Privacy policy

CK Matkali s.r.o. (marketing brand Shuttermoon, used for Photography themed tours)

Information for the personal data subject - Annex No. 2 to the Travel Agreement

Information for the personal data subject – data processed to fulfil contractual and legal obligations Information from the controller for the personal data subject on the processing activities of personal data obtained from the data subject to fulfil contractual and legal obligations pursuant to Article 12 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, General Data Protection Regulation (hereinafter referred to as the “Regulation”), maintained by the entity: CK Matkali s.r.o., Company ID 23637935, using a marketing brand Shuttermoon for Photography themed Tours with its registered office at Korunní 2569/108, Vinohrady, 101 00 Prague 10

Manager Ing. Jan Miřacký, contact details: email: Jan Miřacký - Matkali <jan.miracky@matkali.cz> telephone: +420 737 382 203 www.matkali.cz (hereinafter referred to as the “Controller”)

The Controller provides you (the Client) with the following information in accordance with the Regulation

1. Contact details of the Data Protection Officer

A Data Protection Officer has not been appointed by the Controller, as the Controller is not obliged to do so.

2. Description of the categories of data subjects that the Controller processes about you, categories of personal data and purposes of their processing

Categories of personal data that the Controller processes about you in the performance of contractual and legal obligations:

• name and surname

• contact address

• e-mail

• telephone

Purpose of processing personal data: fulfilment of legal obligations and contractual obligations related to contracts concluded via e-mail, telephone order or order via the Controller’s website operated by the Controller, in particular contracts for the provision of guide services.

3. Description of the categories of recipients to whom your personal data may be made available or transferred, including recipients from third countries or international organizations

All personal data may be provided to providers of delivery, legal and accounting services, as well as to operators of databases for data storage, and to other suppliers of the Controller, if this is necessary for the performance of the contract with us or if you have ordered the provision of these services. All of the above entities cooperate with the Controller on the basis of a contractual relationship and are obliged to ensure their protection on the basis of this contractual relationship.

Personal data will not be provided to recipients from third countries or international organizations.

4. Information about your rights

a) The Controller will provide you with information on the measures taken pursuant to Articles 15 to 22 of the Regulation upon request, without undue delay and in any case within one month of receiving the request.

b) In particular, you have the right to request from the Controller access to the personal data that it processes about you, their correction in the event of inaccuracy, and their deletion (right to be forgotten), or restriction of processing, and to object to processing - i.e. to object to the processing of personal data at any time and without giving a reason. In particular, you are entitled to obtain from the Controller confirmation as to whether or not personal data concerning you are being processed. The above rights are exercised by delivering a letter or e-mail to the Controller's address specified above. The Controller points out that for personal data obtained to fulfill legal and contractual obligations, it is not possible to provide the service you request if you do not provide us with contact details, since without contact details it is not possible to fulfill the contract (deliver the goods).

c) You are entitled to receive the personal data concerning you, which you have provided to the Controller, in a structured, commonly used and machine-readable format, and the right to transmit this data to another controller without the Controller preventing you from doing so. The above rights are exercised by delivering a letter or e-mail to the Controller's address specified above.

d) In the event that personal data is processed on the basis of your consent, you are entitled to withdraw it at any time by delivering a letter or e-mail to the Controller's address specified above,

e) You are entitled to file a complaint about the Controller's actions at any time with the supervisory authority, which is the Office for Personal Data Protection,

f) The Controller does not make automated decisions, including profiling

5. Information on planned deadlines for the deletion of individual categories of personal data

Your personal data of subjects processed on the basis of legal and contractual obligations will always be deleted without undue delay after the expiry of the legally specified period for which the Controller is obliged to store such data (in particular the periods for archiving accounting documents).

For data processed on the basis of your consent, they will always be deleted without undue delay after the expiry of the period for which they are needed; at the latest, however, immediately after the consent to processing expires.

6. Description of the technical and organizational security measures taken by the Controller to protect your personal data

a) Protection against unauthorized access to personal data

The Controller is protecting access to recording devices and documentary evidence in particular as follows: recording devices and documentary evidence are located in the Controller’s lockable room. Only authorized persons have access to the room. Other persons have access to the room only when accompanied by authorized persons. Software access to recording devices s protected by a username and password.

b) Protection against unauthorized reading, copying, transfer, modification and deletion of your personal data

Access to personal data is protected by a username and password. The Controller’s system records all access to individual personal data. Authorized persons are trained, and each additional training will be recorded in the Controller’s operating log. Regular checks of system settings and compliance with the Controller’s internal regulations are also carried out.

c) Protection against external attacks

The Controller’s system is connected to the Internet. Measures have been taken against attacks from the external network in the form of firewall security, login and password security, HTTPS protocol and measures of the web hosting service provider. Another measure is regular system checks by persons authorized by the Controller.

d) Protection against unauthorized use of access data (negligence)

Each access to the Controller’s system is recorded, and individual accesses can be compared with each other. The access passwords to the Controller’s system are changed regularly.

e) Protection against ignorance

All authorized and authorised persons are properly instructed and will be trained regularly. The instruction and training consists mainly of informing these persons about the functionality of the Controller’s system, recording devices and software (including updates), as well as about the rights and obligations when processing personal data within the meaning of the Regulation.

Status as of ………………. December 2025

I confirm receipt of Annex No. 2 to the Travel Agreement on …………………..

________________________

Client