Privacy & Policy

EVENT: UNTOLD DUBAI FESTIVAL

ORGANIZER: UNTOLD EVENTS L.L.C.

LOCATION: EXPO CITY DUBAI

1. Introduction

1.1 The confidentiality of personal data is one of the main concerns for UNTOLD EVENTS LLC. As such, we want to ensure the highest standards of confidentiality and transparency regarding the personal data we process in our current business.

1.2 Since in carrying out the activity it is necessary to process a series of personal data with predilection in relation to the specifics of our object of activity, we want to offer assurances that the processing will take place in compliance with the principles underlying the processing of personal data. This privacy policy is intended to help you understand what data we collect, why we collect it and what we do with it.

This Policy, as well as your access to the UNTOLD EVENTS website, is subject to and governed by the laws of the United Arab Emirates as applied in the Emirate of Dubai and Federal Decree Law no. 45/2021 on the Protection of Personal Data („PDPL”)

2. Information about the data controller

2.1 UNTOLD EVENTS LLC (hereinafter referred to as “UNTOLD EVENTS” or „UNTOLD”) is a limited liability company, established in Dubai, with a registered office at 3F-07 Al Safiya Building, Hor Al Anz, Dubai, Licence Number: 1102119, Tax Registration number: 104070408000003. UNTOLD EVENTS LLC acts as operator of personal data collected through the www.untold.ae website (the "website”), and the UNTOLD EVENTS App, the online and on-site, check-on system, the means of video monitoring and photo and video image capture within the Festival by persons authorised by UNTOLD EVENTS.

2.2 The Operator is required to manage safely and solely for specified purposes, the personal data that the users of the website are providing.

2.3. Individuals who utilise the UNTOLD EVENTS website and services and are subject to the collection of personal data, will be addressed as ("you") and ("your”) within the context of this privacy policy.

3. What kind of data is processed, the purpose of processing and the storage period for and the legal basis for processing for each category of data?

3.1.1. For the purpose of creating and accessing an account on the www.untold.ae website, in the Untold application and/or on external Untold platforms.

1. What data do we process? The phone number and the set of cryptographic hash values ​​(generated by applying the PBKDF2 encryption algorithm) related to the password set by the user so that he can log into his account.
2. Storage period: We will store this data for as long as you have an account on the Untold Events website/app. We specify that to the extent that there is no request for anonymization of these data on [email protected], they will be anonymized within 5 years at most from the last use of the account.
3. Legal basis for processing: Art. 4 (10) of PDPL - the processing is necessary for the execution of a contract to which the data subject is a party or to take steps at the request of the data subject before concluding, terminating or amending a contract.

3.1.2. For the purpose of purchasing an Untold EVENTS product or service.

1. What data do we process? Name, surname, e-mail, phone, country, town, address, IBAN and name of the account holder.
2. Storage period: Until a period of 5 years from the completion of the edition in which the ticket was bought or the edition about which the respective problem was reported.
3. Legal basis for processing: Art. 4 (10) of PDPL - the processing is necessary for the execution of a contract to which the data subject is a party or to take steps at the request of the data subject before concluding, terminating or amending a contract.

3.1.3. For the purpose of returning purchased products or solving a problem addressed to us.

1. What data do we process? Name, surname, e-mail, telephone number, IBAN and name of the account holder, as well as other information provided by e-mail or on other platforms to describe the problem.
2. Storage period: Until a period of 5 years from the completion of the edition in which the ticket was bought or the edition about which the respective problem was reported.
3. Legal basis for processing: Art. 4 (10) of PDPL - the processing is necessary for the execution of a contract to which the data subject is a party or to take steps at the request of the data subject before concluding, terminating or amending a contract.

3.1.4. During the CHECK-IN process:

3.1.4.1 In order to ensure access to the perimeter of the festival and to provide the services to which the participant is entitled based on the ticket, to inform about the aspects related to the organisation and conduct of the event or any other offers and announcements related to the purchased product, to prevent fraud, abusive use and to check the validity of the ticket or subscription.

1. What data do we process? Name, surname, e-mail, phone number, profile photo (except for minors under 18) and ticket / wristband number for access to the festival.
2. Storage period: The profile picture will be deleted within 20 days after the end of the Festival. The other data will be anonymized within 3 years from the last edition in which the person concerned participated in the Festival, if this was not previously requested.
3. Legal basis for processing: Art. 4 (10) of PDPL - the processing is necessary for the execution of a contract to which the data subject is a party or to take steps at the request of the data subject before concluding, terminating or amending a contract.

3.1.4.2. For internal purposes only, to carry out reports and surveys, organise access areas, create campaigns and dedicated activities, to respond to a request from public authorities, for complaints or complaints.

1. What data do we process? Sex, country, city, county, date of birth.
2. Storage period: These data are kept in the Organizer's archive without being associated with a natural person following the irreversible anonymization of personal data.
3. Legal basis for processing: Article 4(7) of PDPL - if the Processing is necessary for archival purposes or for scientific, historical and statistical studies, in accordance with the legislation in force in the State.

3.1.5. For marketing purposes:

3.1.5.1. For commercial purposes promoting Untold EVENTS LLC products and services.

1. What data do we process? Name, surname, email address, phone number.
2. Storage period: Data will be anonymized upon withdrawal of consent or within 5 years at most if the data subject no longer reacts to any commercial message.
3. Legal basis for processing: Article 4(8) of PDPL the Processing is necessary to protect the interests of the Data Subject.

3.1.5.2. For the purpose of subscribing to the Untold Events Newsletter with the consent of the data subject.

1. What data do we process? Email address.
2. Storage period: Until unsubscribe or withdrawal of consent.
3. Legal basis for processing: Art. 6 - the data subject has given his consent for the processing of his personal data for one or more specific purposes.

3.1.5.3. In order to carry out surveys to improve the quality of the services we offer, telephone calls may be recorded with the consent of the person concerned.

1. What data do we process? Voice of the subject.
2. Storage period: Recorded calls will be deleted within 30 days from the time of recording.
3. Legal basis for processing: Art. 6 - the data subject has given his consent for the processing of his personal data for one or more specific purposes.

3.1.6. In the REGISTER CAMPAIGN:

3.1.6.1. For the purpose of registering in the Register Campaign where the persons concerned register in a community where they receive recurring information about the latest promotions, campaigns, announcements, sales of tickets at a promotional price at the Untold Festival editions.

1. What data do we process? Name, surname, email address, phone number.
2. Storage period: Data will be anonymized upon withdrawal of consent or at most within 5 years from the last edition in which the person registered for the campaign. If the persons concerned bought a Ticket in this campaign, their personal data will be processed from this step forward in order to be able to ensure the purchased services and access to the Festival.
3. Legal basis for processing: Art. 4 (10) of PDPL - the processing is necessary for the execution of a contract to which the data subject is a party or to take steps at the request of the data subject before concluding, terminating or amending a contract.

3.1.6.2. For internal purposes only for making reports and surveys, organizing artistic moments, creating the concept of the annual event, creating campaigns and dedicated activities.

1. What data do we process? Sex, country, county, date of birth.
2. Storage period: These data are kept in the Organizer's archive without being associated with a natural person following the irreversible anonymization of personal data.
3. Legal basis for processing: Article 4(7) of PDPL - if the Processing is necessary for archival purposes or for scientific, historical and statistical studies, in accordance with the legislation in force in the State.

3.1.7. In order to ensure the security of goods, premises and people, video monitoring means are used in the perimeter of the festival.

1. What data do we process? Image of visitors from the event.
2. Storage period: 30 days. Some data may be retained for a longer period if the retention is necessary for the investigation of fraud, for the defense of the rights in court of any of the Parties or in situations where it is necessary to comply with the requests made by the competent authorities.
3. Legal basis for processing: Article 4(3) of PDPL - the Processing is necessary to initiate or defend against any actions to claim rights or legal proceedings, or related to judicial or security procedures.

3.1.8. To take photographs and videos during the event, subsequently used for journalistic, informational, commercial, marketing and promotion purposes of the event, Untold products and services or adjacent products and services, in its own name by Untold or by any partner or sponsor of the Untold Festival, as well as for the purpose of making NFT (Non-fungible token) and trading them on the relevant market.

1. What data do we process? Image of visitors from the event.
2. Storage period: Until the deletion request from the data subject or no more than 15 years from the time of completion of the edition in which they were made.
3. Legal basis for processing: Article 4(7) of PDPL - if the Processing is necessary for archival purposes or for scientific, historical and statistical studies, in accordance with the legislation in force in the State.

3.1.9. For the purpose of organising promotional campaigns and contests, as well as to ensure the sending of prizes.

1. What data do we process? Name, surname, e-mail, social media profile (if applicable), information included in comments in campaigns organised by the Organizer or in partnership with other partners.
2. Storage period: Until the expiry of the general limitation period of 3 years from the end of the campaign or contest.
3. Legal basis for processing: Article 4(3) of PDPL - the Processing is necessary to initiate or defend against any actions to claim rights or legal proceedings, or related to judicial or security procedures.

3.2. In addition to the aforementioned purposes, we process the personal data collected for the following purposes: 

1. For the fulfilment of legal obligations, as a result of the services provided (e.g. accounting, fiscal, audit, etc.), these are always compatible with the main purposes, for which the data was collected.
2. To the extent that the data subject has given their consent for the processing of their personal data for one or more specific purposes.
3. For any other purpose auxiliary to the above, or for any other purpose for which we have been provided with personal data, in compliance with the relevant legislation.
4. To protect our legitimate interests, overriding the interests or rights and fundamental freedoms of the data subject, taking into account their reasonable expectations based on the relationship with the operator:

• To conduct market research and analysis that helps improve and customize our products and services.
• For direct marketing purposes, to send communications of general interest or messages asking you to rate the quality of our services/products
• For the management of the company's activity, the creation of internal reports that are used in the organization of the access and wristband pick-up areas of future editions, to organize dedicated campaigns and activities
• To prevent or detect misuse of our intellectual property, fraud or other crimes.
• To ensure security within the event, to resolve complaints related to fraud, criminal or contravention complaints, complaints related to the sale of tickets, cases where the Organizer needs to identify a person with the ticket series, to identify if that person entered the perimeter the festival and at what time, or to defend the company's rights in court.

3.3 In the situations in which we will use your data for purposes other than those mentioned in this Policy, we undertake to obtain your consent, unless we have a legal obligation or have a different legal basis for processing the data.

3.4 The Operator does not create individual profiles for those who participate at the Untold Festival.

4.  How are we collecting your personal data?

4.1 We collect your personal data either directly from you, for example, when you create an account on our website/app, email us, via through which you request an offer/information from us, you give your consent for the communication of commercial messages, when you purchase a product, etc., or indirectly, for example, when you transmit this information on the platforms of other collaborators of our company, in the process of purchasing the ticket /subscription.

4.2 We collect your personal data automatically, when you use our services on the UNTOLD EVENTS LLC website or application, we collect information through cookies and by logging your activity. For more information on the use of cookies , please consult Art. 6 of this Policy.

4.3. If you choose to provide us with the personal data of other people, such as when you purchase tickets on behalf of others, you assume responsibility regarding the way in which you obtained this data and that you have a legal basis for processing it, we cannot be held responsible for violating the rights of the respective persons.

5. How are we storing the personal data? 

5.1 For storing the personal data you're providing as a user of our website / App, a cloud service provided by Amazon Web Services EMEA S.A.R.L. is used.

5.2 Also, the data collected in the context of on-site check-in is stored by our third party partners.

6. COOKIES

6.1 The website contains cookies (very small files are sent to the computers of website users or to other access devices).

6.2 There are two types:

6.2.1. Cookies depending on their lifespan 

a) Session Cookies 

These are temporarily stored in the cookies folder of the web browser so that it may store them until the user leaves the respective website or closes the browser window (e.g. when logging in / logging out of a webmail account or on social networks). 

b) Persistent Cookies 

These are stored on the hard drive of a computer or device (and generally depend on the default lifetime for the cookie). Persistent cookies also include those placed by a website other than the one the User is currently visiting - known as "third party cookies" - which can be used anonymously to store the interests of a User, so that the most relevant advertising for the Users could be delivered.  

6.2.2. Cookies depending on their role

a) Strictly Necessary Cookies

These types of cookies are necessary for the web pages to function properly. Strictly necessary cookies allow you to browse the website and benefit from its features. Without these cookies, we will not be able to provide certain features, such as automatic redirection to the least busy server or remembering your wish list. 

a. Functional Cookies

Functional cookies record information about the choices that users make and also allow website operators to customize the website according to user requirements. For example, cookies can be used to save category / segment preferences. 

b. Performance and Analytics Cookies

These types of cookies allow website operators to monitor visits and traffic sources, how users interact with the website or certain sections of the website. 

The information provided by the analytics cookies helps the operators to understand how the visitors use the websites and then to use this information to improve the way the content provided to the users is presented. 

c. Advertising Cookies

These cookies can provide the ability to monitor users' online activities and to create user profiles, which may then be used for marketing purposes. For example, cookies may be used to identify products and services approved by a user, and this information is then used to send appropriate advertising messages to that user.  6.3 Accessing the website implies the agreement of the users regarding placing these types of cookies on their device and accessing them on their next visit to the site. 

6.3. In general, data about internet browsing activity is collected and analyzed anonymously. If this analysis reveals a specific interest, a cookie (small text file used by most sites to store certain pieces of information useful to make the browsing experience better) - is placed on the User's computer and this cookie determines what type of advertisement the user will receive, which is called interest-based advertising. 

6.4. You can see all the cookies used by our Website in the Cookie Notification at the bottom of the page. You may withdraw your consent to the use of cookies at any time by changing the options in the appropriate cookie settings available. Setting your browser to block necessary cookies may also not work properly. Disabling other types of cookies (other than necessary) may also affect your operation or experience in using the Website. 

6.5 The Website may use or implement third-party social networking plug-ins. In general, your interaction with a plug-in allows the third party to collect some information about you, including your IP address, page header information, and browser information. The Website has implemented the following social media buttons: 

-> Facebook https://www.facebook.com/privacy 

-> Instagram https://help.instagram.com/519522125107875 

-> WhatsApp https://www.whatsapp.com/security 

6.6. The Website uses Google Analytics, a web analytics service provided by Google Inc., located at 1600 Amphitheater Parkway, Mountain View, CA 94043, United States (“Google”). Based on your consent, Google will analyze on our behalf the manner in which you use our Website. For this purpose, we use, among other things, the cookies detailed in the table above. The information Google collects about your use of the Website (e.g., the URL you submit, our web pages you visit, your browser type, language settings, operating system, screen resolution) will be sent to a Google server in the United States, where they will be stored and analyzed; the corresponding results will be subsequently made available to us in an anonymous form. In addition, Google is certified in accordance with EU-US Privacy Shield standards, which provide an adequate level of data protection with respect to the processing of data by Google in the United States. For more information about Google Analytics, please see Google Analytics Terms of Service, Google Analytics Security and Privacy Principles, and Google Privacy Policy. You can withdraw your consent to web analytics at any time by either downloading and installing a Browser Plugin provided by Google or by managing your consent through the settings above. 

7. To whom we’re disclosing your personal data?

7.1 In order to fulfill the processing purposes, the Operators disclose your personal data to partners, to third parties or entities that support the Operators in carrying out their activities, or to central/local public authorities, in the following examples listed:

1.   To our service providers and contractual partners, for example: providers of marketing (including surveys) and advertising services; our partner in charge of providing access to the Untold Festival premises; the IT service provider; courier services, payment services, banking services, payment services, ticket sales, etc. These data will be provided to the extent necessary and only under a confidentiality commitment from the contractual partners, guaranteeing that these data are kept safe and that their processing is done in accordance with the legislation in force;

2.   To the accountants, auditors, lawyers, insurers or other such external advisers of the Operator. These data will be provided to the extent necessary and only under a confidentiality commitment from the contractual partners, guaranteeing that these data are kept safe and that their processing is done in accordance with the legislation in force;

3.   Authorities, institutions and public bodies, if there is a legal request from them or to the extent there is a legal obligation from us;

4.   The operator will be able to disclose this data whenever the law requires it, or in the situation where this step is necessary to allow the exercise of the rights provided by the law and/or to be able to take legal action against any illegal activity;

5.   Your personal data may be transferred to third countries, based on the contractual relationships we have with our partners in order to produce statistics and other types of reports. We will ensure by contractual or other measures that such data enjoys an adequate level of protection there, comparable to that which it would enjoy in Dubai.

8. How long do we store your personal information?

8.1 As a matter of principle, we will process your personal data only to the extent necessary to achieve the processing purposes mentioned above. For more details about our data retention policy for certain specific processing, please review the information from Art.3.

9. Your rights related to personal data processing:

9.1. When the processing is based on consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of the processing carried out on the basis of consent before its withdrawal. You can therefore change or remove consent at any time, and we will act immediately accordingly, unless there is a legal reason or legitimate interest not to do so.

9.2. If we process your data based on our or third parties' legitimate interest, you can object to that processing for reasons related to your particular situation. In some cases, our legitimate interest or that of third parties may outweigh yours and we will not be able to accommodate your request to object to processing.

9.3. As a data subject, you benefit from the following rights:

9.3.1. Right to Access Information 

The data subject has the right to request access to the following information:

• The categories of personal data processed;
• The purpose of the processing;
• Whether the personal data is shared inside or outside the state;
• Automated decision making on his/her personal data;
• Controls or standards relating to storage of his/her personal data;
• Actions for rectification, restriction, or erasure of his/her personal data;
• Safeguards applied to his/her personal data in case of cross border data transfer;
• Actions to be taken in case of Personal Data Breach;
• Procedure to lodge a complaint with the Office.

9.3.2. Right to be Informed 

The right to inform users what kind of data is being collected on them, where it is being stored, whether it is being shared or sold to anyone, and what protective measures are in place to protect this data.

9.3.3. Right to be Forgotten 

The data subject will have the right to rectify any inaccuracy of their personal information and the right to require the data controller to erase their personal information.

9.3.4. Right to Stop Data Processing 

The data subject can exercise the right to request a data handler to cease processing their data in the following circumstances:

• Where personal data is processed for marketing purposes;
• Where the processing is for statistical survey purposes, unless the processing is essential for the reasons of public interest;
• Where the processing does not oblige with the Personal Data Protection Principles as stated under Article 5 of the PDPL.

9.3.5. Right to Rectification

Similar to the right to erasure of data collected on them, the data subject can also request the data handler to make appropriate amendments and modifications if the data collected in the information collected is outdated, inaccurate, or incomplete.

9.3.6. Right to Data Portability

The data subject has the right to receive their personal data in a structured and machine-readable format where the processing of personal data is subject to the data subject’s consent.

If you wish to exercise the rights mentioned above, please contact us in order to solve your problem using the following contact details:

● Email: [email protected]

● Address: 3F-07 Al Safiya Building, Hor Al Anz, Dubai

Please keep in mind the following aspects of interest, related to the method of analysis and response to the request for the exercise of rights:

We will make every effort to respond to your request within 30 days. This period can be extended due to reasons related to the specific legal right invoked or the complexity of your request with a maximum additional period of two months. In any case, if the legal response deadline will be extended, then we will inform you about the new deadline and the reasons that led to this extension.

10. Information security

10.1 We are working hard to protect our website, App and users, as well as all personal data collected in accordance with this Policy, from any unauthorized access or from the modification, unauthorized disclosure or destruction of the information we hold.

10.2. We guarantee that we have implemented technical and organizational measures appropriate to the processing activities they perform, in order to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure or unauthorized access to, transmission, storage or processing in any other illegal ways.

10.3. In this regard:

1. We certify that we meet the minimum requirements for the security of personal data, the data being processed in a way that provides protection against unauthorized or illegal processing and against accidental loss, destruction or damage, by taking appropriate technical or organizational measures;
2. or the data collected through the website and the App, in order to ensure access to the festival, we use a cloud service provided by Amazon Web Services EMEA SARL. Therefore, the security settings provided by Amazon are used. Access to data is done in a whitelist of security groups, which means that data can only be accessed from certain pre-defined IP addresses. Access is based on username and password, and within the organizing entities access to the database is allowed to a limited number of persons.
3. The used data storage systems have implemented back-up mechanisms to ensure the redundancy of the stored data.
4. We are regularly reviewing the practices for collecting, storing and processing information, including physical information, as well as security measures, to prevent unauthorized access to the systems.
5. We are restricting the access of our employees and contractors to your personal information, and the contractual relations with these persons are subject to strict rules regarding contractual confidentiality obligations, including under the sanction of termination of contracts.

11. When does this Privacy Policy apply? 

11.1. Our privacy policy applies to all services offered by our company and excludes services that have separate privacy policies and do not contain the provisions of this privacy policy.

12. Amendments

12.1 We will post any privacy policy changes on our page, which will take effect within one day and, if the changes are material, we will provide more prominent notice (including, for certain services, email notification of policy changes of confidentiality).

12.2. We will also keep previous versions of this Privacy Policy on file for your review at any time.

The most recent update of this Policy was made on the 05th of October, 2023.