This Privacy Policy explains how the operator of the Recordio platform processes the personal data of users, visitors to the platform, Sellers and Buyers.
Recordio is an online marketplace for musical instruments and related hardware. The platform enables private individuals to list an Offer, submit a Price Offer, conclude a purchase contract between users, communicate through chat and use related platform functions.
This Policy follows the Terms of Service of Recordio. The Terms of Service govern in particular the legal relationship between the user and the platform operator. This document describes the processing of personal data in detail.
The controller of personal data is:
Pavel Halabica self-employed natural person IČO: 76608549 registered office: Západní 473/8, 783 36 Křelov-Břuchotín e-mail for data protection matters: privacy@recordio.cz
The controller determines the purposes and means of processing personal data in connection with the operation of the Recordio platform.
The controller has not appointed a data protection officer because, given the current scope of activities, no such obligation applies. If the scope or nature of processing changes in the future, the controller will reassess this matter.
We process only data that is necessary for operating the platform, fulfilling contractual and legal obligations, protecting users, ensuring platform security and communicating with users.
We process in particular:
Depending on what the user completes or verifies, we may process:
For Offers, we process in particular:
The user should not unnecessarily include personal data of third parties, photographs of persons, documents, precise residential addresses or other sensitive data in an Offer. If the user includes such data in an Offer, they do so at their own responsibility.
In connection with Price Offers, counter-offers, Buy Now and completion of Transactions, we process in particular:
Recordio does not hold the purchase price and does not transfer the purchase price between Buyer and Seller. If Buyer and Seller use an external payment service or bank transfer, the payment takes place outside Recordio.
After conclusion of the purchase contract, the platform may make available to both parties the data needed to complete the Transaction, in particular:
The e-mail address of the other party is not made available as standard. Communication should continue primarily through the platform chat.
We process:
Chat and communication may be used for dispute resolution, fraud prevention, moderation, platform security and compliance with legal obligations.
If a user becomes obliged to pay a platform fee, we process in particular:
The operator may be obliged under applicable legal regulations to collect, verify, retain and report selected data concerning Sellers and Transactions carried out through the platform to tax administration authorities.
If such an obligation arises or its arising is reasonably expected, we may request from the Seller in particular:
The scope of the specific data required is always governed by applicable legal regulations.
To ensure platform security and protection against misuse, we process in particular:
The platform may assign a Trust Level to a user based on account verification, telephone verification, history of completed Transactions and other security parameters.
The Trust Level serves to prevent fraud and to inform users about the level of verification of the counterparty. It does not constitute a guarantee by the operator for the user's conduct.
Automated tools may help flag suspicious content, suspicious behaviour or breaches of rules. Significant moderation decisions may be reviewed using the procedure set out in the Terms of Service.
If a user gives consent to receive the newsletter, we process:
Marketing communications are sent only under the conditions set out in the Terms of Service and in this document.
At launch, the platform uses only technically necessary cookies required for the operation and security of the platform, in particular for login, maintaining sessions, protection against attacks and storing basic preferences.
We do not use analytics or marketing cookies unless the user gives express consent to them. Details are set out in the separate Cookie Policy.
Purpose: registration, login, maintaining the account, profile management, use of platform functions. Legal basis: performance of a contract under Article 6(1)(b) GDPR.
Without this data, an account cannot be created or the platform cannot be fully used.
Purpose: publication of an Offer, management of photographs, description of goods, edits and deactivation of an Offer. Legal basis: performance of a contract under Article 6(1)(b) GDPR and legitimate interest under Article 6(1)(f) GDPR in operating and protecting the platform.
Purpose: recording offers, counter-offers, Buy Now, Transaction status, delivery, completion and any dispute. Legal basis: performance of the contract for use of the platform under Article 6(1)(b) GDPR and the controller's legitimate interest under Article 6(1)(f) GDPR in the proper functioning of the platform and protection of users' rights.
Purpose: enabling completion of the Transaction, delivery of goods, personal pickup and resolution of practical issues between Buyer and Seller. Legal basis: performance of a contract under Article 6(1)(b) GDPR.
Purpose: enabling communication between the parties to a Transaction, recording the course of the Transaction, resolving disputes, preventing fraud and protecting the platform. Legal basis: performance of a contract under Article 6(1)(b) GDPR and legitimate interest under Article 6(1)(f) GDPR.
Purpose: issuing invoices, recording fees, reminders, accounting and tax obligations. Legal basis: compliance with a legal obligation under Article 6(1)(c) GDPR and performance of a contract under Article 6(1)(b) GDPR.
Purpose: assessment and fulfilment of any reporting obligations of the operator of a digital platform towards tax administration authorities or other public authorities. Legal basis: compliance with a legal obligation under Article 6(1)(c) GDPR.
Where processing is necessary to comply with a legal obligation, the legal basis is not the user's consent.
Purpose: protection of accounts, fraud prevention, detection of suspicious behaviour, protection against spam, misuse, circumvention of rules and illegal content. Legal basis: legitimate interest under Article 6(1)(f) GDPR.
Purpose: handling reports, content moderation, product safety, cooperation with public authorities, recording measures and protecting users. Legal basis: compliance with a legal obligation under Article 6(1)(c) GDPR and legitimate interest under Article 6(1)(f) GDPR.
Purpose: sending newsletters and marketing communication concerning the Recordio platform. Legal basis: consent under Article 6(1)(a) GDPR.
If legal regulations allow commercial communications to be sent to existing customers without separate consent, the legal basis may also be legitimate interest under Article 6(1)(f) GDPR in conjunction with the relevant electronic communications legislation. The user always has the option to unsubscribe from marketing communication.
Purpose: ensuring platform functionality, login, security, sessions and basic preferences. Legal basis: legitimate interest under Article 6(1)(f) GDPR, or performance of a contract under Article 6(1)(b) GDPR. For technically necessary cookies, consent is not required under the rules for storing cookies.
Purpose: analytics, measurement, advertising or marketing personalisation, if introduced in the future. Legal basis: consent under Article 6(1)(a) GDPR.
At launch, we do not use these cookies.
We disclose personal data only to the necessary extent and only where this is necessary for operating the platform, complying with legal obligations, protecting rights or providing the service.
After conclusion of the purchase contract, we make selected data required to complete the Transaction available to the other party, in particular full name, city and country and verified telephone number, if available.
Offer content, profile information and reviews may be publicly available to the extent to which the user publishes them through the platform.
We may use suppliers who help us operate the platform, in particular:
These suppliers process personal data as processors or independent controllers depending on the nature of the service provided. We enter into data processing agreements with suppliers acting as processors to the extent required by GDPR.
We may disclose personal data to accountants, tax advisers, attorneys or other professional advisers where necessary for accounting, tax obligations, resolution of legal claims or compliance with legal obligations.
We may disclose personal data to public authorities where required by law or by a legitimate request, in particular to:
If the user gives consent to the newsletter or if photographs from a public Offer are used to promote the platform to the extent set out in the Terms of Service, selected data or content may be disclosed to technical, marketing or advertising suppliers to the necessary extent.
The operator does not sell users' personal data to third parties.
We aim to process personal data primarily within the European Union or the European Economic Area.
However, some technology suppliers may have their registered office, infrastructure or subcontractors outside the EU/EEA. Where personal data is transferred outside the EU/EEA, we ensure that such transfer takes place in accordance with GDPR, in particular on the basis of:
We retain personal data only for as long as necessary for the purposes for which it was processed, and further for the period required by legal regulations or necessary to protect legal claims.
Indicative retention periods are as follows:
| Data category | Retention period |
|---|---|
| Account and registration data | for the duration of the account |
| Data required to process account cancellation | generally up to 30 days from handling the request, unless further retention is necessary |
| Offers and public content | for the period of publication and thereafter for the period necessary for records, disputes and protection of rights |
| Transaction data | for the period necessary for performance of the contract, dispute resolution, invoicing and protection of legal claims |
| Invoicing and accounting data | generally 10 years under accounting and tax regulations |
| Chat relating to a Transaction | for the period necessary for resolving the Transaction, disputes, security and protection of rights |
| Security logs | generally 6 to 12 months, longer in the event of a security incident or dispute |
| Data for statutory reporting obligations | for the period laid down by legal regulations |
| Illegal content reports, DSA/GPSR records | for the period necessary to comply with legal obligations and protect rights |
| Newsletter consent | until withdrawal of consent and thereafter for the period necessary to prove that consent was granted or withdrawn |
| Cookies | according to the type of cookies and settings set out in the Cookie Policy |
After expiry of the retention period, we delete, anonymise or restrict the processing of personal data if it is no longer needed.
After account cancellation, we do not automatically delete all data immediately if further retention is necessary to comply with a legal obligation, for accounting or tax purposes, to resolve disputes, for platform security or to protect legal claims.
We use appropriate technical and organisational measures to protect personal data, in particular:
However, no system is absolutely secure. If a personal data breach occurs, we proceed in accordance with GDPR and other applicable legal regulations.
The platform may use automated or semi-automated tools for:
These tools serve to protect the platform and users. If an automated tool makes a decision that significantly affects the user (in particular temporary hiding or removal of content, account restriction, reduction of Trust Level), the user has the right to human review of that decision through the appeal procedure set out in the Terms of Service (in particular Articles 25.2.7 and 25.2.8).
The operator does not use solely automated decision-making within the meaning of Article 22 GDPR without the possibility of human intervention. For significant decisions, an appeal procedure with human review is always available.
The Recordio platform is intended only for persons over 18 years of age and persons with full legal capacity.
A person under 18 years of age may not create an account. If the operator discovers that an account has been created by a person under 18 years of age, the operator may cancel the account and process related data only to the extent necessary to resolve the situation and protect rights.
In relation to their personal data, the user has rights under GDPR, in particular:
The user has the right to obtain confirmation as to whether we process their personal data and, where applicable, to obtain access to such data and further information about the processing.
The user has the right to request correction of inaccurate or outdated personal data.
The user has the right to request erasure of personal data where the conditions under GDPR are met.
The right to erasure is not absolute. We may continue to retain certain data where necessary to comply with legal obligations, for accounting or tax purposes, to resolve disputes, protect legal claims, ensure platform security or for other statutory reasons.
The user has the right to request restriction of processing of personal data in the cases provided for by GDPR.
If processing is based on consent or on a contract and is carried out by automated means, the user has the right to receive their personal data in a structured, commonly used and machine-readable format.
The user has the right to object to processing based on the controller's legitimate interest.
If the user objects, we will no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override the interests or rights of the user, or unless we need the data for the establishment, exercise or defence of legal claims.
Where processing is based on consent, the user may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing before its withdrawal.
The user has the right to lodge a complaint with the supervisory authority:
Office for Personal Data Protection Pplk. Sochora 727/27 170 00 Prague 7 — Holešovice website: www.uoou.gov.cz
The user may exercise their rights by e-mail at:
The request should contain sufficient information to verify the identity of the applicant and to handle the request.
We will usually respond to a request within 30 days of receipt. If the request is complex or if we receive a large number of requests, we may extend the period in accordance with GDPR. We will inform the user of the extension and the reasons for it.
If we are unable to verify the applicant's identity, we may ask for additional information necessary for verification.
Some data is necessary for use of the platform. If the user does not provide it, it may not be possible to create an account, list an Offer, submit an offer, conclude a Transaction, issue an invoice or comply with a legal obligation.
Data required in particular includes data necessary for:
Optional data includes, for example, a profile photograph, profile description or certain additional data in an Offer. Failure to provide such data will generally not prevent basic use of the platform, but may limit the trustworthiness of the profile or the comfort of using the service.
Details on the use of cookies and similar technologies are set out in the separate Cookie Policy.
At launch, the platform uses only technically necessary cookies. These cookies are required for the functioning of the platform and security of the service.
If analytics, marketing or other non-technical cookies are introduced in the future, they will be used only under the conditions laid down by legal regulations, generally on the basis of the user's express consent.
We may amend this Policy from time to time, in particular if legal regulations, the way the platform operates, the suppliers used, the scope of processed data or related documents change.
We will inform users of material changes in an appropriate manner, in particular by e-mail or by notice in the platform interface.
The current version of the Policy is always available on the Recordio platform.
For questions concerning personal data or to exercise rights under GDPR, contact us at:
For legal matters not directly related to personal data, please use:
Issued by: Pavel Halabica, operator of the Recordio platform Date of issue: 31 May 2026 Effective from: 1 June 2026
