In accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), we hereby inform you about how we collect, process, and protect your personal data when you use the vetafestival.com website.

1. Data Controller Identity

• Company Name: VETA MINERAL S.L.
• Tax ID (CIF): B75853978
• Registered Address: Francisco Merino Bravo 5, 34820 Barruelo de Santullán, Palencia, Spain
• Contact Email: info@vetafestival.com

2. Types of Data Collected While using our Website, we may ask you to provide us with certain personally identifiable information. We collect data through distinct operational flows:

• Physical Merchandise (Online Store): When purchasing physical products through our WooCommerce store, we collect your first and last name, email address, phone number, and complete billing and shipping addresses.

• Festival Ticketing (Resident Advisor): We do not sell tickets directly on our servers. When purchasing a ticket, you are redirected to the external platform Resident Advisor (RA). RA acts as an independent Data Controller for the financial transaction and collects your payment data under their own Privacy Policy. Subsequently, RA transfers your basic identification and contact data (name, email, phone) to VETA MINERAL S.L. strictly for event management purposes. We do not receive or store your credit card or financial details.

• Newsletter & Ticket Notifications: When you subscribe through our web form to receive ticket release alerts and festival news, we collect your name, email address, zip/postal code, and the IP address along with the timestamp to record your explicit consent.

• Usage Data & Cookies: We automatically collect data regarding your device, IP address, and browsing activity. Detailed information on cookie management can be found in our integrated Cookie Policy management tool.

3. Purpose of Processing and Legal Basis VETA MINERAL S.L. processes your Personal Data for the following purposes, relying on the corresponding legal bases:

• E-commerce Fulfillment: To process, ship, manage, and invoice your physical merchandise orders. Legal basis: Execution of a contract (Art. 6.1.b GDPR).

• Event Management and Access Control: To validate tickets, manage venue access, ensure security, and send essential operational communications regarding the festival (e.g., schedule changes, access rules). Legal basis: Execution of a contract (Art. 6.1.b GDPR).

• Legal and Tax Obligations: To comply with Spanish tax, accounting, and consumer protection regulations. Legal basis: Compliance with a legal obligation (Art. 6.1.c GDPR).

• Commercial Communications & Alerts: To notify you about ticket releases, send festival newsletters, and provide location-relevant information based on your zip code. This applies when you have expressly opted in via our subscription forms or checkout process. Legal basis: Your explicit consent (Art. 6.1.a GDPR).

4. Data Disclosure and Third Parties Your personal data will not be sold, rented, or transferred to third parties for commercial use. We only share your data in the following circumstances:

• Service Providers: We share necessary details with trusted third parties to execute the contract, such as logistics and courier companies for merchandise delivery, secure payment gateways (e.g., Stripe, PayPal), and web hosting providers.

• Email Marketing Platforms: We use third-party email service providers to manage our mailing lists and send communications. If these providers process data outside the European Economic Area (EEA), such as in the United States, we ensure the transfer is legally protected by frameworks like the EU-US Data Privacy Framework (DPF) or Standard Contractual Clauses (SCCs).

• Legal Authorities: We may disclose your data if required to do so by law or in response to valid requests by public authorities (e.g., courts or law enforcement agencies).

5. Data Retention Period Personal data will be retained strictly for the duration necessary to fulfill the purposes outlined in this Privacy Policy. Once the commercial relationship has ended or the event has concluded, your data will be securely blocked and retained only for the legally established periods under Spanish civil and tax law (generally up to 5 years) to address any potential legal liabilities or claims. After this statutory limitation period, the data will be permanently deleted. For data processed strictly on the basis of your consent (such as mailing list subscriptions and ticket notifications), your personal data will be kept until you withdraw your consent or unsubscribe using the automated link provided in every email communication.

6. Your Data Protection Rights Under the GDPR and LOPDGDD, you hold the following rights regarding your personal data:

• Right of Access: You can request a copy of the personal data we hold about you.

• Right to Rectification: You can request the correction of inaccurate or incomplete data.

• Right to Erasure (Right to be Forgotten): You can request the deletion of your data when it is no longer necessary for the purposes collected.

• Right to Restriction of Processing: You can request that we temporarily suspend the processing of your data under specific circumstances.

• Right to Data Portability: You can request your data in a structured, commonly used, and machine-readable format.

• Right to Object: You can object to the processing of your data for direct marketing purposes at any time.

To exercise any of these rights, please send an email along with a copy of a valid identification document to: info@vetafestival.com. Right to lodge a complaint: If you believe that our processing of your personal data infringes data protection laws, you have the right to file a complaint with the Spanish Data Protection Agency (AEPD – Agencia Española de Protección de Datos) via their official website: www.aepd.es.

7. Data Security The security of your Personal Data is a priority. VETA MINERAL S.L. implements appropriate technical and organizational measures to protect your data against unauthorized access, loss, destruction, or alteration, including SSL encryption for data transmission. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

8. Changes to this Privacy Policy We may update this Privacy Policy from time to time to reflect legal, technical, or operational changes. Any modifications will be published on this page, and the “Last updated” date will be revised accordingly. We advise you to review this page periodically.