Personal Data Protection

01

Data controller

The controller of personal data is the operator of the Thrill Me online store:

The Controller has not appointed a data protection officer. You may contact us about any personal data matter at the email or postal address above.

02

Data we process

When an order is placed and fulfilled, we process in particular:

• first and last name,
• email address and telephone number,
• delivery address, city, postcode and country when address delivery is selected,
• the selected concert when concert collection is selected,
• order contents, quantity, price, delivery method and payment method,
• order number, variable symbol, order status and related timestamps,
• payment receipt information and any concert collection code,
• where PayPal is used, the PayPal order and payment identifiers, transaction status and payer information made available to us by PayPal, in particular the payer ID and email address,
• the content of communications and information connected with a complaint, return or other request.

To protect the online store against repeated or abusive requests, we store one-way cryptographic hashes of the IP address and browser identifier. The original values cannot ordinarily be recovered from these hashes.

Standard technical access data, such as IP address, request time, requested page and browser type, may also be recorded temporarily in the hosting provider’s operational and security logs.

03

Purposes and legal bases

We process personal data for the following purposes:

• receiving and fulfilling an order, communication, receiving payment, delivering or handing over the goods – processing is necessary to enter into and perform a contract,
• accounting, tax and other statutory obligations – processing is necessary to comply with the Controller’s legal obligations,
• handling complaints, withdrawals and other Customer rights – depending on the circumstances, processing is based on performance of the contract or compliance with a legal obligation,
• protection of legal claims, security and prevention of misuse of the online store – processing is based on the Controller’s legitimate interest in protecting its rights, systems and stock.

We do not use order data for marketing emails, newsletters, profiling or behavioural advertising. We do not request consent for the processing described above because it is based on the contract, law or legitimate interests.

04

Is providing the data mandatory?

Providing the information marked as required in the order form is a contractual requirement. Without it, we cannot receive or confirm the order, accept payment, deliver the goods or prepare them for collection.

The Customer is responsible for the accuracy of the information and may ask us to correct it.

05

Who may receive the data

We disclose personal data only to the extent necessary to:

• WEDOS Internet, a.s., which provides hosting, database and email services,
• the carrier selected by the Seller to deliver the shipment; we provide in particular the name, delivery address and contact details,
• Raiffeisenbank a.s. and other banks involved in the bank transfer, to the extent of the payment information,
• PayPal (Europe) S.à r.l. et Cie, S.C.A. where the Customer selects or subsequently uses PayPal; we disclose the information necessary to create, verify and match the payment, in particular the order number and amount, currency, name, email address and, for address delivery, the delivery address,
• accounting, tax, legal or IT advisers where their involvement is necessary and they are bound by confidentiality,
• public authorities where disclosure is required by law or a binding decision.

We do not sell personal data or provide it to third parties for their own marketing.

PayPal processes personal data when providing its payment services in accordance with its own legal obligations and policies. Details are available in the PayPal Privacy Statement.

06

Transfers outside the European Economic Area

When an order is delivered to a country outside the European Economic Area, the necessary delivery information may be transferred to a local carrier, customs authorities or other parties involved in delivery in the destination country. Such transfer is necessary to perform the contract concluded with the Customer.

The website uses remotely loaded Google Fonts. When a font is loaded, the service provider receives the technical data necessary to deliver the file, in particular the IP address and browser information. The provider for users in the European Economic Area is generally Google Ireland Limited; further information is available in Google’s privacy policy.

When PayPal is used, personal data may also be processed by PayPal group companies or their service providers outside the European Economic Area. PayPal describes the countries involved and the applicable legal safeguards, including binding corporate rules and other mechanisms under data protection law, in its privacy statement.

07

How long we retain data

• order data and related communications for the duration of the contract and generally for a further 3 years to protect legal claims, unless a longer period is necessary,
• data contained in accounting and tax records for the period required by law, generally 5 or 10 years depending on the type of record,
• complaint or withdrawal data for the duration of the procedure and subsequently for the period necessary to protect legal claims,
• security hashes of the IP address and browser identifier for no longer than 3 years after the order was created,
• hosting operational logs for the period set by the hosting provider and necessary to ensure security and operation.

After the relevant period expires, we delete or anonymise the data unless further retention is required by law or necessary to protect a specific legal claim.

08

Website, cookies and browser storage

The online store does not use analytics or marketing cookies. We use Cloudflare Web Analytics, provided by Cloudflare, Inc., to measure aggregate website traffic and technical performance. According to the provider, the service does not use cookies or localStorage, create persistent identifiers, track individual visitors or collect their personal data. It records aggregate information such as visits, page views and page load time. The measurement script is loaded from Cloudflare and the measured information is sent to its servers. Further information is available in the Cloudflare Web Analytics documentation and Cloudflare’s privacy policy.

The online store uses an essential session cookie to establish a secure connection with the order server. Without it, the order may not be submitted securely.

The cart and language selection are temporarily stored in your browser’s sessionStorage. This information is used only to preserve the cart and language during the open browser session, is not itself sent to third parties, and is removed by the browser when the session ends.

Additional essential cookies may be used for authentication and website previews in the private administration and maintenance modes. These cookies are not intended for ordinary Customers.

09

How we protect the data

We use appropriate technical and organisational measures, including encrypted HTTPS connections, restricted administration access, protection against forged form requests, repeated-request controls, parameterised database queries and separation of private configuration from the public website.

Personal data is accessible only to persons who need it to fulfil orders, meet accounting obligations, communicate with Customers or administer the website, and who are required to maintain confidentiality.

No method of transmission or storage is completely risk-free. If we discover a personal data breach, we will proceed in accordance with applicable law and, where required, notify the supervisory authority and affected individuals.

10

Your rights

Subject to the conditions laid down by law, you have the right to:

• obtain confirmation of whether we process your personal data and request access to it,
• request correction of inaccurate data or completion of incomplete data,
• request erasure where the data is no longer needed and we have no obligation or right to retain it,
• request restriction of processing,
• receive data in a portable format where the statutory conditions are met,
• object to processing based on legitimate interests.

You may send a request to info@thrillme.cz or to the Controller’s registered office. Before responding, we may reasonably verify your identity. We will respond without undue delay and no later than within the period prescribed by law.

You also have the right to lodge a complaint with the supervisory authority:

11

Final information

We do not carry out automated individual decision-making or profiling that produces legal or similarly significant effects for you.

This policy may be updated, particularly if the services used or legal requirements change. The current version will always be published on this page.

This English text is a translation of the Czech Personal Data Processing Policy. In the event of a discrepancy, the Czech version prevails, without prejudice to rights granted by applicable law.

This Personal Data Processing Policy takes effect on 19/9/2026.