This policy describes how the Museum of Eastern Bohemia in Hradec Králové handles personal data in connection with the register of the intangible cultural heritage of the Hradec Králové Region run at zivededictvi.cz. Your privacy matters to us, so we explain here in plain language what data we process, why, and what rights you have.
Effective from: 1 May 2026
1. Who controls your data
The controller of your personal data is:
Muzeum východních Čech v Hradci Králové (Museum of Eastern Bohemia in Hradec Králové)
Eliščino nábřeží 465, 500 01 Hradec Králové
Company ID: 00088382
an organisation funded by the Hradec Králové Region
In matters of personal data protection you can contact us at podpora@zivededictvi.cz or in writing at the address above.
2. What data we process and why
The scope of processing depends on the role in which you work with the register.
Proposers of inscription proposals
If you submit a proposal to inscribe a cultural practice on the regional list of intangible cultural heritage, we process: name and surname, e-mail, phone, address and organisation name (if you represent a legal entity). We need these data to administer and assess your proposal and to communicate with you about its progress.
Bearers of cultural practices (individuals and associations)
For bearers and keepers of cultural practices we process: name and surname, e-mail, phone, address, photographs and the link to the specific cultural practice. This serves the record of actors, the regular monitoring reports (re-documentation) of the practice and communication.
Supporters of inscription
If you sign up for a cultural practice on the Do you live the heritage page, we process: name and surname, e-mail, municipality, your relationship to the practice and, where given, the name of your organisation. The data serve the record of support (aggregate numbers are presented to the expert committee). Only if you have given consent do they also serve for sending information about the outcome, for contact about the supported practices or for the newsletter. You can withdraw any consent at any time by e-mail; only the number of supporters is displayed publicly, never names.
Reviewers and committee members
For expert reviewers and members of the assessment committee we process: name and surname, e-mail, phone and institutional affiliation. This serves the assignment of reviews, voting and communication within the assessment process.
Website visitors
During an ordinary visit we process only the technical data necessary for operation and security (for example the IP address in server logs). The site uses only the technical cookies necessary for its functioning.
3. What is published
The register has a public and a non-public part. The publicly accessible heritage pages and the map contain only the information meant to be published in connection with keeping the list. Names are published in connection with the presentation of a practice on the basis of the consent you give when submitting a proposal. Sensitive or non-public parts of a proposal that the bearers do not wish to publish can be marked and restricted on request.
4. The legal basis for processing
We process personal data on the basis of:
- the performance of a task in the public interest and the exercise of official authority, namely keeping the regional list of intangible cultural heritage in line with the regional strategy and the UNESCO Convention for the Safeguarding of the Intangible Cultural Heritage,
- your consent, above all for publishing names and for publishing photographs or audiovisual materials,
- compliance with legal obligations that apply to the museum as a publicly funded organisation.
Where processing rests on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
5. How long we keep the data
We keep the data for the time necessary to fulfil the purpose for which they were obtained, and further for the time set by law, above all by the museum’s records management and shredding rules as a public-sector originator.
6. Who we pass the data to
We do not pass your data to third parties for their own purposes. The register is technically supported by a processor who provides development and support of the application for the museum, solely on the basis of a data processing agreement under Article 28 GDPR and only on the museum’s instructions. In connection with the national list, relevant data may be passed to the competent institutions (the Ministry of Culture, the National Institute of Folk Culture) where the inscription process requires it.
7. How we protect the data
We have adopted technical and organisational measures matching the risks of the processing. Communication with the application is encrypted over HTTPS, access to the administration is protected by login and role-based permissions, passwords are stored in hashed form and the system keeps records of access and changes for audit purposes.
8. Your rights
Under the GDPR you have the right:
- to access your data and to information about their processing,
- to rectification of inaccurate or completion of incomplete data,
- to erasure of the data where there is no legal ground for keeping them,
- to restriction of processing,
- to data portability,
- to object to processing,
- to withdraw previously given consent,
- to lodge a complaint with the supervisory authority, which is the Czech Office for Personal Data Protection (Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz).
To exercise your rights, contact us at podpora@zivededictvi.cz. We will handle your request without undue delay, at the latest within one month.
This policy may be updated from time to time. The current wording is always available on this page. The Czech version is the authoritative one.