Privacy Policy for the Recordio Service

1. Introduction

This Privacy Policy explains how the operator of the Recordio platform processes the personal data of users, visitors to the platform, Sellers and Buyers.

Recordio is an online marketplace for musical instruments and related hardware. The platform enables private individuals to list an Offer, submit a Price Offer, conclude a purchase contract between users, communicate through chat and use related platform functions.

This Policy follows the Terms of Service of Recordio. The Terms of Service govern in particular the legal relationship between the user and the platform operator. This document describes the processing of personal data in detail.

2. Who is the controller of personal data

The controller of personal data is:

Pavel Halabica self-employed natural person IČO: 76608549 registered office: Západní 473/8, 783 36 Křelov-Břuchotín e-mail for data protection matters: privacy@recordio.cz

The controller determines the purposes and means of processing personal data in connection with the operation of the Recordio platform.

The controller has not appointed a data protection officer because, given the current scope of activities, no such obligation applies. If the scope or nature of processing changes in the future, the controller will reassess this matter.

3. What personal data we process

We process only data that is necessary for operating the platform, fulfilling contractual and legal obligations, protecting users, ensuring platform security and communicating with users.

3.1 Account and registration data

We process in particular:

e-mail address;
first name and surname;
password in a secure technical form (hash), if the user registers by e-mail;
third-party account identifier, if the user logs in through Google, Facebook or another supported service;
registration date;
account language and currency settings;
e-mail verification status;
account status.

3.2 Profile and contact details

Depending on what the user completes or verifies, we may process:

telephone number;
telephone number verification status;
profile photograph;
profile description;
city and country;
delivery address, if the user provides it for the purposes of a Transaction;
other data that the user voluntarily includes in their profile.

3.3 Offer data

For Offers, we process in particular:

Offer title;
goods category;
brand, model, year of manufacture, condition and description of the goods, where provided;
price and currency;
photographs and other content uploaded by the user;
information about defects, repairs, modifications or accessories;
available shipping and payment methods;
date of publication, edits, deactivation or sale of the Offer;
Offer status.

The user should not unnecessarily include personal data of third parties, photographs of persons, documents, precise residential addresses or other sensitive data in an Offer. If the user includes such data in an Offer, they do so at their own responsibility.

3.4 Offer and Transaction data

In connection with Price Offers, counter-offers, Buy Now and completion of Transactions, we process in particular:

identification of the Seller and Buyer;
data concerning the Offer to which the Transaction relates;
offered and agreed price;
currency;
shipping and its price;
selected payment method;
Transaction status;
dates of sending an offer, acceptance, refusal, expiry, cancellation, marking payment, dispatch, delivery and completion;
data required to calculate platform fees;
any information about a dispute or reported problem.

Recordio does not hold the purchase price and does not transfer the purchase price between Buyer and Seller. If Buyer and Seller use an external payment service or bank transfer, the payment takes place outside Recordio.

3.5 Contact details made available after conclusion of the purchase contract

After conclusion of the purchase contract, the platform may make available to both parties the data needed to complete the Transaction, in particular:

the full name of the other party;
city and country;
verified telephone number, if the other party has provided and verified it.

The e-mail address of the other party is not made available as standard. Communication should continue primarily through the platform chat.

3.6 Chat, messages and communication

We process:

messages sent through the platform chat;
system messages associated with a Transaction;
reports of Transaction problems;
communication with customer support;
e-mail communication with the operator;
the content of reports of illegal content, disputes or security issues.

Chat and communication may be used for dispute resolution, fraud prevention, moderation, platform security and compliance with legal obligations.

3.7 Invoicing data and fees

If a user becomes obliged to pay a platform fee, we process in particular:

identification of the fee payer;
e-mail for invoice delivery;
data concerning the Transaction from which the fee arose;
fee amount, currency and invoice issue date;
due date and payment status;
reminders and data concerning any debt recovery.

3.8 Data for statutory reporting obligations

The operator may be obliged under applicable legal regulations to collect, verify, retain and report selected data concerning Sellers and Transactions carried out through the platform to tax administration authorities.

If such an obligation arises or its arising is reasonably expected, we may request from the Seller in particular:

first name and surname;
main residential address;
date of birth;
country of tax residence;
tax identification number, if issued;
payment data or account identifier, if we process it or if its collection is required by law;
data on the number and value of completed Transactions in the relevant period.

The scope of the specific data required is always governed by applicable legal regulations.

3.9 Security and technical data

To ensure platform security and protection against misuse, we process in particular:

IP address;
device and browser type;
operating system;
login and logout time;
technical logs;
data on unsuccessful login attempts;
information on suspicious activity;
technical session identifiers;
data required to protect against spam, fraud and circumvention of platform rules.

3.10 Trust Level and anti-fraud

The platform may assign a Trust Level to a user based on account verification, telephone verification, history of completed Transactions and other security parameters.

The Trust Level serves to prevent fraud and to inform users about the level of verification of the counterparty. It does not constitute a guarantee by the operator for the user's conduct.

Automated tools may help flag suspicious content, suspicious behaviour or breaches of rules. Significant moderation decisions may be reviewed using the procedure set out in the Terms of Service.

If a user gives consent to receive the newsletter, we process:

e-mail address;
information on granting or withdrawing consent;
date and time of consent;
technical data required to prove consent;
where applicable, information on e-mail delivery and unsubscribe.

Marketing communications are sent only under the conditions set out in the Terms of Service and in this document.

3.12 Cookies and similar technologies

At launch, the platform uses only technically necessary cookies required for the operation and security of the platform, in particular for login, maintaining sessions, protection against attacks and storing basic preferences.

We do not use analytics or marketing cookies unless the user gives express consent to them. Details are set out in the separate Cookie Policy.

4. Why we process personal data and on what legal basis

4.1 Operation of the user account and provision of the service

Purpose: registration, login, maintaining the account, profile management, use of platform functions. Legal basis: performance of a contract under Article 6(1)(b) GDPR.

Without this data, an account cannot be created or the platform cannot be fully used.

4.2 Listing Offers and content management

Purpose: publication of an Offer, management of photographs, description of goods, edits and deactivation of an Offer. Legal basis: performance of a contract under Article 6(1)(b) GDPR and legitimate interest under Article 6(1)(f) GDPR in operating and protecting the platform.

4.3 Conclusion and recording of Transactions between users

Purpose: recording offers, counter-offers, Buy Now, Transaction status, delivery, completion and any dispute. Legal basis: performance of the contract for use of the platform under Article 6(1)(b) GDPR and the controller's legitimate interest under Article 6(1)(f) GDPR in the proper functioning of the platform and protection of users' rights.

4.4 Making contact details available after conclusion of the purchase contract

Purpose: enabling completion of the Transaction, delivery of goods, personal pickup and resolution of practical issues between Buyer and Seller. Legal basis: performance of a contract under Article 6(1)(b) GDPR.

4.5 Chat and communication

Purpose: enabling communication between the parties to a Transaction, recording the course of the Transaction, resolving disputes, preventing fraud and protecting the platform. Legal basis: performance of a contract under Article 6(1)(b) GDPR and legitimate interest under Article 6(1)(f) GDPR.

4.6 Invoicing, accounting and fees

Purpose: issuing invoices, recording fees, reminders, accounting and tax obligations. Legal basis: compliance with a legal obligation under Article 6(1)(c) GDPR and performance of a contract under Article 6(1)(b) GDPR.

4.7 Statutory reporting obligations

Purpose: assessment and fulfilment of any reporting obligations of the operator of a digital platform towards tax administration authorities or other public authorities. Legal basis: compliance with a legal obligation under Article 6(1)(c) GDPR.

Where processing is necessary to comply with a legal obligation, the legal basis is not the user's consent.

4.8 Fraud prevention, security and protection of the platform

Purpose: protection of accounts, fraud prevention, detection of suspicious behaviour, protection against spam, misuse, circumvention of rules and illegal content. Legal basis: legitimate interest under Article 6(1)(f) GDPR.

4.9 Moderation, DSA and product safety

Purpose: handling reports, content moderation, product safety, cooperation with public authorities, recording measures and protecting users. Legal basis: compliance with a legal obligation under Article 6(1)(c) GDPR and legitimate interest under Article 6(1)(f) GDPR.

Purpose: sending newsletters and marketing communication concerning the Recordio platform. Legal basis: consent under Article 6(1)(a) GDPR.

If legal regulations allow commercial communications to be sent to existing customers without separate consent, the legal basis may also be legitimate interest under Article 6(1)(f) GDPR in conjunction with the relevant electronic communications legislation. The user always has the option to unsubscribe from marketing communication.

4.11 Technically necessary cookies

Purpose: ensuring platform functionality, login, security, sessions and basic preferences. Legal basis: legitimate interest under Article 6(1)(f) GDPR, or performance of a contract under Article 6(1)(b) GDPR. For technically necessary cookies, consent is not required under the rules for storing cookies.

4.12 Analytics and marketing cookies

Purpose: analytics, measurement, advertising or marketing personalisation, if introduced in the future. Legal basis: consent under Article 6(1)(a) GDPR.

At launch, we do not use these cookies.

5. To whom we disclose personal data

We disclose personal data only to the necessary extent and only where this is necessary for operating the platform, complying with legal obligations, protecting rights or providing the service.

5.1 Other platform users

After conclusion of the purchase contract, we make selected data required to complete the Transaction available to the other party, in particular full name, city and country and verified telephone number, if available.

Offer content, profile information and reviews may be publicly available to the extent to which the user publishes them through the platform.

5.2 Technology suppliers

We may use suppliers who help us operate the platform, in particular:

hosting and cloud services;
database and storage services;
services for storing and optimising photographs;
e-mail service providers;
SMS or telephone verification providers;
security, monitoring and logging providers;
customer support tools;
invoicing and accounting tools;
identity verification providers, if this function is introduced.

These suppliers process personal data as processors or independent controllers depending on the nature of the service provided. We enter into data processing agreements with suppliers acting as processors to the extent required by GDPR.

5.3 Accountants, tax advisers and legal advisers

We may disclose personal data to accountants, tax advisers, attorneys or other professional advisers where necessary for accounting, tax obligations, resolution of legal claims or compliance with legal obligations.

5.4 Public authorities

We may disclose personal data to public authorities where required by law or by a legitimate request, in particular to:

law enforcement authorities;
courts;
administrative authorities;
product safety supervisory authorities;
tax administration authorities;
the Office for Personal Data Protection.

5.5 Marketing and advertising suppliers

If the user gives consent to the newsletter or if photographs from a public Offer are used to promote the platform to the extent set out in the Terms of Service, selected data or content may be disclosed to technical, marketing or advertising suppliers to the necessary extent.

The operator does not sell users' personal data to third parties.

6. Transfers of personal data outside the EU/EEA

We aim to process personal data primarily within the European Union or the European Economic Area.

However, some technology suppliers may have their registered office, infrastructure or subcontractors outside the EU/EEA. Where personal data is transferred outside the EU/EEA, we ensure that such transfer takes place in accordance with GDPR, in particular on the basis of:

an adequacy decision of the European Commission;
standard contractual clauses;
other appropriate safeguards under GDPR.

7. How long we retain personal data

We retain personal data only for as long as necessary for the purposes for which it was processed, and further for the period required by legal regulations or necessary to protect legal claims.

Indicative retention periods are as follows:

Data category	Retention period
Account and registration data	for the duration of the account
Data required to process account cancellation	generally up to 30 days from handling the request, unless further retention is necessary
Offers and public content	for the period of publication and thereafter for the period necessary for records, disputes and protection of rights
Transaction data	for the period necessary for performance of the contract, dispute resolution, invoicing and protection of legal claims
Invoicing and accounting data	generally 10 years under accounting and tax regulations
Chat relating to a Transaction	for the period necessary for resolving the Transaction, disputes, security and protection of rights
Security logs	generally 6 to 12 months, longer in the event of a security incident or dispute
Data for statutory reporting obligations	for the period laid down by legal regulations
Illegal content reports, DSA/GPSR records	for the period necessary to comply with legal obligations and protect rights
Newsletter consent	until withdrawal of consent and thereafter for the period necessary to prove that consent was granted or withdrawn
Cookies	according to the type of cookies and settings set out in the Cookie Policy

After expiry of the retention period, we delete, anonymise or restrict the processing of personal data if it is no longer needed.

After account cancellation, we do not automatically delete all data immediately if further retention is necessary to comply with a legal obligation, for accounting or tax purposes, to resolve disputes, for platform security or to protect legal claims.

8. How we protect personal data

We use appropriate technical and organisational measures to protect personal data, in particular:

access rights management;
account security;
encrypted communication where technically standard;
storing passwords in a secure form;
backups;
logging of security events;
limiting access to personal data only to persons and suppliers who need it;
measures against spam, misuse and unauthorised access.

However, no system is absolutely secure. If a personal data breach occurs, we proceed in accordance with GDPR and other applicable legal regulations.

9. Automated tools, Trust Level and moderation

The platform may use automated or semi-automated tools for:

detecting suspicious login;
detecting spam;
detecting suspicious contacts or links intended to circumvent the platform;
assessing certain anti-fraud signals;
assigning or adjusting Trust Level;
flagging content for moderation.

These tools serve to protect the platform and users. If an automated tool makes a decision that significantly affects the user (in particular temporary hiding or removal of content, account restriction, reduction of Trust Level), the user has the right to human review of that decision through the appeal procedure set out in the Terms of Service (in particular Articles 25.2.7 and 25.2.8).

The operator does not use solely automated decision-making within the meaning of Article 22 GDPR without the possibility of human intervention. For significant decisions, an appeal procedure with human review is always available.

10. Children and persons under 18 years of age

The Recordio platform is intended only for persons over 18 years of age and persons with full legal capacity.

A person under 18 years of age may not create an account. If the operator discovers that an account has been created by a person under 18 years of age, the operator may cancel the account and process related data only to the extent necessary to resolve the situation and protect rights.

11. User rights

In relation to their personal data, the user has rights under GDPR, in particular:

11.1 Right of access

The user has the right to obtain confirmation as to whether we process their personal data and, where applicable, to obtain access to such data and further information about the processing.

11.2 Right to rectification

The user has the right to request correction of inaccurate or outdated personal data.

11.3 Right to erasure

The user has the right to request erasure of personal data where the conditions under GDPR are met.

The right to erasure is not absolute. We may continue to retain certain data where necessary to comply with legal obligations, for accounting or tax purposes, to resolve disputes, protect legal claims, ensure platform security or for other statutory reasons.

11.4 Right to restriction of processing

The user has the right to request restriction of processing of personal data in the cases provided for by GDPR.

11.5 Right to data portability

If processing is based on consent or on a contract and is carried out by automated means, the user has the right to receive their personal data in a structured, commonly used and machine-readable format.

11.6 Right to object

The user has the right to object to processing based on the controller's legitimate interest.

If the user objects, we will no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override the interests or rights of the user, or unless we need the data for the establishment, exercise or defence of legal claims.

Where processing is based on consent, the user may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing before its withdrawal.

11.8 Right to lodge a complaint

The user has the right to lodge a complaint with the supervisory authority:

Office for Personal Data Protection Pplk. Sochora 727/27 170 00 Prague 7 — Holešovice website: www.uoou.gov.cz

12. How rights may be exercised

The user may exercise their rights by e-mail at:

privacy@recordio.cz

The request should contain sufficient information to verify the identity of the applicant and to handle the request.

We will usually respond to a request within 30 days of receipt. If the request is complex or if we receive a large number of requests, we may extend the period in accordance with GDPR. We will inform the user of the extension and the reasons for it.

If we are unable to verify the applicant's identity, we may ask for additional information necessary for verification.

13. Obligation to provide data

Some data is necessary for use of the platform. If the user does not provide it, it may not be possible to create an account, list an Offer, submit an offer, conclude a Transaction, issue an invoice or comply with a legal obligation.

Data required in particular includes data necessary for:

account creation;
e-mail verification;
listing an Offer;
conclusion and recording of a Transaction;
invoicing of fees;
compliance with statutory reporting obligations, if they arise;
platform security.

Optional data includes, for example, a profile photograph, profile description or certain additional data in an Offer. Failure to provide such data will generally not prevent basic use of the platform, but may limit the trustworthiness of the profile or the comfort of using the service.

14. Cookies

Details on the use of cookies and similar technologies are set out in the separate Cookie Policy.

At launch, the platform uses only technically necessary cookies. These cookies are required for the functioning of the platform and security of the service.

If analytics, marketing or other non-technical cookies are introduced in the future, they will be used only under the conditions laid down by legal regulations, generally on the basis of the user's express consent.

15. Changes to this Policy

We may amend this Policy from time to time, in particular if legal regulations, the way the platform operates, the suppliers used, the scope of processed data or related documents change.

We will inform users of material changes in an appropriate manner, in particular by e-mail or by notice in the platform interface.

The current version of the Policy is always available on the Recordio platform.

16. Contact

For questions concerning personal data or to exercise rights under GDPR, contact us at:

privacy@recordio.cz

For legal matters not directly related to personal data, please use:

legal@recordio.cz

Issued by: Pavel Halabica, operator of the Recordio platform Date of issue: 31 May 2026 Effective from: 1 June 2026

1. Introduction

This Privacy Policy explains how the operator of the Recordio platform processes the personal data of users, visitors to the platform, Sellers and Buyers.

2. Who is the controller of personal data

The controller of personal data is:

Pavel Halabica self-employed natural person IČO: 76608549 registered office: Západní 473/8, 783 36 Křelov-Břuchotín e-mail for data protection matters: privacy@recordio.cz

The controller determines the purposes and means of processing personal data in connection with the operation of the Recordio platform.

3. What personal data we process

We process only data that is necessary for operating the platform, fulfilling contractual and legal obligations, protecting users, ensuring platform security and communicating with users.

3.1 Account and registration data

We process in particular:

e-mail address;
first name and surname;
password in a secure technical form (hash), if the user registers by e-mail;
third-party account identifier, if the user logs in through Google, Facebook or another supported service;
registration date;
account language and currency settings;
e-mail verification status;
account status.

3.2 Profile and contact details

Depending on what the user completes or verifies, we may process:

telephone number;
telephone number verification status;
profile photograph;
profile description;
city and country;
delivery address, if the user provides it for the purposes of a Transaction;
other data that the user voluntarily includes in their profile.

3.3 Offer data

For Offers, we process in particular:

Offer title;
goods category;
brand, model, year of manufacture, condition and description of the goods, where provided;
price and currency;
photographs and other content uploaded by the user;
information about defects, repairs, modifications or accessories;
available shipping and payment methods;
date of publication, edits, deactivation or sale of the Offer;
Offer status.

3.4 Offer and Transaction data

In connection with Price Offers, counter-offers, Buy Now and completion of Transactions, we process in particular:

identification of the Seller and Buyer;
data concerning the Offer to which the Transaction relates;
offered and agreed price;
currency;
shipping and its price;
selected payment method;
Transaction status;
dates of sending an offer, acceptance, refusal, expiry, cancellation, marking payment, dispatch, delivery and completion;
data required to calculate platform fees;
any information about a dispute or reported problem.

3.5 Contact details made available after conclusion of the purchase contract

After conclusion of the purchase contract, the platform may make available to both parties the data needed to complete the Transaction, in particular:

the full name of the other party;
city and country;
verified telephone number, if the other party has provided and verified it.

The e-mail address of the other party is not made available as standard. Communication should continue primarily through the platform chat.

3.6 Chat, messages and communication

We process:

messages sent through the platform chat;
system messages associated with a Transaction;
reports of Transaction problems;
communication with customer support;
e-mail communication with the operator;
the content of reports of illegal content, disputes or security issues.

Chat and communication may be used for dispute resolution, fraud prevention, moderation, platform security and compliance with legal obligations.

3.7 Invoicing data and fees

If a user becomes obliged to pay a platform fee, we process in particular:

identification of the fee payer;
e-mail for invoice delivery;
data concerning the Transaction from which the fee arose;
fee amount, currency and invoice issue date;
due date and payment status;
reminders and data concerning any debt recovery.

3.8 Data for statutory reporting obligations

If such an obligation arises or its arising is reasonably expected, we may request from the Seller in particular:

first name and surname;
main residential address;
date of birth;
country of tax residence;
tax identification number, if issued;
payment data or account identifier, if we process it or if its collection is required by law;
data on the number and value of completed Transactions in the relevant period.

The scope of the specific data required is always governed by applicable legal regulations.

3.9 Security and technical data

To ensure platform security and protection against misuse, we process in particular:

IP address;
device and browser type;
operating system;
login and logout time;
technical logs;
data on unsuccessful login attempts;
information on suspicious activity;
technical session identifiers;
data required to protect against spam, fraud and circumvention of platform rules.

3.10 Trust Level and anti-fraud

The platform may assign a Trust Level to a user based on account verification, telephone verification, history of completed Transactions and other security parameters.

The Trust Level serves to prevent fraud and to inform users about the level of verification of the counterparty. It does not constitute a guarantee by the operator for the user's conduct.

Automated tools may help flag suspicious content, suspicious behaviour or breaches of rules. Significant moderation decisions may be reviewed using the procedure set out in the Terms of Service.

If a user gives consent to receive the newsletter, we process:

e-mail address;
information on granting or withdrawing consent;
date and time of consent;
technical data required to prove consent;
where applicable, information on e-mail delivery and unsubscribe.

Marketing communications are sent only under the conditions set out in the Terms of Service and in this document.

3.12 Cookies and similar technologies

We do not use analytics or marketing cookies unless the user gives express consent to them. Details are set out in the separate Cookie Policy.

4. Why we process personal data and on what legal basis

4.1 Operation of the user account and provision of the service

Purpose: registration, login, maintaining the account, profile management, use of platform functions. Legal basis: performance of a contract under Article 6(1)(b) GDPR.

Without this data, an account cannot be created or the platform cannot be fully used.

4.2 Listing Offers and content management

4.3 Conclusion and recording of Transactions between users

4.4 Making contact details available after conclusion of the purchase contract

4.5 Chat and communication

4.6 Invoicing, accounting and fees

4.7 Statutory reporting obligations

Where processing is necessary to comply with a legal obligation, the legal basis is not the user's consent.

4.8 Fraud prevention, security and protection of the platform

4.9 Moderation, DSA and product safety

Purpose: sending newsletters and marketing communication concerning the Recordio platform. Legal basis: consent under Article 6(1)(a) GDPR.

4.11 Technically necessary cookies

4.12 Analytics and marketing cookies

Purpose: analytics, measurement, advertising or marketing personalisation, if introduced in the future. Legal basis: consent under Article 6(1)(a) GDPR.

At launch, we do not use these cookies.

5. To whom we disclose personal data

We disclose personal data only to the necessary extent and only where this is necessary for operating the platform, complying with legal obligations, protecting rights or providing the service.

5.1 Other platform users

Offer content, profile information and reviews may be publicly available to the extent to which the user publishes them through the platform.

5.2 Technology suppliers

We may use suppliers who help us operate the platform, in particular:

hosting and cloud services;
database and storage services;
services for storing and optimising photographs;
e-mail service providers;
SMS or telephone verification providers;
security, monitoring and logging providers;
customer support tools;
invoicing and accounting tools;
identity verification providers, if this function is introduced.

5.3 Accountants, tax advisers and legal advisers

5.4 Public authorities

We may disclose personal data to public authorities where required by law or by a legitimate request, in particular to:

law enforcement authorities;
courts;
administrative authorities;
product safety supervisory authorities;
tax administration authorities;
the Office for Personal Data Protection.

5.5 Marketing and advertising suppliers

The operator does not sell users' personal data to third parties.

6. Transfers of personal data outside the EU/EEA

We aim to process personal data primarily within the European Union or the European Economic Area.

an adequacy decision of the European Commission;
standard contractual clauses;
other appropriate safeguards under GDPR.

7. How long we retain personal data

We retain personal data only for as long as necessary for the purposes for which it was processed, and further for the period required by legal regulations or necessary to protect legal claims.

Indicative retention periods are as follows:

Data category	Retention period
Account and registration data	for the duration of the account
Data required to process account cancellation	generally up to 30 days from handling the request, unless further retention is necessary
Offers and public content	for the period of publication and thereafter for the period necessary for records, disputes and protection of rights
Transaction data	for the period necessary for performance of the contract, dispute resolution, invoicing and protection of legal claims
Invoicing and accounting data	generally 10 years under accounting and tax regulations
Chat relating to a Transaction	for the period necessary for resolving the Transaction, disputes, security and protection of rights
Security logs	generally 6 to 12 months, longer in the event of a security incident or dispute
Data for statutory reporting obligations	for the period laid down by legal regulations
Illegal content reports, DSA/GPSR records	for the period necessary to comply with legal obligations and protect rights
Newsletter consent	until withdrawal of consent and thereafter for the period necessary to prove that consent was granted or withdrawn
Cookies	according to the type of cookies and settings set out in the Cookie Policy

After expiry of the retention period, we delete, anonymise or restrict the processing of personal data if it is no longer needed.

8. How we protect personal data

We use appropriate technical and organisational measures to protect personal data, in particular:

access rights management;
account security;
encrypted communication where technically standard;
storing passwords in a secure form;
backups;
logging of security events;
limiting access to personal data only to persons and suppliers who need it;
measures against spam, misuse and unauthorised access.

However, no system is absolutely secure. If a personal data breach occurs, we proceed in accordance with GDPR and other applicable legal regulations.

9. Automated tools, Trust Level and moderation

The platform may use automated or semi-automated tools for:

detecting suspicious login;
detecting spam;
detecting suspicious contacts or links intended to circumvent the platform;
assessing certain anti-fraud signals;
assigning or adjusting Trust Level;
flagging content for moderation.

10. Children and persons under 18 years of age

The Recordio platform is intended only for persons over 18 years of age and persons with full legal capacity.

11. User rights

In relation to their personal data, the user has rights under GDPR, in particular:

11.1 Right of access

The user has the right to obtain confirmation as to whether we process their personal data and, where applicable, to obtain access to such data and further information about the processing.

11.2 Right to rectification

The user has the right to request correction of inaccurate or outdated personal data.

11.3 Right to erasure

The user has the right to request erasure of personal data where the conditions under GDPR are met.

11.4 Right to restriction of processing

The user has the right to request restriction of processing of personal data in the cases provided for by GDPR.

11.5 Right to data portability

11.6 Right to object

The user has the right to object to processing based on the controller's legitimate interest.

Where processing is based on consent, the user may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing before its withdrawal.

11.8 Right to lodge a complaint

The user has the right to lodge a complaint with the supervisory authority:

Office for Personal Data Protection Pplk. Sochora 727/27 170 00 Prague 7 — Holešovice website: www.uoou.gov.cz

12. How rights may be exercised

The user may exercise their rights by e-mail at:

privacy@recordio.cz

The request should contain sufficient information to verify the identity of the applicant and to handle the request.

If we are unable to verify the applicant's identity, we may ask for additional information necessary for verification.

13. Obligation to provide data

Data required in particular includes data necessary for:

account creation;
e-mail verification;
listing an Offer;
conclusion and recording of a Transaction;
invoicing of fees;
compliance with statutory reporting obligations, if they arise;
platform security.

14. Cookies

Details on the use of cookies and similar technologies are set out in the separate Cookie Policy.

At launch, the platform uses only technically necessary cookies. These cookies are required for the functioning of the platform and security of the service.

15. Changes to this Policy

We may amend this Policy from time to time, in particular if legal regulations, the way the platform operates, the suppliers used, the scope of processed data or related documents change.

We will inform users of material changes in an appropriate manner, in particular by e-mail or by notice in the platform interface.

The current version of the Policy is always available on the Recordio platform.

16. Contact

For questions concerning personal data or to exercise rights under GDPR, contact us at:

privacy@recordio.cz

For legal matters not directly related to personal data, please use:

legal@recordio.cz

Issued by: Pavel Halabica, operator of the Recordio platform Date of issue: 31 May 2026 Effective from: 1 June 2026

1. Introduction

2. Who is the controller of personal data

3. What personal data we process

3.1 Account and registration data

3.2 Profile and contact details

3.3 Offer data

3.4 Offer and Transaction data

3.5 Contact details made available after conclusion of the purchase contract

3.6 Chat, messages and communication

3.7 Invoicing data and fees

3.8 Data for statutory reporting obligations

3.9 Security and technical data

3.10 Trust Level and anti-fraud

3.11 Newsletter and marketing

3.12 Cookies and similar technologies

4. Why we process personal data and on what legal basis

4.1 Operation of the user account and provision of the service

4.2 Listing Offers and content management

4.3 Conclusion and recording of Transactions between users

4.4 Making contact details available after conclusion of the purchase contract

4.5 Chat and communication

4.6 Invoicing, accounting and fees

4.7 Statutory reporting obligations

4.8 Fraud prevention, security and protection of the platform

4.9 Moderation, DSA and product safety

4.10 Newsletter and marketing

4.11 Technically necessary cookies

4.12 Analytics and marketing cookies

5. To whom we disclose personal data

5.1 Other platform users

5.2 Technology suppliers

5.3 Accountants, tax advisers and legal advisers

5.4 Public authorities

5.5 Marketing and advertising suppliers

6. Transfers of personal data outside the EU/EEA

7. How long we retain personal data

8. How we protect personal data

9. Automated tools, Trust Level and moderation

10. Children and persons under 18 years of age

11. User rights

11.1 Right of access

11.2 Right to rectification

11.3 Right to erasure

11.4 Right to restriction of processing

11.5 Right to data portability

11.6 Right to object

11.7 Right to withdraw consent

11.8 Right to lodge a complaint

12. How rights may be exercised

13. Obligation to provide data

14. Cookies

15. Changes to this Policy

16. Contact

1. Introduction

2. Who is the controller of personal data

3. What personal data we process

3.1 Account and registration data

3.2 Profile and contact details

3.3 Offer data

3.4 Offer and Transaction data

3.5 Contact details made available after conclusion of the purchase contract

3.6 Chat, messages and communication

3.7 Invoicing data and fees

3.8 Data for statutory reporting obligations

3.9 Security and technical data

3.10 Trust Level and anti-fraud

3.11 Newsletter and marketing

3.12 Cookies and similar technologies

4. Why we process personal data and on what legal basis

4.1 Operation of the user account and provision of the service

4.2 Listing Offers and content management

4.3 Conclusion and recording of Transactions between users

4.4 Making contact details available after conclusion of the purchase contract

4.5 Chat and communication

4.6 Invoicing, accounting and fees

4.7 Statutory reporting obligations

4.8 Fraud prevention, security and protection of the platform

4.9 Moderation, DSA and product safety

4.10 Newsletter and marketing

4.11 Technically necessary cookies