YOUR INFORMATION, RESPECTED

Privacy
comes first.

Draft notice. Registration remains closed until the controller details and service arrangements have been completed and reviewed.

Who is responsible?

[Legal controller name required]
[Postal address required]
[Privacy contact email required]

Event registration

We use your email address to verify your event registration, provide any active event reward, recover your pass and prevent duplicate claims. We record registration and confirmation times, campaign source, reward issuance and redemption. Processing needed to fulfil your requested event offer is based on GDPR Article 6(1)(b). Security and fraud prevention rely on our legitimate interests under Article 6(1)(f).

Marketing is optional

Only if you tick the separate marketing box and confirm your email do we add you to marketing communications, based on your consent under Article 6(1)(a). We keep the exact consent wording, notice version, your choice and the time of confirmation. Declining does not affect your event pass. Every future marketing email must include an unsubscribe link. You can also withdraw by contacting the address above.

Service providers and retention

The intended providers are Vercel (hosting), Supabase (database) and Resend (transactional email). The controller must confirm the final providers, data-processing agreements, regions and any international transfer safeguards before opening registration. We retain event records for 90 days after registration, then delete them through a scheduled maintenance process. This initial campaign does not retain a separate long-term subscriber database. Security rate-limit records expire within 24 hours; expired sessions and tokens are removed during maintenance.

Your choices and rights

You may request access, correction, erasure, restriction, portability or object where applicable by contacting us above. Consent may be withdrawn at any time without affecting earlier lawful processing. You can complain to your local supervisory authority, including the Dutch Autoriteit Persoonsgegevens or Czech Úřad pro ochranu osobních údajů.

Cookies, analytics and Instagram

There are no advertising trackers or third-party analytics scripts. Staff sign-in uses an essential secure session cookie. Your claim code stays in your browser’s session storage to display your pass. The dashboard shows aggregate counts only. We retain hashed rate-limit identifiers for abuse prevention; hosting and email providers may also process technical delivery logs under their own retention settings. Instagram opens only if you choose its separate link and is governed by Instagram’s privacy terms. We do not check or require a follow.

Notice version: 2026-11-06.1