In accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), we hereby inform you about how we collect, process, and protect your personal data when you use the vetafestival.com website.

1. Data Controller Identity

• Company Name: VETA MINERAL S.L.
• Tax ID (CIF): B75853978
• Registered Address: Francisco Merino Bravo 5, 34820 Barruelo de Santullán, Palencia, Spain
• Contact Email: info@vetafestival.com

2. Types of Data Collected

While using our Website, we may ask you to provide us with certain personally identifiable information. We collect data through two distinct operational flows:

• Physical Merchandise (Online Store): When purchasing physical products through our WooCommerce store, we collect your first and last name, email address, phone number, and complete billing and shipping addresses.
• Festival Ticketing (Resident Advisor): We do not sell tickets directly on our servers. When purchasing a ticket, you are redirected to the external platform Resident Advisor (RA). RA acts as an independent Data Controller for the financial transaction and collects your payment data under their own Privacy Policy. Subsequently, RA transfers your basic identification and contact data (name, email, phone) to VETA MINERAL S.L. strictly for event management purposes. We do not receive or store your credit card or financial details.
• Usage Data & Cookies: We automatically collect data regarding your device, IP address, and browsing activity. Detailed information on cookie management can be found in our integrated Cookie Policy management tool.

3. Purpose of Processing and Legal Basis

VETA MINERAL S.L. processes your Personal Data for the following purposes, relying on the corresponding legal bases:

• E-commerce Fulfillment: To process, ship, manage, and invoice your physical merchandise orders. Legal basis: Execution of a contract (Art. 6.1.b GDPR).
• Event Management and Access Control: To validate tickets, manage venue access, ensure security, and send essential operational communications regarding the festival (e.g., schedule changes, access rules). Legal basis: Execution of a contract (Art. 6.1.b GDPR).
• Legal and Tax Obligations: To comply with Spanish tax, accounting, and consumer protection regulations. Legal basis: Compliance with a legal obligation (Art. 6.1.c GDPR).
• Commercial Communications: To send you newsletters, special offers, or information about future festival editions, provided you have expressly opted in during the checkout or registration process. Legal basis: Your explicit consent (Art. 6.1.a GDPR).

4. Data Disclosure and Third Parties

Your personal data will not be sold, rented, or transferred to third parties for commercial use. We only share your data in the following circumstances:

• Service Providers: We share necessary details with trusted third parties to execute the contract, such as logistics and courier companies for merchandise delivery, secure payment gateways (e.g., Stripe, PayPal), and web hosting providers.
• Legal Authorities: We may disclose your data if required to do so by law or in response to valid requests by public authorities (e.g., courts or law enforcement agencies).

5. Data Retention Period

Personal data will be retained strictly for the duration necessary to fulfill the purposes outlined in this Privacy Policy. Once the commercial relationship has ended or the event has concluded, your data will be securely blocked and retained only for the legally established periods under Spanish civil and tax law (generally up to 5 years) to address any potential legal liabilities or claims. After this statutory limitation period, the data will be permanently deleted.

6. Your Data Protection Rights

Under the GDPR and LOPDGDD, you hold the following rights regarding your personal data:

• Right of Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can request the correction of inaccurate or incomplete data.
• Right to Erasure (Right to be Forgotten): You can request the deletion of your data when it is no longer necessary for the purposes collected.
• Right to Restriction of Processing: You can request that we temporarily suspend the processing of your data under specific circumstances.
• Right to Data Portability: You can request your data in a structured, commonly used, and machine-readable format.
• Right to Object: You can object to the processing of your data for direct marketing purposes at any time.

To exercise any of these rights, please send an email along with a copy of a valid identification document to: info@vetafestival.com.

Right to lodge a complaint: If you believe that our processing of your personal data infringes data protection laws, you have the right to file a complaint with the Spanish Data Protection Agency (AEPD – Agencia Española de Protección de Datos) via their official website: www.aepd.es.

7. Data Security

The security of your Personal Data is a priority. VETA MINERAL S.L. implements appropriate technical and organizational measures to protect your data against unauthorized access, loss, destruction, or alteration, including SSL encryption for data transmission. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

8. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect legal, technical, or operational changes. Any modifications will be published on this page, and the “Last updated” date will be revised accordingly. We advise you to review this page periodically.