This document describes how Pulsation s.r.o. (“controller” or “we”) processes personal data in connection with Pulsation drum and bass events, the pulsation.agency website, ticket sales, and marketing. Merch sales via an e-shop are not currently active.
1. Controller
Controller:
Pulsation s.r.o.
Legal form: společnost s ručením omezeným
Company ID (IČO): 08656525 · VAT ID (DIČ / IČ DPH): CZ08656525
Registered office: Nové sady 988/2, Staré Brno, 602 00 Brno, Česká republika
Correspondence address: Nové sady 988/2, Staré Brno, 602 00 Brno, Česká republika
Registry: Krajský soud v Brně, spisová značka C 114457
Statutory body: Peter Lörinc a Peter Rajci, jednatelé (společnost zastupují oba jednatelé společně)
Privacy contact: info@pulsation.agency.
No data protection officer (DPO) has been appointed. GDPR requests are handled by the controller at info@pulsation.agency.
2. What data we process
- Identity and contact data — name, email, phone, address (for direct communication or if merch sales resume later).
- Ticket and event attendance data — ticket type, order code, purchase history, and age verification at entry where required (18+).
- Payment data — payment and order status information. Card details are processed only by the payment gateway / ticket seller, not directly by the controller.
- Marketing preferences — cookie / measurement consent (Meta Pixel); we do not currently run a newsletter.
- Technical website data — IP address, browser type, cookies, server logs (see Cookie Policy).
- Event photo and video — professional photo/video production (including aftermovies) in publicly accessible event spaces for marketing. We do not operate CCTV security cameras.
- Communications — content of emails, social messages, or contact forms.
3. Purposes and legal bases
- Ticket sales and contract performance (Art. 6(1)(b) GDPR) — event registration, issuing tickets, communicating programme or safety changes.
- Legal obligations (Art. 6(1)(c)) — accounting, tax records, archiving under applicable law.
- Legitimate interest (Art. 6(1)(f)) — event security, fraud prevention, internal statistics, documenting and promoting events (photo/video / aftermovies), proportionate marketing to existing customers, and pursuing legal claims.
- Consent (Art. 6(1)(a)) — optional analytics / marketing cookies (Meta Pixel), any future newsletter; publishing photos beyond legitimate interest when requested by the data subject.
4. Where we get data
- Directly from you — when buying a ticket, granting cookie consent, or contacting us.
- From the ticket seller GoOut — data needed for sales records and entry.
- From publicly available sources — artist or partner profiles used in event promotion.
- Automatically from your device when you visit the website.
5. Who we share data with
We disclose personal data only as necessary to these categories of recipients (processors or independent controllers):
- GoOut — ticket sales and entry checks (goout.net ). Please also review their privacy policy.
- IT and hosting — Vercel (hosting of pulsation.agency).
- Website analytics — Meta Pixel; Vercel Analytics (cookieless) (Meta Pixel only with consent; Vercel Analytics cookieless). We do not use a newsletter or Google Ads / GA4 on this site.
- Photo / video team — photography: J_JURO; professional video/photo partners per event.
- Security and medical / emergency services — where event safety or a legal duty requires it.
- Public authorities — where required by law.
We have (or will enter into) data processing agreements with processors under Art. 28 GDPR.
6. Transfers to third countries
Some providers may process data outside the EEA, especially in the USA. In that case we ensure appropriate safeguards — EU Standard Contractual Clauses, an adequacy decision, or another mechanism under Chapter V GDPR. On the current site: Meta Platforms (USA — pixel / Conversions API, consent only); Vercel Inc. (hosting / Analytics — per their processor terms).
7. Retention
We keep personal data only as long as needed for each purpose:
- Tickets and related communication: 3 years from the event date (limitation period for private-law claims), unless a specific statute requires longer.
- Accounting and tax records: according to Czech tax and accounting rules (typically 5–10 years).
- Marketing with consent: until consent is withdrawn; inactive contacts are reviewed periodically (max. 3 years from last interaction).
- Website logs and cookies: per the Cookie Policy (cookie consent: 12 months).
- Photo / video production and aftermovies: raw and final photo/video production material (including aftermovies) is kept for as long as we have a legitimate interest in documenting and promoting the Pulsation brand, for a maximum of 5 years from publication of the specific material, unless an earlier successful objection or erasure request applies. We do not operate CCTV.
After the retention period we delete or anonymise the data unless another legal ground requires further processing.
8. Event photo, video and audio
At Pulsation events we create professional photos, video, and audio recordings (including aftermovies) solely for documenting, marketing, and promoting the Pulsation brand. This is production filming, not a security camera system. Recordings are made in publicly accessible event areas.
Legal basis: the controller’s legitimate interest (Art. 6(1)(f) GDPR) and/or consent where required. If you do not want to be recognisable in a specific shot, email info@pulsation.agency. The right to object (Art. 21 GDPR) is not tied to a fixed deadline after publication — we assess each request and reply within 30 days. For crowd shots, full erasure may be technically difficult; we will offer a proportionate solution (blurring, withholding that material).
9. Security
We apply appropriate technical and organisational measures — access control, encrypted transport (HTTPS), limited system access, and contractual safeguards with processors.
In case of a personal data breach we follow Arts. 33 and 34 GDPR and notify the competent supervisory authority and affected persons where the severity of the incident requires it.
10. Your rights
Under the GDPR you have these rights (within legal limits):
- Right of access (Art. 15)
- Right to rectification (Art. 16)
- Right to erasure — “right to be forgotten” (Art. 17)
- Right to restriction of processing (Art. 18)
- Right to data portability (Art. 20)
- Right to object to processing based on legitimate interest (Art. 21)
- Right to withdraw consent at any time — withdrawal does not affect prior lawful processing
- Right not to be subject to automated decision-making with legal effects (Art. 22) — we do not carry out such decision-making
Send requests to info@pulsation.agency. We will verify your identity and reply within 30 days (or an extension under Art. 12 GDPR).
If you purchased via GoOut, some data may be held by that partner — we will redirect you or provide their contact so you can exercise rights with them.
11. Complaint to a supervisory authority
You may lodge a complaint with the Czech Office for Personal Data Protection (controller is established in Czechia):
Úřad pro ochranu osobních údajů
Pplk. Sochora 27, 170 00 Praha 7, Czech Republic
uoou.cz
If you are in Slovakia, you may also contact the Slovak Office for Personal Data Protection (dataprotection.gov.sk ).
12. Children
Pulsation events are for persons aged 18+. We do not knowingly collect children’s data without a guardian’s consent. If we learn we have processed such data, we will delete it.
13. Changes to this document
We may update this document when processes, laws, or services change. The current version is always published on this page. For material changes we may notify you by email or a prominent notice on the site.