Privacy Policy and Cookies Policy

1. Data Controller

The data controller is:

Stowarzyszenie Fotosyny
ul. 1 Maja 196, 44-341 Gołkowice
Poland
NIP: 6472609160
REGON: 528875959

For matters related to personal data protection, you can contact the Controller by e-mail: rodo@bazafestival.com

2. About the website

The website bazafestival.com is an informational website for BAZA Festival. The website provides information about the festival, programme, artists, tickets, partners, regulations and ways to contact the Organiser. The website is available in two language versions: Polish and English.

3. What data may be processed

The website does not allow users to create an account, log in, post comments, subscribe to a newsletter or send a contact form. Therefore, the Controller does not collect data through the website such as name, surname, e-mail address, telephone number, message content or user account data.

However, when using the website, certain technical and usage-related information may be processed automatically, in particular:

• the user's IP address,
• information about the device and browser,
• approximate location data based on the IP address,
• information about how the website is used,
• data stored in cookies or similar technologies,
• information recorded in server logs.

The scope of processed data depends, among other things, on browser settings, cookie settings and the consents given by the user in the cookie banner.

4. Purposes and legal bases of data processing

4.1. Ensuring the proper operation of the website

Technical data may be processed to display the website correctly, ensure its security, stability and support its basic functions.

Legal basis: the legitimate interest of the Controller, consisting in operating and securing the website.

4.2. Statistics and analytics

If the user consents to analytical cookies, we may use analytics tools to understand how users interact with the website, which content is visited most often and how the website can be improved. For this purpose, we may use Google Analytics 4, implemented through Google Tag Manager.

Legal basis: the user's consent.

4.3. Marketing and remarketing activities

If the user consents to marketing cookies, we may use marketing tools, in particular Meta Pixel, to measure the effectiveness of advertising activities and conduct remarketing activities within Meta services, such as Facebook and Instagram.

Legal basis: the user's consent.

4.4. Security and prevention of abuse

Technical data, including server logs, may be processed to ensure the security of the website, detect errors, prevent abuse and protect the website against unauthorised access.

Legal basis: the legitimate interest of the Controller.

5. Ticket sales

The website bazafestival.com does not sell tickets, products or services directly.

Ticket sales for BAZA Festival are carried out through the external platform Going. After clicking a link leading to ticket purchase, the user is redirected to an external service which operates under its own terms and may process the user's personal data independently.

We recommend reading the privacy policy and terms of the Going platform before purchasing a ticket.

6. Recipients of data

Data may be transferred to entities that support the Controller in operating the website and carrying out informational, analytical or marketing activities.

Such entities may include in particular:

• the website hosting provider - LH.pl,
• providers of analytical and technical tools, including Google Ireland Limited,
• providers of marketing tools, including Meta Platforms Ireland Limited,
• entities providing technical or IT services to the Controller,
• the ticket sales platform Going, if the user follows a link from our website to the ticket sales system.

Data is transferred only to the extent necessary to achieve specific purposes.

7. Transfer of data outside the European Economic Area

Some tools used on the website, in particular Google or Meta services, may involve transferring data outside the European Economic Area. In such cases, data transfer is carried out in accordance with the rules provided for by GDPR, in particular using appropriate safeguards such as standard contractual clauses or other legally permitted data transfer mechanisms.

8. Data retention period

Technical data and data contained in server logs are stored for the period necessary to ensure the security, stability and proper operation of the website, and may then be deleted or anonymised.

Data processed on the basis of consent, in particular within analytical or marketing cookies, is processed until the consent is withdrawn, cookie settings are changed, or for the period resulting from the settings of a given tool.

User cookie consent records may be stored for the period necessary to demonstrate that consent was given or withdrawn in accordance with applicable law.

9. User rights

The website does not contain a contact form, newsletter, user accounts or a comment system. Therefore, the Controller does not collect data through the website such as name, surname, e-mail address, telephone number, message content or user account data.

However, using the website may result in the automatic recording of limited technical information, such as an IP address in server logs or cookie identifiers, especially if the user consents to analytical or marketing cookies.

If a user contacts the Controller with a request concerning their data, the Controller will respond in accordance with GDPR, to the extent that the Controller actually processes data relating to that person and is able to identify them.

In practice, this may mean that in many cases the Controller will not have data enabling the identification of a specific user or will not be able to assign technical data to a specific person without additional information.

However, if in a given case it turns out that the Controller processes the user's personal data, the user may have rights provided for under GDPR, including in particular the right of access to data, rectification, erasure, restriction of processing, objection, withdrawal of consent and the right to lodge a complaint with the competent supervisory authority.

For matters concerning personal data, you can contact the Controller at: rodo@bazafestival.com

10. Voluntary use of the website

Using the website is voluntary.

Providing technical data, such as an IP address, is necessary to display the website correctly and use its basic functions. Consent to analytical or marketing cookies is voluntary. Lack of consent does not block access to the website, but may limit the Controller's ability to conduct statistics, analytics and marketing activities.

11. Automated decision-making and profiling

The Controller does not make decisions about users in a fully automated manner that would produce legal effects concerning them or similarly significantly affect them.

If the user consents to marketing cookies, data may be used by advertising tools to create audience groups or match advertisements within external services, such as Meta. Such activities are carried out in accordance with the rules of those platforms.

Cookies

12. What cookies are

Cookies are small text files stored on the user's device when using a website. They may be used, among other things, to ensure the proper operation of the website, remember user settings, collect statistics or support marketing activities. Similar functions may also be performed by other technologies, such as pixels, tags or identifiers stored in the browser.

13. What categories of cookies we use

13.1. Necessary cookies

These cookies are required for the proper operation of the website and to support its basic functions, such as remembering cookie consent settings. These cookies do not require the user's consent because they are necessary to provide the electronic service.

13.2. Analytical cookies

These cookies help us analyse how users use the website. They allow us to check, among other things, the number of visits, traffic sources, popularity of particular sections and basic information about user behaviour on the website.

Analytical cookies are activated only after the user gives consent.

For this purpose, the website may use Google Analytics 4, implemented through Google Tag Manager.

13.3. Marketing cookies

These cookies are used for advertising activities, measuring campaign effectiveness and remarketing, i.e. reaching people who have previously visited the website with advertising communication.

Marketing cookies are activated only after the user gives consent.

For this purpose, the website may use Meta Pixel.

14. Managing cookie consents

During the first visit to the website, the user may decide whether they consent to the use of analytical and marketing cookies.

The user may:

• accept all cookie categories,
• reject cookies other than necessary cookies,
• choose the cookie categories they consent to.

The user may change their cookie settings at any time by using the "Cookie settings" link available in the website footer. Changing or withdrawing consent does not affect the lawfulness of actions taken before the settings were changed.

15. External tools used on the website

Google Tag Manager

A tool used to manage scripts and tags on the website. Google Tag Manager itself performs a technical function, but it may be used to launch other tools, such as Google Analytics 4 or Meta Pixel, only in accordance with the user's consent settings.

Google Analytics 4

An analytics tool used to measure website traffic and analyse how users interact with the website. Google Analytics 4 is activated after the user consents to analytical cookies.

Meta Pixel

A marketing tool that enables the measurement of advertising effectiveness and remarketing activities within Meta services, such as Facebook and Instagram. Meta Pixel is activated after the user consents to marketing cookies.

Going

An external ticket sales platform. After going to the Going service, the user uses an external service and data processing takes place in accordance with the documents and rules of that platform.

YouTube

The website may contain links to materials available on YouTube. These materials are not embedded directly on the website. After clicking such a link, the user goes to the external YouTube service, which operates under its own rules.

16. Links to social media

The website may contain links to BAZA Festival profiles on social media, in particular:

• Facebook,
• Instagram,
• YouTube.

Clicking such a link takes the user to an external service. The administrators of those services may process the user's data under their own rules and in accordance with their own privacy policies.

17. Changes to this Privacy Policy

The Controller may update this Privacy Policy, in particular if the website functionality, tools used, scope of data processing or applicable legal requirements change. The current version of this document will always be available on bazafestival.com

18. Contact

For matters related to privacy, personal data or cookies, you can contact the Controller at: rodo@bazafestival.com