PRIVACY POLICY

The Cartel

thecartel.retiva.io | Effective: 6 May 2026

This Privacy Policy explains how we process personal data of persons using the voucher and ticket sales page available at thecartel.retiva.io ("Website"), redeeming vouchers at The Cartel premises, and using admission tickets to events.

1. Data Controller

The controller of your personal data is:

The Cartel, ul. Św. Filipa 23/3, 31-150 Kraków, Polska

E-mail: thecartelktw@gmail.com

(hereinafter: "The Cartel" or "Controller")

2. Contact for Data Matters

For matters relating to personal data, contact us at: thecartelktw@gmail.com.

3. Data We Process

3.1. Voucher buyers: e-mail address, first name (if provided), payment confirmation details (we do not store card numbers — payments are handled by a third-party payment operator), voucher code, date and amount of purchase, IP address.

3.2. Persons redeeming vouchers at the premises or presenting an admission ticket at the venue gate: voucher or ticket code, timestamp of redemption or entry, and device data used to present the code where applicable.

3.3. Technical data: IP address, browser data, access logs — to the extent necessary to ensure security and proper functioning of the Website.

4. Purposes and Legal Bases for Processing

Performing the voucher sales contract and electronic delivery — Art. 6(1)(b) GDPR.

Handling complaints and refund requests — Art. 6(1)(b) and (c) GDPR.

Fulfilling tax and accounting obligations — Art. 6(1)(c) GDPR.

Ensuring security and preventing fraud — Art. 6(1)(f) GDPR (legitimate interest).

Direct marketing of The Cartel's own products — only with consent — Art. 6(1)(a) GDPR.

5. Recipients of Data

Retiva.io (MS Quality Maria Szruba, NIP: 6462759343, ul. gen. Pułaskiego 38 lok. 11, 40-276 Katowice, Poland) — platform operator acting as a data processor on behalf of The Cartel.

Payment operator — a licensed third-party payment service provider, processing data solely to complete the transaction.

Legal and accounting advisors — only where required by law.

We do not sell your personal data.

6. Transfers Outside the EEA

If any service providers are located outside the EEA, we ensure appropriate safeguards in accordance with Chapter V of the GDPR (e.g. Standard Contractual Clauses).

7. Retention Periods

Purchase data, vouchers and tickets — for the duration of the contract and 5 years after expiry (tax/accounting obligations).

Marketing data — until consent is withdrawn.

Technical logs — generally up to 12 months.

8. Your Rights

access your data;

rectify inaccurate data;

erasure — where legally permissible;

restriction of processing;

data portability;

object to processing based on legitimate interest;

withdraw consent at any time;

lodge a complaint with the UODO (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

To exercise your rights, contact: thecartelktw@gmail.com.

9. Cookies

The Website may use cookies and similar technologies. Full details are set out in the Cookie Policy available on the Website.

10. Changes to This Privacy Policy

The Cartel reserves the right to amend this Privacy Policy. Changes take effect upon publication of the updated version on the Website.

Last updated: 6 May 2026.

The Cartel | thecartel.retiva.io | Platform: Retiva.io