PRIVACY POLICY

This Privacy Policy sets out how your personal data that you provide in connection with your use of the https://mucha.eu website (the "Website"), your interaction with us (e.g., through a face-to-face meeting or written communication with us, and in any other contact with us where you provide us with any of your personal data) is used and protected.

The controller of personal data is the Mucha Foundation, with registered office at Hradčanské náměstí 65/6, Hradčany, 118 00 Prague 1, ID : 62930494, (hereinafter referred to as the "Controller").

At the same time, we may work with business partners with whom we offer you joint products and with whom we act as joint controllers, which means that we determine the purposes and means of processing jointly. The joint controllers currently include:

• Mucha Muzeum Prague s.r.o., with registered office at Boudníkova 2506/1, Libeň, 180 00 Prague 8, ID No.: 22070818, registered in the Commercial Register maintained by the Municipal Court in Prague, file No. C 410513 (operator of the Mucha Museum in the Savarin Palace at Na Příkopě 10, Prague 1);
• the company ALFONS MUCHA s.r.o., with registered office at Hradčanské náměstí 65/6, Hradčany, 118 00 Prague 1, ID No.: 26507480, registered in the Commercial Register maintained by the Municipal Court in Prague, file No. C 86550;
• Mucha Trail, s.r.o., with registered office at Hradčanské náměstí 65/6, Hradčany, 118 00 Prague 1, ID No.: 19750404, registered in the Commercial Register maintained by the Municipal Court in Prague, file No. C 391018.

We respect the privacy of our website users, our clients, suppliers, contractors and other entities with whom we work and understand that when you choose to entrust us with information about yourself, you do so with the confidence that we will treat that information responsibly. This Privacy Policy contains important information about how we handle your personal information.

All your personal information is used only in accordance with this privacy policy.

By providing us with your personal data, you consent to the processing and management of the data provided for the purposes and under the conditions set out below. All personal data we receive from you will be collected, stored and used in accordance with applicable law, in particular in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, hereinafter referred to as the "Regulation") and Act No. 110/2019 Coll., on the processing of personal data, as amended, and Act No. 480/2004 Coll., on certain information society services, (hereinafter referred to as the "Act").

 

What data do we collect?

The controller may collect and process your personal data:

• Identification data, these data include in particular: name, surname
• Contact details, these details include in particular: correspondence address, email, telephone number;
• Payment and transaction data includes in particular: bank and payment data, billing data, order, payment and receivables history (if we operate an e-shop via the website);
• Video footage (camera system in the Mucha Muzeum in the Savarin Palace at Na Příkopě 10, Prague 1)
• Correspondence records (when contacting the Administrator)
• IP address (unique identifier of your computer or other device)/mobile device ID

In general, we collect and receive personal data directly from you as a result of your interaction with us or the existence of a contractual relationship with us. Technical Data may be collected by your visit to the Website in the manner described in the Technical Data and to visit the Website section of this Policy.

You acknowledge that refusal to provide personal data in cases where the provision of personal data is necessary for the conclusion and performance of a contract between us or in cases where we are obliged to process your personal data to comply with a legal obligation imposed by us may result in the non-execution of our contractual relationship.

 

For what purpose we process your personal data:

Performance of the contract and legal obligations

We may process your identification, payment and contact data for the purpose of negotiating the conclusion, modification or performance of a contract. In other words, we need the data in order to fulfil the obligations of our contractual relationship (sale of tickets, goods or provision of the services you have requested). We also need to fulfil certain legal obligations, in particular those regulated by the Accounting Act and the Value Added Tax Act.

However, we may also use your personal data for the purpose of defending or enforcing our legal claims based on our legitimate interest. A typical example of this would be the use of your personal data in the event of legal recovery of unpaid invoices.

Newsletter

On our Website you can subscribe to our newsletter (if you wish to receive news). In this case, however, you must give your consent for your e-mail address to be used for this purpose. In order for us to send you the newsletter, you need to confirm your email address via a message that we will send you after you have filled in the details on our Website.

You can withdraw your consent by using the link in the email you receive or by sending a message to hello@mucha.eu.

If you are our customer, your data may be used for the purpose of evaluating what is relevant to you and what you are interested in. Based on our legitimate interest, we may send you marketing offers  via email about goods or services you have purchased from us or information you have requested from us.  You can object to processing for direct marketing purposes at any time and your personal data will no longer be processed for that purpose.

 

Have you made an enquiry about us on our Website?

If you have contacted us via the contact form on our Website, we will process data in the range of first name, surname, email address and any data contained in the enquiry itself. The legal basis for processing this data is the performance of contractual obligations. The personal data will be deleted after the enquiry has been processed. However, if further legal services are subsequently provided, we will retain this data for the purpose of providing legal services as described above.

 

Camera system

In order to protect the property and health of persons on the premises of the Mucha Muzeum in the Savarin Palace at Na Příkopě 10, Prague 1, we may, due to legitimate interest, operate a camera system with recording that processes your identification data; the monitored premises are always marked at the entrance and detailed information regarding the camera system is provided in the internal regulations and we will make these regulations available to you on request at the place of operation.

 

Technical data and to visit the Website

Detailed information on the processing and protection of personal data through technical data when visiting the Website can be found at https://mucha.eu/en/privacy-policy.

 

Do we pass your data to third parties?

We may transfer your personal data to other companies in our group and affiliates (see above) and to third parties to assist us in processing your personal data for the purposes set out in this policy, such as our partner external accounting company and our external development company that manages and operates our Website.

Disclosure of your personal information may occur in the event of a sale or disposal of any of our assets or a similar corporate transaction. We will ensure that the confidentiality of your personal information is maintained by third parties who obtain your personal information.

We may disclose your personal data to a third party where we have reasonable grounds to believe that we are under a legal obligation to do so, and for the purpose of investigating, preventing or taking action in relation to suspected or actual illegal or otherwise prohibited activities, such as.

 

Where do we store your personal data?

Your personal data is stored on secure servers in our IT systems in the European Union (save for Cookies). Personal data may be disclosed to entities that work with us where this is necessary to ensure our legal and contractual rights and obligations, with whom we have entered into a data processing agreement. A current list of processors is maintained by the Controller and will be provided on request.

The processing of personal data is mainly carried out at the Administrator's registered office. The processing takes place by means of computer technology or, where appropriate, by manual processing of personal data in paper form, in compliance with all security principles for the management and processing of personal data.

 

How long do we keep your data?

We will retain your personal data for the time necessary to carry out the above purposes for the period set out here:.

 

Third party websites

Our website links to third-party sites that we do not operate or authorize. Such websites may use cookies and collect your personal information in accordance with their own privacy policies. This Privacy Policy does not apply to third party websites; we are not responsible for third party websites.

 

How do we protect your data?

We take appropriate measures to ensure that the personal data you have entrusted to us is kept secure, accurate and up-to-date and only for as long as necessary for the purpose of its use.

 

Your rights

In connection with the processing of personal data, you are entitled to the rights specified below, which you may exercise at your discretion.

 

Right to withdraw consent to the processing of personal data

You have the right to withdraw your consent to the processing of your personal data at any time. You may do so by written notice sent to the postal address or contact email of the Controller listed below. The withdrawal of your consent does not affect the processing of your personal data prior to its withdrawal.

 

Right of access to your personal data

The right to request rectification, blocking or destruction of personal data if you believe or discover that the Controller or third parties authorised by it carry out processing of your personal data that is contrary to the protection of your private and personal life or in breach of applicable law, in particular if your personal data are inaccurate with regard to the purpose of their processing.

 

The right to request the erasure of personal data if:

• Your personal data is no longer needed for the purposes for which it was collected or otherwise processed;
• If you withdraw your consent to the processing of personal data and there is no other legal basis for the processing;
• you object to the processing and there are no overriding legitimate grounds for further processing;
• Your personal data has been unlawfully processed;
• personal data must be erased to comply with a legal obligation.

 

Right to restriction of processing

You have the right to have the Controller restrict the processing of your personal data in any of the following cases:

• you deny the accuracy of the personal data for the time necessary for the Controller to verify the accuracy of the personal data;
• the processing is unlawful and you refuse to erase the personal data and instead request a restriction on its use;
• The controller no longer needs the personal data for the purposes of processing, but you require it for the establishment, exercise or defence of legal claims.

 

Right to data portability

You have the right to have the Controller transfer your personal data processed by automated means on the basis of your consent to another controller in a structured, commonly used and machine-readable format. In exercising your right to data portability, you have the right to have your personal data transferred directly from one controller to another controller, where technically feasible.

If you wish to exercise any of these rights, please contact us using the contact details below.

If you are dissatisfied with the way we handle your personal data, you also have the right to file a complaint with the Office for Personal Data Protection, Pplk. Sochora 27, Postal Code 170 00, Prague 7,  www.uoou.cz.

 

How to contact us

If you wish to exercise any of your rights in relation to your personal data or if you have any questions about how we use your personal data, please contact us by email at hello@mucha.eu.

 

Changes to this Privacy Policy

We review this privacy policy periodically to ensure that it is up-to-date with respect to our use of your personal information and our compliance with applicable data protection laws.

We reserve the right to change this privacy policy from time to time. The updated privacy policy will be posted on our Website. We encourage you to review this Privacy Policy from time to time.

 

Version: February, 2025