Privacy policy

The controller is Brasov Entertainment SRL, unique registration code 51709407, Trade Register no. J2025030681001.

Registered office and address for privacy requests: 6 Gloriei Street, building 329, apartment 7, Brașov 500138, Romania. Mark the envelope “Data protection”.

The website is hosted through Vercel. Technical data such as IP address, access date and time, requested page, device type and browser information may be processed to deliver and secure the pages. The legal basis is our legitimate interest in providing a secure and functional website.

Technical providers include Vercel for hosting and delivering the website and Sanity for managing and delivering content. They may act as processors or independent controllers for certain service-generated data, according to the service supplied and the applicable agreements.

Technical logs are retained only for as long as needed for operation, security and incident investigation, subject to service configuration and provider retention periods. We apply reasonable measures including role-based access, security updates, backups, and contractual confidentiality and security obligations for providers.

The strictly necessary language-preference cookie is retained for one year. The cookie choice is stored in localStorage until it is changed through “Cookie settings” or deleted from the browser.

Meta Pixel is loaded only after optional technologies are accepted and only if enabled in production. The current implementation sends the PageView event and may include the page URL, referring page, IP address, browser and device information, and Meta/cookie identifiers. We do not send names, email addresses or phone numbers through the Pixel and do not use advanced matching.

Consent can be withdrawn at any time through “Cookie settings”. Withdrawal stops future Pixel events and clears first-party Meta identifiers that the browser allows this site to remove; it does not affect processing lawfully carried out before withdrawal.

Online ticket sales are handled through the external iaBilet and Eventim platforms, which act as independent controllers for accounts, orders and payments made on their websites. Brasov Entertainment SRL is a separate controller for data it receives to organize the event and does not receive full payment-card details.

We may receive from the platforms data strictly necessary for ticket validation, admission administration, handling requests and complying with legal obligations, within the limits of the applicable agreements.

Mandatory data is marked by the ticketing platform; without it, the order or admission cannot be validated. Operational admission lists received from the platforms will be erased or anonymized within 72 hours after the festival closes, except for data needed for a complaint, incident or legal obligation.

To validate admission, we may check the ticket, wristband and identity document without copying the document unless required by law. For guests aged 16 and 17, we process the data included in the form signed by a parent or guardian.

We may document incidents, complaints and interventions for safety, legal compliance and the establishment or defence of rights. Access is limited to authorized staff and suppliers.

Minor consent forms and incident reports are retained for no more than three years after the festival closes. If a complaint, investigation or proceeding is ongoing, relevant data may be retained until final resolution and expiry of the applicable legal periods.

If you request an accessibility adjustment or disclose a medical need, we process only information strictly necessary to provide assistance, protect vital interests or comply with legal obligations. We do not request diagnoses that are not necessary.

Access is limited to authorized staff and, where necessary, the medical provider. Data is erased within 30 days after the festival unless an incident or legal obligation requires longer retention.

Throughout the event, photographs and video recordings may be made across the festival site by the organizer, the press and authorized suppliers. They may capture performances, activities, guests and shared areas and may be used for documentation, press, archive and promotion of Country Fest editions.

Recordings may include both general scenes and identifiable guests in the audience, without separately designated filming areas. Processing is based on the organizer’s legitimate interest in documenting and promoting the festival, while respecting guests’ dignity, privacy and rights. Attendance acknowledges notice of this possibility; it does not waive rights under the GDPR.

A person may report a particular situation or object to future use through the privacy contact channel; each request will be assessed against its context and the rights involved.

Compensation is not normally provided for incidental appearances in festival materials. Promotional materials are retained for no more than five years; a limited selection may then be kept in the festival’s historical archive based on legitimate interests and subject to the right to object.

The public area contains cameras previously installed by the municipality. These cameras are not owned, operated or controlled by Brasov Entertainment SRL; the organizer has no access to the footage and does not determine its purposes or retention.

For information or rights requests concerning these cameras, consult the signage and notice of the competent public controller. If the organizer installs a separate CCTV system, a distinct notice will be provided before it is used.

Unless a specific period is stated above, data is retained for no more than five years after the last interaction, or longer only where required by a fiscal or legal obligation, complaint or dispute. Hosting and IT providers, ticketing platforms, admission and security staff, medical and photo-video suppliers, advisers and authorities may receive data only within their role.

Where applicable, you have rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent. You may also complain to the Romanian data-protection authority: https://www.dataprotection.ro/.

We normally respond to requests within one month; this may be extended by two further months for complex requests after notifying the requester. We do not use solely automated decisions that produce legal effects for guests. This policy may be updated, and the current version date will remain visible.

Requests may be sent by post to the registered office marked “Data protection”. Before responding, we may request additional information strictly necessary to verify the requester’s identity.

Vercel and Sanity may process technical or service-related data in the United States and other countries where they or their subprocessors operate. Sanity identifies, among other locations, infrastructure processing in Belgium and the United States. If accepted, Meta Pixel sends visit data to Meta Platforms Ireland Limited, and Meta may process data through its global infrastructure, including in the United States.

For transfers from the European Economic Area to countries without an adequacy decision, we use the mechanism applicable to the provider relationship and recipient: the European Commission's Standard Contractual Clauses and supplementary measures and, for certified recipients in the United States, the EU-US Data Privacy Framework, as applicable. Providers may update their subprocessor lists and processing locations.

Meta is the only optional marketing provider integrated into the website and receives data only after consent. Vercel and Sanity are necessary technical providers; disabling them would prevent delivery of the website or its content. Links to iaBilet, Eventim, Facebook, Instagram, Google Maps and ANPC open external services, which process data under their own policies after they are accessed.