Privacy notice

This notice describes how Harafica handles the personal data of people who write to it through this website, order a CD, book the band or sign up for its news.

The Czech version of this notice is the binding one; this is a translation for convenience.

Who processes the data

The controller is HARAFICA Records s.r.o., company number 22310436, registered at Sokolovská 1406/184b, 180 00 Prague 8, Czech Republic. You can write to us at cm@harafica.eu.

What we collect and why

Booking enquiry. In the form you give us your name, e-mail, phone number, the name of the event, the venue, the date, the start, how long we are to play and a note. We need them to answer you and to agree on the performance. The legal basis is the negotiation and performance of a contract under Article 6(1)(b) GDPR.

Order from the shop. When ordering you give us your name, e-mail, phone number and either a delivery address or a Zásilkovna pickup point, together with what you ordered and any note. We need them to fulfil the order, which is again the performance of a contract. What ends up on the tax document we keep because the law requires it.

News by e-mail. When you sign up for the news you give us only your e-mail address. We send it news about concerts and new recordings, usually a few times a year. The legal basis is your consent under Article 6(1)(a) GDPR. The sign-up takes effect only once you confirm it in the e-mail we send you straight away; you can withdraw your consent at any time with the unsubscribe link in every message.

Protecting the forms. The forms are protected against bots by Cloudflare Turnstile, which sees your IP address and basic information about your browser when you submit. The legal basis is our legitimate interest in not receiving spam.

Map of the concert. On a concert's page we show a map preview from Google. Your browser downloads the picture straight from Google, which sees your IP address and basic information about your browser. The legal basis is our legitimate interest in showing you where the concert is. The links to Google Maps, Waze, Mapy.cz and Apple Maps open that service only when you click them, and from then on its own privacy terms apply.

Running the website. Our hosting provider keeps operational logs that include IP addresses. They serve the security and running of the site; the legal basis is legitimate interest.

The site uses no analytics and no advertising tools.

Who we pass the data to

• Zásilkovna, when you have goods delivered. It receives your name, address or pickup point, phone number and e-mail, without which it cannot deliver.
• Cloudflare, which runs this website and the Turnstile service.
• Google, from which the map preview on a concert's page is loaded. It sees your IP address.
• Our hosting provider, on whose server the internal system that keeps enquiries and orders runs.
• Our e-mail provider, through which we correspond.
• Our accountant, who processes the accounting documents.
• Mailchimp (The Rocket Science Group LLC, USA), through which we send the news. It receives the e-mail address and the language you read in, and only from people who signed up for the news.

We pass the data to nobody else, we do not sell it, and we send marketing only to those who signed up for the news themselves.

Cloudflare, Google and Mailchimp are US companies, so the data may be processed outside the European Union. That happens under the standard contractual clauses approved by the European Commission, or under another safeguard that the GDPR requires for such a transfer.

How long we keep it

An enquiry that came to nothing we keep for as long as we might return to it, and no longer than two years from the day it reached us. Data about a concert we played and about an order we keep for as long as rights under the contract can be exercised, and accounting and tax documents for as long as Czech accounting and tax law requires. An e-mail address signed up for the news we keep until you unsubscribe; a sign-up nobody confirmed is discarded by Mailchimp after a while.

Cookies and browser storage

This site stores no cookies in your browser. It puts two things into local storage, and only when you ask for them: the light or dark appearance you chose and the contents of your basket. Both stay in your browser, neither is sent anywhere and neither says who you are. That is why we do not ask you for consent.

What happens if you do not give the data

We do not ask for the details in the forms out of curiosity: without them we cannot answer your enquiry or send you the goods. You are under no statutory duty to provide them, but without them no contract can be made. We take no automated decisions and do not profile you.

Your rights

You have the right of access to your data, to have it corrected or erased, to restrict processing, to data portability and to object to processing based on legitimate interest. Write to cm@harafica.eu.

If you believe we handle your data badly, you can turn to the Czech Data Protection Authority, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.

In force

This notice applies from 4 October 2026.