Last updated: 21 October 2026
Cookies and privacy policy
This policy covers the Carmania website, communication with us and records from past events. The 2026 events have ended and their registration, media and VIP forms are closed.
Cookies ↓1. Website operator and data controller
carmania.sk
Legal form: civic association
Mládeže 364/30, 038 21 Mošovce, Slovenská republika
Company ID: 56 628 927
Register of Civic Associations, Ministry of Interior of the Slovak Republic
Registration number: VVS/1-900/90-70971
info@carmania.sk · +421 919 323 561
For privacy questions or to exercise your rights, write to info@carmania.sk or to our registered address. Please include enough information to identify your request; do not send unnecessary identity documents.
Official register entry ↗2. What data we process
- Website operation: technical connection data, including IP address, time, requested address, browser information and diagnostic records in server logs.
- Email and telephone contact: your contact details, the content of your enquiry and the information needed to respond.
- Past vehicle registrations: name, email, phone, city/country, vehicle details, registration plate, social profile and uploaded photos.
- Past media applications: name, email, Instagram, portfolio, age, media type and application details. Past VIP orders: name, address, email, phone, selected T-shirt size and order/payment status.
- Event archive: published event photographs and videos, which may include identifiable people or vehicle registration plates. Registration attachments are not a public gallery.
3. Purposes and legal bases
| Purpose | Legal basis under the GDPR |
|---|---|
| Handling enquiries and requests related to an order | Article 6(1)(b) — steps at your request before a contract or performance of a contract. Other correspondence: Article 6(1)(f) — our legitimate interest in responding to enquiries. |
| Past vehicle registrations and media applications | Article 6(1)(a) — the consent given for that registration or application, within its original purpose and scope. Consent can be withdrawn. |
| Handling VIP orders and their outstanding obligations | Article 6(1)(b) — performance of the order; mandatory accounting records: Article 6(1)(c) — compliance with applicable legal obligations. |
| Website security, operation and defence of legal claims | Article 6(1)(f) — our legitimate interest in protecting the website, data and legal rights, subject to the rights of the people concerned. |
| Reporting on past events in the public archive | Article 6(1)(f) — our legitimate interest in presenting the association and its events, where proportionate and compatible with the rights of the people depicted. For individual images processed on consent, Article 6(1)(a) applies. |
4. How long data are kept
- Organisational registration and application records: only for the necessary period, ordinarily no longer than 24 months after the relevant event or request is closed. An earlier end to the purpose or a justified erasure request may require earlier deletion.
- Order and accounting documents: for the period required by the applicable accounting and tax rules. Data needed for an existing legal claim are retained only for the necessary duration of that claim and the relevant limitation periods.
- Technical logs: for the period necessary for operation, detecting and resolving errors or security incidents, taking into account the hosting provider’s log rotation. A specific incident may require keeping the relevant records until it is resolved.
- Published archive material: while it remains necessary for documenting the association’s events, with regular consideration of relevance and the rights of the people depicted. Public event archiving does not justify indefinite retention of registration forms.
5. Recipients and service providers
Data may be accessed by authorised organisers, the website administrator and suppliers of hosting, databases, email and necessary accounting or legal services, to the extent required for their role. The current site configuration uses HostCreators hosting/database and email services. Processors may act only on documented instructions and under the applicable GDPR arrangements. Data may also be disclosed to public authorities where required by law.
6. External services and international transfers
The public website loads its fonts, images and videos locally. It does not embed social widgets, maps, advertising pixels or external analytics. Facebook, Instagram, YouTube, TikTok and Google Maps are links: opening them is a visit to another service governed by its own privacy policy and possible international transfers. Any transfer by our service providers outside the EEA must have a valid basis and safeguards under Chapter V of the GDPR; details can be requested from the controller.
7. Your rights and how to exercise them
- Access your personal data and request correction of inaccurate data.
- Request erasure or restriction of processing where the legal conditions are met.
- Object to processing based on legitimate interests, including publication of a specific archive image. Identify the relevant page/image so we can assess the request.
- Withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
- Request data portability where processing is automated and based on consent or a contract.
- Lodge a complaint with the Office for Personal Data Protection of the Slovak Republic.
Send requests to info@carmania.sk. We normally respond within one month. If a request is complex or numerous, the GDPR allows an extension of up to two further months; we must inform you within the first month and explain why. Reasonable identity verification may be necessary before disclosing personal data.
Slovak Data Protection Authority — current contacts and complaint information ↗8. Providing data and automated decisions
Browsing the public archive does not require registration. Sending an enquiry is voluntary; without sufficient contact information we may be unable to reply. Past orders required the information necessary to fulfil them. The website does not make decisions with legal or similarly significant effects solely by automated means and does not profile visitors.
9. Cookies and browser storage
The public archive does not set analytics, advertising or preference cookies and does not use localStorage for tracking. No cookie-consent window is needed for the current setup. A strictly necessary session cookie is set when you use the administration login.
| Name / provider | Purpose | Duration |
|---|---|---|
| PHPSESSID / carmania.sk, first party; path /admin/ | Maintain a secure administration session. HttpOnly and SameSite=Strict; Secure when served over HTTPS. No advertising or analytics. | Session cookie. Admin access expires after 30 minutes of inactivity; logout expires the cookie. A browser may restore session cookies when restoring a session. |
The former carmania_cookie_notice cookie only remembered dismissal of the old notice (maximum one year). This version deletes it if it is still present. Cookies can also be deleted or blocked in your browser; blocking the necessary session cookie prevents administration login. If non-essential tracking is introduced later, it must remain disabled until valid prior consent, with an equally accessible refusal and withdrawal option.
10. Photos, videos and privacy
If an archive photograph or video affects your privacy, send the page address, identify the image or video timestamp and explain your request to info@carmania.sk. We assess objections and erasure requests individually, including whether publication remains justified. A public event does not by itself remove the rights of people depicted.
Legal information
The principal rules are Regulation (EU) 2016/679 (GDPR), Slovak Act No. 18/2018 on personal data protection and Section 109(8) of Act No. 452/2021 on electronic communications.
Slovak regulator — cookie guidance ↗