Privacy Policy

1. Who we are

Festifeed is a platform for discovering electronic music events worldwide. This Privacy Policy explains how we collect, use, and protect your personal data when you use our website and services.

The data controller is Festifeed, based in the Netherlands. You can reach us at [email protected]. Our full registered address is available in our Terms of Service.

2. What data we collect

We collect the following categories of personal data:

• Account data: name, email address, hashed password (if registered via email), authentication provider (Google, Apple, or email), and the date and version of the Terms you agreed to.
• Date of birth: asked once when you create an account, to check that you meet the minimum age of 16 (see section 11). We keep it so the check does not have to be repeated, and we may use it in future to send you a birthday message about events on that day. If you would rather we did not hold it, ask us at [email protected].
• Profile data: profile picture (optional), country, preferred music genres, and onboarding selections.
• Activity data: events you mark as attending or interested in, artists and organizers you follow, events you save, and events you submit.
• Technical data: IP address, browser type, and operating system, used for security and fraud prevention.
• Communication data: emails you send us and our replies.

3. Legal basis for processing

Under the GDPR, we process your data on the following legal grounds:

• Performance of a contract (Art. 6(1)(b)): to provide you with the Festifeed service when you create an account.
• Legitimate interests (Art. 6(1)(f)): to keep the platform secure, prevent fraud, and improve our service.
• Consent (Art. 6(1)(a)): for any non-essential processing where you have given explicit consent (e.g. optional emails).
• Legal obligation (Art. 6(1)(c)): where required by law (e.g. responding to a court order).

4. How we use your data

We use your personal data to:

• Create and manage your account, including authentication and password recovery
• Personalize your experience (e.g. event recommendations based on your followed artists and preferred genres)
• Send essential service emails (verification, password reset, account changes)
• Respond to support requests and improve the service
• Keep the platform secure and detect abuse
• Comply with legal obligations

We do not sell your personal data to third parties, and we do not use it for advertising or profiling.

5. Who has access to your data (sub-processors)

We use the following third-party service providers to operate Festifeed. These parties act as data processors and are bound by data processing agreements:

6. International data transfers

Some of our sub-processors are based outside the European Economic Area (EEA), in particular in the United States. When personal data is transferred outside the EEA, we ensure an adequate level of protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• The EU–US Data Privacy Framework where the provider is certified
• Additional technical and organisational safeguards such as encryption in transit and at rest

7. How long we keep your data

8. Your rights under the GDPR

You have the following rights regarding your personal data:

• Right to access — request a copy of the personal data we hold about you
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure — request deletion of your data ("right to be forgotten")
• Right to restrict processing — ask us to temporarily stop processing your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — at any time, where processing is based on consent
• Right not to be subject to automated decision-making — we do not make automated decisions that significantly affect you

You can exercise most of these rights directly in your account settings, or by contacting us at [email protected]. We will respond within one month.

9. Right to lodge a complaint

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the Dutch Data Protection Authority:

Autoriteit Persoonsgegevens
PO Box 93374
2509 AJ The Hague
autoriteitpersoonsgegevens.nl

10. Security

We take appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS/TLS), encryption at rest, hashed passwords (bcrypt), access controls, and regular security reviews. In the unlikely event of a data breach affecting your rights, we will notify the Dutch Data Protection Authority within 72 hours and inform you directly if required by law.

11. Minimum age

Anyone can browse Festifeed without an account. To create an account, you must be at least 16 years old, in accordance with Article 8 of the GDPR as applied in the Netherlands.

We ask for your date of birth when you sign up. If it shows you are under 16, the account and the data that came with it are deleted immediately rather than kept.

If you believe an account belongs to someone under 16, tell us at [email protected]. We look into every report and delete the account and its data if it turns out to be the case.

12. Cookies

Festifeed uses only strictly necessary cookies. See our Cookie Policy for the full list and details.

13. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page indicates the latest revision. Material changes will be communicated to you by email or via a notice on the platform before they take effect.

14. Contact

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at [email protected].