Privacy & Policy

EVENT: NEVERSEA
ORGANIZER: NEVERSEA S.R.L.
LOCATION: Constanța

1. Introduction
1.1 Privacy of personal data represents one of the main concerns for NEVERSEA SRL. As such, we aspire to provide the highest standards of privacy and transparency for the personal data we’re processing in our current activity.
1.2 Since for conducting our business we are required to process a series of personal data, especially in relation to the specifics of our line of business, we wish to provide assurances that the processing will take place in compliance with the principles of transparency and security of personal data. This privacy policy is meant to help you understand what data we’re collecting, why we’re collecting it and what we’re doing with it.

2. Who are we?
2.1 NEVERSEA SRL (hereinafter referred to as „NEVERSEA�) is a Romanian company, established Cluj-Napoca, Eremia Grigorescu, nr. 122A, registered with the Trade Register under no. J12/183/2017, VAT number: 36944344. NEVERSEA SRL acts as operator of personal data collected through the www.neversea.com website (the "website�), and the NEVERSEA App, the online and on-site check-on system, the means of video monitoring and photo and video image capture within the Festival by persons authorized by NEVERSEA.
2.2 The operator is required to manage safely and solely for specified purposes, the personal data that the users of the website are providing.

3. What kind of data is processed, the purpose of processing and the storage period for and the legal basis for processing for each category of data?

3.1	WHAT KIND OF DATA IS PROCESSED	THE PURPOSE OF PROCESSING	STORAGE PERIOD	LEGAL BASIS FOR PROCESSING
3.1.1	The e-mail address and set of cryptographic hash values (generated by applying the SHA-2 512 encryption algorithm) related to the password set by the users so that they can log into their accounts.	For the purpose of creating and accessing an account on the NEVERSEA.com website, the Neversea app or on external Neversea platforms (such as the online check-in platforms, ticket sale platforms).	We will store this data as long as you have an account on the NEVERSEA website / App. To the extent that there is no request to anonymize the data, they will be anonymized within 5 years from the last use of the account.	a) Art. 6 (1) par. b - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;  b) Art. 6 (a) par. f processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party;
3.1.2	Last name, first name, email, phone number, gender, country, city, county, date of birth, profile photo (with the exception of children under the age of 18) and number of access ticket / bracelet for the festival;	In order to ensure the access and services to which the participant is entitled based on the ticket, to prevent fraud, abusive use and to verify the validity of the ticket or subscription once the check-in process is completed; For the purpose of information in relation to the aspects related to the organization and conduct of the event or any other offers and announcements in strict connection with the purchased product The processing of data regarding gender, country, city, county, date of birth is justified by the fact that the data is processed for internal reports and surveys. Also, these data are necessary to respond to a request from public authorities, for complaints or complaints.	The profile photo and date of birth will be deleted 20 days after the end of the Festival. All data will be processed for 3 years from the last edition in which the person concerned participated in the Festival. After this term, the data will be anonymized if this has not been previously requested. Sex, country, city, county, year of birth are kept to make internal reports that are used to organize access areas, to organize dedicated campaigns and activities, etc. Â	a) Art. 6 (1) lit. b - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;  b) Art. 6 (a) lit. f processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party;
3.1.3	Name, surname, e-mail, telephone number and other information provided by email or on other platforms to describe the problem.	For the purpose of returning purchased products or solving a problem addressed to us.	Until the general limitation period of 3 years from the date on which the client can file an action in court is fulfilled.	a) Art. 6 (1) lit. b - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
3.1.4	Last name, first name, email and telephone number.	For marketing purpose,  for promoting products provided by NEVERSEA and its partners, as well as conducting surveys to improve the quality of the services we provide.	Until the consent is withdrawn or at most 5 years from the date on which consent was granted. After this term, the data (name, surname, e-mail, phone number) will be anonymized, if their anonymization was not previously requested.	Art. 6 (1) (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
3.1.5	Last name, first name, email and telephone number.	For marketing purpose, for  promoting products provided by NEVERSEA and its partners, as well as conducting surveys to improve the quality of the services we provide.	Until the consent is withdrawn or at most 3 years from the date on which consent was granted. After this term, the data (name, surname, e-mail, phone number) will be anonymized, if their anonymization was not previously requested.	Article 6 (a) lit. f - processing is necessary for the purpose of the legitimate interests pursued by the operator or by a third party.
3.1.6	The voice of the data subject	For marketing purposes, telephone calls may be recorded with the consent of the data subject, with the aim of carrying out surveys to improve the quality of the services we offer.	Recorded calls will be deleted within 30 days from the time of recording.	Art. 6 (1) (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
3.1.7	Name, surname; E-mail Phone number; Country, county, city Date of birth, sex:	Information collected in the Pre-register Campaign: Data processing is necessary to allow the persons concerned to register for the campaign. Subjects understand (and accept) that they are signing up to receive recurring marketing information regarding the latest promotions, campaigns, announcements, to be able to purchase tickets at a promotional price, regarding the Neversea Festival Editions. The purpose of the Register Campaign is to create a community where people interested in finding out the latest information about the event register. Afterwards, NEVERSEA sends e-mails/text messages notifying data subjects of the date on which promotional tickets go on sale, artist release announcements, and other campaigns and promotions.	All the personal data of the people who registered in the Campaign, but did not purchase the product for which they registered, will be anonymized within 3 years from the last edition in which the person registered. After this term, the data will be anonymized, if their anonymization was not previously requested. If the persons concerned bought a Ticket in this campaign, their personal data will be processed from this step forward in order to be able to ensure the purchased services and access to the Festival. Data related to gender, country, city, county, date of birth are kept to make internal reports that are used to organize access areas, to organize dedicated campaigns and activities, etc.	Art. 6 (1) (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
3.1.8	Name, surname, e-mail, phone number, signature, photo and / or audio-video recordings that may include your image or voice in the event - "Activation in the Blood Network Caravan". Name and legal representative (in the case of minors).	Information collected for the purpose of running the "Enter the Blood Network" campaign/project. These categories of data are processed to be able to offer a free one-day ticket to the participants of this campaign or a discount voucher to purchase a subscription. The phone number in particular is processed so that the Organizer can contact the participants on the day of the campaign to inform them of the time at which they must show up at the caravan. Photo/video images - For journalistic, informational, artistic or commercial purposes and to promote the event.	3 years. The storage period is justified by the fact that there are situations where you, after receiving the prize, contact us again about the same matters and we can thus use previous correspondence with you or to respond to a request from public authorities, for complaints or complaints. Photo-video images are stored for 15 years	Art. 6 (1) (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;  Art. 6 (1) lit. b - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;  Art. 6 (a) lit. f processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party;
3.1.9	Last name, first name, certificate attesting the applicant has passed the Baccalaureate exam (name, surname, date of birth, general grade). The applicant has the obligation to delete any other information from the certificate or to make the data indecipherable to the Operator.	Information collected for the purpose of carrying out the "Bac de 10" campaign.	3 years. The storage period is justified by the fact that there are situations where you, after receiving the prize, contact us again about the same matters and we can thus use previous correspondence with you or to respond to a request from public authorities, for complaints or complaints.	Art. 6 (1) lit. b - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
3.1.10	Inside the NEVERSEA Festival there are used video monitoring means through which the images of the data subjects, respectively of all the visitors of the Event will be processed.	a) For the purpose of ensuring the security of property, spaces and people. b) In For the purpose of defending rights in court or for the purpose of a legal obligation.	20 days. Some data may be stored for a longer period, if storage is necessary to investigate a fraud, to defend in court the rights of either Party or in cases where compliance with requests from competent authorities is required.	Art. 6 (1) (c) the processing is necessary in order to fulfill a legal obligation incumbent on the operator; Art. 6 (a) lit. f processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party;
3.1.11	Photographs or footage taken during the Event.	For journalistic, informational, artistic, commercial purposes, for marketing and promotional purposes of the event, Neversea products and services or related products and services, in its own name by Neversea or by any partner or sponsor of the Neversea Festival. They can also be used to make NFTs (Non-fungible tokens) and trading them on the relevant market.	For a period of 15 years from the time of completion of the edition in which they were made.	Art. 6 (a) lit. f processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party;
3.1.12	IBAN and account holder name	It is requested to the customer if we have to make a return of the value of the products or services, to respond to a request from public authorities, claims or complaints.	3 years from the moment when the return could be requested by the customer	Art. 6 (a) lit. f processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party;
3.1.13	Name, Surname, e-mail, social media profile (if applicable), information included in comments in campaigns organized by the Organizer or in partnership with Companies/Organizations	The purpose of requesting this data is to organize promotional campaigns and contests, as well as to ensure the delivery of prizes.	3 years. The storage period is justified by the fact that there are situations where you, after receiving the prize, contact us again about the same matters and we can thus use previous correspondence with you or to respond to a request from public authorities, for complaints or complaints.	Art. 6 (a) lit. f processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party;
3.1.14	Merchant name, company name, contact person name, address, email address, phone number	Information collected in the FAB STAGE Campaign: The targeted persons register to be selected to participate as collaborators in the Fashion Corner area of ​​the Festival.	Until consent is withdrawn or at most 3 years from the date on which consent was granted.	a) Art. 6 (a) lit. f processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party;

3.2 In addition to the aforementioned purposes, NEVERSEA SRL processes the personal data collected for the following purposes:
a. For the fulfillment of the obligations that incube on us, as a result of the services provided (e.g. accounting, fiscal, audit, etc.), these are always compatible with the main purposes, for which the data was collected;
b. To the extent that the data subject has given their consent for the processing of their personal data for one or more specific purposes;
c. For any other purpose auxiliary to the above, or for any other purpose for which we have been provided with personal data, in compliance with the relevant legislation;
3.3 In the situations in which we will use your data for purposes other than those mentioned in this Policy, we undertake to obtain your consent, unless we have a legal obligation or have a different legal basis for processing the data.
3.4 The operator does not create individual profiles for those who participate at the NEVERSEA Festival.

4. How are we collecting your personal data?
4.1 We are collecting your personal data either directly from you, e.g. when you’re creating an account on our website/App, you’re sending us an e-mail at [email protected], in which you’re requesting us an offer / information, and you’re giving your consent for communication of commercial messages, etc., or indirectly, e.g. when you’re sending this information to the platforms of other collaborators for our company, in the process of purchasing the ticker/pass.
4.2 We collect your personal data automatically, when you use our services from the website or the NEVERSEA application, we collect information through cookies and by logging your activity. For more information on the use of cookies, please refer to Art. 6 of this Policy.
4.3. If you choose to provide us with the personal data of others, such as when you purchase tickets on behalf of others, you are responsible for how you obtained these data and that you have a legal basis for processing them. We cannot be held liable for the violation of the rights of the respective persons.

5. How are we storing the personal data?
5.1 For storing the personal data you''re providing as a user of our website / App, a cloud service provided by Amazon Web Services EMEA S.A.R.L. is used.
5.2 Also, the data collected in the context of on-site check-in is stored by our partner, Festipay Zrt., on their servers in the European Union.

6. COOKIES
6.1 The website contains cookies (very small files NEVERSEA is sending to the computers of website users or to other access devices).
6.2 There are two types of these cookies:
â—� Functionality cookies: These types of cookies improve the users'' website navigation experience and allow them to benefit from various features;
â—� Performance Cookies: These types of cookies are used to measure and analyze how NEVERSEA customers are using the Website. These cookies can continually improve the functionality of the website and the user experience.
6.3 Accessing the website implies the agreement of the users regarding placing these types of cookies on their device and access them on their next visit to the site.
6.4 Information on deleting and controlling cookies is available at www.aboutcookies.org. Deleting or blocking the cookies may prevent access to certain areas or features of the site.
6.5 For more information, please consult our Cookie Policy.

7. To whom we’re disclosing your personal data?
7.1 For fulfilling the processing purposes, NEVERSEA SRL may disclose your personal data to partners, third parties or entities supporting NEVERSEA SRL in the conduct of their business, or to central / local public authorities, in the following cases listed as examples:
1. To our service providers and contractual partners, for example: marketing and advertising service providers; to our partner in charge of ensuring access to the NEVERSEA Festival venue; to IT service provider; to courier services, payment services, banking services, ticket sale, payment service providers etc. This data will be provided to the extent necessary and only on the basis of a confidentiality agreement from the contractual partners, which guarantees that this data is kept safe and that its processing is done according to the legislation in force;
2. To the accountants, auditors, lawyers, insurers or other such external advisers Operator might employ. This data will be provided to the extent necessary and only on the basis of a confidentiality agreement from the contractual partners, which guarantees that this data is kept safe and that its processing is done according to the legislation in force;
3. Authorities, institutions and public bodies, if there is a legal request from them or to the extent that there is a legal obligation from us;
4. The operator will be able to disclose this data whenever the law requires it, or in the case in which this action is necessary to allow the exercise of the rights provided by the law and / or to be able to take legal action against any illegal activity;
5. Your personal data may be transferred to third countries, based on the contractual relationships we have with our partners (both affiliates and other entities in the European Union) in order to compile statistics and other types of reports;

8. How long do we store your personal information?
8.1 As a matter of principle, NEVERSEA SRL will process your personal only to the extent necessary to achieve the processing purposes mentioned above. Please note that for most processing purposes, data about the Participants at the festival will be deleted within 20 days from the end of the Festival, unless the Participant has an account on our website or has given us the consent to retain the data in order to be contacted for certain, clearly defined, purposes.
For further details about our Data Retention Policy for certain specific data processing please review column 3 of the Table in Art. 3.

9. Your rights related to personal data processing:
As the data subject, you benefit from a series of specific rights guaranteed by the General Data Protection Regulation no. 679/2016 (GDPR) and the legislation in force in Romania regarding the protection of personal data.

9.1. The right to information
The persons concerned whose personal data are processed within our specific activities have the right to receive from us information about the processing operations carried out in our capacity as data operator.

9.2. Right of access
You have the right to obtain from us a confirmation of whether or not we are processing personal data concerning you.
If we confirm that we have your personal data, you have the right to access it and obtain a series of relevant additional information.

9.3. The right to rectification
You have the possibility to obtain from the data operator, the rectification of inaccurate data concerning you or the completion of personal data that are incompletely recorded in our internal records.

9.4. The right to data erasure (“the right to be forgotten�)
You have the right to request that we delete the personal data that we process about you. We must comply with this request if:
a) personal data are no longer necessary to fulfill the purposes for which they were collected;
b) you oppose the processing for reasons related to your particular situation;
c) personal data were processed illegally;
d) personal data must be deleted to comply with a legal obligation that rests with us, except for the case where the data is necessary:
• for exercising the right to free expression and information;
• to comply with a legal obligation we have;
• for archiving purposes in the public interest, scientific or for historical studies or for statistical purposes;
• for ascertaining, exercising or defending a right in court.

9.5. The right to restriction of processing
You can ask us to restrict the processing of your personal data when:
• contest the accuracy of the personal data that we process, during the period that we check the accuracy of the data;
• data processing is illegal, but instead of requesting the deletion of personal data, you want to restrict their processing;
• the personal data are no longer necessary for us to achieve the purpose for which they were processed, but you request that data from us for ascertaining, exercising or defending a right in court;
• you objected to the processing and request restriction while we check whether it receives our legitimate interest for the processing.

9.6. The right to data portability
You have the right to obtain your data from us in a structured, commonly used and machine-readable format.

9.7. The right to opposition
At any time, the data subject has the right to object, for reasons related to the particular situation in which he is, to the processing. The operator no longer processes personal data, unless the operator demonstrates that it has legitimate and compelling reasons that justify the processing and that prevail over the interests, rights and freedoms of the data subject or that the purpose is to ascertain, exercise or defend a right in court.
You can object at any time to the processing of your personal data for direct marketing purposes, whatever your reason.

9.8. The right not to be the subject of a decision based exclusively on automatic processing, including the creation of profiles
This right is applicable if the automated individual decision-making process produces legal effects that concern or affect you to a significant extent.

9.9. The right to file a complaint
If you have a complaint about the way we process your personal data, please contact us in order to solve your problem using the following contact details:
â—� Email: [email protected]
â—� Address: str. G-ral Eremia Grigorescu, no. 122 A, Cluj-Napoca, Jud. Cluj.

You can also contact the National Supervisory Authority for the Processing of Personal Data through their website www.dataprotection.ro.
Please keep in mind the following aspects of interest, related to the method of analysis and response to the request for the exercise of rights:
We will make every effort to respond to your request within 30 days. This period can be extended due to reasons related to the specific legal right invoked or the complexity of your request with a maximum additional period of two months. In any case, if the legal response deadline will be extended, then we will inform you about the new deadline and the reasons that led to this extension.

10. Information security
10.1 We are working hard to protect our website, App and users, as well as all personal data collected in accordance with this Policy, from any unauthorized access or from the modification, unauthorized disclosure or destruction of the information we hold.
2. In this regard:
a. NEVERSEA certifies that it meets the minimum requirements for the security of personal data, the data being processed in a way that provides protection against unauthorized or illegal processing and against accidental loss, destruction or damage, by taking appropriate technical or organizational measures;
b. or the data collected through the website and the App, in order to ensure access to the festival, NEVERSEA uses a cloud service provided by Amazon Web Services EMEA SARL. Therefore, the security settings provided by Amazon are used. Access to data is done in a whitelist of security groups, which means that data can only be accessed from certain pre-defined IP addresses. Access is based on username and password, and within NEVERSEA access to the database is allowed to a limited number of persons.
c. The used data storage systems have implemented back-up mechanisms to ensure the redundancy of the stored data.
d. We are regularly reviewing the practices for collecting, storing and processing information, including physical information, as well as security measures, to prevent unauthorized access to the systems.
e. We are restricting the access of our employees and contractors to your personal information, and the contractual relations with these persons are subject to strict rules regarding contractual confidentiality obligations, including under the sanction of termination of contracts.

11. When does this Privacy Policy apply?
Our privacy policy applies to all services provided by our company and excludes services that have separate privacy policies and do not contain the provisions of this privacy policy.

12. Amendments
12.1 We will publish any amendment to the privacy policy on our webpage, amendment which will come into effect within one day and, if the changes are significant, we will provide more prominent notification (including, for some services, email notification of privacy policy changes). We will also store earlier versions of this Privacy Policy in the archive so that it can be reviewed by you at any time.
12.2 The latest update of this policy was made on the 30th of June 2023.