This is an informative translation. The legally binding version of this document is the Czech one, available at https://andrekohout.cz/privacy. It was translated automatically and is provided for convenience only; in case of any discrepancy, the Czech wording prevails.

Personal Data Processing Policy

of Andrého, s.r.o., IČO: 14128543, with registered office at Lublaňská 267/12, Vinohrady, 120 00 Praha 2, a company registered in the Commercial Register maintained by the Municipal Court in Prague under file no. C 360739, represented by André Kouhout, managing director (hereinafter also only the "controller" or "we"),

for the sale of goods or tickets to events through the online store located at www.andrekohout.cz and activities related to the sale (in particular marketing).

The purpose of this document is to acquaint you with all the information concerning the processing of your personal data. We recommend that you read this personal data processing policy. If you have any further questions regarding the processing of your personal data, please contact us at the e-mail jajsem@andrekohout.cz or by post at the address stated above.

We process your personal data for reasons laid down by law, for the purpose of performance of a contract or on the basis of our legitimate interest. If the processing of personal data does not fall under any of these three stated reasons, we will request your consent. We make sure that your personal data is processed in accordance with the following principles:

reasonable limits, meaning that we use your personal data to the extent necessary to fulfil the purpose for which it is provided;
transparency, in other words, we inform you in advance what personal data we process, why, for how long and to whom we transfer your personal data; and
security, we always work with technologies and internal procedures so that your personal data is safe; it goes without saying that we monitor and evaluate our internal settings and adopt them in line with the development of modern technologies.

For better clarity and orientation, the terms that are frequently repeated in this policy are listed below.

E-shop — the online store operated by the controller, available at

www.andrekohout.cz;

GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council;

Commercial — usually an e-mail message or SMS sent to the User for the purpose of

communication — promoting similar products and services;

Order — a transaction completed by the customer by pressing the relevant button

Order with obligation to pay with the customer's intention to conclude a purchase contract for goods or tickets to an event, which obliges them to pay the price of the goods or tickets to the event; Personal data means any information about a data subject (customer or user) on the basis of which they can be directly or indirectly identified;

User — a natural person to whom the Personal data relates, most often a customer

or a potential customer, or a user of our website, also referred to as "You";

The Processor carries out personal data processing activities on the basis of a contract or other authorisation for the controller;

Processing is any operation or set of operations on personal data or sets of personal data, which is performed with or without the aid of automated procedures, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or any other making available, alignment or combination, restriction, erasure or destruction; Special categories of personal data means such personal data which reveal racial or ethnic origin, political opinions, religious belief or philosophical conviction, trade union membership, health status or sexual life or sexual orientation of a natural person. Genetic and biometric data are also considered a special category of data, if they are processed for the purpose of unique identification of a natural person; We do not process this personal data.

1. What personal data we process, how we obtain it, for what purpose and

FOR HOW LONG WE RETAIN IT

We process the following personal data about you:

name and surname,
contact details (in particular e-mail, telephone number),
delivery address,
age,
billing details and bank details (data necessary for keeping accounts and making payments for goods or tickets to an event),
notes to the order, or specification of the order according to your wishes,
identification data of an entrepreneur (if you are an entrepreneur),
information you communicate to us as part of communication with us (in particular, this will be your questions and answers to your queries, communication with you),
comments added by you to our posts on social networks (especially Facebook, Instagram, TikTok), as well as the name (nickname) of your profile on these social networks and information publicly accessible by you on your profiles,
IP address,
cookies.

We do not process any Special categories of personal data.

2. How we process personal data

General information on the duration of Processing of personal data. We process your personal data to the necessary extent for the entire duration of the purchase contract and further for the period necessary for the exercise of rights and obligations arising from the contractual relationship between you and us and the possible assertion of claims from these contractual relationships (e.g. exercise of rights from defects within a complaint, exercise of the warranty on goods, etc.). Please note that in some cases the period for processing personal data may be up to 15 years after the fulfilment of the Contract in order to protect our interests.

3. For what purpose we process personal data

E-shop website. We process information about when you visit and browse our website. This information may include, for example, IP address, date and time of access to our website, information about your internet browser, operating system or your language settings. We may also look into the history of your behaviour

on the website, e.g. which links on our website you visit and which offered goods are displayed to you. However, information about your behaviour on the website is anonymised for the sake of your maximum privacy.

If you access our website from a mobile phone or similar device, we may also process information about your mobile device (data about your mobile phone, etc.).

We may collect this data as part of a log or using cookies or other tracking technologies.

Improving the provision of our services, promotion of goods, events and services. We may process Personal data from publicly available sources, our marketing partners and combine it with Personal data that is voluntarily provided to us. We take measures to ensure that third parties are legally entitled to provide us with this information. For example, this will be demographic information, IP addresses and cookies. The reason is to improve the provision of our services and to promote the sale of our goods or events.

Performance of the contractual relationship. The legal basis for the Processing of personal data is the performance of the purchase contract, or the proper handling of the Order and the related obligations.

Personalised advertising. We cooperate with third parties to manage and display our advertising on third-party websites.

Competitions and other promotional events. On our website or through social networks, we may conduct surveys, hold competitions or other promotional events. Your participation in our promotional events is voluntary. As part of these surveys, competitions and promotional events, we may ask you for Personal data, e.g. name and surname, address, age, telephone number, e-mail address, username and similar data. We will use the Personal data you provide to us to administer these promotional events or for another purpose, if so stated in the terms and conditions of the particular promotional event.

Social networks. We have a profile on Facebook, Instagram and TikTok. All information, communications or materials provided through the social network platform are also provided according to the personal data processing policies of these platforms. The protection of personal data is handled separately within each of the mentioned platforms.

Registration for commercial communications (newsletter). If you register for our newsletter, we will send you interesting information and offers for the promotion of our goods, or events and services on the basis of the consent you have granted. When you no longer want to receive e-mails, then click on the unsubscribe link ("unsubscribe"), which is in the footer of each of our e-mails.

Commercial communications for our customers (newsletter). We may send commercial communications on the basis of our legitimate interest in promoting our goods, or events and services to customers, until they themselves unsubscribe from receiving commercial communications. This is enabled by a simple click-through in every commercial communication that we send in the form of an e-mail. On the basis of our legitimate interest in promoting our goods, or events and services, we may also use the telephone number communicated to us by the user for the purpose of disseminating commercial communications in the form of SMS. In such a case, the user can unsubscribe from receiving SMS by a short message to the e-mail: jajsem@andrekohout.cz. You can object at any time to the processing of your personal data on the basis of our legitimate interests (more in the section devoted to your rights).

Customer reviews. You can share your shopping experience and evaluate individual goods or events in the Reviews section on our website. We may use other processors to evaluate your feedback regarding individual purchased goods or events.

Customer satisfaction evaluation. We ascertain your satisfaction with your purchase through a questionnaire on our E-shop. This is sent to you shortly after you make a purchase with us, unless you express your disagreement with this. Your evaluation will remain anonymous, we do not link it anywhere in public together with your Personal data (e.g. name or e-mail). We may use other processors for sending questionnaires and evaluating your feedback regarding individual purchased goods or events.

Communication with customer support or other queries. If you have contacted us by e-mail, by telephone or on social networks, then we process your personal data for the purpose of handling the query.

Card payment. If you enter your credit card details to us, we do not have access to the complete data. We only know that you are paying by card and the card details are processed by the recipients of this data, who process the payment for us.

Events. On our E-shop you can, among other things, also purchase tickets (participation) to various events. During events, your likeness may be incidentally recorded both in photographs and in video taken at the event. In the event that you do not wish these recordings to be made at all during the event, please contact us before the start of the event at the e-mail jajsem@andrekohout.cz or in person upon entry to the event. In such a case we will be able to secure a place for you outside the audiovisual recording.

4. Summary of the reasons and purposes for processing your personal data

We understand that it is sometimes difficult for you to work through the amount of text devoted to how and why we process your Personal data and where we obtain it. In order to provide you with basic information about the processing of your Personal data quickly and clearly, we have summarised everything in this clear table:

Purpose of processing — Which personal Legal Duration of processing Processors

of Personal data — data is concerned basis for

processing of Personal data

Handling of the — name, surname, e- Performance For the duration of the Andre Kohout,

Order — mail, telephone of the contract contractual relationship Zemská 37, Teplice,

number, delivery of the customer with us 41501 address and information about Zásilkovna s.r.o., the ordered goods Českomoravská or tickets to an 2408/1a, Libeň, 190 event 00 Praha 9

Keeping accounts billing details, Performance Accounting data is Fakturoid s.r.o. bank details and of the contract processed for V Pláni 532/7 information about and fulfilment a period of 5 years, tax Praha - Lhotka the ordered goods of a legal documents for a period 142 00 or tickets to an obligation of 10 years event

Handling of — name, surname, e- Fulfilment For the duration of the Zásilkovna s.r.o.,

complaints from — mail, telephone of a legal contractual relationship

consumers or — number of the obligation of the customer with us and

grievances customer, data on subsequently for a period Českomoravská the concluded of 4 years from its 2408/1a, Libeň, 190 purchase contract, termination 00 Praha 9 necessary data on payments

Direct marketing — name, surname, e- Legitimate 2 years from the ECOMAIL.CZ, s.r.o.,

(in particular sending — mail, telephone interest last active with registered office at Na

newsletters — number of the viewing of the Zderaze 1275/15,

to customers) — customer newsletter, Nové Město, 120 00

unless you unsubscribe Praha 2 earlier

Marketing and — name, surname, e- Legitimate For the duration of Instagram and

promotion of our — mail, telephone interest in the consent Facebook,

website, — number of potential promoting Facebook Ireland

goods and — customers, IP similar Ltd., with registered office at

events — addresses and other goods or Grand Canal

technical events and Square, Grand identifiers consent Canal Harbour, Dublin 2 Ireland

Analysis of — pseudo- Legitimate The specific storage Google Analytics,

website traffic, — anonymised interest and period for cookies Google LLC,

security of — identifiers consent differs according to DE19808

our website, — of registered the specific type of Wilmington,

detection — users, IP cookie files, for the Corporation Service

of server errors — address duration of the consent Company, 251 Little

and prevention — Falls Drive, USA

of fraud and attacks on the server

Processing and — name, surname, Consent 2 years from the Instagram and

evaluation of — address, age, last end of the competition, Facebook,

the competition, announcement telephone number, e- unless you withdraw Facebook Ireland and publication mail address, your consent earlier - Ltd., with registered office at of the winner on our name of the or another period, Grand Canal website and user account if it is stated Square, Grand social networks differently in the Canal Harbour, terms of the competition Dublin 2 Ireland

Reply to a — name, surname, e- Consent to After your query is Google Ireland

message sent — mail, telephone processing handled, the Limited, with registered office at

via e-mail or — number for the purpose Personal data will be Gordon House

social networks — of handling erased, this Barrow Street

the query does not apply if Dublin 4 you become Ireland our customer

Instagram and Facebook, Facebook Ireland Ltd., with registered office at Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland

We do not have data about your payment cards; only the secure payment gateway and the relevant banking institution have these.

5. Our obligations from the point of view of accounting and taxes

Please note that we process a number of personal data for reasons for which we are obliged to do so by law. We have an obligation to archive accounting documents and accounting records (invoices) for a period of 5 years starting from the end of the accounting period to which they relate. The invoice contains the following personal data: name, surname, e-mail address, billing address, or other identification of the User and details of the purchased goods or tickets to an event.

Please further note that we have an obligation to archive tax documents for a period of 10 years from the end of the tax period in which the supply took place. The tax document contains the following personal data: name, surname, e-mail address, billing address, or other identification of the User and details of the purchased goods or tickets to an event.

6. What measures have we adopted to protect your personal data?

Technical measures. We have adopted and undertake to maintain appropriate technical measures, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the Processing of personal data as well as the variously probable and variously serious risks for the User, in all areas where Processing of personal data takes place (in particular the operation of the website, the operation of the E-shop, employee agenda, communication with customers). The technical measures adopted include:

A. regular backup of the User's data;

B. updating of antivirus software systems;

C. access passwords to information systems where Personal data will be processed and access authorisations are controlled at the level of individuals.

Organisational measures. We have adopted and undertake to maintain the following measures:

A. our employees who have access to Personal data are bound by confidentiality; and

B. our employees are acquainted with the rules of safe work on work devices, including the principle of Personal data protection;

C. our employees are regularly trained in the rules of safe handling of Personal data, especially on work devices.

7. When do we transfer your personal data to third parties?

Your personal data may be transferred to our business partners (Processors) or other third parties, if required by law.

Processors. We only use vetted Processors with whom we have concluded a written contract and who provide us with at least the same guarantees as we provide to you. These are

only Processors who are from the European Union, or from countries that have been declared and recognised as safe, or from countries with which we have concluded standard contractual clauses in accordance with Art. 46 GDPR and who provide your Personal data with a comparable level of protection as in the case of the application of the GDPR and Czech legal regulations. All these Processors of ours are bound by the obligation of confidentiality and may not use the Personal data provided for any purposes other than those for which we made them available in accordance with this policy. We have listed the specific Processors with each individual reason and purpose of the Processing of personal data.

Legal obligations. Apart from Processors, we may transfer Personal data to third parties if required by law or in response to legal requirements of public authorities or at the request of a court in legal disputes.

8. What rights do you have?

It is possible to ask us for access to personal data, to request correction, change, erasure or restriction of the processing of personal data where it is inaccurate or has been processed contrary to applicable personal data protection laws. You have the right to data portability, to object to the processing of personal data, the right to withdraw consent to the processing of personal data and the right not to be subject to automated individual decision-making, including profiling (which we do not carry out).

Your rights concerning the processing of Personal data can be exercised at the e-mail jajsem@andrekohout.cz, in person or by post to our address.

We strive to be able to comply with your requests without delay, however no later than within 1 month. Nevertheless, circumstances may arise under which we cannot provide access (for example, if the requested information threatens the privacy of other persons or other legitimate rights, or where the costs of providing access would be disproportionate to the risks threatening the privacy of the individual in the given case). We may take reasonable steps to verify the identity of the user before we take any steps regarding the rights of data subjects.

Right of access to personal data

Pursuant to Art. 15 GDPR you have the right of access to personal data, which includes the right to obtain from the controller:

confirmation as to whether it processes personal data,
information about the purposes of processing, the categories of personal data concerned, the recipients to whom the personal data have been or will be disclosed, the envisaged period of processing, the existence of the right to request from the controller the rectification or erasure of personal data relating to the Users or restriction of their processing or to object to such processing, the right to lodge a complaint with a supervisory authority, all available information about the source of the personal data, if it is not obtained from the Users, the fact that automated decision-making, including profiling, takes place, about appropriate safeguards when transferring data outside the European Union,
in the event that the rights and freedoms of other persons will not be adversely affected, also a copy of the personal data. In the case of a repeated request, the controller will be entitled to charge a reasonable surcharge for a copy of the personal data.

Right to rectification of inaccurate data

Pursuant to Art. 16 GDPR you have the right to rectification of inaccurate personal data. You also have an obligation to notify changes to your personal data. At the same time, you are obliged to provide cooperation if it is found that the personal data we process is not accurate. We will carry out the rectification without undue delay, but always with regard to the given technical possibilities.

Right to erasure

Pursuant to Art. 17 GDPR you have the right to erasure of personal data concerning you, unless we demonstrate legitimate grounds for processing such personal data. We have in place mechanisms for ensuring automatic anonymisation or erasure of personal data in the event that it is no longer needed for the purpose for which it was processed.

Right to restriction of processing

Pursuant to Art. 18 GDPR you have the right to restriction of processing until the matter is resolved, if you contest the accuracy of the personal data, the grounds for its processing or if you lodge an objection to its processing.

Right to notification of rectification, erasure or restriction of processing

Pursuant to Art. 19 GDPR you have the right to notification in the case of rectification, erasure or restriction of processing of personal data. If personal data is rectified or erased, we will inform the individual recipients, except in cases where this proves impossible or requires disproportionate effort.

Right to data portability

Pursuant to Art. 20 GDPR you have the right to portability of data concerning you which you have provided to the controller, in a structured, commonly used and machine-readable format, and the right to request the transmission of such data to another controller. If, in connection with our contractual obligations or on the basis of consent, you provide personal data and its processing is carried out by automated means, you have the right to obtain such data in a structured, commonly used and machine-readable format. If it is technically feasible, the data can also be transmitted to a controller designated by you, provided that the person acting on behalf of the relevant controller is duly designated and it will be possible to authorise them. In the event that the exercise of this right could adversely affect the rights and freedoms of third parties, your request cannot be complied with.

Right to object to the processing of personal data

Pursuant to Art. 21 GDPR you have the right to object to the processing of personal data on the grounds of legitimate interest. In the event that we do not demonstrate that there is a compelling, legitimate ground for processing which overrides your interests or rights and freedoms, we will terminate the processing on the basis of the objection without undue delay. If the objection is lodged in the case of processing related to direct marketing, then we will terminate the processing without undue delay.

Right to withdraw consent to the processing of personal data

Consent to the processing of personal data for marketing and commercial purposes can be withdrawn at any time. The withdrawal must be made by an explicit, comprehensible and definite expression of will.

Automated individual decision-making, including profiling

You have the right not to be subject to any decision based solely on automated processing, including profiling, which would have legal effects for you or similarly significantly affect you. However, we state that we do not carry out automated decision-making without the influence of human assessment with legal effects for the Users of data.

CONCLUSION

This Personal Data Processing Policy may be changed only in writing. Users will be informed of this through our website.

In the event of any questions concerning our Personal Data Processing Policy, please contact us at the e-mail jajsem@andrekohout.cz

If you are dissatisfied, then you may at any time submit a suggestion or complaint to the Office for Personal Data Protection, with registered office at Pplk. Sochora 727/27, 170 00 Praha 7 – Holešovice (more at https://www.uoou.cz/).

This personal data protection policy is effective from 30.06.2023