Legal
Privacy policy
How we collect, use and protect your personal data.
Last updated: September 1, 2026
Who is responsible
This website is a university demonstration project modelled on the Ohrid Summer Festival. For the purposes of this project, the "controller" is the festival office described on the Contact page. Questions about privacy can be sent to privacy@ohridsummer.test.
What data we collect
- Account data: first and last name, email address, optional phone number, preferred language and an encrypted (hashed) password.
- Orders and tickets: event, seats, ticket categories, amounts, payment method and — for card payments — only the card type and last four digits. Full card numbers and security codes are never stored.
- Messages sent through the contact form.
- Newsletter subscriptions and the time of your consent.
- Your cookie choices, stored with an anonymous identifier and a hashed IP address.
- Anonymous page-view counts, only if you allow analytics.
Why we use it
We use your data to provide the services you request: your account, ticket sales and reservations, answers to your messages and — with your consent — the newsletter. The legal bases are the performance of a contract (tickets and account), your consent (newsletter, preference and analytics cookies) and our legitimate interest in keeping the website secure.
How long we keep it
Order data is kept for as long as accounting rules require. Contact messages are deleted after 12 months. Newsletter data is kept until you unsubscribe. You can ask us to delete your account at any time.
Your rights
You have the right to access, correct and delete your data, to restrict or object to processing, to data portability and to withdraw consent at any time — in line with the Law on Personal Data Protection of North Macedonia and the GDPR principles on which it is based. You can also lodge a complaint with the Personal Data Protection Agency.
Security
Passwords are stored only as secure hashes, all forms are protected against cross-site request forgery, and access to the administration is limited to authorised staff.