1. Introduction

    1. This Privacy Policy explains how personal data is collected, used, stored, and protected in connection with AfrOstrava Festival 2026 and related activities.
    2. The controller of personal data is:
    3. West Merge s.r.o. Registered seat: Čeladná 409, 739 12 Čeladná, Czech Republic Registered in the Commercial Register maintained by the Regional Court in Ostrava, Section C, File No. 91758 Email: info@afrostrava.cz
    4. West Merge s.r.o. acts as the organiser of AfrOstrava Festival 2026 and processes personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR).
    5. All personal data is processed lawfully, fairly, and transparently. Data subjects may exercise their GDPR rights at any time.

  2. 1. General Personal Data and Image Use

    1. West Merge s.r.o. acts as a personal data controller within the meaning of Article 4(7) GDPR.
    2. Personal data is processed for legitimate purposes including festival organisation, ticketing, contractual relationships, legal compliance, security, communication, and marketing.
    3. Image and Media Use
    4. By entering the festival venue, visitors acknowledge that photographs, video recordings, broadcasts, or other audio-visual materials may be created in which they may appear.
    5. Such materials may be used for promotional, documentary, media, and archival purposes in accordance with applicable law, including Sections 84–89 of the Czech Civil Code.
    6. Where required under GDPR, the legal basis for processing image data is legitimate interest in promoting and documenting the festival, or consent where applicable.
    7. Consent, if required, may be withdrawn at any time. Withdrawal does not affect processing carried out prior to withdrawal in accordance with applicable law.
    8. Media Coverage
    9. Accredited media may capture recordings for journalistic purposes (print, radio, television, online). Recordings may also be made without consent where permitted under Section 89 of the Czech Civil Code, provided they do not unreasonably interfere with legitimate interests.

  3. 2. Specific Processing Activities

    1. 2.1 Commercial Communications – New Email Subscribers
    2. Purpose: Sending newsletters, festival updates, and promotional communications. Legal basis: Consent (Art. 6(1)(a) GDPR) Data processed: Email address, name, subscription metadata Recipients: Email distribution platforms and IT/marketing processors Retention: Until consent is withdrawn Rights: Consent may be withdrawn at any time by clicking “unsubscribe” or contacting info@afrostrava.cz
    3. 2.2 Commercial Communications – Existing Customers or Participants
    4. Purpose: Sending festival-related marketing to individuals who previously purchased tickets, registered, or participated.
    5. Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)
    6. The legitimate interest consists of promoting related cultural events and maintaining communication with existing supporters. A balancing test has been conducted to ensure that such interest does not override the rights and freedoms of data subjects.
    7. Individuals may request further information about this legitimate interest assessment.
    8. Data processed: Name, email address, previous interactions, email engagement data Recipients: Email and marketing service providers (processors) Retention: Until objection is raised or the legitimate interest no longer applies Rights: Right to object at any time by clicking “unsubscribe” or contacting info@afrostrava.cz
    9. 2.3 Contractual Partners
    10. Purpose: Managing relationships with vendors, performers, suppliers, sponsors, and partners. Legal basis:
      • Contract performance (Art. 6(1)(b) GDPR)
      • Legal obligation (Art. 6(1)(c) GDPR)
      • Legitimate interest (Art. 6(1)(f) GDPR)
      Data processed: Identification and contact details, banking/payment information, contractual documentation, communication records Recipients: Accounting, legal, production, and technical service providers Retention: Duration of contract plus statutory archival periods Rights: All rights listed in Section 4 of this notice
    11. 2.4 Ticket Purchasers
    12. Purpose: Processing ticket purchases, managing access control, essential communication, fraud prevention, and security. Legal basis:
      • Contract performance (Art. 6(1)(b) GDPR)
      • Legal obligation (Art. 6(1)(c) GDPR)
      • Legitimate interest (Art. 6(1)(f) GDPR)
      Data processed: Name, email, billing/address information, payment details, ticket ID, entry and security logs Recipients: Ticketing platforms, payment processors, accounting providers, entry/security systems Retention:
      • Ticket and contractual data: 5 years
      • Accounting data: 10 years (in accordance with Czech accounting and tax regulations)
      • Fraud and security logs: 1 year
      Rights: All rights listed in Section 4 of this notice

  4. 3. Website and Analytics Data

    1. Purpose: Ensuring website functionality, security, performance monitoring, analytics, and improvement.
    2. Data collected: IP address, device and browser information, cookies, usage data
    3. Legal basis:
      • Legitimate interest for essential website functionality and security (Art. 6(1)(f) GDPR)
      • Consent for non-essential cookies where required by law
    4. A legitimate interest assessment has been conducted. Individuals may request further information about this assessment.
    5. Recipients: Hosting providers, analytics providers, and IT service providers Retention: For the period necessary to fulfil the purpose
    6. Cookies
    7. The website uses cookies to ensure proper functionality and to analyse website usage.
    8. Non-essential cookies are used only where consent has been provided. Users may manage cookie preferences via the cookie banner or through browser settings.

  5. 4. International Transfers

    1. Personal data is not transferred outside the European Union.
    2. If any service provider processes personal data outside the EU or EEA, appropriate safeguards in accordance with Articles 44–49 GDPR will be implemented.

  6. 5. Your GDPR Rights

    1. You may exercise the following rights at any time:
      • Access to your personal data
      • Rectification of inaccurate or incomplete data
      • Erasure of personal data where applicable
      • Restriction of processing in certain circumstances
      • Objection to processing, including direct marketing
      • Data portability (receive data in structured, machine-readable format)
      • Withdrawal of consent where processing is based on consent
    3. You also have the right to lodge a complaint with the supervisory authority:
    4. Office for Personal Data Protection Pplk. Sochora 27 170 00 Prague 7 Czech Republic www.uoou.cz

  7. 6. Contact

    1. For any questions or requests regarding personal data, please contact:
    2. Email: info@afrostrava.cz