PRIVACY NOTICE

1. INTRODUCTION

This Privacy Notice explains how Lugerinc AB (company registration number 556516-5577) (“we“, “our” or “us“) processes personal data in connection with the music festival ”Way Out West” (the “Festival“).

Individuals who attend, work at, or are granted access to the Festival are accredited through an accreditation system used to administer and manage individuals. Accordingly, this Privacy Notice applies to Festival guests and other individuals who apply for, are granted, or use accreditation for the Festival, including representatives of the music industry, media representatives, creators (influencers), volunteers, staff, suppliers, business partners, and other individuals participating in or working during the Festival.

An individual may fall within multiple roles simultaneously or at different times. For example, a volunteer may also attend the Festival as a guest. This Privacy Notice applies regardless of your role in relation to the Festival.

The purpose of this Privacy Notice is to provide information about how we process personal data, the rights you have under applicable data protection legislation, and how you can contact us if you have any questions regarding the processing.

2. DEFINITIONS

In this Privacy Notice, definitions are used in accordance with the EU General Data Protection Regulation (“GDPR“), including the terms “personal data“, “processing“, “data subject“, “controller“, and “processor“. These terms have the same meaning as set out in Article 4 of the GDPR.

3. PERSONAL DATA CONTROLLER

We are the controller of the processing of personal data carried out by us and described in this Privacy Notice. This Privacy Notice only covers our processing of personal data in connection with the Festival. Such processing is carried out in accordance with the EU General Data Protection Regulation (GDPR) and other applicable data protection legislation.

Other organisations, companies, or entities that process personal data, such as employers, suppliers, media organisations, or other parties participating in the Festival, are independently responsible for their own processing of personal data and for complying with their obligations under applicable data protection legislation. Such parties are also responsible for informing relevant individuals about the processing of their personal data and, where applicable, providing this Privacy Notice.

4. HOW WE OBTAIN PERSONAL DATA
   • Personal Data Provided by You

We primarily collect personal data directly from you when you register as a guest, apply for accreditation to the Festival, communicate with us, or otherwise provide personal data in connection with the Festival.

• Personal Data Provided by Third Parties

We may also obtain personal data from third parties. This may occur, for example, when an employer, client, supplier, business partner, media organisation, artist representative, or another organisation registers you in the accreditation system or provides your personal data to us so that you may participate in, work at, or gain access to the Festival.

Where we collect your personal data from a source other than you, we will provide you with the information required under the GDPR within the applicable timeframe, unless an exemption under applicable law applies.

5. CATEGORIES OF PERSONAL DATA WE PROCESS

We only process personal data that is necessary and relevant for the purposes described in this Privacy Notice. Depending on your relationship with the Festival, we may process different categories of personal data, including:

• Identification data (e.g. first name and last name).
• Contact details (e.g. email address, telephone number and postal address).
• Organisation and role information (e.g. employer, job title, assignment, or role in relation to the Festival).
• Accreditation and access information (e.g. information relating to applications, granted accreditation, permissions, and access to Festival areas).
• Communication data (e.g. correspondence, messages, and other information provided when communicating with us).

6. LEGAL BASIS FOR PROCESSING PERSONAL DATA

Under the GDPR, we must have a lawful basis for processing personal data. We process personal data on one or more of the following legal bases:

• Contract (Article 6(1)(b) GDPR): Processing is necessary for the performance of a contract with you, to enter into a contract with you, or to take steps at your request prior to entering into a contract.
• Legitimate Interests (Article 6(1)(f) GDPR): Processing is necessary for the purposes of our legitimate interests or those of a third party. We always carry out a balancing test to ensure that the processing does not unduly affect your rights and freedoms.
• Legal Obligation (Article 6(1)(c) GDPR): Processing is necessary for compliance with a legal obligation to which we are subject.
• Consent (Article 6(1)(a) GDPR): In certain cases, we process personal data based on your consent. You may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

In certain circumstances, we need to process personal data in order to provide our services, administer participation in the Festival, or comply with legal obligations. If you do not provide the personal data required, this may mean that we are unable to provide certain services or fulfil our obligations.

7. PURPOSES OF THE PROCESSING OF PERSONAL DATA

Below, we describe the purposes for which we process personal data, the categories of personal data processed, the lawful basis relied upon for the processing, any recipients of the personal data, and the applicable retention periods.

• Communication and Administration of the Festival

• Purpose: To manage incoming questions, requests, feedback, and other matters relating to the Festival.
• Personal Data: Identification data (e.g. name); Contact details (e.g. email address and telephone number); Communication data (e.g. the content of messages, correspondence, and other information provided when communicating with us).
• Processing Activities: Receiving, recording, managing, and following up on incoming and outgoing communications and related matters.
• Lawful Basis: Legitimate Interests – our legitimate interest in handling questions, requests, feedback, and other administrative matters relating to the Festival.
• Recipients: Providers of IT services, such as the accreditation system, communication solutions, email services, and other administrative systems used to manage communications and related matters (processors).
• Retention Period: Personal data is retained for as long as necessary to manage and follow up on the relevant matter. Personal data relating to general communications is normally retained for up to one (1) year after the communication has concluded.
  • Management of Guest Participation and the Evaluation and Development of the Festival
• Purpose: To administer and facilitate guests’ participation in the Festival and to plan, evaluate, develop, and improve the organisation and delivery of current and future festivals.
• Personal Data: Identification data (e.g. name); Contact details (e.g. email address, telephone number, and postal address); Ticket information (e.g. ticket type, booking reference number, date and time of purchase, and other information related to the ticket purchase).
• Processing Activities: Registering and administering guests’ participation in the Festival; Providing services and support to guests where necessary; Monitoring participation, ticket sales, and ticket-related trends; Producing statistics and analyses relating to ticket sales and participation; Using previously collected information where appropriate for the administration, evaluation, and planning of future festivals.
• Lawful Basis: Legitimate Interests – our legitimate interest in planning, administering, organising, evaluating, and developing the Festival.
• Recipients: Providers of IT services, communication solutions, and other services used to administer, deliver, and evaluate the Festival (processors).
• Retention Period: Personal data is retained for the period necessary to plan, administer, and deliver the Festival. Certain personal data may thereafter be retained by us for up to one (1) year following the conclusion of the Festival for administrative purposes, evaluation, analysis of ticket sales and participation, and to facilitate and improve the planning of future festivals.
  • Photography and Video Recording of the Festival
• Purpose: To document the Festival and use photographic and video material for the promotion of the Festival, future festivals, and our business activities.
• Personal Data: Photographs and video recordings in which individuals may be identified.
• Processing Activities: Taking photographs and recording video during the Festival; Storing, editing, and compiling photographic and video material; Publishing such material on websites, social media platforms, and in other marketing materials; Archiving the material.
• Lawful Basis: Legitimate Interests – our legitimate interest in documenting and promoting the Festival, future festivals, and our business activities.
• Recipients: Providers of photography, video production, communication, marketing, and IT services that process personal data on our behalf (processors), as well as members of the public when the material is published through our social media channels or other publicly accessible platforms.
• Retention Period: Photographic and video material is normally retained for up to one (1) year following the Festival. Material that continues to be used, or is considered relevant for documentation or marketing purposes, may be retained for a longer period. Material that is no longer required for these purposes will be deleted or anonymised.
  • Newsletters and Marketing
    • Distribution of Newsletters and Marketing Communications
  • Purpose: To send newsletters, event information, and other marketing communications to individuals who have chosen to receive such communications.
  • Personal Data: Email address, as well as information relating to consent and communication preferences.
  • Processing Activities: Recording consents; Managing mailing list recipients; Sending newsletters and marketing communications; Managing communication preferences.
  • Lawful Basis: Consent – the processing is based on your consent. You may withdraw your consent at any time by using the unsubscribe link included in our communications or by contacting us.
  • Recipients: Providers of email, communication, and marketing services that process personal data on our behalf (processors).
  • Retention Period: Personal data is processed until you withdraw your consent or unsubscribe from future communications.
    • Management of Unsubscribes and Suppression Lists
  • Purpose: To ensure that individuals who have unsubscribed from marketing communications do not receive further marketing communications from us.
  • Personal Data: Email address and information relating to unsubscribing and communication preferences.
  • Processing Activities: Recording unsubscribe requests; Maintaining suppression lists; Checking distribution lists against suppression lists.
  • Lawful Basis: Legitimate Interests – our legitimate interest in respecting the data subject’s choice not to receive marketing communications.
  • Recipients: Providers of email, communication, and marketing services that process personal data on our behalf (processors).
  • Retention Period: Personal data is retained for as long as necessary to ensure that the data subject does not receive further marketing communications from us.
    • Accreditation Applications, Administration and Follow-Up
  • Purpose: To manage and assess accreditation applications, administer accredited individuals and staff, manage permissions and access rights, and plan, coordinate, evaluate, and streamline participation, work-related activities, and future accreditation processes in connection with the Festival.
  • Personal Data: Identification data (e.g. name, date of birth, and profile picture); Contact details (e.g. address, email address, and telephone number); Accreditation category; Information relating to employer, organisation, role, assignment, and social media channels; and other information provided in connection with an application or registration.
  • Processing Activities: Receiving and assessing applications; Registering and administering accreditations and permissions; Communicating with applicants and registered individuals; Managing access to the Festival; Planning, coordinating, and monitoring participation and work-related activities; Administering returning accredited individuals and reusing previously registered information where appropriate to streamline future accreditation processes.
  • Lawful Basis: Legitimate Interests – our legitimate interest in planning, administering, delivering, evaluating, and developing the Festival, as well as managing accreditations, permissions, and individuals working in connection with the Festival.
  • Recipients: Providers of the accreditation platform, IT services, communication solutions, and other administrative systems used to manage accreditations, permissions, and access to the Festival (processors).
  • Retention Period: Personal data within the accreditation platform is normally deleted or anonymised no later than ninety (90) days after the Festival has concluded. For certain categories of registered individuals, some personal data may thereafter be retained by us for up to one (1) year following the Festival for administrative purposes, evaluation, and the improvement and streamlining of future accreditation processes. Personal data relating to individuals accredited under the category “Staff” is not normally retained by us outside the accreditation platform.
    • Volunteer Management and Administration
  • Purpose: To manage volunteer applications, plan and administer volunteer operations, manage permissions and access rights, communicate with volunteers, and evaluate and improve future volunteer programmes in connection with the Festival.
  • Personal Data: Identification data (e.g. name, date of birth, and profile picture); Contact details (e.g. address, email address, and telephone number); Information relating to language, country, and T-shirt size; Information regarding experience, skills, and volunteer background; Information regarding availability, preferred work areas, and group selections; Communication data (e.g. motivations, free-text responses, and correspondence); Emergency contact information; and other information provided in connection with the application process or participation as a volunteer.
  • Processing Activities: Receiving and assessing volunteer applications; Communicating with applicants and volunteers; Planning staffing, work teams, schedules, and assignments; Identifying volunteers; Managing permissions and access rights; Contacting emergency contacts where necessary; Monitoring volunteer activities and participation; Administering returning volunteers and reusing previously registered information where appropriate to streamline future volunteer administration.
  • Lawful Basis: Legitimate Interests – our legitimate interest in recruiting, administering, staffing, evaluating, and developing volunteer operations in connection with the Festival.
  • Recipients: Providers of the accreditation platform, IT services, communication solutions, and other administrative systems used to manage volunteer operations (processors).
  • Retention Period: Personal data within the accreditation platform is normally deleted or anonymised no later than ninety (90) days after the Festival has concluded. Certain personal data may thereafter be retained by us for up to one (1) year following the Festival for administrative purposes, evaluation, and the improvement and streamlining of future volunteer operations.

• Compliance with Legal Obligations and Regulatory Requirements

• Purpose: To comply with legal obligations, regulatory requirements, official decisions, and other legal requirements. This may include obligations under accounting legislation, data protection legislation (such as handling data subjects’ rights under the GDPR and reporting and managing personal data breaches), or the disclosure of information to competent authorities where required by law.
• Personal Data: The personal data necessary to comply with the relevant legal obligation or to manage the relevant matter.
• Processing Activities: Storing, documenting, disclosing, and otherwise processing personal data where required by law, regulatory decisions, or other legal requirements.
• Lawful Basis: Legal Obligation – the processing is necessary for compliance with legal obligations, regulatory requirements, official decisions, and other legal requirements.
• Recipients: Public authorities, courts, external advisers, auditors, and other recipients where required by law or by a regulatory decision.
• Retention Period: Personal data is retained for as long as required under applicable legislation or for the fulfilment of the relevant legal obligation. Accounting records are normally retained for seven (7) years following the end of the calendar year in which the relevant financial year ended.

8. RETENTION OF PERSONAL DATA

We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Notice, to comply with legal obligations, or to establish, exercise, or defend legal claims. The specific retention periods applicable to each processing activity are set out in Section 7.

When personal data is no longer required for the purposes for which it was collected, it will be deleted or anonymised in accordance with our internal procedures and applicable legislation.

9. INTERNATIONAL TRANSFERS OF PERSONAL DATA

We seek to process personal data within the EU/EEA whenever possible. In certain circumstances, personal data may be transferred to, or processed in, countries outside the EU/EEA, for example where we use providers of IT services, communication solutions, or other services necessary to plan, administer, and deliver the Festival.

Where personal data is transferred to a country outside the EU/EEA, we ensure that the transfer takes place in accordance with the GDPR and that appropriate safeguards are in place. Such safeguards may include an adequacy decision adopted by the European Commission or the European Commission’s Standard Contractual Clauses (SCCs), supplemented by additional safeguards where required.

You may contact us if you would like more information about any transfers of personal data to countries outside the EU/EEA and the safeguards applied, or if you wish to obtain a copy of the relevant Standard Contractual Clauses.

10. RECIPIENTS OF PERSONAL DATA

We disclose personal data only where necessary to administer and deliver the Festival, comply with legal obligations, or protect our rights and legitimate interests. Personal data may be shared with the following categories of recipients:

• Public Authorities: Where required by law, regulatory decision, or official request, or where necessary to prevent, detect, or investigate criminal offences, security incidents, or other irregularities.
• Processors: Service providers that process personal data on our behalf and in accordance with our instructions, such as providers of the accreditation platform, IT systems, communication solutions, support services, hosting services, and storage services. These service providers may only process personal data in accordance with our instructions and the applicable data processing agreements.
• Third Parties Acting as Independent Controllers: In certain circumstances, personal data may be shared with third parties that are independently responsible for their own processing of personal data. Such parties may include public authorities, banks, payment service providers, insurance companies, business partners, or other organisations that require the information for a legitimate purpose or where disclosure is required by law.

11. YOUR RIGHTS UNDER THE GDPR

Under the GDPR, you have the following rights in relation to the personal data that we process about you:

• Right to Information: You have the right to receive clear information about how we process your personal data, including why we process it, what categories of personal data are processed, how long the data is retained, and who may receive access to it. This information is provided in this Privacy Notice. Where we have not collected the personal data directly from you, you also have the right to receive information about the source of the personal data.
• Right of Access: You have the right to request a copy of the personal data we process about you and to obtain information about the processing, including the purposes of the processing, the recipients of the personal data, and whether the personal data is transferred to countries outside the EU/EEA.
• Right to Rectification: You have the right to request that inaccurate or incomplete personal data be corrected or completed. Where possible and unless it would involve a disproportionate effort, we will also inform recipients who have received the personal data about the rectification. You also have the right to be informed about those recipients.
• Right to Erasure (“Right to be Forgotten”): In certain circumstances, you have the right to request that we erase your personal data, for example where the personal data is no longer necessary for the purposes for which it was collected, where you withdraw your consent, or where the processing is contrary to applicable law. However, we may need to retain certain personal data in order to comply with legal obligations or to establish, exercise, or defend legal claims. Where personal data is erased, we will, where possible and unless it would involve a disproportionate effort, inform recipients who have received the personal data about the erasure. You also have the right to be informed about those recipients.
• Right to Restriction of Processing: In certain circumstances, you have the right to request that the processing of your personal data be restricted, for example if you contest the accuracy of the personal data or if the processing is unlawful but you do not wish the personal data to be erased. Where processing is restricted, we may generally only store the personal data and process it in certain specific circumstances, such as with your consent or for the establishment, exercise, or defence of legal claims. We will inform you before any restriction of processing is lifted.
• Right to Data Portability: Where our processing is based on your consent or on a contract, you may, in certain circumstances, have the right to receive the personal data that you have provided to us in a structured, commonly used, and machine-readable format. You may also have the right to have the personal data transmitted to another controller where technically feasible.
• Right to Object: You have the right to object to the processing of your personal data where the processing is based on our legitimate interests. If you object, we may only continue the processing if we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where the processing is necessary for the establishment, exercise, or defence of legal claims. You also have the absolute right to object at any time to the processing of your personal data for direct marketing purposes.
• Right Not to Be Subject to Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing, including profiling, where the decision produces legal effects concerning you or similarly significantly affects you. We do not carry out any such automated decision-making in relation to the personal data that we process.

12. HOW TO EXERCISE YOUR RIGHTS

You may contact us using the contact details provided at the end of this Privacy Notice to exercise your rights under the GDPR. Exercising your rights is free of charge unless your request is manifestly unfounded, excessive, or repetitive. In such cases, we may charge a reasonable administrative fee or refuse to act on the request.

In order to process your request, we may need to verify your identity. If we are unable to verify your identity, we may in certain circumstances be unable to process or comply with your request.

We will respond to your request without undue delay and normally within one (1) month of receiving it. If the request is complex or if we have received a large number of requests simultaneously, the response period may be extended by up to two (2) additional months. If the response period is extended, we will inform you of the extension and the reasons for it within the first month.

Certain rights apply only under specific conditions set out in the GDPR and other applicable legislation. If we are unable to comply with your request, we will inform you of the reasons for our decision.

13. CHANGES TO THIS PRIVACY NOTICE

We may update this Privacy Notice from time to time. If we make material changes that affect how we process your personal data, we will inform you where required by applicable law.

14. CONTACT DETAILS

If you have any questions about this Privacy Notice or our processing of personal data, please contact us by email at info@luger.se, by post at Folkungagatan 44, SE-118 26 Stockholm, Sweden, or by telephone at +46 (0)8 665 01 00 (Monday to Friday, excluding public holidays, 09:00–16:00 CET/CEST). We have not appointed a Data Protection Officer.

If you are dissatisfied with our processing of your personal data, you have the right to lodge a complaint with the Swedish supervisory authority, the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten – IMY), by telephone at +46 (0)8 657 61 00, by email at imy@imy.se, or by post at Integritetsskyddsmyndigheten, Box 8114, SE-104 20 Stockholm, Sweden.

If you reside in another EU/EEA country, you may also lodge a complaint with the supervisory authority in your country of residence. A list of the supervisory authorities of the EU/EEA Member States is available on the website of the European Data Protection Board (EDPB):

https://edpb.europa.eu/about-edpb/about-edpb/members_en

For Swedish version, click here.