personalized commercial communications and for use in marketing and promotional materials in print and electronic form, including our website and social networks. For these purposes, we process mainly the following personal data:

  1. name, surname;

  2. contact and/or delivery address, e-mail, phone number;

  3. details about provided services;

  4. photographs, visual recordings;

  5. functional (or technical) cookies;

  6. analytical and marketing cookies;

  7. IP address;

  8. MAC address;

  9. type of operating system of your device.

4.8 For the specified purposes, we process personal data until you withdraw your consent, for a maximum period of 1 or 3 years from the date it was granted.

5 Personal Data Security

5.1 The processing of your personal data is carried out on the premises of ARCHA+, or by our processors on their premises through individual authorized employees of the processor who are bound by a sufficient obligation of confidentiality. Processing occurs both electronically, i.e., via computing technology, and in hard copy, i.e., manually, adhering to all security principles.

5.2 All personal data you provide to the Controller is secured using standard procedures and technologies, with all data transmissions being encrypted. We have implemented strictly monitored data management processes to detect security breaches, both on the side of our suppliers and our employees. Despite our maximum effort and preventive mechanisms, our security measures may potentially be breached. In such a case, we undertake to proceed as quickly and effectively as possible so that any interference with your right to privacy is minimized and the consequences are remedied as soon as possible, as required by relevant legal regulations.

6 Recipients of Personal Data

6.1 In addition to employees and executive staff of ARCHA+, third parties may also be recipients of your personal data. ARCHA+ carefully selects its business partners to whom it entrusts data subject data, ensuring they are capable of providing technical and organizational security for your personal data at the highest level.

6.2 Third parties that may have access to your personal data include:

  1. entities providing technical operation of a specific service for us or operators of technologies we use for our services, in particular the ticketing system operator GoOut.cz and the registration forms operator Google Forms;

  2. entities ensuring sufficient security and integrity of our services and websites for us and regularly testing this security;

  3. postal, communication, and electronic communication service providers;

  4. payment service providers and payment processors for the purpose of securing and implementing payment transactions;

  5. business partners or sponsors involved in organizing our performances, concerts, events, conferences, seminars, etc.;

  6. entities providing debt collection services for ARCHA+.

6.3 Under certain, precisely defined conditions, ARCHA+ is obliged to transfer certain personal data of data subjects based on applicable legal regulations, e.g., to the Police of the Czech Republic, the Financial Office, the Office for Personal Data Protection, and other public authorities.

7 Transfer of Personal Data to Third Countries

7.1 ARCHA+ does not intend to transfer personal data of data subjects to a third country. If personal data of data subjects is transferred to third countries outside the EU, it will be done in compliance with legislative requirements, and the protection of the data subjects' personal data will be secured in every case. ARCHA+ undertakes to inform you without undue delay of any such transfer.

8 Rights of Data Subjects

8.1 In connection with personal data processing, data subjects may exercise the following rights:

  1. the right to request access to your personal data from ARCHA+;

  2. the right to request information from ARCHA+ regarding the processing of your personal data, the purpose of processing, scope of processing, and categories of personal data subject to processing;

  3. the right to rectification of your personal data;

  4. the right to completion of incomplete personal data;

  5. the right to restriction of processing in cases provided by legal regulations;

  6. the right to erasure of your personal data;

  7. the right to data portability;

  8. the right to request information from ARCHA+ regarding the transfer of your personal data to third parties (information on processors and recipients of personal data);

  9. the right to contact the relevant supervisory authority, which is the Office for Personal Data Protection located at Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz;

  10. the right to object to processing in cases provided by the GDPR.

8.2 If you believe that ARCHA+ is processing personal data in violation of your right to privacy or personal life, you may request an explanation and remedy from ARCHA+.

9 Final Provisions

9.1 We reserve the right to amend this Policy if necessary, particularly in light of developments in national legal regulations, decision-making practice of the Office for Personal Data Protection, and other recommendations and opinions of other authorities whose outputs concern personal data protection. We recommend reviewing this Policy regularly to stay informed about how we help protect your personal data that we process.

9.2 In case of any questions regarding personal data protection or the withdrawal of consent to further processing of your personal data, you can contact us using the contact details provided above.

9.3 This Policy is effective from March 1, 2025.