privatlivspolitik for ædru festival

who is responsible for your data?

ædru festival (sobe), cvr 46272668, is the controller responsible for the website and newsletter. our postal address is c/o thomas jonassen, tøndergade 15, st. tv, 1752 københavn v. contact us at kontakt@ædrufestival.dk or through https://sobe.dk.

contact messages

if you send a contact message, we process your name, email address, message and selected language to respond to your enquiry. we rely on our legitimate interests in handling correspondence under article 6(1)(f). sending a message alone does not subscribe you to marketing. a separate, optional checkbox lets you join the newsletter; leaving it unchecked does not prevent you from contacting us. the required privacy checkbox records that you have read this policy, not consent to marketing. the website saves your enquiry in a private supabase contact-message table through cloudflare. we also record the submission time and the privacy-policy version, when you acknowledged the policy, and whether you chose marketing. contact messages are separate from newsletter signups. no contact email or automatic reply is sent; a new optional newsletter signup receives the welcome email described below. correspondence is kept only as long as needed to handle the enquiry and any related legal obligations or claims, and is reviewed for deletion when no longer needed. contact us about access or deletion of correspondence. email providers may retain delivery and security records separately.

newsletter and marketing consent

if you choose to sign up, we use your email address to send email marketing about sobe tickets, merch and events, including a welcome email. we rely on your consent under article 6(1)(a) of the gdpr. the checkbox starts unchecked. choosing to receive marketing is separate from reading this privacy policy, and you can use the website without signing up.

we record your email address, selected language, signup and consent timestamps, the exact consent wording and its version, the privacy policy version, and private token hashes for unsubscribe and deletion links. we do not verify ownership of the email address through a confirmation email.

unsubscribe and deletion are different choices

use the personal unsubscribe link at the bottom of an email to withdraw your consent and stop future marketing. you do not need an account or a password. withdrawal does not affect the lawfulness of processing before withdrawal. you may also withdraw consent by contacting kontakt@ædrufestival.dk.

after withdrawal we retain the signup and consent record, including the withdrawal timestamp, for up to two years solely to document consent and withdrawal and prevent further marketing. we rely on our legitimate interests in documenting compliance and respecting opt-outs under article 6(1)(f), not on continued marketing consent. these records must not be used for marketing. expired withdrawn records are removed by a daily cleanup.

if you also want this retained signup record removed, use the separate delete my signup data link in an email. after you confirm, we delete the matching email address, consent record, withdrawal timestamp and private link hashes from the signup database. this also stops marketing. these links are personal; share the public signup link instead of forwarding your personal preference links.

these controls concern the newsletter signup database. they do not recall emails already delivered to your inbox or instantly remove independent email delivery logs, security logs, correspondence or backup copies. contact us for a wider deletion request. copies in backups expire according to the applicable backup retention schedule and must not be used to restart marketing.

if you no longer have an email link, or received an older email without one, contact kontakt@ædrufestival.dk. we may need proportionate information to verify a request before disclosing or deleting personal data. do not send identity documents unless we specifically explain why they are necessary.

retention while subscribed

we retain your active signup while you want the newsletter and it remains necessary for that purpose. we review whether continued retention and use of consent are justified; consent is not treated as permission for indefinite or unrelated marketing. after withdrawal the two-year maximum above applies, unless you request deletion sooner.

service providers, security and transfers

we use supabase for the signup and contact-message databases and cloudflare for website hosting, database connectivity, security and email delivery. these providers process data needed to provide their services. cloudflare may process the recipient address, email contents, delivery events and technical request information. email delivery and security records can have different retention periods from the signup database.

for essential hosting, security and rate limiting, we rely on our legitimate interests in operating and protecting the service under article 6(1)(f). the signup and contact endpoints use the request ip address transiently for rate limiting. the application does not add ip addresses to signup records. access to the database is restricted, database connections are encrypted, and personal email-link credentials are stored only as hashes in the signup database.

we do not sell signup data or provide it to other organisations for their own marketing. we may disclose data where required by law. depending on configured hosting regions, support access and subprocessors, providers may process data outside the european economic area. where required, transfers must rely on an applicable adequacy decision or appropriate safeguards such as standard contractual clauses. contact us for details about the safeguards applicable to your data.

cookies, analytics and profiling

the website application does not implement advertising cookies, third-party analytics scripts, account registration, profiling or automated decisions about subscribers. hosting and security services may process technical request information to operate and protect the website. if we introduce additional tracking or new purposes, we will update this policy and obtain consent where required before using them.

your rights

subject to the applicable conditions, you may request access, correction, deletion, restriction of processing and data portability. you can object to processing based on legitimate interests. you can object to direct marketing at any time; marketing must then stop. use kontakt@ædrufestival.dk for these requests or questions about this policy. we normally respond within one month; if a lawful extension is needed, we will explain it.

you can complain to datatilsynet, the danish data protection authority, through https://www.datatilsynet.dk.

changes and contact

we will publish changes on this page and update the date and version. materially new marketing purposes require a fresh choice where required; a policy change alone does not expand your consent.

ædru festival (sobe) · cvr 46272668

c/o thomas jonassen, tøndergade 15, st. tv, 1752 københavn v

email: kontakt@ædrufestival.dk · website: https://sobe.dk