1. Data controller
The controller is Vladlena Sherova, Karpatské námestie 7770/10A, 831 06 Bratislava-Rača, Slovenská republika, Company ID 55462375. Privacy contact: eventra.agency@gmail.com, +421 949 371 199.
2. Data we process
- For a waitlist: required email and phone, optional name, selected event, language, entry status, creation time and notice/consent versions. Consent covers only updates and an invitation for the selected event; withdraw by emailing eventra.agency@gmail.com.
- Orders: name, email, phone, language, order items, ticket details, amounts, statuses, payment identifiers and timestamps. If provided, campaign UTM labels and only the referring domain are retained, without its path, query or fragment.
- KULT does not store full card numbers. Stripe handles payment details on its own checkout page.
- Enquiries: name, email, optional phone, message and language. Contact-form messages reach our Gmail support mailbox through Resend.
- Admission: ticket identifier and protected credential, status, check-in time, refund, cancellation or transfer information.
- Staff: name, email, role, assigned events and necessary sign-in, security and operational audit records.
- Service operation: request, error and abuse-prevention logs. Public-page traffic and speed analytics require permission; browser choices are described below.
3. Purposes and required information
We need data for reservations, payments, issuing and delivering tickets, admission, support, refunds, abuse prevention and mandatory records. Name, email and phone are required by the purchase form; an order through that form cannot be completed without them. Phone is optional in the contact form.
Buying a ticket does not subscribe you to advertising. Ticket, payment and support messages serve the purchase. A separate advertising mailing requires its own lawful basis and, where required, separate consent. We do not make solely automated decisions with legal or similarly significant effects.
4. Legal bases
- Article 6(1)(b) GDPR: steps before and performance of a contract — reservation, payment, tickets, admission, purchase support and refunds.
- Article 6(1)(c) GDPR: mandatory accounting, tax and other statutory records.
- Article 6(1)(f) GDPR: legitimate interests in security, fraud prevention, legal claims, answering general enquiries and analysing order sources. Attribution is limited to campaign labels and the referring domain.
- Article 6(1)(a) GDPR: optional traffic and speed analytics and selected waitlist notifications with consent. The browser preference and consent record help respect and demonstrate your choice; they are not linked to an order or customer.
5. Providers and recipients
Supabase provides the database and staff authentication; Vercel provides hosting; Stripe handles payments; Resend sends service email; Google/Gmail hosts our support mailbox. Each receives information needed for its service. Access within KULT is limited by staff responsibilities and roles. Meta receives advertising pixel data only with separate consent, as described in the cookies section.
Stripe may act as a processor or an independent controller for its own legal obligations. Information is shared with accounting advisers, other advisers or competent authorities when needed for records, legal claims or a legal duty. Providers may use subprocessors.
6. Hosting and international transfers
The Supabase database is hosted in Ireland (eu-west-1). Individual providers and subprocessors may still process data outside the EEA. Such transfers are subject to GDPR Chapter V: an adequacy decision or appropriate safeguards, such as Standard Contractual Clauses (SCCs).
Request details of recipients, countries and applicable safeguards, including a copy of safeguards, at eventra.agency@gmail.com. Provider privacy information is linked below.
7. Retention
- Accounting documents covered by section 35 of Slovak Act No. 431/2002 Z. z. are retained for ten years after the year concerned. This does not automatically require retaining every customer detail for ten years.
- Waitlist contacts are used until notification about the selected event or withdrawal. Order and ticket data is kept for completing the purchase and event, refunds, unresolved disputes and applicable legal claims. When these purposes end, data is subject to erasure or anonymisation, except mandatory financial records.
- Correspondence is kept while needed to answer and follow up an enquiry; purchase or dispute correspondence follows the relevant criteria above. Technical-log retention depends on security needs and provider configuration.
- Your browser choice lasts 180 days. Minimal server consent and change records are kept for two years and then removed by a daily job. This is our consent-evidence retention period, not a general GDPR retention period for all data.
9. Your rights and requests
Depending on the applicable basis, you can request access and a copy, correction, erasure, restriction, portability or object to processing based on legitimate interests. Send requests to eventra.agency@gmail.com. Withdraw measurement consent through cookie settings; purchase services remain available.
We normally respond within one month. For a complex request, this may be extended by two further months with notice within the first month. If necessary, we ask only for information needed to verify identity. Mandatory records or legal claims may limit erasure; we will explain the reasons.
You may complain to Úrad na ochranu osobných údajov Slovenskej republiky or the supervisory authority where you habitually live, work or believe an infringement occurred.
10. Security and changes
Data access is restricted by role and event scope; broader staff permissions require two-factor verification. We use secure connections and operational audit records. Material changes receive a new policy version; changed purposes for optional measurement require a fresh choice.