Privacy Policy

Slovak Philharmonic · Legal document

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (hereinafter “GDPR”) and Act No. 18/2018 Coll. on Personal Data Protection, we provide you with the following information about the processing of personal data on the website of the Concert Archive of the Slovak Philharmonic (stream.filharmonia.art; the address stream.filharmonia.sk redirects to it).

This statement applies exclusively to the web application Concert Archive of the Slovak Philharmonic. Information about data processing on the main website of the Slovak Philharmonic can be found at www.filharmonia.sk.

Data Controller

Slovak Philharmonic Medená 3, 816 01 Bratislava, Slovak Republic ID No.: 00 164 976

Data Protection Officer

Email: gdpr@filharmonia.sk
Post: to the address of the data controller, marked “DATA PROTECTION OFFICER GDPR”

Purposes and Legal Bases of Processing

1. Personal Data of Artists in the Archive

The Concert Archive contains names, photographs and biographical data of artists (conductors, performers, composers and others) who have performed at concerts of the Slovak Philharmonic.

Scope of data: name, surname, photograph, biographical data, nationality; for composers also year of birth and death
Legal basis: legitimate interest of the controller (Art. 6(1)(f) GDPR) – documentation and public access to cultural heritage; public interest (Art. 6(1)(e) GDPR) – performance of tasks carried out in the public interest in the field of culture
Processing period: for the duration of the archive (permanent preservation as part of cultural heritage)

2. Playback of Recordings

When you play a video or audio recording, we record technical data about the playback.

Scope of data: IP address, country derived from the IP address, browser identification (user agent), the recording played, the time of playback and, periodically, the current position in the recording
Purpose: viewing statistics, protection against misuse and checking whether a recording is available in your country (some recordings are licensed for certain countries only)
Legal basis: legitimate interest of the controller (Art. 6(1)(f) GDPR)
Processing period: 12 months; after that the IP address is irreversibly replaced by an anonymous code (identical only within one month, with no way of recovering the address) and the browser identification by the device type (mobile, tablet, desktop). The anonymised statistics are kept indefinitely.

3. Contact Form and CD Orders

If you write to us via the contact form or order a CD, we process the data you enter in the form.

Scope of data: name, e-mail address, text of the message or order; technically also the IP address and browser identification (spam protection)
Legal basis: for orders, steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR); for other messages, the legitimate interest of the controller in replying to you (Art. 6(1)(f) GDPR)
Processing period: 2 years from receipt of the message

4. User Authentication

The Archive allows login for administrators and editors of the application. Visitors access published content without logging in.

Scope of data: username, password (hashed), role, date of last login; for score downloads, a download record including IP address and browser
Legal basis: legitimate interest of the controller (Art. 6(1)(f) GDPR) – ensuring administration and content management of the archive; for employees also performance of a contract (Art. 6(1)(b) GDPR)
Processing period: for the duration of access authorisation; data is deleted after account removal

5. Traffic Analytics

We use Fathom Analytics to measure website traffic, a service designed with user privacy in mind.

Scope of data: Fathom Analytics does not use cookies, does not collect IP addresses or any other personal data. It processes only aggregated, anonymised statistics (visit counts, page views)
Legal basis: legitimate interest of the controller (Art. 6(1)(f) GDPR) – analysis of archive usage to improve the service
Processing period: aggregated data is retained indefinitely

6. User Interactions

Visitors may rate concerts and playlists with the “Love It” heart and save favourite concerts.

Scope of data: no personal data – ratings are tied to an anonymous session, not to a specific individual; favourites of visitors who are not logged in are stored only in their browser
Legal basis: legitimate interest of the controller (Art. 6(1)(f) GDPR)

Cookies and Technical Data

Strictly Necessary Cookies

PHPSESSID – session identification for login, ratings and basic functionality. Duration: until browser is closed.
lang – selected language of the site (Slovak or English). Duration: 90 days.

These cookies are essential for the operation of the website and do not require your consent (Art. 5(3) of the ePrivacy Directive 2002/58/EC).

Local Storage (localStorage)

The website stores display preferences (dark/light mode, last calendar view, researcher mode) and the list of favourite concerts in your browser's local storage. This data does not leave your browser, is not sent to the server and does not contain personal data.

Cookies We Do Not Use

The Concert Archive does not use advertising cookies, third-party tracking cookies, Google Analytics or Facebook Pixel.

Processors and Recipients

Infomaniak (Hosting)

The website and the archive database are hosted on servers of Infomaniak Network SA (Geneva, Switzerland). Infomaniak, as a processor, processes technical data (IP address, access logs) necessary for server operation. Switzerland provides an adequate level of data protection under a decision of the European Commission (Art. 45 GDPR).

MEGA and Backblaze (Storage of Recordings)

Video and audio recordings are stored with MEGA Limited (New Zealand). During playback your browser downloads the recording directly from MEGA via time-limited links, so MEGA sees your IP address and browser identification. New Zealand provides an adequate level of data protection under a decision of the European Commission (Art. 45 GDPR).

A backup copy of the recordings is stored with Backblaze, Inc. (USA). The recordings contain the likeness and performances of the artists; visitor data does not reach Backblaze. Transfers to the USA are covered by the EU-US Data Privacy Framework (Art. 45 GDPR).

Vimeo (Video Player, until December 2026)

Some older recordings are played via the Vimeo platform (Vimeo, Inc., USA) until December 2026. When a video is started, Vimeo may set its own cookies and process data in accordance with its privacy policy.

Transfer to a third country: data transfers to the USA are safeguarded by Standard Contractual Clauses (Art. 46(2)(c) GDPR)
Vimeo Privacy Policy: vimeo.com/privacy

External Resources

To display the website, fonts and libraries are loaded from external providers: Google Fonts (Google Ireland Limited / Google LLC), jsDelivr and unpkg. When the page loads, your browser sends them your IP address; no cookies are stored.

Embedded YouTube and Facebook Videos

Some articles contain embedded videos. YouTube videos are embedded in privacy-enhanced mode (youtube-nocookie.com) – cookies are set only after you start the video. Embedded Facebook videos (Meta Platforms Ireland Limited) may process data as soon as the page loads, in accordance with Meta's policies.

Processing Periods

Artist data in the archive – permanent (cultural heritage)
Playback records – 12 months, then anonymised (statistics indefinitely)
Contact form and CD orders – 2 years
Administrator and editor login – for the duration of the account
Analytics (Fathom) – aggregated data, indefinite
Session cookies – until browser is closed

Your Rights

The rights below apply to individuals whose data is part of the archive (artists), to visitors who wrote to us or played recordings, and to administrators and editors of the application.

Right of access – you may request information about what personal data we process about you and obtain a copy thereof
Right to rectification – you may request correction of inaccurate or incomplete data
Right to erasure – you may request deletion of personal data if the purpose for processing has ceased or if you withdraw your consent
Right to restriction of processing – you may request temporary suspension of the processing of your data
Right to data portability – you may request transfer of your data to another controller in a structured format
Right to object – you may object to processing based on legitimate interests of the controller
Right to lodge a complaint – you may contact the data protection officer or the supervisory authority directly

You may exercise your rights by contacting the Data Protection Officer at gdpr@filharmonia.sk.

Automated Decision-Making

The Concert Archive does not carry out automated decision-making or profiling within the meaning of Art. 22 GDPR.

Supervisory Authority

Office for Personal Data Protection of the Slovak Republic

Web: dataprotection.gov.sk
Address: Hraničná 12, 820 07 Bratislava 27
Phone: +421 2 3231 3214
Email: statny.dozor@pdp.gov.sk

Last updated: 12 October 2026