Policy
PRIVACY POLICY
1. Introduction
1.1 Privacy of personal data is one of the main concerns for DETTRA ORGANIZATION SRL. As such, we aspire to provide the highest standards of privacy and transparency for the personal data we’re processing in our current activity.
1.2 Since for conducting our business we are required to process a series of personal data, especially in relation to the specifics of our line of business, we wish to provide assurances that the processing will take place in compliance with the principles of transparency and security of personal data. This privacy policy is meant to help you understand what data we’re collecting, why we’re collecting it and what we’re doing with it.
2. Who are we?
2.1 DETTRA ORGANIZATION SRL (hereinafter referred to as „Dettra”) is a Romanian company, established Cluj-Napoca, Aviator Badescu 17, registered with the Trade Register under no. J12/1595/2010, VAT NUMBER 27454408. Dettra SRL acts as the operator of personal data collected through the www.in-town.ro website (the "website”), the online and online check-in systems.
Dettra SRL acts as the operator of the personal data collected through the website www.in-town.ro ("Site"), regarding the sale of tickets. For online check-in and top-up operations, Dettra SRL acts as a person authorized by the Event Organizer (Untold SRL, Untold Production SRL or Neversea SRL).
2.2 The operator is required to manage safely and solely for specified purposes, the personal data that the users of the website are providing.
3. What kind of data is processed, the purpose of processing and the storage period for each category of data
What kind of data is processed | The purpose of processing | Storage period | Legal basis for processing |
The e-mail address and set of cryptographic hash values (generated by applying the SHA-2 512 encryption algorithm) related to the password set by the users so that they can log into their accounts. | For the purpose of creating and accessing an account on the in-town.ro website. | We will store this data as long as you have an account on our website. You may request to us, at any time, to delete certain information or to close the account and we will respond to these requests, subject to storing certain information, including after closing the account, in situations where the applicable law or our legitimate interests require it. ease take note of the fact that as long as there is no request to delete this data, it will be deleted within 3 years counting from the last use of the account. | a) Art. 6 (1) par. b - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; b) Art. 6 (a) par. f processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party; |
Last name, first name, gender, country, date of birth, nationality, profile photo (with the exception of children under the age of 16) and number of access ticket/bracelet for the festival; | For the purpose of ensuring access and services to which the participant is entitled based on the ticket, fraud prevention, abusive use and for verifying the validity of the ticket or the pass once the check-in process has been completed; | 20 days after the end of the Festival the first name, last name and photo will be deleted, and the other data will remain anonymized for the purpose of compiling statistics according to the following paragraph. | a) Art. 6 (1) lit. b - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; b) Art. 6 (a) lit. f processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party; |
Age, gender, country. | For the purpose of sending such data to our Contractual Partners for the purpose of evaluating the products and services provided, For more information about this please see The Privacy Policy of our partners for which you buy the ticket. | 5 years from the date of anonymization. | Art. 6 (a) lit. f processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party; |
The contact details of the data subjects (e.g. e-mail and / or telephone) could be used to inform them about the issues related to the organization and conduct of the event. | For the purpose of informing about aspects related to the organization and conduct of the event. For example, if a particular concert was canceled or rescheduled at another time, the data subjects could receive an informational message to that effect.
| 72 hours from the end of the Festival. | Art. 6 (1) lit. b - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; |
Last name, first name, email and telephone number. | For the purpose of promoting products provided by Dettra and its partners, as well as conducting surveys. | Until the withdrawal of consent. | Art. 6 (1) (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; |
3.2 In addition to the aforementioned purposes, DETTRA SRL may process the personal data collected for the following purposes:
a)For the fulfillment of the obligations incumbent on us, as a result of the services provided (e.g. accounting, fiscal, audit, etc.), these are always compatible with the main purposes, for which the data was collected.
b)To the extent that the data subject has given their consent for the processing of their personal data for one or more specific purposes;
c) For any other purpose auxiliary to the above, or for any other purpose for which we have been provided with personal data, in compliance with the relevant legislation
3.3 In the situations in which we will use your data for purposes other than those mentioned in this Policy, we undertake to obtain your consent, unless we have a legal obligation or have a different legal basis for processing the data.
3.4 The operator does not create individual profiles of Clients.
4. How are we collecting your personal data?
4.1 We are collecting your personal data directly from you, e.g. when you’re creating an account on our website, you’re sending us an e-mail, in which you’re requesting us an offer/information, and you’re giving your consent for the communication of commercial messages, etc.,
4.2 Also, the Dettra’d website – in-town.ro includes the top-up option, context in which Europayment Services SRL, the euplătesc.ro payment platform provider, a personal data operator, collects and processes the user data necessary to process the payments required for topping up the bracelets. For details regarding the category of data processed in this regard, the purpose of the processing and how this operator processes the data of the Buyers please consult their Privacy Policy by accessing the following link- https://www.euplatesc.ro/privacy-policy.php.
5. How are we storing personal data?
5.1 For storing the personal data you're providing as a user of our website, a cloud service provided by Amazon Web Services EMEA S.A.R.L. is used.
6. COOKIES
The website contains cookies (very small files Dettra is sending to the computers of website users or to other access devices).
There are two types of these cookies:
Functionality cookies: These types of cookies improve the users' website navigation experience and allow them to benefit from various features;
Performance Cookies: These types of cookies are used to measure and analyze how Dettra customers are using the Website. These cookies can continually improve the functionality of the website and the user experience.
Accessing the website implies the agreement of the users regarding placing these types of cookies on their device and access them on their next visit to the site.
Information on deleting and controlling cookies is available at www.aboutcookies.org. Deleting or blocking the cookies may prevent access to certain areas or features of the site.
For more information, please consult our Cookie Policy.
7. To whom we’re disclosing your personal data?
In order to fulfill the processing purposes, Dettra SRL may disclose your personal data to the Event Organizers whose tickets have been purchased (Untold SRL, Untold Production SRL and / or NEVERSEA SRL) so that they can offer you the services you have purchased or so that they can respond to any request regarding the purchased product that you have addressed to Dettra SRL (for example: requests regarding the Risk-Free service, Flexi, refund requests or any other offers or ads that are strictly related to the product you purchased).
Dettra SRL may also disclose your personal data to partners, third parties or entities that support Dettra SRL in carrying out its activity, or to central / local public authorities, in the following examples:
To our service providers and contractual partners, for example: marketing and advertising service providers; to our partner in charge of ensuring access to the Dettra Festival venue; to IT service provider; to courier services, payment services, banking services, etc. This data will be provided to the extent necessary and only on the basis of a confidentiality agreement from the contractual partners, which guarantees that this data is kept safe and that its processing is done according to the legislation in force;
To the accountants, auditors, lawyers, insurers or other such external advisers Operator might employ. This data will be provided to the extent necessary and only on the basis of a confidentiality agreement from the contractual partners, which guarantees that this data is kept safe and that its processing is done according to the legislation in force;
Authorities, institutions and public bodies, if there is a legal request from them or to the extent that there is a legal obligation from us;
The operator will be able to disclose this data whenever the law requires it, or in the case in which this action is necessary to allow the exercise of the rights provided by the law and / or to be able to take legal action against any illegal activity;
Your personal data may be transferred to third countries, based on the contractual relationships we have with our partners (both affiliates and other entities in the European Union) in order to compile statistics and other types of reports;
8. How long do we store your personal information?
8.1 As a matter of principle, Dettra SRL will process your personal data for a period of time expressly specified in Art.3 or as much as necessary to achieve the processing purposes mentioned above.
9. Your rights related to personal data processing:
If you have consented to process activities, you may withdraw this consent at any time. This withdrawal will only take effect for the future and will not affect the legality of the processing prior to its withdrawal.
To the extent that your consent is withdrawn, DETTRA SRL will prohibit the processing of your personal data and will take all actions to delete all records containing this data.
However, if the processing is compulsory for the provision of services by DETTRA SRL and this can be performed on the basis of other legal provisions, DETTRA will carry out such processing and will notify you to this regard.
In accordance with the legal the right to obtain from us, upon request and free of charge, the confirmation that the data concerning you is or is not processed by the company and the right of access to these data, unless these requests are repetitive or made in bad faith;
Information – the right to be informed about the identity of the operator, the purpose for which the data is processed, the recipients or categories of data recipients, the existence of the rights provided by the GDPR and the conditions under which they can be exercised
Correcting your personal data – You may request to amend any incorrect personal data.
Deleting your personal data (the right to be forgotten) – you can obtain the deletion of the data, if their processing was not legal or in other cases provided by law;
Restriction of processing - you can request restricting the processing if you dispute the accuracy of the data, as well as in other cases provided by law;
Objection – the right to object, at any time, for good and legitimate reasons related to the data being processed, unless otherwise provided by law;
Transferring your personal data (right to data portability) - you may receive, under certain conditions, the personal data you have provided to us, in a format that can be read automatically, or you may request that the data be transmitted to another operator
Filing a complaint - you can file a complaint regarding the manner of processing personal data at the National Supervisory Authority for the Processing of Personal Data or you can address the courts of law.
Not being subjected to automatic decisions or additional profiling related to automatic decisions: the right to request and obtain the withdrawal, annulment or reassessment of any decision having legal effect, adopted exclusively on the basis of personal data processing, carried out by automatic means, designed to evaluate some aspects of their personality, such as professional competence, credibility, behavior or other such aspects;
If you wish to exercise the rights mentioned above, please contact the person responsible for the protection of personal data using the following contact details:
E-mail: [email protected]
Address: str. G-ral Eremia Grigorescu, nr. 122 A, Cluj-Napoca, Cluj County.
You can also file a complaint regarding the processing of your data with the National Authority for the Processing and Supervision of Personal Data (B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest, Romania, www.dataprotection.ro, [email protected]).
10. Information security
We are working hard to protect our website, and users, as well as all personal data collected in accordance with this Policy, from any unauthorized access or from the modification, unauthorized disclosure or destruction of the information we hold.
In this regard:
Dettra certifies that it meets the minimum requirements for the security of personal data, the data being processed in a way that provides protection against unauthorized or illegal processing and against accidental loss, destruction or damage, by taking appropriate technical or organizational measures;
or the data collected through the website, in order to ensure access to the festival, Dettra uses a cloud service provided by Amazon Web Services EMEA SARL. Therefore, the security settings provided by Amazon are used. Access to data is done in a whitelist of security groups, which means that data can only be accessed from certain pre-defined IP addresses. Access is based on username and password, and within Dettra access to the database is allowed to a limited number of persons.
The used data storage systems have implemented back-up mechanisms to ensure the redundancy of the stored data.
We are regularly reviewing the practices for collecting, storing and processing information, including physical information, as well as security measures, to prevent unauthorized access to the systems.
We are restricting the access of our employees and contractors to your personal information, and the contractual relations with these persons are subject to strict rules regarding contractual confidentiality obligations, including under the sanction of termination of contracts.
11. When does this Privacy Policy apply?
Our privacy policy applies to all services provided by our company and excludes services that have separate privacy policies and do not contain the provisions of this privacy policy.
12. Amendments
Our privacy policy may change, but we promise not to reduce your rights under these changes without your explicit consent. We will publish any amendment to the privacy policy on our webpage, amendment which will come into effect within one day and, if the changes are significant, we will provide more prominent notification (including, for some services, email notification of privacy policy changes). We will also store earlier versions of this Privacy Policy in the archive so that it can be reviewed by you at any time.
The latest update of this policy was made in 10.03.2022.