Bobovka Prosek

These policies explain how we process personal data when using the website www.bobovadraha.cz, purchasing tickets, and communicating with Bobovka Prosek. They also include information about the live stream from webcams on the premises.

1. Who is the personal data controller

The personal data controller is Bobová dráha Prosek a.s., with registered office at Prosecká 906/34b, Vysočany, 190 00 Prague 9, Company ID 07343663, VAT ID CZ07343663, registered in the Commercial Register maintained by the Municipal Court in Prague, Section B, Insert 23713 (hereinafter also “we” or “controller”).

Website: https://www.bobovadraha.cz
Email for questions and requests regarding personal data: info@bobovadraha.cz
Written requests can also be sent to the address of our registered office.

We do not have a designated Data Protection Officer.

We process personal data according to the Regulation of the European Parliament and Council (EU) 2016/679 (GDPR), Act No. 110/2019 Coll., on personal data processing, and other applicable legal regulations. For storing cookies and accessing information on your device, Section 89 paragraph 3 of Act No. 127/2005 Coll., on electronic communications, also applies.

2. Purchase and delivery of tickets

When purchasing online, we process the name, email address, and phone number you enter in the order. We use the email to deliver the ticket and messages related to the order. We do not use the data to send newsletters or promotional offers.

Processing of data necessary to fulfill the order and deliver the ticket is based on contract performance according to Article 6(1)(b) GDPR. Data retention required by accounting and tax regulations is processed based on legal obligation under Article 6(1)(c) GDPR. To the necessary extent, data may also be retained for asserting or defending legal claims based on our legitimate interest under Article 6(1)(f) GDPR.

Providing data necessary to process the order is a contractual requirement. Without it, we cannot process the online order or deliver the ticket. Data marked as optional do not have to be provided.

NOTE FOR COMPLETION: The ticket sales provider will add the actual stored data about the order, payment, and any usage of rides, e.g., order number, ticket identifier, price, and payment status. Confirm whether surname or billing data are also stored. For the phone, specify the exact purpose; if not necessary for contract performance, it should not be a mandatory field. Confirm who processes payment card data and whether the controller has access to them.

3. Inquiries and requests for events or terraces

If you contact us via form or email, we process your contact details, message content, and other data you provide. We use them to handle the inquiry or request, prepare an offer, and arrange the requested service.

If you, as a natural person, request a service for yourself, the legal basis is steps taken before concluding a contract at your request according to Article 6(1)(b) GDPR. For general inquiries and communication with company contacts, the legal basis is our legitimate interest in handling requests and business communication according to Article 6(1)(f) GDPR.

Providing data is voluntary. Without contact or information necessary to assess the request, however, we cannot respond or prepare an offer. For ordering a children’s event, we do not require personal data of individual children. We do not create customer accounts.

4. Technical operation and website security

When visiting the website, technical data may be processed to ensure its operation and security, especially IP address, date and time of access, requested page, browser information, and error or security events. The legal basis is our legitimate interest in a functional and secure website and preventing its misuse according to Article 6(1)(f) GDPR.
Data are logged by the system into files with automatic seven-day rotation and are deleted by the system after this period.

5. Cookies and Google Analytics

Cookies and similar technologies allow storing information on your device or retrieving information from it. We use necessary cookies only to the extent needed for communication transmission or providing a service you explicitly request, such as the shopping cart function. Consent is not required for these cookies. If personal data are processed through them, the legal basis is, depending on the purpose, contract performance or our legitimate interest in the necessary operation of the website.

We use Google Analytics to measure traffic and evaluate website usage. Analytical cookies and related personal data processing for this purpose are activated only after your consent. The legal basis for this processing is Article 6(1)(a) GDPR.

Consent to analytical and any other optional cookies is voluntary. You can refuse it and use the website and ticket purchase without it. You can withdraw or change consent anytime in cookie settings. Withdrawal does not affect the lawfulness of processing before withdrawal.

Details about the cookies used, their providers, purposes, and validity periods are listed in the cookie overview available on the website in the cookie settings footer.

6. Live stream from webcams

We publish a live image from webcams on the Bobovka Prosek premises on the website. Visitors, including children, may be recognizable in the footage. Their likeness is made available to internet users through the public stream. The video stream is live – we do not store or record it.

7. Who can access personal data

Authorized persons of the controller and, to the necessary extent, suppliers providing ticket sales and delivery, website operation, hosting, email, accounting, analytics, or webcam streaming have access to personal data. If they process data as processors for us, they must be bound by appropriate contractual agreements according to Article 28 GDPR.

Recipients may also include payment service providers and banks, who usually act as independent controllers when fulfilling their own legal obligations. Authorities may obtain data if required by law, as well as legal advisors or other persons to the extent necessary to protect legal claims. The scope of recipients for the webcam live stream is described in section 6.

8. Data transfer outside the European Economic Area

Data outside the EU/EEA may only be transferred within the scope of cookie transfers + Google Analytics data as defined above. Visitors can select settings for individual cookies in the cookie bar.

9. How long we retain data

We retain data only to the extent and for the period necessary for the specific purpose. After that, we delete or irreversibly anonymize them unless further retention is required by law or for protecting a specific legal claim.

We retain data for order processing for the duration of contract performance, including ticket validity and handling any complaints. Afterwards, we retain only data necessary for legal obligations or protection of legal claims.

Accounting documents are usually retained for 5 years from the end of the accounting period to which they relate, according to Act No. 563/1991 Coll., on accounting. Tax documents for VAT purposes are retained for 10 years from the end of the taxable period in which the supply occurred, according to Act No. 235/2004 Coll., on value-added tax. If a legal regulation requires longer retention in a specific case, we follow it. These periods do not automatically apply to all contact data or communication content.

NOTE FOR COMPLETION: The accountant will confirm which documents containing personal data the controller creates and which retention periods apply to them. Adjust the previous paragraph accordingly.

Common inquiries and unsuccessful requests are retained for the duration of their processing and then for up to 5 years from the last communication, unless specific messages need to be retained to protect a legal claim.

Data necessary to protect legal claims are retained for the applicable limitation period; in case of a dispute, also for its resolution and settlement of related obligations. The scope of retained data is limited to what is necessary for the specific claim.

Cookie validity periods and retention of analytical data are stated in the cookie overview and Google Analytics information.

10. Your rights

Within the scope and under the conditions set by the GDPR, you can exercise the following rights:

• Access: obtain confirmation whether we process your personal data, information about the processing, and a copy of the processed data.
• Rectification: request correction of inaccurate or completion of incomplete data.
• Erasure: request deletion of data if legal conditions are met, for example, if they are no longer needed. Erasure may not be possible if we must retain data by law or for establishing, exercising, or defending legal claims.
• Restriction of processing: request restriction, for example, during verification of data accuracy or assessment of your objection.
• Data portability: obtain data you provided to us in a structured, commonly used, and machine-readable format if processing is automated and based on consent or contract. If technically possible, you can request direct transfer to another controller.

Right to object: you can object at any time to processing based on legitimate interest for reasons related to your specific situation. Then we will no longer process data for that purpose unless we demonstrate compelling legitimate grounds overriding your interests, rights, and freedoms, or processing is necessary for establishing, exercising, or defending legal claims.

Right to withdraw consent: if processing is based on consent, you can withdraw it anytime. Withdrawal does not affect the lawfulness of processing before withdrawal. For cookies, use cookie settings; for other consents, contact us at info@bobovadraha.cz.

If you believe we handle data contrary to legal regulations, you can file a complaint with the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, website https://uoou.gov.cz, email posta@uoou.gov.cz. You can also seek protection of your rights in court.

11. How to exercise rights

Write to info@bobovadraha.cz or to the address of our registered office. Specify which right you want to exercise and which processing the request concerns. If we have reasonable doubts about your identity, we may request additional information necessary to confirm it.

We will respond to the request without undue delay, at the latest within one month of receipt. If necessary due to complexity and number of requests, we may extend the period by another two months; we will inform you about the extension and reasons during the first month.

Exercising rights is usually free of charge. For manifestly unfounded or excessive requests, especially if repetitive, we may charge a reasonable fee or refuse to comply under GDPR conditions. If we refuse, we will inform you of the reasons and your right to lodge a complaint and seek judicial protection.

12. Automated decision-making

We do not carry out decisions based solely on automated processing, including profiling, which would have legal effects on you or similarly significantly affect you.

13. Changes to the policy

We update the policies when changing used services or methods of personal data processing. The current version is published on the website. If we intend to process data for a new purpose, we will provide you with relevant information in advance and ensure an appropriate legal basis.