Privacy policy

The controller of personal data is Eventlook s.r.o., company ID 19156481, registered office Belgická 280/1, Vinohrady, 120 00 Praha 2, Česká republika, entered in the Commercial Register kept by the Municipal Court in Prague, section C, insert 212454. Contact for data protection matters: email [email protected].

We process personal data under Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll. This policy explains what data we process, why, for how long, and what your rights are.

We process only the data needed to run the marketplace:

• Buyers: email, order details (event, number of tickets, price, payment method, status), language and technical access data. Purpose: concluding and performing the contract, delivering the ticket, handling complaints and refunds, meeting accounting and tax duties.
• Sellers: email, first and last name, date of birth, address, phone, tax identification number or birth number, bank account number and holder name, identity verification data (provider and verification reference, never document data), listings and payouts. Purpose: verifying the seller, paying out, preventing fraud, and meeting Czech Act No. 373/2022 Coll. on reporting the income of sellers on digital platforms.
• All users: support communication, sign-in records and technical logs (IP address, browser, time) for security and abuse detection.
• Alerts: your email if you ask to be told about new listings for an event. You can unsubscribe with the link in every such email.

We process buyer and seller data to perform the contract (Art. 6(1)(b) GDPR), to meet legal obligations, in particular accounting, tax and reporting duties (Art. 6(1)(c) GDPR), and on the basis of our legitimate interest in running the marketplace safely, preventing fraud and enforcing claims (Art. 6(1)(f) GDPR). Listing alerts are sent at your request.

We process a seller's birth number solely because the law on reporting the income of sellers on digital platforms requires it, and we show it nowhere other than in your profile.

We share data only with those who need it to provide the service:

• GOPAY s.r.o., the payment gateway operator, to process payments and refunds.
• Bankovní identita, a.s. and your bank, to verify a seller's identity; the bank passes us the result, we never see the documents.
• The Eventlook ticketing network, to verify and reissue tickets from that network; the buyer receives the new ticket at their email.
• Our bank, to send payouts to sellers and match incoming verification payments.
• Technical infrastructure providers: hosting and storage in the European Union, email delivery, error tracking. Each is bound by a data processing agreement.
• The Czech Financial Administration, for the statutory reporting of sellers' income, and public authorities where the law requires it.

We keep order, payout and payment data for 10 years from the end of the year they were made, as accounting and tax rules require. Seller data needed for income reporting is kept for the period set by law. Uploaded tickets (PDF) are deleted after the event. Sign-in links are valid for 15 minutes and then removed. Technical logs are kept for at most 12 months. Alert data is deleted as soon as you unsubscribe.

You have the right:

• to access your data and receive a copy,
• to have inaccurate data corrected; sellers can edit most data in their profile,
• to have data we no longer need erased, and to restrict processing,
• to object to processing based on legitimate interest,
• to portability of the data you gave us,
• to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz.

The connection to the marketplace is encrypted. We do not store card details; the payment gateway handles them. Only authorized staff can access data, and only as far as their work requires. Sellers sign in with a one-time link without a password; every change of bank account is confirmed by email.

We use only strictly necessary cookies: for seller sign-in and for remembering the chosen language. We use no analytics or advertising cookies, which is why there is no consent banner.

We may update this policy; the new version is published on this page with its effective date. This policy is effective from October 9, 2026.