Legal
Privacy Policy
This notice explains how we handle personal data in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Czech legislation. Last updated: 25 August 2026.
1. Who we are (data controller)
The controller of your personal data is Feng-yün Song, z.s., a registered association with its seat at Chodovská 1549/18, 101 00 Praha 10, Czech Republic, IČO 28558502. You can reach us at info@karmakare.com or +420 272 142 821 with any question or request regarding your data.
2. What data we collect and why
Enquiries and correspondence: your name, email address, subject and message content when you write to us or use our contact form. We use these solely to answer you and to keep a record of the exchange.
Programme participation: name, contact details, and where strictly necessary information relevant to safe participation (for example an accessibility need, a relevant health note you choose to disclose, or parental consent for a minor). We collect the minimum required and nothing more.
Volunteers and members: contact details, role, availability and records of contribution; for certain roles, a safeguarding declaration.
Donors and partners: name, contact details, donation amount and date, and bank transaction data required by accounting law.
Photographs and recordings: taken at public events for documentation and reporting. We ask for consent, and we always respect a request not to be photographed or to have an image removed.
Technical data: our website may record basic, aggregated technical information necessary to deliver and secure the site. See our Cookie Policy.
3. Legal bases for processing
We rely on: consent (Art. 6(1)(a)) for photography, newsletters and any optional processing; performance of a contract or pre-contractual steps (Art. 6(1)(b)) for membership, volunteering agreements and donation agreements; legal obligation (Art. 6(1)(c)) for accounting, tax and grant-reporting duties under Czech law; and legitimate interests (Art. 6(1)(f)) for responding to enquiries, safeguarding participants and securing our systems. Any special category data is processed only with explicit consent or where otherwise permitted under Art. 9.
4. Sharing, transfers and retention
We do not sell personal data and we never share donor or participant lists. Data may be shared with service providers acting as processors under written agreements (for example email, accounting and website hosting providers), with our accountant and auditor, with funders where a grant contract requires anonymised or aggregated reporting, and with public authorities where the law obliges us.
We keep data within the European Economic Area wherever possible. Where a provider processes data outside the EEA, we ensure an adequate transfer mechanism such as the European Commission's Standard Contractual Clauses.
Retention: enquiry correspondence up to 3 years; participant and volunteer records for the duration of involvement plus 3 years; accounting and donation records for the periods required by Czech accounting and tax law (generally 5–10 years); consent-based materials until consent is withdrawn.
5. Your rights
Under the GDPR you have the right of access to your data; the right to rectification; the right to erasure; the right to restriction of processing; the right to data portability; the right to object to processing based on legitimate interests; and the right to withdraw consent at any time without affecting the lawfulness of prior processing.
To exercise any right, write to info@karmakare.com. We respond within one month. If you believe we have handled your data improperly, you may lodge a complaint with the Czech data protection authority: Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz.
We apply appropriate technical and organisational security measures, limit access to personal data to those who need it, and review this policy at least annually. Material changes will be announced on this page.