effective as of 6 November 2025

1. Data Controller

The data controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation (“GDPR”), is:

Antonín Blažek
Company ID No.: 21879206
Registered office: T. G. Masaryka 313, 407 77 Šluknov, Czech Republic
E-mail: info@90plustickets.com
Phone: +420 774 051 061

The controller operates on the market mainly under the following brands:

• 90+Tickets – sale of tickets and related services,
• 90+ Football Travel Agency – provision of package travel and related travel services.

The controller processes personal data in accordance with the GDPR, Act No. 110/2019 Coll., on the Processing of Personal Data, and other applicable legal regulations.

2. What Personal Data We Process

We process personal data that a customer or website user provides to us, in particular when placing an order, concluding a contract, sending an enquiry, communicating with us, registering, subscribing to commercial communications or using the website.

The personal data processed may include in particular:

• first name and surname,
• billing and delivery address,
• e-mail address and telephone number,
• data relating to orders, reservations, invoices and payments,
• data necessary for issuing tickets, arranging a package, accommodation, transport or other agreed services,
• data required for personalised tickets or services linked to a specific person, such as date of birth, nationality, customer account identifiers, membership details or, where necessary for a specific service, data from a travel document,
• content of mutual communication,
• technical data relating to the use of the website, such as IP address, device identifiers, browser data, cookies and similar online identifiers, where processed.

We process personal data only to the extent necessary for the relevant purpose of processing.

3. Purposes and Legal Bases of Processing

We process personal data mainly for the following purposes:

Purpose of processing	Legal basis	Example
Processing orders, concluding and performing a contract	Article 6(1)(b) GDPR	sale of a ticket, arranging a package, order-related communication
Compliance with legal obligations	Article 6(1)(c) GDPR	accounting and tax records, statutory retention obligations
Protection of the controller’s rights and legitimate interests	Article 6(1)(f) GDPR	handling complaints, enforcing claims, fraud prevention, website security
Customer support and communication	Article 6(1)(b) or 6(1)(f) GDPR	responding to enquiries, handling order changes, assistance during a package
Sending commercial communications to existing customers relating to similar own services	legitimate interest and Act No. 480/2004 Coll.	offers of similar tickets, packages or related services
Newsletter and marketing based on consent	Article 6(1)(a) GDPR	newsletter for persons who have separately subscribed
Analytical and marketing cookies	Article 6(1)(a) GDPR	Google Analytics, Meta Pixel, Google Ads, where activated on the basis of consent

Where processing is based on consent, the customer or website user may withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

4. Retention Period of Personal Data

We retain personal data only for the period necessary for the purpose for which it was collected or for the period required by applicable legal regulations.

Personal data processed for the purpose of contract performance is retained for the duration of the contractual relationship and subsequently for the period necessary to protect the controller’s rights and legitimate interests, in particular for handling complaints, claims or disputes.

Accounting and tax documents are retained for the period required by applicable legal regulations.

Personal data processed on the basis of consent is retained for the duration of the consent or until its withdrawal, unless a shorter retention period applies.

Data processed for the purpose of sending commercial communications is retained for as long as there is a legal basis for sending such communications, or until the recipient unsubscribes or objects.

After the relevant retention period expires, personal data is deleted or anonymised.

5. Recipients and Processors of Personal Data

We may disclose personal data only to entities that help us operate the website, process orders, provide services, handle payments, accounting, marketing, customer support or comply with legal obligations.

Recipients or processors of personal data may include in particular:

• providers of the e-commerce platform and technical infrastructure, especially Shopify,
• payment service providers and payment gateways, such as Stripe, PayPal, GP webpay or other payment partners,
• ticket providers, ticketing platforms, clubs, organisers of sports or cultural events and stadium systems, where necessary to arrange a ticket or participation in an event,
• accommodation providers, carriers, travel partners and other providers of travel services, where necessary to arrange a package or ordered service,
• carriers and delivery companies,
• accounting, tax and legal advisers,
• providers of IT services, hosting, security, e-mail services and customer support,
• providers of analytical and marketing tools, where used in accordance with applicable legal regulations and the user’s consent settings,
• public authorities, where required by applicable legal regulations.

Personal data is disclosed only to the extent necessary.

6. Transfers of Personal Data outside the EU/EEA

Some of our suppliers or their technical infrastructure may process personal data outside the European Union or the European Economic Area.

In such cases, we ensure that transfers of personal data take place only in compliance with the conditions set out in the GDPR, in particular on the basis of an adequacy decision of the European Commission, standard contractual clauses or other appropriate safeguards under the GDPR.

7. Cookies and Tracking Technologies

The website www.90plustickets.com uses cookies and similar technologies.

Necessary technical cookies are used to ensure the proper functioning of the website and the order process. Analytical, marketing and other optional cookies are used only on the basis of the user’s consent given through the cookie banner or cookie settings.

Detailed information on the use of cookies, including the option to change settings or withdraw consent, is provided in the separate Cookie Policy available on the website.

8. Commercial Communications and Marketing

We may send commercial communications:

• to persons who have given their consent, for example by subscribing to the newsletter,
• to our customers under the conditions set out by applicable law, where the commercial communication concerns our own similar products or services and the customer has had the opportunity to refuse such communication.

Each commercial communication contains an easy unsubscribe option. The customer may also refuse commercial communications at any time by sending an e-mail to info@90plustickets.com.

9. Rights of Data Subjects

Each data subject has, under the conditions set out in the GDPR, in particular the following rights:

• the right of access to their personal data,
• the right to rectification of inaccurate or incomplete data,
• the right to erasure of personal data,
• the right to restriction of processing,
• the right to data portability,
• the right to object to processing based on legitimate interest,
• the right to withdraw consent where processing is based on consent,
• the right to lodge a complaint with a supervisory authority.

The supervisory authority is:

Office for Personal Data Protection
Pplk. Sochora 27
170 00 Prague 7
Website: www.uoou.cz

Requests concerning data subject rights may be sent to info@90plustickets.com.

10. Security of Personal Data

We have adopted appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, misuse, alteration or damage.

Personal data is accessible only to persons who need it to perform their tasks or provide services.

Data transmission between the user and the website is secured using the encrypted HTTPS/SSL protocol, where available.

11. Changes to this Privacy Policy

We may update this Privacy Policy, in particular in the event of changes to legal regulations, the way personal data is processed, services used or the technical settings of the website.

The current version of this Privacy Policy is always available on the website www.90plustickets.com.

In Liberec, on 6 November 2025

Antonín Blažek
90+Tickets / 90+ Football Travel Agency
Company ID No.: 21879206
info@90plustickets.com