Personal Data Processing Policy
Kontrapunkt, z.ú. is a non-profit organisation focused on organising cultural and community events in Hradec Králové and the surrounding area. We consider the protection and confidentiality of all personal data we come into contact with to be important. We process personal data in accordance with applicable legislation and only to the minimum necessary extent, with the aim of effectively ensuring our activities.
The purpose of this document is to inform data subjects about the principles governing the processing of their personal data.
This document has been effective since 1 May 2018. The controller is entitled to update it whenever necessary.
Data Controller
The data controller within the meaning of this document is kontrapunkt, z.ú., with its registered office at třída Karla IV. 714/5, 500 02 Hradec Králové, Company ID: 269 98 939.
Controller contact details: Karla Hynka Máchy 733, 500 02 Hradec Králové, barbora@kontrapunkt.cz.
Controller activities: The controller organises or co-organises the following events and festivals: Festival Regiony (June), Jazz Goes To Town / Jazz jde městem (October), Galerie Podchod / Walk Thru Gallery / WTG (year-round), and the Hradec Králové Architectural Manual (KAM).
Definitions
Personal data means any information relating to an identified or identifiable natural person (the data subject). An identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. Personal data includes, for example, an email address or mobile phone number. Information about purchase preferences may also be personal data if combined with a surname.
The data subject is the natural person whose personal data is processed pursuant to this document.
A processor is a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller.
The purpose of processing is the reason why the controller processes personal data. The purpose is always specific, explicitly stated, and legitimate.
The scope of processing means the definition of the specific personal data being processed, for example name and surname.
The controller’s legitimate interests include, in particular, the presentation and promotion of the controller and its activities, ensuring the operation and functioning of the controller and its activities, including financing, which also requires retaining records for grant settlements, accounting, and similar purposes; and compliance with obligations laid down by applicable legal regulations.
Purposes of Personal Data Processing
Sending newsletters
If the data subject gives the controller consent to send newsletters, their personal data will be processed on the basis of the data subject’s request, i.e. granted consent, or on the basis of the controller’s legitimate interest. The data subject is included in a direct marketing database. The data subject may withdraw consent at any time.
This purpose consists in sending newsletters (emails) containing information about the controller’s activities, including upcoming events and commercial communications.
For the purpose of sending newsletters, personal data is processed to the following extent: name, surname, and email address, for an indefinite period, but no longer than until the consent is withdrawn by the data subject or valid objections to such processing are raised.
For sending newsletters, the controller uses the online service ecomail.cz. In relation to the controller, this service acts as a personal data processor and carries out its activities in accordance with its own personal data processing policy.
Application of a theatre performance to the Festival Regiony programme
The data subject’s personal data is processed in connection with applications to the Festival Regiony programme if the submitted theatre performance is not selected. If the performance is selected, the data subject’s personal data is subsequently processed according to the rules for accreditation.
The purpose of this processing is to include the applicant and the submitted theatre performance in a database from which performances are selected for inclusion in the Festival Regiony programme.
The legal basis for this purpose (until the Festival Regiony programme is finalised) is the data subject’s consent. For archiving purposes, the controller’s legitimate interests also apply, unless this purpose is covered by a contract concluded between the data subject and the controller (if the submitted performance is not selected). The data subject may withdraw consent at any time.
For the purpose of submitting a theatre performance to Festival Regiony, personal data is processed electronically for five years to the following extent:
- details of the applicant (if the applicant is a natural person): name, surname, date of birth, residence, bank account number, email address, telephone number;
- contact person authorised to act on behalf of the applicant in matters related to participation in the festival: name, surname, email address, telephone number.
When Providing Personal Data Is a Legal or Contractual Requirement
If the controller processes personal data for the purpose of preparing, concluding, and performing a contract, the data subject is obliged to provide such data. Without it, it is impossible to conclude and perform contracts between the data subject and the controller.
If data that is contractually required is provided and the relevant consent is subsequently withdrawn, the controller will cease all related processing activities.
Personal data is processed to the following extent: email, name, surname, permanent residence, date of birth, bank account number.
Processors
The data subject acknowledges that the controller uses processors to fulfil the relevant purposes. Processors have access to the personal data of data subjects to the extent necessary to perform the tasks assigned to them by the controller.
These processors fall into the following categories: persons providing accounting and legal services, and persons engaged in internet marketing and the controller’s online presentation.
Withdrawal of Consent, Objections
The controller’s contact details listed above may be used by the data subject to withdraw consent to the processing of personal data or to submit objections. Objections may be submitted against personal data processing, against direct marketing, and against processing based on the controller’s legitimate interests.
The controller will respond to every request without undue delay, no later than within 14 days.
Information on the Rights of the Data Subject
The data subject has the right to be informed about the processing of their personal data. This includes, in particular, information about the purpose of processing, the identity of the controller, its legitimate interests, and similar matters.
Other rights of the data subject include the right of access to personal data, the right to rectification or completion, the right to erasure, the right to restriction of processing, the right to data portability, the right to object, and the right not to be subject to automated individual decision-making, including profiling.
Security of Personal Data
All personal data processed electronically is stored on data storage services provided by Google Inc.
Personal data processed in physical (paper) form is stored at the premises of EKUS HK, s.r.o., Company ID 05140951, Velké nám. 32/40, 500 03 Hradec Králové, which provides accounting services for the controller.
Personal and Other Data of Event Visitors
Visitors and audiences attending events organised by the controller acknowledge that photography and filming take place during such events. They agree that their likeness may be captured in a way that allows identification. They also grant consent for the controller to use the event documentation for the promotion of the controller and its activities (licence). The licence is granted free of charge, without limitation in time, scope, or territory, for all types of use, both independently and in combination with copyrighted works or artistic performances of third parties. The controller is entitled to provide the licence to third parties. If visitors or audiences do not agree with the publication of materials depicting their likeness, they are entitled to contact the controller via press@festivalregiony.cz.
In connection with the sale, ticket validation, and other handling of tickets for events organised by the controller, the controller does not process personal data. Personal data related to the purchase and sale of tickets for such events is processed exclusively by the service provider, Perfect System, s.r.o., in accordance with its own personal data processing policy.