Privacy & Policy

PRIVACY POLICY

UNTOLD FESTIVAL 

EVENT: UNTOLD FESTIVAL

ORGANIZER: UNTOLD EVENTS LLC

1. Introduction

1.1 The confidentiality of personal data is one of the main concerns for UNTOLD EVENTS LLC. As such, we want to ensure the highest standards of confidentiality and transparency regarding the personal data we process in our current business.

1.2 Since in carrying out the activity it is necessary to process a series of personal data with predilection in relation to the specifics of our object of activity, we want to offer assurances that the processing will take place in compliance with the principles underlying the processing of personal data. This privacy policy is intended to help you understand what data we collect, why we collect it and what we do with it.

2. Information about the data controller

2.1 UNTOLD EVENTS LLC (hereinafter referred to as “UNTOLD EVENTS”) is a limited liability company, established in Dubai, with a registered office at Al-Barsha First, Al Khaimah Building II, Licence Number: 1102119, Tax Registration number: 104070408000003. UNTOLD EVENTS LLC acts as operator of personal data collected through the www.untold.ae website (the "website”), and the UNTOLD EVENTS App, the online and on-site check-on system, the means of video monitoring and photo and video image capture within the Festival by persons authorised by UNTOLD EVENTS.

2.2 The Operator is required to manage safely and solely for specified purposes, the personal data that the users according to the Federal Decree-Law No. 45 of 2021, also known as the Personal Data Protection Law (PDPL).

2.3. Individuals who utilise the UNTOLD EVENTS website and services and are subject to the collection of personal data, will be addressed as ("you") and ("your”) within the context of this privacy policy.

3. What kind of data is processed, the purpose of processing and the storage period for and the legal basis for processing for each category of data?

3.1.1. For the purpose of creating and accessing an account on the www.untold.ae website, in the Untold application and/or on external Untold platforms (Extasy).

1. What data do we process? The phone number and the set of cryptographic hash values ​​(generated by applying the PBKDF2 encryption algorithm) related to the password set by the user so that he can log into his account.
2. Storage period: We will store this data for as long as you have an account on the Untold website/app. We specify that to the extent that there is no request for anonymization of these data on [email protected], they will be anonymized within 5 years at most from the last use of the account.
3. Legal basis for processing: Art. 4 (10) - the processing is necessary for the execution of a contract to which the data subject is a party or to take steps at the request of the data subject before concluding, terminating or amending a contract.

3.1.2. For the purpose of purchasing an Untold EVENTS LLC product or service.

1. What data do we process? Name, surname, e-mail, phone, country, town, address.
2. Storage period: Until the end of the general prescription period of 3 years from the completion of the edition in which the ticket was bought or the edition about which the respective problem was reported.
3. Legal basis for processing: Art. 4 (10) - the processing is necessary for the execution of a contract to which the data subject is a party or to take steps at the request of the data subject before concluding, terminating or amending a contract.

3.1.3. For the purpose of returning purchased products or solving a problem addressed to us.

1. What data do we process? Name, surname, e-mail, telephone number, IBAN and name of the account holder, as well as other information provided by e-mail or on other platforms to describe the problem.
2. Storage period: Until the end of the general prescription period of 3 years from the completion of the edition in which the ticket was bought or the edition about which the respective problem was reported.
3. Legal basis for processing: Art. 4 (10) - the processing is necessary for the execution of a contract to which the data subject is a party or to take steps at the request of the data subject before concluding, terminating or amending a contract.

3.1.4. During the CHECK-IN process:

3.1.4.1 In order to ensure access to the perimeter of the festival and to provide the services to which the participant is entitled based on the ticket, to inform about the aspects related to the organisation and conduct of the event or any other offers and announcements related to the purchased product, to prevent fraud , abusive use and to check the validity of the ticket or subscription.

1. What data do we process? Name, surname, e-mail, phone number, profile photo (except for minors under 18) and ticket / wristband number for access to the festival.
2. Storage period: The profile picture will be deleted within 20 days after the end of the Festival. The other data will be anonymized within 3 years from the last edition in which the person concerned participated in the Festival, if this was not previously requested.
3. Legal basis for processing: Art. 4 (10) - the processing is necessary for the execution of a contract to which the data subject is a party or to take steps at the request of the data subject before concluding, terminating or amending a contract.

3.1.4.2. For internal purposes only, to carry out reports and surveys, organise access areas, create campaigns and dedicated activities, to respond to a request from public authorities, for complaints or complaints.

1. What data do we process? Sex, country, city, county, date of birth.
2. Storage period: These data are kept in the Organizer's archive without being associated with a natural person following the irreversible anonymization of personal data.
3. Legal basis for processing: Article 4(7) - if the Processing is necessary for archival purposes or for scientific, historical and statistical studies, in accordance with the legislation in force in the State.

3.1.5. For marketing purposes:

3.1.5.1. For commercial purposes promoting Untold EVENTS LLC products and services.

1. What data do we process? Name, surname, email address, phone number.
2. Storage period: Data will be anonymized upon withdrawal of consent or within 4 years at most if the data subject no longer reacts to any commercial message.
3. Legal basis for processing: Article 4(8) the Processing is necessary to protect the interests of the Data Subject.

3.1.5.2. For the purpose of subscribing to the Untold Newsletter with the consent of the data subject.

1. What data do we process? Email address.
2. Storage period: Until unsubscribe or withdrawal of consent.
3. Legal basis for processing: Art. 6 - the data subject has given his consent for the processing of his personal data for one or more specific purposes.

3.1.5.3. In order to carry out surveys to improve the quality of the services we offer, telephone calls may be recorded with the consent of the person concerned.

1. What data do we process? Voice of the subject.
2. Storage period: Recorded calls will be deleted within 30 days from the time of recording.
3. Legal basis for processing: Art. 6 - the data subject has given his consent for the processing of his personal data for one or more specific purposes.

3.1.6. In the REGISTER CAMPAIGN:

3.1.6.1. For the purpose of registering in the Register Campaign where the persons concerned register in a community where they receive recurring information about the latest promotions, campaigns, announcements, sales of tickets at a promotional price at the Untold Festival editions.

1. What data do we process? Name, surname, email address, phone number.
2. Storage period: Data will be anonymized upon withdrawal of consent or at most within 4 years from the last edition in which the person registered for the campaign. If the persons concerned bought a Ticket in this campaign, their personal data will be processed from this step forward in order to be able to ensure the purchased services and access to the Festival.
3. Legal basis for processing: Art. 4 (10) - the processing is necessary for the execution of a contract to which the data subject is a party or to take steps at the request of the data subject before concluding, terminating or amending a contract.

3.1.6.2. For internal purposes only for making reports and surveys, organising artistic moments, creating the concept of the annual event, creating campaigns and dedicated activities.

1. What data do we process? Sex, country, county, date of birth.
2. Storage period: These data are kept in the Organizer's archive without being associated with a natural person following the irreversible anonymization of personal data.
3. Legal basis for processing: Article 4(7) - if the Processing is necessary for archival purposes or for scientific, historical and statistical studies, in accordance with the legislation in force in the State.

3.1.7. In order to ensure the security of goods, premises and people, video monitoring means are used in the perimeter of the festival.

1. What data do we process? Image of visitors from the event.
2. Storage period: 20 days. Some data may be retained for a longer period if the retention is necessary for the investigation of fraud, for the defense of the rights in court of any of the Parties or in situations where it is necessary to comply with the requests made by the competent authorities.
3. Legal basis for processing: Article 4(3)- the Processing is necessary to initiate or defend against any actions to claim rights or legal proceedings, or related to judicial or security procedures.

3.1.8. To take photographs and videos during the event, subsequently used for journalistic, informational, commercial, marketing and promotion purposes of the event, Untold products and services or adjacent products and services, in its own name by Untold or by any partner or sponsor of the Untold Festival, as well as for the purpose of making NFT (Non-fungible token) and trading them on the relevant market.

1. What data do we process? Image of visitors from the event.
2. Storage period: Until the deletion request from the data subject or no more than 15 years from the time of completion of the edition in which they were made.
3. Legal basis for processing: Article 4(7) - if the Processing is necessary for archival purposes or for scientific, historical and statistical studies, in accordance with the legislation in force in the State.

3.1.9. For the purpose of organising promotional campaigns and contests, as well as to ensure the sending of prizes.

1. What data do we process? Name, surname, e-mail, social media profile (if applicable), information included in comments in campaigns organised by the Organizer or in partnership with other partners.
2. Storage period: Until the expiry of the general limitation period of 3 years from the end of the campaign or contest.
3. Legal basis for processing: Article 4(3)- the Processing is necessary to initiate or defend against any actions to claim rights or legal proceedings, or related to judicial or security procedures.

3.2 In addition to the aforementioned purposes, we process the personal data collected for the following purposes: 

1. For the fulfilment of legal obligations, as a result of the services provided (e.g. accounting, fiscal, audit, etc.), these are always compatible with the main purposes, for which the data was collected.
2. To the extent that the data subject has given their consent for the processing of their personal data for one or more specific purposes.
3. For any other purpose auxiliary to the above, or for any other purpose for which we have been provided with personal data, in compliance with the relevant legislation.
4. To protect our legitimate interests, overriding the interests or rights and fundamental freedoms of the data subject, taking into account their reasonable expectations based on the relationship with the operator:

• To conduct market research and analysis that helps improve and customize our products and services.
• For direct marketing purposes, to send communications of general interest or messages asking you to rate the quality of our services/products
• For the management of the company's activity, the creation of internal reports that are used in the organization of the access and wristband pick-up areas of future editions, to organize dedicated campaigns and activities
• To prevent or detect misuse of our intellectual property, fraud or other crimes.
• To ensure security within the event, to resolve complaints related to fraud, criminal or contravention complaints, complaints related to the sale of tickets, cases where the Organizer needs to identify a person with the ticket series, to identify if that person entered the perimeter the festival and at what time, or to defend the company's rights in court.

3.3 In the situations in which we will use your data for purposes other than those mentioned in this Policy, we undertake to obtain your consent, unless we have a legal obligation or have a different legal basis for processing the data.

3.4 The Operator does not create individual profiles for those who participate at the Untold Festival.

4.  How are we collecting your personal data?

4.1 We collect your personal data either directly from you, for example, when you create an account on our website/app, email us, via through which you request an offer/information from us, you give your consent for the communication of commercial messages, when you purchase a product, etc., or indirectly, for example, when you transmit this information on the platforms of other collaborators of our company, in the process of purchasing the ticket /subscription.

4.2 We collect your personal data automatically, when you use our services on the UNTOLD EVENTS LLC website or application, we collect information through cookies and by logging your activity. For more information on the use of cookies , please consult Art. 6 of this Policy.

4.3. If you choose to provide us with the personal data of other people, such as when you purchase tickets on behalf of others, you assume responsibility regarding the way in which you obtained this data and that you have a legal basis for processing it, we cannot be held responsible for violating the rights of the respective persons.

5. How are we storing the personal data? 

5.1 For storing the personal data you're providing as a user of our website / App, a cloud service provided by Amazon Web Services EMEA S.A.R.L. is used.

5.2 Also, the data collected in the context of on-site check-in is stored by our third party service providers.

6. COOKIES

6.1 The website contains cookies (very small files are sent to the computers of website users or to other access devices).

6.2 There are two types of these cookies:

• Functionality cookies: These types of cookies improve the users' website navigation experience and allow them to benefit from various features;
• Performance Cookies: These types of cookies are used to measure and analyse how UNTOLD EVENTS LLC customers are using the Website. These cookies can continually improve the functionality of the website and the user experience.

6.3 Accessing the website implies the agreement of the users regarding placing these types of cookies on their device and accessing them on their next visit to the site. 

6.4 Information on deleting and controlling cookies is available at www.aboutcookies.org. Deleting or blocking the cookies may prevent access to certain areas or features of the site.

6.5 For more information, please consult our Cookie Policy.

7. To whom we’re disclosing your personal data?

7.1 In order to fulfill the processing purposes, the Operators disclose your personal data to partners, to third parties or entities that support the Operators in carrying out their activities, or to central/local public authorities, in the following examples listed:

1.   To our service providers and contractual partners, for example: providers of marketing (including surveys) and advertising services; our partner in charge of providing access to the Untold Festival premises; the IT service provider; courier services, payment services, banking services, payment services, ticket sales, etc. These data will be provided to the extent necessary and only under a confidentiality commitment from the contractual partners, guaranteeing that these data are kept safe and that their processing is done in accordance with the legislation in force;

2.   To the accountants, auditors, lawyers, insurers or other such external advisers of the Operator. These data will be provided to the extent necessary and only under a confidentiality commitment from the contractual partners, guaranteeing that these data are kept safe and that their processing is done in accordance with the legislation in force;

3.   Authorities, institutions and public bodies, if there is a legal request from them or to the extent there is a legal obligation from us;

4.  The operator will be able to disclose this data whenever the law requires it, or in the situation where this step is necessary to allow the exercise of the rights provided by the law and/or to be able to take legal action against any illegal activity;

 5.  Your personal data may be transferred to third countries, based on the contractual relationships we have with our partners in order to produce statistics and other types of reports. We will ensure by contractual or other measures that such data enjoys an adequate level of protection there, comparable to that which it would enjoy in Dubai.

8. How long do we store your personal information?

8.1 As a matter of principle, we will process your personal data only to the extent necessary to achieve the processing purposes mentioned above. For more details about our data retention policy for certain specific processing, please review the information from Art.3.

9. Your rights related to personal data processing:

 9.1. When the processing is based on consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of the processing carried out on the basis of consent before its withdrawal. You can therefore change or remove consent at any time, and we will act immediately accordingly, unless there is a legal reason or legitimate interest not to do so.

9.2. If we process your data based on our or third parties' legitimate interest, you can object to that processing for reasons related to your particular situation. In some cases, our legitimate interest or that of third parties may outweigh yours and we will not be able to accommodate your request to object to processing.

9.3. As a data subject, you benefit from the following rights:

9.3.1. Right to Access Information 

The data subject has the right to request access to the following information:

• The categories of personal data processed;
• The purpose of the processing;
• Whether the personal data is shared inside or outside the state;
• Automated decision making on his/her personal data;
• Controls or standards relating to storage of his/her personal data;
• Actions for rectification, restriction, or erasure of his/her personal data;
• Safeguards applied to his/her personal data in case of cross border data transfer;
• Actions to be taken in case of Personal Data Breach;
• Procedure to lodge a complaint with the Office.

9.3.2. Right to be Informed 

The right to inform users what kind of data is being collected on them, where it is being stored, whether it is being shared or sold to anyone, and what protective measures are in place to protect this data.

9.3.3. Right to be Forgotten 

The data subject will have the right to rectify any inaccuracy of their personal information and the right to require the data controller to erase their personal information.

9.3.4. Right to Stop Data Processing 

The data subject can exercise the right to request a data handler to cease processing their data in the following circumstances:

• Where personal data is processed for marketing purposes;
• Where the processing is for statistical survey purposes, unless the processing is essential for the reasons of public interest;
• Where the processing does not oblige with the Personal Data Protection Principles as stated under Article 5 of the PDPL.
•  

9.3.5. Right to Rectification

Similar to the right to erasure of data collected on them, the data subject can also request the data handler to make appropriate amendments and modifications if the data collected in the information collected is outdated, inaccurate, or incomplete.

9.3.6. Right to Data Portability

The data subject has the right to receive their personal data in a structured and machine-readable format where the processing of personal data is subject to the data subject’s consent.

If you wish to exercise the rights mentioned above, please contact us in order to solve your problem using the following contact details:

● Email: [email protected]

● Address: Al-Barsha First, Al Khaimah Building II, Dubai

Please keep in mind the following aspects of interest, related to the method of analysis and response to the request for the exercise of rights:

We will make every effort to respond to your request within 30 days. This period can be extended due to reasons related to the specific legal right invoked or the complexity of your request with a maximum additional period of two months. In any case, if the legal response deadline will be extended, then we will inform you about the new deadline and the reasons that led to this extension.

10. Information security

10.1 We are working hard to protect our website, App and users, as well as all personal data collected in accordance with this Policy, from any unauthorized access or from the modification, unauthorized disclosure or destruction of the information we hold.

10.2. We guarantee that we have implemented technical and organizational measures appropriate to the processing activities they perform, in order to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure or unauthorized access to, transmission, storage or processing in any other illegal ways.

10.3.  In this regard:

1. We certify that we meet the minimum requirements for the security of personal data, the data being processed in a way that provides protection against unauthorized or illegal processing and against accidental loss, destruction or damage, by taking appropriate technical or organizational measures;
2. or the data collected through the website and the App, in order to ensure access to the festival, we use a cloud service provided by Amazon Web Services EMEA SARL. Therefore, the security settings provided by Amazon are used. Access to data is done in a whitelist of security groups, which means that data can only be accessed from certain pre-defined IP addresses. Access is based on username and password, and within the organizing entities access to the database is allowed to a limited number of persons.
3. The used data storage systems have implemented back-up mechanisms to ensure the redundancy of the stored data.
4. We are regularly reviewing the practices for collecting, storing and processing information, including physical information, as well as security measures, to prevent unauthorized access to the systems.
5. We are restricting the access of our employees and contractors to your personal information, and the contractual relations with these persons are subject to strict rules regarding contractual confidentiality obligations, including under the sanction of termination of contracts.

11. When does this Privacy Policy apply? 

11.1. Our privacy policy applies to all services offered by our company and excludes services that have separate privacy policies and do not contain the provisions of this privacy policy.

12. Amendments

12.1 We will post any privacy policy changes on our page, which will take effect within one day and, if the changes are material, we will provide more prominent notice (including, for certain services, email notification of policy changes of confidentiality).

12.2. We will also keep previous versions of this Privacy Policy on file for your review at any time.

The most recent update of this policy was made on the 20th of May, 2024.