Legal

Privacy Policy

Last updated
20 August 2026
Status
Draft for review

This Privacy Policy explains how the Project Team handles information collected through the Culture Fest website, account system, and survey.

This policy is published in English and Greek. Where the two differ, the English text is the authoritative version.

1. Who is responsible for the information?

The Culture Fest website and survey are operated by the Project Team.

For questions about privacy or personal information, users can contact:

Privacy Contact
Spyridon Siachamis

The privacy contact receives privacy-related requests and coordinates with the Project Team where necessary.

2. What information do we collect?

Account information

When you create an account, the service may collect:

  • Email address
  • Phone number
  • Password
  • Account creation date
  • Email verification status
  • Survey participation status
  • Eligibility and redemption status

Passwords are never stored in plain text and are protected using secure password hashing.

For privacy and security purposes, email addresses and phone numbers are stored in a protected, hashed form within the application database.

Survey information

When you complete the Culture Fest survey, we may collect:

  • Audience type
  • Gender
  • Age range
  • Interest level
  • Likelihood of recommending the event
  • Preferred ticket-price range
  • Date preference
  • Group size
  • Interest in food stalls
  • Interest in transportation
  • Accommodation area
  • Student-pass status
  • Optional open feedback
  • Survey submission date and time

3. Separation of account and survey information

Culture Fest is designed to keep survey responses separate from account identity.

Survey responses do not contain your account ID, email address, or phone number.

Your account does record whether you have submitted the survey. This is necessary to prevent multiple submissions from the same account and, where applicable, determine eligibility for an associated event benefit.

As a result, the system can record that an account has submitted a survey without storing that account's identity together with the specific answers submitted.

Please avoid including unnecessary personal or sensitive information in the optional open-feedback field.

4. Why do we use this information?

The Culture Fest survey is being used as a trial run for the festival. Its purpose is to help the Project Team understand attendee preferences, evaluate the event, and develop the Culture Fest brand and future events.

Information may be used to:

  • Create and manage attendee accounts
  • Verify accounts
  • Authenticate users
  • Prevent duplicate survey submissions
  • Analyze attendee preferences
  • Evaluate the festival
  • Plan future Culture Fest events
  • Improve the attendee experience
  • Determine eligibility for event benefits
  • Manage digital passes and QR-based benefits
  • Record redemption of eligible benefits
  • Maintain and secure the website
  • Prevent abuse or fraudulent activity
  • Troubleshoot technical issues

Survey information is intended for internal use by the Project Team and is not intended to be shared with people outside the project team for their own purposes.

5. Authentication and cookies

The website uses JSON Web Tokens (JWTs) to maintain authenticated user sessions.

The JWT is stored in an HttpOnly, Secure cookie and is used by the server to identify the authenticated account.

The authentication cookie:

  • Cannot normally be accessed by client-side JavaScript because it is HttpOnly
  • Is transmitted only over HTTPS because it is Secure
  • Uses SameSite protections to reduce cross-site request risks
  • Contains authentication/session information rather than survey responses

Administrative and other access permissions are determined by the server.

6. Sharing and service providers

We do not sell your personal information.

Survey responses are intended for internal use by the Project Team.

The technical operation of the website requires third-party infrastructure and service providers. These currently include:

  • Vercel — website hosting and deployment
  • Railway — application and database infrastructure
  • Resend — transactional email delivery

These services may process information as necessary to provide their services.

Information may also be disclosed where required by applicable law or a lawful request from a competent authority.

7. Data security

The Culture Fest service uses technical measures designed to protect information against unauthorized access, alteration, disclosure, or destruction.

These measures include:

  • Secure password hashing
  • Protected authentication sessions
  • Server-side authorization
  • Administrative access controls
  • Rate limiting
  • Input validation
  • Request-size restrictions
  • HTTPS
  • Protection of application secrets
  • Separation of account information from survey responses
  • Database protections against concurrent duplicate survey submissions

While we take reasonable measures to protect information, no internet-based service can guarantee absolute security.

8. How long is information retained?

Account information and survey responses are retained for the operation of the Culture Fest event and related event activities.

The information will be deleted after the festival has concluded and the associated event operations have been completed.

Information may remain temporarily in technical backups or service-provider systems according to their applicable retention and deletion procedures.

Information may also be retained where required by law.

9. Your rights

Depending on applicable law, you may have rights regarding your personal information, including the right to:

  • Request access to your personal information
  • Request correction of inaccurate information
  • Request deletion of your information
  • Request restriction of processing
  • Object to certain processing
  • Request data portability where applicable
  • Withdraw consent where processing is based on consent

Privacy requests can be submitted to:

Privacy Contact
Spyridon Siachamis

Because survey responses are deliberately stored separately from account identity, it may not always be technically possible to identify a particular survey response as belonging to a specific account.

You may also have the right to lodge a complaint with the relevant data-protection supervisory authority.

10. Optional feedback

The survey includes an optional open-feedback field.

Please do not include passwords, financial information, unnecessary contact information, or other sensitive personal information in your response.

11. Changes to this Privacy Policy

We may update this Privacy Policy if the Culture Fest service, its data-processing practices, or applicable requirements change.

When changes are made, the “Last updated” date will be updated.

12. Contact

For questions about privacy, personal information, or this Privacy Policy:

Team
The Project Team
Privacy Contact
Spyridon Siachamis