1. Data controller
The controller responsible for processing the data managed by the Organisation is identified below, in accordance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD):
- Registered company name
- [Pending completion]
- Trading name
- Vullkanfest
- Tax ID (NIF)
- [Pending completion]
- Registered address
- [Pending completion]
- [Pending completion]
- Telephone
- [Pending completion]
- Registration details
- [Pending completion]
- Website
- https://vullkanfest.com
2. Purposes
- To manage ticket sales and admission control, through the official channels and ticketing services.
- To handle enquiries, registrations and support requests received by email or WhatsApp.
- To send information about the event or future editions only with consent where this is necessary.
- To comply with legal and contractual obligations relating to these activities.
This site does not currently include registration forms, analytics tools or advertising pixels. When following an external link, the policy of the destination service will also apply.
3. Legal basis
The legal bases are performance of the contract for the purchase of tickets and associated services; consent for optional communications and non-essential technologies; and compliance with legal obligations. Providing data for an enquiry does not amount to accepting marketing communications. Consent may be withdrawn without affecting the lawfulness of processing carried out beforehand.
4. Recipients, processors and transfers
The data necessary for selling and validating tickets is managed with the ticketing provider EnterTicket. Infrastructure and payment providers that actually take part may process the data strictly necessary under the contract and the role assigned to them. The source texts mention AWS, IONOS or other cloud providers, and Redsys or Stripe Inc. as potential payment providers: this mention does not mean that all of them operate on this website, or that they receive data from every visit.
Google receives connection information when the map is loaded, which remains blocked until third parties are accepted. Fonts are served from the website itself. Instagram and WhatsApp receive data when their services are accessed via the corresponding links.
Where an international transfer takes place, it must be based on an adequacy decision, standard contractual clauses or another appropriate GDPR safeguard, together with any additional measures required. The Organisation must confirm and keep up to date the list of providers and applicable safeguards before any processing begins.
5. Retention
Data is retained for as long as necessary for the purpose for which it was collected and, thereafter, for the statutory limitation or retention periods that apply, subject to the appropriate blocking measures. Communications based on consent will cease upon its withdrawal, except for the minimum information necessary to honour the opt-out or to meet legal obligations.
6. Rights
You may request access, rectification, erasure, objection, restriction of processing and portability, where applicable, as well as withdraw your consent. Please send your request to [Pendiente de completar], stating the right you wish to exercise and the information necessary to identify your relationship with the Organisation.
To verify identity, an appropriate document or means may be requested, limited to the data strictly necessary and particularly where there are reasonable doubts. Withdrawal of consent does not affect the lawfulness of processing carried out beforehand. Requests will be dealt with within the time limits set out in the GDPR.
7. Supervisory authority
If you believe your rights have not been properly addressed, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos): www.aepd.es .
8. Security
Appropriate technical and organisational measures must be applied to protect the confidentiality, integrity and availability of data, to limit access and to prevent loss or unauthorised use. No system can guarantee absolute security; any incidents will be managed in accordance with the legal obligations regarding notification and response.