Information on personal data processing for suppliers, customers and business partners

This information on the processing of personal data, prepared with regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the "Regulation"), as well as with regard to related legislation, explains which personal data we collect in the context of our cooperation with our customers, suppliers and other business partners and how we process and protect such data.


We are Kunsthalle Praha, Endowment Fund, ID No.: 045 35 871, with our registered office at Evropská 2758/11, Dejvice, 160 00 Prague 6, Czech Republic, registered in the Foundation Register maintained by the Municipal Court in Prague, Section N, File 1290 (hereinafter referred to as "we", "us", "our", etc.), and within the scope of our activities we process personal data of our suppliers, customers, other business partners and their contact persons, where the purpose of such processing is primarily the execution of mutual business or other relationships.

In relation to this processing, we act as a data controller, and we ensure that we process all your personal data in accordance with applicable law. The purpose of this document is to explain which of your personal data we process, for what purposes, by what means and what rights you, as a data subject, have in relation to the processing of your personal data.

In connection with the processing of your personal data, you can contact us by e-mail at:

For the purposes of this information on personal data processing, the data subject shall be:

  • our customer or supplier, if a natural person, or an agent, contact person or other natural person interacting with us on behalf of a customer or supplier that is a legal person;

  • a person lending or borrowing a work of art to us or from us, a person licensing a work of art or other intellectual property rights to us or obtaining such a licence or rights from us, if a natural person; when our partner is a legal person, the data subject shall be an agent, contact person or other natural person interacting on their behalf with us; and

  • the author of a work of art or other holder of intellectual property rights or a licence to such a work of art.

Which personal data we process

In the performance of our activities, we process various types of personal data, which can be broadly divided into the following categories:

  • Identification
    E.g. academic title, name, surname, residence, correspondence address, registration number, VAT number, date of birth.

  • Contact
    E.g. phone number, fax, e-mail.

  • Payment and billing
    E.g. bank account number, VAT number, billing address.

  • Data related to licences, intellectual property rights and copyright
    This category includes, without limitation, information about the work of art and the rights to it, as well as information about the relationship of the author of the work or the holder of the intellectual property rights in the work or the licence. It may also include personal data of the author of the work of art.

  • Data provided in the communication
    This data includes, without limitation, any personal data you provide to us in the course of communication with you, as well as the content of such communication.

How we use personal data

We collect and use personal information for the purposes of:

  • Contract conclusion and performance; setup, implementation and management of licensing relationships and intellectual property rights

    We use the above personal data for the performance of any contract concluded with you or the entities for which you act including, but not limited to, the fulfilment of our contractual or payment obligations and for communication.

    In the event that we enter into contractual relationships with you (or with entities for which you act) relating to specific works of art, we also use, among other things, data relating to licenses and intellectual property rights, in particular for the proper setup and implementation of the relevant licensing or other relationships or the exercise of our related rights, which necessarily occurs     in connection with special aspects of intellectual property law relating to copyrighted works. Thus, we may need personal data, for example, to verify the authenticity of a work of art, to verify the existence and proper scope of a license or intellectual property rights in the work of art, to properly set the terms of a loan or other disposition of the work, and to simultaneously ensure our related rights.

    We process personal data for these purposes in the context of pre-contractual and contractual relationships and partly on the basis of our legitimate interests. The provision of personal data is thus necessary for the conclusion and performance of the contract, the correct setting up of relations with you or the entities for which you act, as well as for the management and registration of such relations. Without the provision of such personal data, we may not be able to enter into and perform the relevant contract, and we may also not be able to properly handle the necessary intellectual property rights or our authorisation to use the copyrighted work in the intended manner.

  • Compliance with legal obligations

    We also process your identification, contact, payment and billing data for the purpose of fulfilling our legal and other legal obligations, e.g. in the field of taxation, accounting, mandatory reporting, etc. The processing of your personal data in such cases is necessary for the fulfilment of our legal obligations and we would not be able to properly fulfil our obligations without your provision of such data.

  • Protecting our legitimate interests

    We also process the personal data in order to protect our legitimate interests, in particular to protect our property, assets, goodwill and reputation, to ensure the proper performance of our business and to ensure the proper authorization for the handling of the works of art at our disposal.

    In addition, we are also entitled to use personal data on the basis of our legitimate interest to assert, enforce or defend our claims before courts, administrative authorities and other public bodies. Such processing is based on our legitimate interest and without the use of your personal data we would not be able to protect our interests properly.

  • Marketing and promotion of our activities

    Furthermore, we may process personal data related to licenses, intellectual property rights and copyright for the purposes of our marketing, i.e., for example, the production and distribution of invitations to our events and exhibitions, the production and sale of promotional items, and the promotion of our operations and activities in general by any means (or means agreed in a contract with you or the person for whom you are acting).

    Your personal data will be used for such purposes in various forms, including in written form (invitations, posters, etc.) or online form (promotion on our website). As part of online marketing, personal data will also be published on our social media profiles (Facebook, Instagram, etc.).

    Please note that our website and social media accounts are publicly accessible, and their visibility is not restricted in any way. This means that your personal data may be accessible in countries outside the European Economic Area where different data protection rules apply. The operation of social networks and the related processing of personal data are governed by separate privacy policies issued by the operators of these networks. We cannot interfere in any way with these policies or influence their content. If you are interested in the specific data processing rules of a particular social network, please visit its website, or contact its operator.

    For the promotional purposes mentioned above, we may also transfer your personal data to our affiliate organization, Kunsthalle Praha Services, s.r.o., which arranges some of the activities described above for us, or to other related organizations.

    This processing is based on our legitimate interest. You are therefore not obliged to provide the data. Without providing it, we will not be able to use your personal data for marketing purposes.

No personal data are transferred to third countries outside the European Economic Area or to international organisations (for data accessibility in such countries and organisations, if any, see section 3.d above) and are not subject to automated individual decision-making or profiling.

If we obtain personal data of other persons who have rights in the copyrighted work or persons otherwise associated with the copyrighted work from you, you acknowledge that you (or the person for whom you are acting) are responsible for informing them of our processing of their personal data to the extent of this personal data processing information, as in such cases we are generally unable to adequately inform these third parties of the policies, rules and principles of processing their personal data directly.

How we share personal data

We only share personal data with trusted partners, in the way that the law allows us to do so and on the basis of appropriate contracts that ensure adequate protection.

Our authorised processors

We share personal data with authorised data processors for the purposes of processing personal data on our behalf and based on our instructions. These partners must comply with strict confidentiality obligations in accordance with the contracts we have entered into with them.

Our processors are mainly operators of video surveillance and security systems, delivery services, providers of consulting services, technical and IT services.

Other recipients

We share personal information with legal and natural persons, government authorities and public institutions when we believe in good faith that access to, use, retention or disclosure of such personal information is reasonably necessary to:

  • cooperate in the performance of a contractual relationship with you or an entity for which you are acting, or to exercise and enforce our rights and authorisations when it comes to sharing with our affiliate organization, Kunsthalle Praha Services, s.r.o,

  • comply with a legal regulation or an enforceable decision of a government authority,

  • enforce contract terms, including the investigation of possible breaches,

  • implement a procedure aimed at dealing with fraud or security incidents,

  • protect against any harm to the rights, property or safety of the Endowment Fund, our clients or the public as required or permitted by law.

We always ensure that we do not provide more data than is necessary to achieve the relevant purpose of the processing.

How you can manage your personal data

As a data subject, you have the right to decide on the treatment of your personal data. You can exercise the rights set out below at the address and in the ways set out above. We will endeavour to respond to you as soon as possible but will always respond within one month of receiving your request. In case of doubt, we may ask you for additional verification of your identity.

You have the following rights under applicable law and the Regulation:

  • Right of access under Article 15 of the Regulation

  • Right to rectification under Article 16 of the Regulation

  • Right to erasure according to Article 17 of the Regulation

  • Right to restriction of processing under Article 18 of the Regulation

  • Right to portability under Article 20 of the Regulation

  • Right to object to processing under Article 21 of the Regulation

  • The right to lodge a complaint with the competent supervisory authority, which is the Office for Personal Data Protection in the Czech Republic 

  • Right to withdraw consent under Article 7(3) of the Regulation

Where we get your personal data from

We obtain personal data directly from you, based on your communications (or communications from entities for which you act or with which you cooperate) and from mutual communication. We may also indirectly obtain personal data relating to the author of a work of art or other third parties having rights or other relationships to the copyrighted work from our customers, suppliers, and other business partners.

How long and where we keep the data

We retain personal data for varying lengths of time depending on the purpose of the processing. In general, however, we process personal data:

  • for the duration of our contractual relationship with you (or the person for whom you are acting) or for the duration of (or time of exercising) our intellectual property rights in the copyrighted work in question or any of our related rights,

  • for ten years from the end of the tax year in which the transaction took place, for the purposes of meeting our legal obligations under the tax legislation,

  • for up to ten years from the end of the financial year to which the documents relate for the purposes of meeting our legal obligations under accounting regulations,

  • until your consent is withdrawn if the processing is based on consent and we have no other legal basis for processing your personal data,

  • until you object to processing where your rights and interests override our legitimate interests.

After the expiration of the aforementioned time limits, we are only entitled to process personal data for compatible purposes, for the protection of our rights and property (i.e. generally for the duration of the relevant statutory bar period) or for special purposes such as archiving or statistics.

We only store personal data on the Endowment Fund's secure servers or, when on paper, in properly secured premises or with our trusted partners.

Changes to this document

We are entitled to amend or supplement the wording of this document in any way including, but not limited to, incorporating legislative changes or changes in the purposes and means of processing. However, we will not restrict your rights under this document or under applicable law. If changes are made to this document which may affect your rights, we will notify you in an appropriate manner and with a sufficient advance notice.

In addition to this document, we may also inform you of certain other or additional ways and policies related to the processing your personal data through separate information, notices, or consents.