PRIVACY POLICY

FOR THE MUZIKER NEWSLETTER AND COMPETITION

Thank you for following news from the world of MUZIKER!

If you subscribe to our newsletter or would like to sign up for it, please read how we process and protect your personal data in accordance with Regulation 2016/679 of the European Parliament and of the Council (“GDPR”).

This privacy policy for the MUZIKER newsletter and competition (hereinafter the “privacy policy”) is intended for all subscribers to and persons interested in subscribing to our newsletter (hereinafter the “newsletter”), including members of the MUZIKER Smile loyalty programme (hereinafter the “loyalty programme”) to whom we send the newsletter as marketing communication on the basis of legitimate interest, as well as for participants in the competition for newsletter subscribers (hereinafter the “competition”), which is governed by the General Terms of Competitions of MUZIKER, a.s. and the Special Terms of the Competition for Muziker Newsletter Subscribers available on our website (together hereinafter the “competition rules”). Terms related to the competition, in particular competition round, entry, participant, prize and voucher, have the meaning given to them in the competition rules.

The processing of personal data when shopping in the e-shop and in the MUZIKER Smile loyalty programme is governed by a separate privacy policy available on our website.

1. WHO PROCESSES YOUR PERSONAL DATA?

The controller and the person responsible for processing your personal data in connection with the newsletter and the competition is

MUZIKER, a.s., with its registered office at Lozorno 1102, 900 55 Lozorno, Slovak Republic, Company ID (IČO) 35 840 773, registered in the Commercial Register of the Bratislava III Municipal Court, Section: Sa, Insert No.: 3337/B

(hereinafter “MUZIKER, a.s.” or the “controller”)

Do you have any questions about personal data? Contact us at any time at gdpr@muziker.com or in writing at the registered office address of MUZIKER, a.s.

Subscribing to the newsletter and participating in the competition are based on your voluntary decision.

1. WHAT PERSONAL DATA DO WE PROCESS AND WHY?

II.1 NEWSLETTER

If you subscribe to the newsletter, we will send to your e-mail address information about our range of goods and services, current promotions, discounts, competitions and various interesting information from the world of music and musical instruments.

For this purpose, we process ordinary personal data to the following extent:

• e-mail address
• country and language of the e-shop through which you subscribed
• name, if you provide it
• data on the granting and withdrawal of consent (date and time, IP address, wording of the consent)
• data on opening the newsletter and clicking on links in it,,

Legal basis for subscribers with consent: your consent to receiving the newsletter pursuant to Art. 6(1)(a) GDPR in conjunction with § 116 of Act No. 452/2021 Coll. on Electronic Communications

We also send the newsletter to members of the loyalty programme without separate consent, as marketing communication pursuant to section II.2 of the privacy policy for the loyalty programme. For the purposes of this privacy policy, a member of the loyalty programme to whom we send the newsletter is also considered a newsletter subscriber.

Legal basis for members of the loyalty programme: the controller’s legitimate interest in marketing communication with members of the loyalty programme as contracting parties to the loyalty programme membership agreement pursuant to § 116(15) of Act No. 452/2021 Coll. on Electronic Communications in conjunction with Art. 6(1)(f) GDPR

As a member of the loyalty programme, you can easily refuse to receive the newsletter at any time, free of charge, by clicking the unsubscribe link in every newsletter. Unsubscribing does not terminate your membership in the loyalty programme. The period of processing of your data for this purpose is governed by the privacy policy for the loyalty programme.

You may withdraw your consent at any time by clicking the unsubscribe link in every newsletter or by contacting us in one of the ways set out in this privacy policy. Withdrawal of consent does not affect the lawfulness of processing before its withdrawal.

If you unsubscribe from the newsletter before the end of a competition round, you will no longer be included in the draw for that round. Unsubscribing after the end of a competition round has no effect on the draw or on the prize for that round. After re-subscribing, you can enter the competition again.

You will find more information in section 7. of this privacy policy (your rights).

Processing period: until you withdraw your consent or until we stop sending the newsletter, whichever occurs first. We keep the record of the granting and withdrawal of consent for a further 4 years after the withdrawal of consent in order to demonstrate the compliance of the processing with the GDPR (section II.4).

The provision of personal data for this purpose is neither a statutory nor a contractual requirement, nor a requirement necessary to enter into a contract, and is voluntary. However, without your e-mail address we cannot send you the newsletter.

II.2 COMPETITION FOR NEWSLETTER SUBSCRIBERS

The competition is intended for newsletter subscribers who have entered it in the manner set out in the competition rules. It runs in monthly competition rounds until its termination, which we will announce in advance on our website. For each competition round, we draw winners of electronic gift vouchers (hereinafter the “prize”). The number and value of the prizes and the states in which the competition takes place are set out in the competition rules.

We include in the draw for the relevant competition round every participant who entered the competition no later than on the last day of that round and who is subscribed to the newsletter as of that day. The entry also applies to each subsequent competition round for as long as you subscribe to the newsletter. The same applies to members of the loyalty programme to whom we send the newsletter and who have entered the competition. Each e-mail address is included in the draw only once per competition round.

For this purpose, we process your e-mail address, the e-shop (state) through which you entered the competition, the date, time and method of entry (e.g. a click in an e-mail or subscribing via a form with information about the competition, including the wording of that information), the fact that you are a newsletter subscriber at the end of the competition round, and the result of the draw.

Legal basis: performance of the competition rules, which you accepted by entering, pursuant to Art. 6(1)(b) GDPR

You may withdraw from participation in the competition at any time by e-mail to podpora@muziker.sk. We will continue to send you the newsletter. Participation in the competition also ends when you unsubscribe from the newsletter.

You will find more information in section 7. of this privacy policy (your rights).

Processing period: for the duration of your participation in the competition, i.e. until the end of the competition, your unsubscribing from the newsletter or your withdrawal from the competition. We keep the record of your entry and the record of the draw (date, number of participants included and winners drawn) for 3 years from the end of your participation or from the relevant draw, respectively, in order to demonstrate the proper conduct of the competition and to handle any objections.

The provision of personal data for this purpose is not a statutory requirement, but it is necessary for participation in the competition. Without it, you cannot enter the competition.

II.3 HANDOVER OF THE PRIZE AND PUBLICATION OF WINNERS

We contact the winner at the e-mail address they used when entering the competition. To issue the voucher, we will ask the winner for their first name, surname, address and telephone number, which are stated on the voucher. We also process the voucher code, its value and data on its redemption. If necessary to verify the conditions of participation under the competition rules, in particular age and habitual residence, we will ask the winner for a solemn declaration; in the case of a winner under 18 years of age, where applicable, also for the consent of their legal representative, including the legal representative’s first name and surname.

We publish the winners on our MUZIKER website, stating their first name, the first letter of their surname and their town.

Legal basis: (i) performance of the competition rules towards the winner as the data subject pursuant to Art. 6(1)(b) GDPR when verifying the conditions of participation and issuing and handing over the prize; (ii) the controller’s legitimate interest in the transparency of the competition pursuant to Art. 6(1)(f) GDPR when publishing the winners

Under Art. 21 GDPR, as a natural person you have the right to object, on grounds relating to your particular situation, to the processing of your personal data based on the controller’s legitimate interest. An objection to publication does not affect your right to the prize.

You will find more information in section 7. of this privacy policy (your rights).

Processing period: we keep the winner’s data until the voucher expires and for 3 months thereafter; we remove published data no later than 2 months after their publication.

The provision of personal data by the winner is a requirement necessary for the handover of the prize. If you do not provide them, we will not be able to hand over the prize to you.

II.4 COMPLIANCE WITH LEGAL OBLIGATIONS

The controller is subject to a number of legal obligations that it is required to fulfil. For the purposes of their proper fulfilment, it is necessary to also process certain personal data of newsletter subscribers and competition participants, to the extent and for the period laid down by the relevant legislation or determined on its basis by us or by a public authority.

Our obligations include, for example, keeping accounts and archiving accounting documents (if the handover of a prize is recorded in accounting documents), handling requests from data subjects and fulfilling other obligations under the GDPR, including demonstrating that consent to receiving the newsletter was granted and that these obligations have been fulfilled.

Legal basis: compliance with the controller’s obligations arising from legislation pursuant to Art. 6
(1)(c) GDPR

Processing period: for the period laid down by legislation or on its basis

The processing of personal data for this purpose is a requirement arising for us from the relevant legislation, and without such processing we would not be able to fulfil our legal obligations.

II.5 EXERCISE AND DEFENCE OF RIGHTS AND CLAIMS

For the purpose of exercising or defending our rights and claims (for example in out-of-court or, where applicable, court proceedings), including the preparation and use of evidence to demonstrate the compliance of our activities with legislation and to demonstrate the fulfilment of our obligations, primarily towards public authorities, we may process the personal data of newsletter subscribers and competition participants to the extent necessary.

The scope of the personal data processed will depend on the type of proceedings or the right or claim being asserted or defended.

Legal basis: the controller’s legitimate interest in exercising and defending rights and claims pursuant to Art. 6(1)(f) GDPR

Under Art. 21 GDPR, as a natural person you have the right to object, on grounds relating to your particular situation, to the processing of your personal data based on the controller’s legitimate interest.

You will find more information in section 7. of this privacy policy (your rights).

Processing period: for the period laid down by legislation during which we are entitled to exercise or defend our rights and claims (limitation or preclusive period), or during which we may bear legal consequences of failing to fulfil obligations imposed by law, e.g. in the form of a penalty imposed by public authorities.

The provision and processing of personal data for this purpose is neither a statutory nor a contractual requirement, nor a requirement necessary to enter into a contract; it is, however, based on the controller’s legitimate interest.

1. FROM WHAT SOURCE DO WE OBTAIN YOUR PERSONAL DATA?

The controller obtains your personal data directly from you as the data subject, in particular when you subscribe to the newsletter, when you enter the competition and from the winner when the prize is issued. For members of the loyalty programme, we use for the purposes of the newsletter and the competition the e-mail address you provided when registering for the loyalty programme.

Some data are generated by our system when you subscribe (e.g. the date and time of granting consent, IP address) or during your interaction with the newsletter (opening, clicking on a link) and when you enter the competition.

1. WHO HELPS US IN OUR ACTIVITIES?

We share the personal data processed for the purposes stated above, to the extent necessary, with our processors, i.e. contractual partners who process them on our behalf and exclusively on the basis of our instructions, e.g. the provider of the bulk e-mailing service, providers of IT solutions including cloud storage and administration of our website, etc.

Furthermore, personal data may be provided in particular to public authorities and other institutions where this arises for us from legislation or is necessary for the defence or exercise of rights and claims. Winners’ data to the extent set out in section II.3 are accessible to the public.

When selecting all these entities, in particular our processors, we always make sure that they provide adequate guarantees of the security and lawfulness of the processing of personal data.

1. HOW LONG DO WE PROCESS YOUR PERSONAL DATA?

We always process personal data for the period necessary to fulfil the specified purpose of processing.

This period varies depending on the purpose for which the personal data are processed. We regularly review the duration of each processing purpose and, if we find that the processing of personal data is no longer necessary and is not required by legislation either, we will erase them even before the expiry of the originally specified processing period.

You will find the specific processing periods in section 2 under the individual purposes.

1. WHAT ELSE DO YOU NEED TO KNOW?

The personal data we process are stored on servers and other technical equipment located within the European Union, where they are protected by advanced security measures against unauthorised access or other security risks.

We determine the winners of the competition by a random draw. This is not automated decision-making, including profiling, that would produce legal effects concerning you or similarly significantly affect you.

The controller does not transfer personal data processed for the above purposes to third countries outside the European Union/European Economic Area or to international organisations. If any of our service providers, e.g. the provider of the bulk e-mailing service, transfers personal data to third countries, we always duly verify that it meets the requirements for a proper transfer (e.g. on the basis of an adequacy decision of the European Commission; for transfers to the USA, the European Commission’s adequacy decision of 10.7.2023 applies, or it has concluded standard contractual clauses).

In order to protect your personal data as much as possible, we as the controller have adopted appropriate personnel, organisational and technical measures. Our aim is to prevent, or reduce, to the greatest possible extent the risk of leakage, misuse, disclosure or other use of your personal data.

1. WHAT RIGHTS DO YOU HAVE UNDER THE GDPR?

As a data subject, i.e. a person whose personal data are processed, you have the following rights under the GDPR:

1. Right to withdraw consent at any time

You have the right to withdraw the consent you have given to receiving the newsletter at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

1. Right of access to the personal data processed

This right includes the right to obtain from us as the controller confirmation as to whether or not your personal data as a data subject are being processed, as well as the right to access such data and other information pursuant to Art. 15 GDPR.

1. Right to rectification

As a data subject, you have the right to have the controller rectify inaccurate personal data concerning you, or complete incomplete personal data, without undue delay.

1. Right to data portability

As a data subject, you have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, including the right to transmit those data to another controller where technically feasible, if a) the processing is based on consent or a contract and at the same time b) the processing is carried out by automated means. This right must not adversely affect the rights and freedoms of others.

1. Right to erasure

As a data subject, you also have the right to request the controller to erase personal data concerning you without undue delay if one of the grounds provided for by the GDPR applies, in particular if a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; b) you withdraw consent and there is no other legal basis for the processing; c) you object to the processing of personal data based on the controller’s legitimate interest and there are no overriding legitimate grounds for the processing; d) the personal data have been processed unlawfully; e) erasure is required for compliance with a legal obligation, etc., unless one of the exceptions laid down by the GDPR applies.

The controller shall erase the personal data on the basis of a request without undue delay after assessing that the data subject’s request is justified.

1. Right to restriction of processing

As a data subject, you have the right to have the controller restrict the processing of your personal data in one or more of the cases provided for by the GDPR.

If the processing of your personal data has been restricted, we will inform you before the restriction of processing is lifted.

1. Right to object to processing based on legitimate interest

As a data subject, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on the controller’s legitimate interest, and the controller may no longer process your personal data on the basis of legitimate interest unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims.

You may withdraw from participation in the competition at any time pursuant to section II.2 without affecting the sending of the newsletter. If you object to the processing of personal data for direct marketing purposes, we will stop processing your personal data for this purpose without delay.

1. Right to lodge a complaint/petition to initiate proceedings

If you believe that your rights have been infringed in connection with the processing of personal data concerning you, you have the right to lodge a complaint with:

Úrad na ochranu osobných údajov SR (Office for Personal Data Protection of the Slovak Republic), Galvaniho Business Centrum II, Galvaniho 7/B, Bratislava, Slovak Republic.

You will find more information on the Office’s website at: https://www.dataprotection.gov.sk/uoou/.

You may also lodge a complaint with the data protection authority in the EU Member State in which you have your habitual residence or place of work, or where the alleged infringement of your rights or of the GDPR took place.

1. HOW CAN YOU EXERCISE YOUR RIGHTS?

If you have any question regarding the processing of your personal data or wish to exercise your rights under the GDPR, contact us at any time in one of the following ways:

1. E-mail: gdpr@muziker.com
2. By post to the registered office address of the controller MUZIKER, a.s. stated above

The controller reserves the right to update this privacy policy where necessary. The current version will always be published on the e-shop website.

Effective as of: 6.11.2026