Privacy policy

1. Data controller

The controller of personal data is ECHO katedrály, z. s., company ID (IČO) 30060290, registered office Puchmajerova 980/10, 702 00 Ostrava, Czech Republic, registered in the Register of Associations kept by the Regional Court in Ostrava under file no. L 22989.

For any questions about personal data protection, please contact us at info@echokatedraly.cz or in writing at our registered office.

We have not appointed a data protection officer, as we are not required to do so under the GDPR.

We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll., on the processing of personal data.

2. Visiting the website

We do not ask you for any personal data during an ordinary visit to the website. To operate the website securely, our hosting provider records technical access data (IP address, time of access, page visited and browser type). This data is used only to run the website and protect it against attacks. We do not link it to specific individuals and do not use it for marketing.

• Legal basis: legitimate interest in the secure operation of the website (Art. 6(1)(f) GDPR).
• Retention: for a limited period necessary to ensure security, according to the hosting provider’s rules.

3. Cookies

Cookies are small text files that a website stores in your browser.

This website does not use analytics, advertising or any other tracking cookies. That is why we do not ask for your consent to cookies.

• On the Contact page, the form is protected against spam by Cloudflare Turnstile. It checks that the form is filled in by a human and serves security purposes only. Its use is technically necessary.
• We do not embed maps. The “Show on Mapy.cz” link takes you to the Mapy.cz website, where its operator’s policy applies.
• You can restrict or disable cookies at any time in your browser settings.

If we ever want to use tools that require cookies, we will ask for your consent in advance and update this policy.

4. Contact form and e-mail

When you write to us via the contact form or by e-mail, we process your name, e-mail address and the content of your message.

• Purpose: to answer your question and deal with your request.
• Legal basis: legitimate interest in communicating with you (Art. 6(1)(f) GDPR) or steps prior to entering into a contract (Art. 6(1)(b) GDPR).
• Retention: 2 years after your enquiry has been dealt with.

5. Tickets and reservations

Tickets are sold at the cathedral information centre. When you reserve tickets by phone, we process your name and phone number.

• Purpose: reserving and handing over tickets, informing you about any change or cancellation of a concert.
• Legal basis: performance of a contract and steps prior to it (Art. 6(1)(b) GDPR).
• Retention: 2 years.

When we launch online ticket sales, we will add information about its operator and the data processed during purchase.

6. Donors and patrons

If you support us with a donation, we process the data needed to record it: name or company name, address, amount and date of the donation, the account it came from and, where applicable, contact details.

• Purpose: recording the donation, concluding a donation agreement, issuing a donation receipt for tax purposes, fulfilling accounting obligations.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations under accounting and tax laws (Art. 6(1)(c) GDPR).
• Retention: 10 years.

We publish the names of patrons and partners on the website or at concerts only with their consent. You can withdraw your consent at any time.

7. Who we share data with

We do not sell personal data or pass it on to third parties for marketing purposes. To run the website we use these processors:

• Cloudflare, Inc.: website hosting and spam protection for the form (Turnstile),
• Resend: delivering messages from the contact form to our mailbox.

We may also disclose data to public authorities where required by law.

8. Transfers outside the European Union

Some processors (Cloudflare, Resend) are based in the United States. Data is transferred only on the basis of safeguards required by the GDPR (Art. 44 et seq.), in particular the European Commission’s adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.

9. Security

The website is available only over an encrypted connection (HTTPS). Access to personal data is limited to authorised members of the association who need it for their work. We protect data against loss, misuse and unauthorised access.

10. Automated decision-making

We do not use personal data for automated decision-making or profiling.

11. Your rights

In connection with the processing of your personal data, you have the right:

• of access to your personal data,
• to rectification of inaccurate data,
• to erasure of data where there is no longer a reason to process it,
• to restriction of processing,
• to data portability,
• to object to processing based on legitimate interest,
• to withdraw consent where processing is based on consent (this does not affect processing before the withdrawal),
• to lodge a complaint with the supervisory authority: the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.

You can exercise your rights by e-mail at info@echokatedraly.cz or by letter to our registered office. We will reply without undue delay and no later than within one month.

12. Children

The website is not intended for children under 15. We do not knowingly process their personal data without the consent of a legal guardian.

13. Changes to this policy

We may update this policy, for example when we launch online ticket sales. The current version is always available on this page. The Czech version of this policy is authoritative.

Last updated: 30 October 2026.