Privacy Policy

Rockbusters s.r.o.

Last updated: 29 September 2026

1. Who we are (Data Controller)

Rockbusters s.r.o.
Registered address: Klíšská 100/165, Klíše, 400 01 Ústí nad Labem, Czech Republic
Company ID (IČO): 06675603
VAT ID (DIČ): CZ06675603
Email: info@rockbusters.net

We are the controller of your personal data. This means we decide how and why your personal data is processed when you use our website (rockbusters.net), book trips or courses, or otherwise interact with us. We have not appointed a Data Protection Officer, as we are not required to. Please send all privacy questions to the email above.

2. What personal data we collect

Depending on how you interact with us, we may process:

• Identity and contact data: name, email address, phone number, billing address, date of birth
• Travel and participant data: passport/ID details where needed for insurance, transport or accommodation bookings; emergency contact details
• Booking and contract data: trip/course details, dates, number of participants, special requirements, climbing experience and skill level
• Payment data: processed through payment providers. We do not store full card details.
• Communication data: messages, emails, WhatsApp messages or form enquiries
• Health-related information you choose to give us: e.g. relevant medical conditions, injuries or allergies, for your safety during outdoor activities. This is special-category data.
• Photos and videos taken during trips and courses
• Technical data: IP address, browser type, device information, cookies and similar technologies
• Marketing preferences

Data about other people: If you book for other participants (e.g. friends or family), you give us their personal data. By doing so, you confirm that you have told them about this Privacy Policy.

Do you have to give us your data? We need your contact and booking data to make and fulfil the contract. Some data is required by law (e.g. for invoicing). Without it we cannot accept your booking. Health information and marketing consent are always voluntary. However, if you don't tell us about a relevant health condition, we may not be able to adapt the activity to it safely.

3. Why we process your data and the legal bases

• Processing bookings, contracts and payments, and delivering trips/courses
  Legal basis: Performance of a contract (Art. 6(1)(b) GDPR)
• Responding to enquiries before a booking and providing customer support
  Legal basis: Steps before entering a contract / performance of a contract (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f))
• Newsletters and offers to people who are not yet customers
  Legal basis: Consent (Art. 6(1)(a))
• Information about similar trips/courses sent to our existing customers
  Legal basis: Legitimate interest (Art. 6(1)(f)) together with §7(3) of Act No. 480/2004 Coll. You can opt out in every message.
• Website analytics, security and improving our services
  Legal basis: Legitimate interest (Art. 6(1)(f)); analytics cookies only with consent
• Showing and measuring our ads on Google and Meta (Facebook/Instagram), including remarketing
  Legal basis: Consent (Art. 6(1)(a)) given through cookie settings
• Using photos/videos in which you can be identified on our website and social media
  Legal basis: Consent (Art. 6(1)(a))
• Complying with legal obligations (accounting, tax, consumer protection)
  Legal basis: Legal obligation (Art. 6(1)(c))
• Establishing, exercising or defending legal claims
  Legal basis: Legitimate interest (Art. 6(1)(f))
• Processing health data you give us for your safety
  Legal basis: Explicit consent (Art. 9(2)(a)). In an emergency where you cannot give consent: vital interests (Art. 9(2)(c)).

You can withdraw your consent at any time (see Section 8). Withdrawing consent does not affect processing we carried out before you withdrew it.

4. Who we share your data with

We only share personal data when necessary:

• Payment processors and booking platforms
• Accommodation providers, transport providers, insurers, local partners or guides involved in your specific trip (only the data needed to deliver the service)
• IT and hosting providers, email/WhatsApp service providers, and analytics and advertising tools (under data-processing agreements)
• Professional advisers (accountants, lawyers) who are bound by confidentiality
• Public authorities, when required by law

We do not sell your personal data.

Transfers outside the EU/EEA: Some service providers (e.g. Google, Meta/WhatsApp) may process data outside the EU/EEA. In those cases we rely on an adequacy decision (including the EU-US Data Privacy Framework) or Standard Contractual Clauses. If your trip takes place outside the EU/EEA, we pass the necessary data to local partners there so we can fulfil your booking (Art. 49(1)(b) GDPR).

5. How long we keep your data

• Booking and contract data: for the duration of the contract, then for the limitation period for legal claims (usually 3 years).
• Accounting and tax documents: 5 years under the Accounting Act; 10 years for VAT documents under the VAT Act.
• Health data: deleted after your trip/course ends, unless we need it longer because of an incident or insurance claim.
• Marketing data: until you withdraw consent or unsubscribe.
• Enquiry data: usually up to 2 years after our last contact, unless a longer period is required.
• Photos/videos: until you withdraw consent.
• Technical/cookie data: according to the retention periods in our Cookie settings / Cookie Policy.

When we no longer need data for the purposes above, we delete or anonymise it.

6. Photos and videos

Our guides may take photos and videos during trips and courses. We share them with participants and, with your consent, may use them on our website and social media. You can withdraw your consent at any time. Just contact us and we will remove the material from our own channels.

7. Cookies and similar technologies

Our website uses cookies and similar technologies. Essential cookies are needed for the site to work. With your consent, we also use:

• Analytics: Google Analytics, to understand how visitors use our website
• Marketing pixels: Meta Pixel and Google Ads tags, to measure our ads and show you relevant ads on Facebook, Instagram and Google

These tools set cookies only after you accept them. You can change or withdraw your consent at any time through the Cookie settings link on our website. Google and Meta may process this data outside the EU/EEA (see Section 4). Meta and Google act as joint controllers with us for some pixel data. For details, see our Cookie Policy: https://rockbusters.net/policy-cookies

8. Your rights under GDPR

You have the right to:

• Access your personal data
• Have inaccurate data corrected
• Have your data erased (“right to be forgotten”) in certain circumstances
• Restrict processing
• Data portability
• Withdraw consent at any time
• Not be subject to decisions based solely on automated processing (we do not use such decision-making)

Right to object: You can object at any time to processing based on our legitimate interests. You can also object to direct marketing at any time. If you do, we will stop using your data for marketing.

To exercise any of these rights, contact us at info@rockbusters.net. We will respond within one month. For complex requests, we can extend this by up to two more months.

You also have the right to lodge a complaint with the Czech supervisory authority:
Úřad pro ochranu osobních údajů (ÚOOÚ)
Pplk. Sochora 27, 170 00 Praha 7
https://uoou.gov.cz
or with the supervisory authority in your country of residence.

9. Children and youth camps

We run camps and courses for participants under 18. For these:

• A parent or legal guardian makes the booking and gives us the participant's personal data, including health information and emergency contacts.
• A parent or guardian must give consent for health data and for the use of photos/videos in which the participant can be identified. The participant's own view is taken into account where appropriate.
• During the camp, we share health and emergency information only with the guides and staff responsible for the participant.
• We do not send marketing to anyone under 15 based on their own consent, since that is the age of digital consent under Czech law (Act No. 110/2019 Coll.). Marketing about youth camps is sent to parents/guardians.

10. Security

We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or destruction.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The latest version will always be on this page, with the “Last updated” date. Where appropriate, we will let you know about significant changes.

12. Contact

For any privacy-related questions, or to exercise your rights:

Email: info@rockbusters.net
Postal address: Rockbusters s.r.o., Klíšská 100/165, Klíše, 400 01 Ústí nad Labem, Czech Republic

Our Terms and Conditions are available here: https://rockbusters.net/terms-and-conditions