Personal data and privacy protection

Content

Information on the processing of personal data
Rules on the use of "cookies"
Privacy policy for marketing activities
General data protection rules

Valid from 01.01.2022

Information on the processing of personal data

Information on the processing of personal data

Personal data is processed by Ticketportal SK, s.r.o., Kalinčiakova 33, 831 04 Bratislava, ID No.: 35 850 698, registered in the Commercial Register of the District Court Bratislava I, Section Sro, Insert No. 28073/B (hereinafter referred to as the "Company"), which may have the status of a controller (if it processes personal data for itself, e.g. for the purpose of operating the data subject's account on the website www.ticketportal.sk) or an intermediary (if it processes personal data for another person in the capacity of a controller, usually an event organizer for whom it provides ticket sales or performs other obligations towards the data subject).

Any questions can be sent to zodpovednaosoba@ticketportal.sk. The above address is also the contact for the Company's responsible person, if one has been appointed.

The legal basis for the processing of personal data is (i) the fulfilment of the Company's legal obligations under Article 13 of the General Data Protection Regulation and Section 19 of the Data Protection Act, (ii) the Company's legitimate interest in the protection of its rights and legitimate interests under contracts with data subjects or in administrative or judicial proceedings relating to such processing of personal data or legal claims arising therefrom, and (iii) the consent of the data subject, if required by law.

The Company processes personal data for the purpose of (i) fulfilling contractual obligations relating to the booking, sale and distribution of tickets for mass events and other events, as well as controlling access to events in the case of personalised tickets, and (ii) marketing purposes with the processing of personal data, typically sending newsletters, offers, promotions and customer surveys.

The provision of personal data is not a legal requirement. The data subject is under no obligation to provide personal data. If the data subject fails to provide personal data, the Company is entitled to terminate the contract it has entered into with the data subject on its own behalf or on behalf of a third party, or if it is objectively unable to fulfil some of its obligations under the contract for which personal data is required, or to refuse to perform it (e.g. information on changes and cancellations of mass events, in the case of personalised tickets, refusal of entry to an event, etc.).

The company will process personal data for the duration of the contractual relationship with the data subject. Where personal data is processed on the basis of consent, the Company will process it for a period of thirty-six (36) months from the date of its provision or until the consent is withdrawn or an objection is lodged. If the data subject has provided the Company with consent to the processing of personal data, he or she may withdraw it by sending it to zodpovednaosoba@ticketportal.sk.

The data protection regulations grant the data subject the rights of a so-called data subject. The rights and basic principles of personal data processing are set out in the Company's General Terms and Conditions published on the Company's website www.ticketportal.sk and other rules and conditions of personal data processing and privacy protection adopted by the Company and published on its website.

The data subject has the right to object to the processing of personal data directly with the Company. He or she may send an e-mail to zodpovednaosoba@ticketportal.sk.

The data subject has the right to file a petition with the Office for Personal Data Protection of the Slovak Republic (https://dataprotection.gov.sk).

The data subject also has the right of access to his/her personal data, the right to rectification or erasure of personal data and restriction of their processing, and the right to data portability.

The Company does not use automated individual decision-making or profiling.

The Company may disclose the personal data of the data subject to business partners and third parties through whom it processes them in the context of ensuring the performance and exercise of its contractual and legal obligations and rights (so-called recipients and processors). As a rule, the recipients of personal data are the employees and external collaborators of the Company who ensure their processing. We may also disclose personal data to our legal advisors.

Rules on the use of "cookies"

Rules on the use of "cookies"

• Operator

The controller is the person who processes the personal data of the data subject (you). The controller is Ticketportal SK, s.r.o., with registered office at Kalinčiakova 33, 831 04 Bratislava, ID No.: 35 850 698, registered in the Commercial Register of the District Court Bratislava I, Section Sa, Insert No. 28073/B (hereinafter referred to as "Ticketportal"). If you have any questions, you can contact us by e-mail at zodpovednaosoba@ticketportal.sk.

These rules were created to clarify the protection of personal data and to strengthen transparency in the processing of personal data. This policy will be updated regularly and published on Ticketportal's websites. The rules come into force on 01.01.2022.

• What are "cookies"

"Cookies" are small text files that our websites (servers) send to your internet browser (e.g. Google Chrome, Safari, Mozilla Firefox, Opera, Edge, Internet Explorer) and that your internet browser stores on your device (e.g. computer, phone or tablet).

Thanks to these files, we can identify you and offer you information and marketing content designed specifically for you each time you visit, making your stay on our website more enjoyable. We cannot usually identify you exactly on the basis of "cookies". In the event that we can identify you while you are using our online services or website, this will be the processing of personal data in accordance with our Privacy Policy for Marketing Activities https://www.ticketportal.sk/Article/18230 and the terms and conditions of the relevant service you are using. The legal basis for such processing of personal data is (i) your consent as a data subject and (ii) in the case of activity tracking and evaluation, our legitimate interest, which is to offer you the best possible service setup or support when using our services and sites.

Cookies are small and take up minimal space on your device.

• What "cookies" we use

Depending on the type of "cookies" and the settings of your internet browser, they can be permanent or temporary (for as long as your internet browser is running or for the period of time specified in its settings). Persistent "cookies" help to identify your device when you visit our website and allow us to prevent you from seeing the same content repeatedly. Temporary "cookies" are automatically deleted when you close your browser and allow us to store some information to make your stay on our website more pleasant (e.g. you will not have to re-enter some data in forms). You can always delete cookies, regardless of whether they are permanent or temporary.

We use the following types of "cookies" on our website:

(a)          Basic cookies: these are essential for the operation of our website and may be used to authenticate users, to prevent fraud and unauthorised access to user accounts of our online services or to offer various functionalities.

(b)          Functional/operational "cookies": we use them to get to know you on repeat visits. They allow us to personalise the content that our website shows you and remember your preferences (e.g. language choices, etc.).

(c)          Analytical "cookies": we use them to recognise visitors to our website, count their numbers and identify how visitors use our website and which sections of it they visit. They allow us to improve our site and your impressions and experience of it.

(d)          Advertising "cookies": we use these "cookies" to record your visits to our website, other sites and the links you click on. We use the information we obtain in this way to tailor our website to your interests. We may also share this information with third parties, such as social network operators.

In addition to our own cookies, we may also use cookies from third parties, which we need and use mainly for statistical surveys about the use of our website, to obtain marketing-relevant information, to make content available from other sites (e.g. YouTube videos), and to make our marketing activities more effective (tracking cookies, optimisation cookies and affiliate cookies). Third-party "cookies" are created and subsequently used by service providers such as Google Analytics, Google AdSense, Facebook, Strossle, etc. The rules for the use of these "cookies" can be found on the websites of these partners.

We can also use so-called measurement pixels (or web beacons). These are small images placed on a web page that are not "cookies" but can be used to obtain certain information from your device. We usually use them to test our website, to find out where a visitor is on the site, whether they have opened a message that has been sent to them, and to supplement the information from "cookies" when displaying advertising and content.

• How we use "cookies"

When you visit one of our websites, we store one or more "cookies" on your device. In particular, we use "cookies" so that we can identify and identify repeat visitors, authenticate registered users, recognise the type of content you are viewing, other websites from which you have visited us, the length of your visit to different sections of our website and the functionality you have used on our website.

Based on the information from the cookies, we can identify you in certain circumstances and associate your cookie data with you as a specific person. In view of this, we will only collect this cookie information and process the personal data thus obtained on the basis of your consent. You consent to the use of "cookies" and the relevant settings when you first visit our website.  Depending on your browser settings, we may ask for this consent repeatedly each time you visit. Your consent is always voluntary and unconditional, so even if you do not provide it, you can still visit and use our website and online services and products to the extent that "cookies" are not necessary for their functionality and accessibility. If you disable or restrict the use of "cookies", this may therefore affect the functionality and accessibility of our website and services and may result in all or part of our services not being fully functional or accessible to you.

• Consent to the use of "cookies"

We only use "cookies" that are not essential or functional if you agree to this. Your consent and the extent of your consent is given to us when you first visit our website and, depending on your browser settings, each time after a set period of time has elapsed or each time it is re-launched. In addition, you can delete cookies from your device after you have given your consent, either via your internet browser or directly from the relevant directory on your device.

You can set the management of cookies and the corresponding permissions in each internet browser. You can find instructions on how to adjust the settings for cookies and procedures for deleting them in the most commonly used internet browsers on the websites of the manufacturers of these browsers.

Please note that if you delete or do not allow cookies, our website may not display or offer you some parts or functionalities and some pages may not display properly or may be inaccessible.

Privacy policy for marketing activities

Privacy policy for marketing activities

1             Operator

1.1         The controller is the person who processes the personal data of the data subject (you). The controller is Ticketportal SK, s.r.o., with registered office at Kalinčiakova 33, 831 04 Bratislava, ID No.: 35 850 698, registered in the Commercial Register of the District Court Bratislava I, Section Sa, Insert No. 28073/B (hereinafter referred to as "Ticketportal").

1.2         If you have any questions, you can contact us by email at zodpovednaosoba@ticketportal.sk.

2             Person concerned

2.1         A data subject is any natural person whose personal data is processed by Ticketportal.

3             Personal data

3.1         Personal data are any data on the basis of which the data subject is identified or identifiable. The scope of your personal data that Ticketportal processes depends on the purpose for which the personal data is processed.

3.2         If your personal data is processed for marketing purposes, Ticketportal will process your first name, last name, email and telephone number, and in some cases your home address. Occasionally, we may also ask you for your gender and age for the purposes of compiling statistical marketing data, in which case this data will be completely anonymised and separated from your identifying data.

3.3         We do not process special categories of personal data which are particularly sensitive (data revealing racial or ethnic origin (thus nationality, data revealing political opinions, data revealing religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health and data concerning sex life or sexual orientation cannot be processed).

4             Sources of personal data

4.1         Ticketportal usually obtains your personal data directly from you. The personal data (i) is primarily set out on the contracts we have entered into with you, or (ii) you have filled in a form on the Website, or (iii) you have sent or provided it to us in correspondence or communication (in person, by telephone or through various applications or interfaces), or (iv) we have derived it from other data you have provided to us.

5             Purpose of the processing of personal data

5.1         Ticketportal processes your personal data for the following marketing purposes:

(a)          sending newsletters of a commercial and non-commercial nature by electronic mail, which may contain promotional and other offers, links to articles of interest from Ticketportal's website or other information

(b)          sending written reports, information, offers and catalogues,

(c)          contacting you by telephone with commercial or other offers or non-commercial information or questions,

(d)          contacting via SMS,

(e)          consumer competitions,

(f)          satisfaction surveys and other customer surveys,

(g)          registration of personal data in Ticketportal's information systems.

6             Legal bases for processing personal data

6.1         We process your personal data on one of the following legal bases:

(a)          The data subject's consent to the processing of personal data for one or more specific purposes. We process your personal data on the basis of your consent, which you have provided to us either directly in the contract, or via a form on our website, by telephone or other reliable means (e.g. letter or email). The consent you have provided to us for marketing purposes is voluntary and providing it is not a contractual or legal requirement. Ticketportal cannot make contractual performance conditional on the granting of this consent.

(b)          A legitimate interest of Ticketportal or a third party, unless that interest is overridden by the interests or rights of the data subject requiring the protection of his or her personal data. You will always be informed of the legitimate interest. The processing of personal data for marketing purposes may also be based on Ticketportal's legitimate interest in providing you with the best possible products and services and the related improvement of Ticketportal's economic position and results.

7             Withdrawal of consent

7.1         If consent is the legal basis for the processing of your personal data, you may withdraw it at any time (i) by email to zodpovednaosoba@ticketportal.sk, (ii) via a link in the message, or (iii) in the interface of the online service you are using that enables this functionality. Withdrawal of consent does not affect the lawfulness of the processing of personal data based on consent prior to its withdrawal. If you withdraw consent, we will immediately stop processing your personal data and delete it.

7.2         If Ticketportal processes your personal data on a legal basis other than your consent, the withdrawal of consent does not extinguish Ticketportal's right to process your personal data on other legal bases.

8             Right to object and right to bring a data protection action

8.1         You have the right to object to the processing of your personal data directly to Ticketportal by email at zodpovednaosoba@ticketportal.sk.

8.2         In addition to the right to file objections, you also have the right to file a petition to initiate a personal data protection proceeding before the Office for Personal Data Protection of the Slovak Republic.

9             Recipients of personal data

9.1         Ticketportal processes your personal data primarily for its own purposes. In addition, we may share your personal data with our business partners through whom we process your personal data. These are trusted parties (so-called recipients and processors) who provide us with the development, maintenance and operation of software solutions and other services through which we process your personal data or provide us with services (e.g. economic, legal, auditing and marketing services).

9.2         List of partners who may process your personal data and recipients of personal data:

In the table that follows the text above, you are missing a company among the partners:

Packeta Slovakia s.r.o., with registered office at Kopčianska 3338/82A, 851 01 Bratislava - Petržalka, ID No.: 31329217, registered in the Commercial Register of the District Court Bratislava I., Section Sro, Entry No. 105158/B.

which, as a courier service provider, processes the personal data of your customers for the purpose of delivering paper printed tickets for events.

We recommend that you add the following to the terms and conditions in accordance with the applicable legislation and certification rules:

    bank account number in IBAN format,

    the method of further communication with consumers after the order has been placed (e.g. electronically via e-mail),
After sending the order, your order will be processed and Ticketportal SK, s.r.o. will deliver to your e-mail a confirmation of receipt of the order.  If necessary, any further information regarding your order will be sent to the e-mail address provided by you.

Confirmation email

Please also modify and update the General Terms and Conditions sent as an attachment to the confirmation email in PDF format according to the above instructions to make them identical to the terms and conditions on your online shop page.

9.3         In addition, the recipients of your personal data are our employees. With your consent, we may also provide your personal data to third parties who will process your personal data for their marketing needs.

10          Transfer of personal data to third countries

10.1       We process your personal data primarily within the European Union and the European Economic Area. However, as noted above, your personal data is also transferred to the United States of America, where the United States of America has the status of a third country that does not ensure an adequate level of protection of personal data.

10.2       However, in these cases, the cross-border transfers and processing of your personal data are secured by the Privacy Shield certification system, which was created by the U.S. Department of Commerce, the European Commission, and the Swiss government to provide entities in the European Economic Area and the United States with the means to comply with the requirements for the protection of personal data when transferring it from a member state of the European Economic Area to the United States, and for the purposes of promoting transatlantic trade. This system, as decided by the European Commission, ensures adequate protection of personal data. You can find out more about this system on its website. Please note that based on the European Court of Justice Decision No. 2016/1250, the Privacy Shield certification system does not provide sufficient protection for personal data. However, this decision does not mean that Privacy Shield has ceased to exist, and its participants are still bound by its obligations.

10.3       In addition, MailChimp and Office 365 service providers have updated their terms and conditions and contracts to ensure that the personal data they process and transfer is protected in accordance with European regulations. Microsoft Corporation's standard contractual clauses comply with the relevant European Commission decisions.

11          Period of processing of personal data

11.1       The duration of the processing of your personal data depends on the legal basis for its processing. It may be determined directly by law or it may be specified in a contract we have entered into with you or in a consent you have provided to us.

11.2       If the processing period is not directly specified in the law or contract, we will normally process personal data (i) for a period of 24 months from the start of processing or (ii) for the duration of the limitation period if the legal basis is our legitimate interest (e.g. in the case of a legal claim).

11.3       We will delete your personal data after the expiry of this period, the termination of the reason for processing your personal data or the withdrawal of your consent (unless we are processing your personal data on a legal basis other than consent). Before the expiry of this period, we may ask you to extend your consent for a further 24 months.

12          Method of processing personal data

12.1       Ticketportal primarily processes your personal data electronically through automated information systems operated by Ticketportal itself or through its business partners. We may also process your personal data in paper form (e.g. contracts, accounting and tax documents, written correspondence) in systematically organised records.

13          Rights of the data subject

(a)          RIGHT TO OBJECT: You have the right to object to the processing of your personal data. You can object if your personal data is processed for the performance of a task carried out in the public interest or in the legitimate interest of Ticketportal or for direct marketing purposes. Your objection will be justified and successful if your legitimate grounds outweigh Ticketportal's legitimate grounds or if the processing of your personal data is for direct marketing purposes (in which case the objection is treated as a withdrawal of your consent). You cannot object if the processing is necessary for (i) the performance of a task for reasons of public interest or (ii) scientific or statistical purposes or historical research purposes. If your objection is justified and successful, we will not process your personal data further.

(b)          RIGHT TO INFORMATION: You have the right to be informed about whether we are processing your personal data, the extent to which we are processing your personal data, and to be informed about a breach of your personal data protection.

(c)          RIGHT OF ACCESS TO PERSONAL DATA: You have the right to be issued with a confirmation that we are processing your personal data, what personal data we are processing and a copy of that personal data. We will provide you with this confirmation by email unless you ask us to do otherwise. We may refuse to provide you with this confirmation if it would adversely affect the rights of other individuals.

(d)          RIGHT TO CORRECTION: If the personal data we process about you is incorrect or incomplete, you have the right to have it corrected or completed. If you use one of the online services where you manage your personal data, you can exercise your right to rectification directly by making a correction in the interface of that online service.

(e)          RIGHT TO DELETION/RIGHT TO CLEARANCE: You have the right to have your personal data erased when the processing of your personal data has been terminated (withdrawal of consent, successful objection, expiry of the time limit, etc.) or when it has been processed in breach of the law, in which case Ticketportal will erase your personal data without delay. You may also request the erasure of your personal data. Erasure is always final. The right to erasure cannot be exercised if the personal data is necessary, for example, to exercise the right to freedom of expression and the right to information, to comply with a legal obligation, to perform a task carried out in the public interest, for reasons of public interest in the field of public health, for archiving, scientific or statistical purposes or for the purpose of historical research or to assert legal claims.

(f)          RIGHT TO LIMIT PROCESSING: If you object to the accuracy of your personal data, Ticketportal will limit the processing of your personal data for the duration of the verification of its accuracy. If your personal data is processed unlawfully and you do not request its erasure, we will restrict its processing to the extent that you request, otherwise only to archiving it. If your personal data are processed for the performance of a task of public interest or on the basis of a legitimate interest of Ticketportal, their processing will be limited to the period of verification that the legitimate grounds for processing outweigh the legitimate grounds of the data subject. You can also ask us to restrict the processing of your personal data. We will inform you by e-mail about the beginning and the end of the restriction of the processing of your personal data.

(g)          RIGHT TO TRANSPARENCY: Where (i) it is technically feasible, (ii) the processing of your personal data is based on your consent or for the performance of a contract, (iii) and not for the performance of a task carried out in the public interest, (iv) the processing is carried out by automated means, and (v) the transfer of your personal data does not adversely affect the rights of others, you have the right to have your personal data processed in a structured, commonly used and machine-readable format (e.g. .xml). For personal data processed in this way, you have the right to request its transfer to another controller.

(h)          RIGHT TO REFUSE AUTOMATED INDIVIDUAL DECISION-MAKING AND PROFILING: You have the right to refuse a decision that is based on automated processing of personal data and profiling if it has legal effects or significantly affects the data subject. The right cannot be exercised if such a decision is necessary for the conclusion or performance of a contract or is made pursuant to a legal provision or on the basis of the data subject's consent. Any decision based on automated processing of personal data and profiling must be manually reviewable. The data subject shall be entitled to contest the decision in writing or to provide his or her views on it. Ticketportal does not currently use automated individual decision-making and profiling. However, it may send you offers that are specifically targeted to you based on the information and personal data we have collected from you.

14           Method of exercising rights and instructions

14.1       You can exercise your rights and requests by email to zodpovednaosoba@ticketportal.sk. If you deliver your request, objection, opinion or withdrawal of consent other than by letter with your signature, by email with a qualified electronic signature or in person, we may require you to provide additional credible verification of your identity or we may not be required to comply with your request. We may also not comply with your request in cases governed by law.

14.2       Your requests will be processed within one month of receipt at the latest. We may extend this period by a further two months, including repeatedly if justified and taking into account the complexity and number of requests. We will inform you of the extension of the deadline.

14.3       We will provide you with information, confirmations and notifications free of charge. In the case of repeated requests, or requests that are manifestly unfounded or unreasonable, we may require you to pay the administrative costs incurred in dealing with them, or we may refuse to deal with them.

14.4       If we contact you by telephone or you contact us directly, these telephone conversations will be recorded. You will be advised of this fact at the beginning of the telephone conversation. If you wish the conversation not to be recorded, please contact us by other means or request to be contacted by telephone from an unmonitored line.

15          Personal data processing principles

(a)          LAWFULNESS PRINCIPLE: We process personal data fairly, transparently and only on the basis of a lawful ground (consent of the data subject, performance of a contract, performance of a legal obligation, protection of the vital interests of the data subject or another natural person, performance of a task carried out in the public interest or in the exercise of official authority, legitimate interest of Ticketportal). We will not violate the rights of the data subject in the processing.

(b)          PURPOSE-BASED PRINCIPLE: We may only process personal data for a specific, specified, explicitly stated and legitimate purpose, otherwise only for archival, scientific or statistical purposes or for historical research purposes.

(c)          PRINCIPLE OF PERSONAL DATA MINIMISATION: We may only process personal data that we strictly need or that the law allows us to process. We will not process or request unnecessary personal data. It is also up to you to provide us with only the personal data that is strictly necessary for the purpose for which we will process it and not to provide us with unnecessary data (e.g. for communication with each other, etc.).

(d)          PRINCIPLE OF CORRECTNESS: We only process correct and up-to-date personal data. If the personal data processed by us is incorrect or incomplete, we will correct or complete it. We will delete incorrect personal data. The correctness of the personal data also depends on you, so it is essential that you always provide us with correct and complete personal data.

(e)          STORAGE MINIMISATION PRINCIPLE: We will only process personal data for as long as necessary to fulfil the purpose or as required by law. For longer periods, we will only process it for archiving, scientific or statistical purposes or for historical research purposes.

(f)          PRINCIPLE OF INTEGRITY AND CONFIDENTIALITY: We will protect personal information from loss, accidental deletion, damage, theft or destruction. We will ensure that personal data is not unlawfully processed. The security of personal data is important and we ensure it through standard appropriate technical and other measures.

(g)          PRINCIPLE OF LIABILITY: We are responsible for the security and protection of personal data to you and to the Office for Personal Data Protection of the Slovak Republic, which is entitled to review the processing of personal data in the context of a personal data protection procedure.

16          Processing of children's personal data

16.1       Personal data of children under the age of 16 may only be processed in specific and justified cases. If you are under 16 years of age and have given us your consent to process your personal data, this consent must also be given and confirmed by your legal representative. In this context, we may request your date of birth as one of the personal data for the purpose of verifying your age. If we process your personal data on a legal basis other than your consent, we may require confirmation and consent from your legal representative.

17          Other Information and Relationship to Other Ticketportal Terms and Conditions

17.1       These rules were created to clarify the protection of personal data and to strengthen transparency in the processing of personal data. This policy will be updated regularly and published on Ticketportal's websites. The rules come into force on 01.01.2022.

General data protection rules

General data protection rules

1          Operator

• The controller is the person who processes the personal data of the data subject (you). The controller is Ticketportal SK, s.r.o., with registered office at Kalinčiakova 33, 831 04 Bratislava, ID No.: 35 850 698, registered in the Commercial Register of the District Court Bratislava I, Section Sa, Insert No. 28073/B (hereinafter referred to as "Ticketportal").

• If you have any questions, you can contact us by email at zodpovednaosoba@ticketportal.sk.

2          Person concerned

• The data subject is any natural person whose personal data is processed by Ticketportal.

3          Personal data

• Personal data are any data on the basis of which the data subject is identified or identifiable. The scope of your personal data that Ticketportal processes depends on the purpose for which the personal data is processed.

• The different categories and types of personal data we process always depend on the purpose for which we process your personal data and the legal basis on which we process it. In particular, the personal data that we may request from you and that we will process include:

• identification data (first and last name, maiden name, titles before and after the name, date of birth, birth number, ID number, ID document, photographs, online identifiers, IP addresses, signatures),

• contact details (addresses / permanent residence, temporary residence, domicile, billing address, delivery address, e-mail address, telephone number, fax number),

• social identity data (marital status, number of children, children's names and surnames, gender, education data, job positions, job functions, trait data from job evaluations, family life and behavioural data),

• economic identity data (bank account numbers, tax, accounting, delivery and other document numbers, details of payments, debts and liabilities),

• consumer data (IP addresses, data on purchases and shopping preferences, data from cookies),

• location data

• other data on the legal identity of data subjects (data from contracts and other legal transactions, data on non-financial obligations, rights and entitlements, data on activities, actions and behaviour),

• data on criminal and misdemeanour activity (data relating to guilty pleas in the case of criminal offences and misdemeanours).

• We do not process special categories of personal data that are particularly sensitive (data revealing racial or ethnic origin (thus nationality cannot be processed, data revealing political opinions, data revealing religious or philosophical beliefs, trade union membership / only for the purpose of fulfilling legal obligations under the Labour Code, genetic data, biometric data, data relating to health and data relating to sex life or sexual orientation).

4          Sources of personal data

• Ticketportal usually obtains your personal data directly from you. The personal data (i) is primarily set out on the contracts we have entered into with you, or (ii) you have filled in a form on the Website, or (iii) you have sent or provided it to us in correspondence or communication (in person, by telephone or through various applications or interfaces), or (iv) we have derived it from other data you have provided to us.

5          Purpose of the processing of personal data

• Ticketportal processes your personal data for the purposes required by law, contract or consent given by you. Each purpose for which personal data is processed is always specified in the relevant governing document.

6          Legal basis for processing personal data

• We process your personal data on one of the following legal bases:

• The data subject's consent to the processing of personal data for one or more specific purposes.

• The performance of a contract to which the data subject is a party or the performance of a pre-contractual measure at the request of the data subject.

• Compliance with a legal obligation under a special regulation or an international treaty by which the Slovak Republic is bound.

• Protection of the vital interests of the data subject or another natural person (life, health or property of the data subject or another natural person).

• The performance of a task carried out in the public interest or in the exercise of public authority entrusted to Ticketportal.

• A legitimate interest of Ticketportal or a third party, unless that interest is overridden by the interests or rights of the data subject requiring the protection of his or her personal data. You will always be informed of the legitimate interest.

7          Withdrawal of consent

• If consent is the legal basis for the processing of your personal data, you may withdraw it at any time (i) by email to zodpovednaosoba@ticketportal.sk, (ii) via a link in the message, or (iii) in the interface of the online service you are using that enables this functionality. Withdrawal of consent does not affect the lawfulness of the processing of personal data based on consent prior to its withdrawal. If you withdraw consent, we will immediately stop processing your personal data and delete it.

• If Ticketportal processes your personal data on a legal basis other than your consent, the withdrawal of consent does not extinguish its right to process your personal data on other legal bases.

8          Right to object and right to bring a data protection action

• You have the right to object to the processing of your personal data directly to Ticketportal by email at zodpovednaosoba@ticketportal.sk.

• In addition to the right to file objections, you also have the right to file a petition to initiate a personal data protection proceeding before the Office for Personal Data Protection of the Slovak Republic.

9          Recipients of personal data

• Ticketportal processes your personal data primarily for its own purposes. In addition, we may share your personal data with our business partners through whom we process your personal data. These are trusted parties (so-called recipients and processors) who provide us with the development, maintenance and operation of software solutions and other services through which we process your personal data or provide us with services (e.g. economic, legal, auditing and marketing services).

• List of partners who may process your personal data and recipients of personal data:

• In addition, the recipients of your personal data are our employees. With your consent, we may also provide your personal data to third parties who will process your personal data for their marketing needs.

10       Transfer of personal data to third countries

• We process your personal data primarily within the European Union and the European Economic Area. However, as noted above, your personal data is also transferred to the United States of America, where the United States of America has the status of a third country that does not ensure an adequate level of protection of personal data.

• However, in these cases, the cross-border transfers and processing of your personal data are secured by the Privacy Shield certification system, which was created by the U.S. Department of Commerce, the European Commission, and the Swiss government to provide entities in the European Economic Area and the United States with the means to comply with the requirements for the protection of personal data when transferring it from a member state of the European Economic Area to the United States, and for the purposes of promoting transatlantic trade. This system, as decided by the European Commission, ensures adequate protection of personal data. You can find out more about this system on its website. Please note that based on the European Court of Justice Decision No. 2016/1250, the Privacy Shield certification system does not provide sufficient protection for personal data. However, this decision does not mean that Privacy Shield has ceased to exist, and its participants are still bound by its obligations.

• In addition, MailChimp and Office 365 service providers have updated their terms and conditions and contracts to ensure that the personal data they process and transfer is protected in accordance with European regulations. Microsoft Corporation's standard contractual clauses comply with the relevant European Commission decisions.

11       Period of processing of personal data

• The duration of the processing of your personal data depends on the legal basis for its processing. It may be determined directly by law or it may be specified in a contract we have entered into with you or in a consent you have provided to us.

• If the processing period is not directly specified in the law or contract, we will normally process personal data (i) for a period of 24 months from the start of processing or (ii) for the duration of the limitation period if the legal basis is our legitimate interest (e.g. in the case of a legal claim).

• We will delete your personal data after the expiry of this period, the termination of the reason for processing your personal data or the withdrawal of your consent (unless we are processing your personal data on a legal basis other than consent). Before the expiry of this period, we may ask you to extend your consent for a further 24 months.

12       Method of processing personal data

• Ticketportal primarily processes your personal data electronically through automated information systems operated by Ticketportal itself or through its business partners. We may also process your personal data in paper form (e.g. contracts, accounting and tax documents, written correspondence) in systematically organised records.

13       Rights of the data subject

• RIGHT TO OBJECT: You have the right to object to the processing of your personal data. You can object if your personal data is processed for the performance of a task carried out in the public interest or in the legitimate interest of Ticketportal or for direct marketing purposes. Your objection will be justified and successful if your legitimate grounds outweigh Ticketportal's legitimate grounds or if the processing of your personal data is for direct marketing purposes (in which case the objection is treated as a withdrawal of your consent). You cannot object if the processing is necessary for (i) the performance of a task for reasons of public interest or (ii) scientific or statistical purposes or historical research purposes. If your objection is justified and successful, we will not process your personal data further.

• RIGHT TO INFORMATION: You have the right to be informed about whether we are processing your personal data, the extent to which we are processing your personal data, and to be informed about a breach of your personal data protection.

• RIGHT OF ACCESS TO PERSONAL DATA: You have the right to be issued with a confirmation that we are processing your personal data, what personal data we are processing and a copy of that personal data. We will provide you with this confirmation by email unless you ask us to do otherwise. We may refuse to provide you with this confirmation if it would adversely affect the rights of other individuals.

• RIGHT TO CORRECTION: If the personal data we process about you is incorrect or incomplete, you have the right to have it corrected or completed. If you use one of the online services where you manage your personal data, you can exercise your right to rectification directly by making a correction in the interface of that online service.

• RIGHT TO DELETION/RIGHT TO CLEARANCE: You have the right to have your personal data erased when the processing of your personal data has been terminated (withdrawal of consent, successful objection, expiry of the time limit, etc.) or when it has been processed in breach of the law, in which case Ticketportal will erase your personal data without delay. You may also request the erasure of your personal data. Erasure is always final. The right to erasure cannot be exercised if the personal data is necessary, for example, for the exercise of the right to freedom of expression and the right to information, for compliance with a legal obligation, for the performance of a task carried out in the public interest, for reasons of public interest in the field of public health, for archiving, scientific or statistical purposes or for the purpose of historical research, or for the exercise of legal claims.

• RIGHT TO LIMIT PROCESSING: If you object to the accuracy of your personal data, Ticketportal will limit the processing of your personal data for the duration of the verification of its accuracy. If your personal data is processed unlawfully and you do not request its erasure, we will restrict its processing to the extent that you request, otherwise only to archiving it. If your personal data are processed for the performance of a task of public interest or on the basis of a legitimate interest of Ticketportal, their processing will be limited to the period of verification that the legitimate grounds for processing outweigh the legitimate grounds of the data subject. You can also ask us to restrict the processing of your personal data. We will inform you by e-mail about the beginning and the end of the restriction of the processing of your personal data.

• RIGHT TO TRANSPARENCY: Where (i) it is technically feasible, (ii) the processing of your personal data is based on your consent or for the performance of a contract, (iii) and not for the performance of a task carried out in the public interest, (iv) the processing is carried out by automated means, and (v) the transfer of your personal data does not adversely affect the rights of others, you have the right to have your personal data processed in a structured, commonly used and machine-readable format (e.g. .xml). For personal data processed in this way, you have the right to request its transfer to another controller.

• RIGHT TO REFUSE AUTOMATED INDIVIDUAL DECISION-MAKING AND PROFILING: You have the right to refuse a decision that is based on automated processing of personal data and profiling if it has legal effects or significantly affects the data subject. The right cannot be exercised if such a decision is necessary for the conclusion or performance of a contract or is made pursuant to a legal provision or on the basis of the data subject's consent. Any decision based on automated processing of personal data and profiling must be manually reviewable. The data subject shall be entitled to contest the decision in writing or to provide his or her views on it. Ticketportal does not currently use automated individual decision-making and profiling. However, it may send offers that are specifically targeted to you based on the information and personal data we have collected from you.

14        Method of exercising rights and instructions

• You can exercise your rights and requests by email to zodpovednaosoba@ticketportal.sk. If you deliver your request, objection, opinion or withdrawal of consent other than by letter with your signature, by email with a qualified electronic signature or in person, we may require you to provide additional credible verification of your identity or we may not be required to comply with your request. We may also not comply with your request in cases governed by law.

• Your requests will be processed within one month of receipt at the latest. We may extend this period by a further two months, including repeatedly if justified and taking into account the complexity and number of requests. We will inform you of the extension of the deadline.

• We will provide you with information, confirmations and notifications free of charge. In the case of repeated requests, or requests that are manifestly unfounded or unreasonable, we may require you to pay the administrative costs incurred in dealing with them, or we may refuse to deal with them.

• If we contact you by telephone or you contact us directly, these telephone conversations will be recorded. You will be advised of this fact at the beginning of the telephone conversation. If you wish the conversation not to be recorded, please contact us by other means or request to be contacted by telephone from an unmonitored line.

15       Personal data processing principles

• LAWFULNESS PRINCIPLE: We process personal data fairly, transparently and only on the basis of a lawful ground (consent of the data subject, performance of a contract, performance of a legal obligation, protection of the vital interests of the data subject or another natural person, performance of a task carried out in the public interest or in the exercise of official authority, legitimate interest of Ticketportal). We will not violate the rights of the data subject in the processing.

• PURPOSE-BASED PRINCIPLE: We may only process personal data for a specific, specified, explicitly stated and legitimate purpose, otherwise only for archival, scientific or statistical purposes or for historical research purposes.

• PRINCIPLE OF PERSONAL DATA MINIMISATION: We may only process personal data that we strictly need or that the law allows us to process. We will not process or request unnecessary personal data. It is also up to you to provide us only with the personal data that is strictly necessary for the purpose for which we will process it and not to provide us with unnecessary data (e.g. for communication with each other, etc.).

• PRINCIPLE OF CORRECTNESS: We only process correct and up-to-date personal data. If the personal data processed by us is incorrect or incomplete, we will correct or complete it. We will delete incorrect personal data. The correctness of the personal data also depends on you, so it is essential that you always provide us with correct and complete personal data.

• STORAGE MINIMISATION PRINCIPLE: We will only process personal data for as long as necessary to fulfil the purpose or as required by law. For longer periods, we will only process it for archiving, scientific or statistical purposes or for historical research purposes.

• PRINCIPLE OF INTEGRITY AND CONFIDENTIALITY: We will protect personal information from loss, accidental deletion, damage, theft or destruction. We will ensure that personal data is not unlawfully processed. The security of personal data is important and we ensure it through standard appropriate technical and other measures.

• PRINCIPLE OF LIABILITY: We are responsible for the security and protection of personal data to you and to the Office for Personal Data Protection of the Slovak Republic, which is entitled to review the processing of personal data in the context of a personal data protection procedure.

16       Processing of children's personal data

• Personal data of children under the age of 16 may only be processed in specific and justified cases. If you are under 16 years of age and have given us your consent to process your personal data, this consent must also be given and confirmed by your legal representative. In this context, we may request your date of birth as one of the personal data for the purpose of verifying your age. If we process your personal data on a legal basis other than your consent, we may require confirmation and consent from your legal representative.

17       Other Information and Relationship to Other Ticketportal Terms and Conditions

• This Ticketportal Privacy Policy is a general policy and provides a general and basic framework for the protection of your personal data. Ticketportal may adopt specific rules for different purposes for processing personal data (e.g. for processing personal data for marketing activities) and these privacy rules will also be part of Ticketportal's individual terms and conditions for the provision and use of its individual services and products. The specific privacy rules take precedence over these general rules.

• These rules were created to clarify the protection of personal data and to strengthen transparency in the processing of personal data. This policy will be updated regularly and published on Ticketportal's websites. The rules come into force on 01.2022.