Effective 6 August 2026 · last updated 6 August 2026
1. Data controller
The controller of personal data processed through this website and when arranging ROURA performances is:
Jan Vondryskaself-employed individualBusiness ID: 75599619Ruská 1241/178, Vršovice, 100 00 Praha 10registered in the Czech Trade Licensing Registerkapelaroura@gmail.com+420 732 905 776No data protection officer has been appointed. Privacy requests can be sent to the email address above.
2. Data we process and its source
We mainly receive data directly from you through the enquiry form, email, telephone and subsequent contract communication. This may include:
- identification and contact details, including name, email, phone number and any billing or business details;
- event details such as event type, date, venue, programme, guest count and technical requirements;
- communications, offers, contracts, orders, invoices and payment information;
- technical data such as IP address, request time, device and browser type, security logs and cookie preferences;
- anything else you voluntarily include in a message.
Please do not send special-category personal data unless it is genuinely necessary and has been agreed with us.
3. Purposes and legal bases
| Purpose | Legal basis | Typical data |
|---|---|---|
| Handling an enquiry, preparing an offer and pre-contract communication | Steps at your request before entering a contract, Art. 6(1)(b) GDPR | Contact and event details |
| Entering into and performing a live-music contract | Performance of a contract, Art. 6(1)(b) GDPR | Contract, event and payment data |
| Accounting, tax and other statutory duties | Legal obligation, Art. 6(1)(c) GDPR | Billing and accounting records |
| Website security, spam prevention, incident response and legal claims | Legitimate interests, Art. 6(1)(f) GDPR | IP address, logs, communications and contracts |
| Loading external YouTube players | Consent, Art. 6(1)(a) GDPR and applicable Czech electronic communications law | Online identifiers disclosed to YouTube |
| Advertising measurement and audience building through the Meta Pixel | Consent, Art. 6(1)(a) GDPR and applicable Czech electronic communications law | Online identifiers, IP address, pages visited and data disclosed to Meta |
Our legitimate interests are operating a secure website, preventing misuse and establishing or defending legal claims. Marketing technologies activate only with your consent, and this website does not collect data for newsletters.
4. Is providing data mandatory?
Sending an enquiry is voluntary. Without a contact detail and basic event information, we may be unable to reply. If you order a service, contract and billing information required by law must be supplied. Sending the form does not itself conclude a contract.
5. Retention
- enquiries that do not lead to a contract: no more than 12 months after the last communication;
- contracts and event communication: during performance and usually 4 years afterwards for legal claims;
- accounting and tax documents: as required by law, usually 5 to 10 years;
- security logs: usually no more than 30 days, unless an incident requires longer retention;
- external-media and marketing preference: 12 months after acceptance or 6 months after refusal, unless changed or deleted earlier.
Where a dispute or legal duty requires longer retention, we keep only the data necessary for that purpose.
6. Recipients and international transfers
Data may be accessed where necessary by the website hosting and support provider, email provider, Google Ireland Limited through Gmail and a private Google Sheet, accounting or legal advisers, and public authorities where required by law.
If Cloudflare Turnstile is enabled, Cloudflare, Inc. processes security information. Once you consent and start a video, Google Ireland Limited and YouTube may process online identifiers. If you consent to marketing, Meta Platforms Ireland Limited also processes visit data through the Meta Pixel. These providers may use infrastructure outside the EEA. Transfers are governed, as applicable, by an adequacy decision, the EU–US Data Privacy Framework or Standard Contractual Clauses.
We do not sell personal data or disclose it for another party’s independent marketing.
7. Cookies and similar technologies
The website uses no analytics cookies. Advertising technology (the Meta Pixel) loads only if you consent under the Marketing category. External-media and marketing consent is optional and can be changed at any time through “Cookie settings” in the footer.
| Technology | Purpose | Category and duration |
|---|---|---|
roura-consent-v1 in local storage | Remember whether external media and marketing technologies may be loaded | Necessary; 12 months after acceptance, 6 months after refusal |
| Cloudflare Turnstile and possible security identifiers | Protect forms from bots and abuse, only if the service is enabled | Necessary security; duration is determined by Cloudflare’s security requirements |
| YouTube privacy-enhanced mode | Play music videos after consent and a click | External media; Google/YouTube control the identifiers and duration |
Meta Pixel (_fbp and related identifiers) | Measure Facebook and Instagram advertising and build advertising audiences; loads only after consent | Marketing; Meta controls the identifiers and duration, the _fbp cookie usually 90 days |
Rejecting external media and marketing does not restrict the rest of the website or its enquiry form. Videos can be enabled later from a player or cookie settings.
8. Your rights
Subject to the GDPR, you may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interests. You can withdraw external-media consent at any time without affecting prior lawful processing.
Email requests to kapelaroura@gmail.com. We may reasonably verify your identity and will normally respond within one month.
9. Automated decisions
We do not use automated decision-making or profiling that produces legal or similarly significant effects when handling enquiries.
10. Complaints and updates
You may complain to the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, email posta@uoou.gov.cz, uoou.gov.cz. You may also contact your local EEA supervisory authority where applicable.
We may update this policy when services or legal requirements change. The current version is always published here.