Personal Data Protection Policy (GDPR)

Effective from: 12 October 2026

Name: Občianske združenie AdvenTour

Company identification number (IČO): 53613716

Registered office: J. Bodona 1702/12, 979 01 Rimavská Sobota, Slovakia

Email: ozadventour@gmail.com

Website: www.oz-adventour.sk

Article I – Introductory Provisions

This policy explains how the personal data of website visitors, event participants, legal guardians, members, volunteers and partners of AdvenTour Civic Association are processed.

The Association complies with Regulation (EU) 2016/679 (GDPR), Slovak Act No. 18/2018 Coll. on Personal Data Protection and other relevant legislation.

Article II – Data Controller and Contact

The data controller is AdvenTour Civic Association, identification number 53613716, registered office at J. Bodona 1702/12, 979 01 Rimavská Sobota, Slovakia. Please send requests to ozadventour@gmail.com.

Contact person for personal data protection matters: Bc. Gabriella Csúsz. Requests may be sent to ozadventour@gmail.com.

Article III – Categories of Data

Depending on the purpose, we process names, surnames, ages or dates of birth, contact details, addresses, registration and participation details, payment information, transport and accommodation details, and legal guardians' contact details.

Where necessary to ensure participants' safety, we may process appropriate information about allergies and health restrictions. We process such data only where there is a legal basis under Article 6 GDPR and an applicable exception under Article 9(2) GDPR; where processing is based on explicit consent, that consent may be withdrawn.

Photographs and videos may be taken at events. The website may process technical data, including IP addresses and cookies.

Article IV – Purposes and Legal Bases

Registration, communication and event delivery: Article 6(1)(b) GDPR where a contractual relationship exists; otherwise the legal basis is determined according to the nature of the activity.

Accounting and mandatory reporting: Article 6(1)(c) GDPR. Membership records and project administration: Article 6(1)(b), (c) or (f), as appropriate.

Photographs for public promotion: consent or another appropriate legal basis, depending on the circumstances, while respecting personality rights; identifiable photographs of minors require particular care.

Responding to enquiries: Article 6(1)(b) or (f). Marketing communications: only in compliance with electronic communications rules and on an appropriate legal basis.

Article V – Minors and Health Data

For children, we collect necessary information about legal guardians and emergency contacts. Consent to participate does not replace separate consent to personal data processing where such consent is required.

Access to health data is restricted to authorised persons to the extent necessary. Photographs of children are published only where the applicable legal requirements are met.

Article VI – Recipients and Processors

Where necessary, data may be disclosed to:

• accountants or accounting firms;
• IT and hosting service providers;
• email and communications service providers;
• payment service providers;
• invoicing or administrative system providers;
• persons entrusted with organising or leading a particular activity, where necessary for its safe and proper delivery;
• legal or professional advisers, where necessary;
• public authorities, courts or other entities where required by law.

Article VII – Transfers Outside the EEA

International projects may involve sharing data with partners abroad. Transfers outside the European Economic Area (EEA) are subject to the mechanisms set out in Chapter V GDPR.

Article VIII – Data Retention

We retain personal data only for as long as necessary to fulfil the purpose for which they were collected, or for the period required by law or project funding conditions. After the relevant period expires, we securely erase or anonymise the data unless another lawful ground for continued retention exists.

We retain health data only for as long as necessary in connection with participant safety or compliance with legal obligations. Accounting and grant documentation is retained in accordance with statutory and contractual retention periods; membership data is retained during membership and subsequently only to the extent necessary.

Photographs are retained for as long as the purpose and legal basis remain valid, subject to regular review.

Article IX – Rights of Data Subjects

Subject to the conditions of GDPR, data subjects have rights of access, rectification, erasure, restriction of processing, data portability, objection, withdrawal of consent and protection against decisions based solely on automated processing.

Requests may be sent to ozadventour@gmail.com. We generally respond within one month; this period may be extended as permitted by GDPR. Complaints may be lodged with the Slovak Office for Personal Data Protection (www.dataprotection.gov.sk).

Article X – Security

The Association implements appropriate technical and organisational measures, including access restrictions, secure accounts, document protection, training of authorised persons and secure data transfers. In the event of a personal data breach, it follows Articles 33 and 34 GDPR.

Article XI – Cookies

The website may use cookies necessary for its operation and, where applicable, other technologies. Where consent is required for a particular technology, it must be obtained before that technology is used, and visitors must be able to withdraw their consent. Details of the cookies used and options for managing them are provided through the available website settings, where such functions are in use.

Article XII – Photographs and Videos

The Association documents events and may publish photographs and footage on its website, social media and in project materials, subject to the applicable requirements.

Where processing is based on consent, consent may be withdrawn at any time by email. Withdrawal does not have retroactive effect. Requests to remove images or footage are assessed individually.

Article XIII – Final Provisions

The current version of this policy is available at www.oz-adventour.sk. The Association may update it when its processing activities or applicable legislation change.

Effective date: 12 October 2026