This Privacy Policy explains how the operator of the Recordio platform processes the personal data of users, visitors to the platform, Sellers and Buyers.
Recordio is an online marketplace for musical instruments and related hardware. The platform enables private individuals to list an Offer, submit a Price Offer, conclude a purchase contract between users, communicate through chat and use related platform functions.
This Policy follows the Terms of Service of Recordio. The Terms of Service govern in particular the legal relationship between the user and the platform operator. This document describes the processing of personal data in detail.
The controller of personal data is:
Pavel Halabica self-employed natural person IČO: 76608549 registered office: Západní 473/8, 783 36 Křelov-Břuchotín e-mail for data protection matters: privacy@recordio.cz
The controller determines the purposes and means of processing personal data in connection with the operation of the Recordio platform.
The controller has not appointed a data protection officer because, given the current scope of activities, no such obligation applies. If the scope or nature of processing changes in the future, the controller will reassess this matter.
We process only data that is necessary for operating the platform, fulfilling contractual and legal obligations, protecting users, ensuring platform security and communicating with users.
We process in particular:
Depending on what the user completes or verifies, we may process:
For Offers, we process in particular:
The user should not unnecessarily include personal data of third parties, photographs of persons, documents, precise residential addresses or other sensitive data in an Offer. If the user includes such data in an Offer, they do so at their own responsibility.
In connection with Price Offers, counter-offers, Buy Now and completion of Transactions, we process in particular:
Recordio does not hold the purchase price and does not transfer the purchase price between Buyer and Seller. If Buyer and Seller use an external payment service or bank transfer, the payment takes place outside Recordio.
After conclusion of the purchase contract, the platform may make available to both parties the data needed to complete the Transaction, in particular:
The e-mail address of the other party is not made available as standard. Communication should continue primarily through the platform chat.
We process:
Chat and communication may be used for dispute resolution, fraud prevention, moderation, platform security and compliance with legal obligations.
If a user becomes obliged to pay a fee for a voluntarily ordered paid platform service, we process in particular:
The operator may be obliged under applicable legal regulations to collect, verify, retain and report selected data concerning Sellers and Transactions carried out through the platform to tax administration authorities.
If such an obligation arises or its arising is reasonably expected, we may request from the Seller in particular:
The scope of the specific data required is always governed by applicable legal regulations.
To ensure platform security and protection against misuse, we process in particular:
The approximate country of connection is derived from technical connection data and is not used to determine the user’s physical location; for this purpose we do not process GPS data or a city or postal code derived from the connection. The content of the message is not stored in these security records in either its original or processed form. The technical fingerprint does not contain the wording of the message and is used only to recognise repeated or similar communication patterns. We use pseudonymised connection identifiers to assess security signals; the IP address may still form part of the technical and security logs under this article.
The platform may assign a Trust Level to a user based on account verification, telephone verification, history of completed Transactions and other security parameters.
The Trust Level serves to prevent fraud and to inform users about the level of verification of the counterparty. It does not constitute a guarantee by the operator for the user’s conduct.
Automated tools may help flag suspicious content, suspicious behaviour or breaches of rules. Significant moderation decisions may be reviewed using the procedure set out in the Terms of Service.
For the purposes of preventing fraud and coordinated misuse, we may compare technical and security characteristics relating to different accounts and activities on the platform, for example matching pseudonymised connection identifiers or recurring patterns of behaviour. A match of such characteristics does not in itself mean that the accounts belong to the same person or that the rules have been breached; it serves as a basis for further assessment.
If a user gives consent to receive the newsletter, we process:
Marketing communications are sent only under the conditions set out in the Terms of Service and in this document.
Recordio always uses strictly necessary cookies required for the operation and security of the platform, in particular for login, maintaining sessions, protection against attacks and storing basic preferences.
With the user’s consent, the platform may additionally use optional tools for analytics and service improvement (e.g. PostHog including session replay, Vercel Analytics, Speed Insights, Sentry diagnostics/replay) and marketing (e.g. Google Ads / conversion measurement) where configured.
Session replay may record interactions such as clicks, scrolling and navigation for debugging and UX improvement. Sensitive form fields are masked or excluded where technically possible.
Details are set out in the separate Cookie Policy.
Purpose: registration, login, maintaining the account, profile management, use of platform functions. Legal basis: performance of a contract under Article 6(1)(b) GDPR.
Without this data, an account cannot be created or the platform cannot be fully used.
Purpose: publication of an Offer, management of photographs, description of goods, edits and deactivation of an Offer. Legal basis: performance of a contract under Article 6(1)(b) GDPR and legitimate interest under Article 6(1)(f) GDPR in operating and protecting the platform.
Purpose: recording offers, counter-offers, Buy Now, Transaction status, delivery, completion and any dispute. Legal basis: performance of the contract for use of the platform under Article 6(1)(b) GDPR and the controller’s legitimate interest under Article 6(1)(f) GDPR in the proper functioning of the platform and protection of users’ rights.
Purpose: enabling completion of the Transaction, delivery of goods, personal pickup and resolution of practical issues between Buyer and Seller. Legal basis: performance of a contract under Article 6(1)(b) GDPR.
Purpose: enabling communication between the parties to a Transaction, recording the course of the Transaction, resolving disputes, preventing fraud and protecting the platform. Legal basis: performance of a contract under Article 6(1)(b) GDPR and legitimate interest under Article 6(1)(f) GDPR.
Purpose: issuing invoices, recording fees, reminders, accounting and tax obligations. Legal basis: compliance with a legal obligation under Article 6(1)(c) GDPR and performance of a contract under Article 6(1)(b) GDPR.
Purpose: assessment and fulfilment of any reporting obligations of the operator of a digital platform towards tax administration authorities or other public authorities. Legal basis: compliance with a legal obligation under Article 6(1)(c) GDPR.
Where processing is necessary to comply with a legal obligation, the legal basis is not the user’s consent.
Purpose: protection of accounts, fraud prevention, detection of suspicious behaviour, protection against spam, misuse, circumvention of rules and illegal content, including detection of coordinated misuse through multiple accounts and assessment of security and anti-fraud signals. Legal basis: legitimate interest under Article 6(1)(f) GDPR.
Purpose: handling reports, content moderation, product safety, cooperation with public authorities, recording measures and protecting users. Legal basis: compliance with a legal obligation under Article 6(1)(c) GDPR and legitimate interest under Article 6(1)(f) GDPR.
Purpose: sending newsletters and marketing communication concerning the Recordio platform. Legal basis: consent under Article 6(1)(a) GDPR.
If legal regulations allow commercial communications to be sent to existing customers without separate consent, the legal basis may also be legitimate interest under Article 6(1)(f) GDPR in conjunction with the relevant electronic communications legislation. The user always has the option to unsubscribe from marketing communication.
Purpose: ensuring platform functionality, login, security, sessions and basic preferences. Legal basis: legitimate interest under Article 6(1)(f) GDPR, or performance of a contract under Article 6(1)(b) GDPR. For technically necessary cookies, consent is not required under the rules for storing cookies.
Purpose: analytics, performance measurement, error diagnostics, session replay, advertising or marketing personalisation. Legal basis: consent under Article 6(1)(a) GDPR.
These tools are activated only after consent is given in the cookie banner. Declining does not prevent use of the marketplace.
We disclose personal data only to the necessary extent and only where this is necessary for operating the platform, complying with legal obligations, protecting rights or providing the service.
After conclusion of the purchase contract, we make selected data required to complete the Transaction available to the other party, in particular full name, city and country and verified telephone number, if available.
Offer content, profile information and reviews may be publicly available to the extent to which the user publishes them through the platform.
We may use suppliers who help us operate the platform, in particular:
These suppliers process personal data as processors or independent controllers depending on the nature of the service provided. We enter into data processing agreements with suppliers acting as processors to the extent required by GDPR.
We may disclose personal data to accountants, tax advisers, attorneys or other professional advisers where necessary for accounting, tax obligations, resolution of legal claims or compliance with legal obligations.
We may disclose personal data to public authorities where required by law or by a legitimate request, in particular to:
If the user gives consent to the newsletter or if photographs from a public Offer are used to promote the platform to the extent set out in the Terms of Service, selected data or content may be disclosed to technical, marketing or advertising suppliers to the necessary extent.
The operator does not sell users’ personal data to third parties.
We aim to process personal data primarily within the European Union or the European Economic Area.
However, some technology suppliers may have their registered office, infrastructure or subcontractors outside the EU/EEA. Where personal data is transferred outside the EU/EEA, we ensure that such transfer takes place in accordance with GDPR, in particular on the basis of:
We retain personal data only for as long as necessary for the purposes for which it was processed, and further for the period required by legal regulations or necessary to protect legal claims.
Indicative retention periods are as follows:
| Data category | Retention period |
|---|---|
| Account and registration data | for the duration of the account |
| Data required to process account cancellation | generally up to 30 days from handling the request, unless further retention is necessary |
| Offers and public content | for the period of publication and thereafter for the period necessary for records, disputes and protection of rights |
| Transaction data | for the period necessary for performance of the contract, dispute resolution, invoicing and protection of legal claims |
| Invoicing and accounting data | generally 10 years under accounting and tax regulations |
| Chat relating to a Transaction | for the period necessary for resolving the Transaction, disputes, security and protection of rights |
| Security logs and anti-fraud records | generally 3 to 12 months depending on the type of record, longer in the event of a security incident, suspected fraud or dispute |
| Data for statutory reporting obligations | for the period laid down by legal regulations |
| Illegal content reports, DSA/GPSR records | for the period necessary to comply with legal obligations and protect rights |
| Newsletter consent | until withdrawal of consent and thereafter for the period necessary to prove that consent was granted or withdrawn |
| Cookies | according to the type of cookies and settings set out in the Cookie Policy |
After expiry of the retention period, we delete, anonymise or restrict the processing of personal data if it is no longer needed.
After account cancellation, we do not automatically delete all data immediately if further retention is necessary to comply with a legal obligation, for accounting or tax purposes, to resolve disputes, for platform security or to protect legal claims.
We use appropriate technical and organisational measures to protect personal data, in particular:
However, no system is absolutely secure. If a personal data breach occurs, we proceed in accordance with GDPR and other applicable legal regulations.
The platform may use automated or semi-automated tools for:
These tools serve to protect the platform and users. If an automated tool makes a decision that significantly affects the user (in particular temporary hiding or removal of content, account restriction, reduction of Trust Level), the user has the right to human review of that decision through the appeal procedure set out in the Terms of Service (in particular Articles 25.2.7 and 25.2.8).
The operator does not use solely automated decision-making within the meaning of Article 22 GDPR without the possibility of human intervention. For significant decisions, an appeal procedure with human review is always available.
The Recordio platform is intended only for persons over 18 years of age and persons with full legal capacity.
A person under 18 years of age may not create an account. If the operator discovers that an account has been created by a person under 18 years of age, the operator may cancel the account and process related data only to the extent necessary to resolve the situation and protect rights.
In relation to their personal data, the user has rights under GDPR, in particular:
The user has the right to obtain confirmation as to whether we process their personal data and, where applicable, to obtain access to such data and further information about the processing.
The user has the right to request correction of inaccurate or outdated personal data.
The user has the right to request erasure of personal data where the conditions under GDPR are met.
The right to erasure is not absolute. We may continue to retain certain data where necessary to comply with legal obligations, for accounting or tax purposes, to resolve disputes, protect legal claims, ensure platform security or for other statutory reasons.
The user has the right to request restriction of processing of personal data in the cases provided for by GDPR.
If processing is based on consent or on a contract and is carried out by automated means, the user has the right to receive their personal data in a structured, commonly used and machine-readable format.
The user has the right to object to processing based on the controller’s legitimate interest.
If the user objects, we will no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override the interests or rights of the user, or unless we need the data for the establishment, exercise or defence of legal claims.
Where processing is based on consent, the user may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing before its withdrawal.
The user has the right to lodge a complaint with the supervisory authority:
Office for Personal Data Protection Pplk. Sochora 727/27 170 00 Prague 7 — Holešovice website: www.uoou.gov.cz
The user may exercise their rights by e-mail at:
The request should contain sufficient information to verify the identity of the applicant and to handle the request.
We will usually respond to a request within 30 days of receipt. If the request is complex or if we receive a large number of requests, we may extend the period in accordance with GDPR. We will inform the user of the extension and the reasons for it.
If we are unable to verify the applicant’s identity, we may ask for additional information necessary for verification.
Some data is necessary for use of the platform. If the user does not provide it, it may not be possible to create an account, list an Offer, submit an offer, conclude a Transaction, issue an invoice or comply with a legal obligation.
Data required in particular includes data necessary for:
Optional data includes, for example, a profile photograph, profile description or certain additional data in an Offer. Failure to provide such data will generally not prevent basic use of the platform, but may limit the trustworthiness of the profile or the comfort of using the service.
Details on the use of cookies and similar technologies are set out in the separate Cookie Policy.
Recordio always uses strictly necessary cookies. Optional analytics, diagnostics, session replay and marketing tools are used only with the user’s consent. Consent can be changed at any time in the cookie banner.
We may amend this Policy from time to time, in particular if legal regulations, the way the platform operates, the suppliers used, the scope of processed data or related documents change.
We will inform users of material changes in an appropriate manner, in particular by e-mail or by notice in the platform interface.
The current version of the Policy is always available on the Recordio platform.
For questions concerning personal data or to exercise rights under GDPR, contact us at:
For legal matters not directly related to personal data, please use:
Issued by: Pavel Halabica, operator of the Recordio platform Date of issue: 25 September 2026 Effective from: 28 October 2026
