Last updated: January 5, 2026

This Privacy Policy explains how Paradise City BVBA (“Paradise City”, “we”, “us”) processes personal data when you visit our website, subscribe to our communications, purchase tickets, attend the festival or contact us.

1. Who is responsible?

Data controller
Paradise City BVBA
Clovislaan 23, 1000 Brussels, Belgium
Company number: 0422.500.029
Email: info@paradisecity.be

For any privacy-related questions, please contact us at info@paradisecity.be with the subject “Privacy”.

2. Which personal data do we process?

Depending on your interaction with us, we may process the following categories of personal data:

A. Website usage

• IP address (anonymised where possible)
• device and browser information
• visited pages, date and time
• cookie identifiers

B. Contact and customer support

• name
• email address
• (optional) phone number
• content of your message or complaint

C. Ticketing and payments

• name and email address
• order and ticket details
• order ID
• payment status and payment method. (Payment details themselves are processed by our payment and ticketing partners.)

D. Festival operations

• ticket validation (entrance scans)
• operational and security-related information
• incident and complaint records

E. Food and Drink Credits / cashless

• festival wristband or account ID
• transactions and balance
• bank account number solely for refunds

F. Marketing and communication

• email address for newsletters
• marketing preferences
• participation in contests or promotions

G. Image and sound

• photographs and video recordings taken on the festival grounds (crowd and atmosphere footage)
• We do not intentionally collect sensitive personal data. If such data is nevertheless voluntarily provided, we limit its processing to what is strictly necessary.
   

3. Why do we process personal data, and on which legal basis?

We only process personal data when a valid legal basis applies:

• Performance of a contract (ticket sales, cashless systems, customer support)
• Legitimate interest (website security, festival organisation, promotional reporting, fraud prevention)
• Consent (newsletters, marketing cookies, marketing communications)
• Legal obligation (accounting, tax and administrative obligations)
   

4. With whom do we share personal data?

Personal data may be shared with:

• ticketing and payment partners (Paylogic)
• IT, hosting and security providers
• mailing and communication platforms
• analytics and marketing partners (only where permitted)
• cashless and festival operations partners
• competent authorities where legally required
• Where required, data processing agreements are concluded with processors.
   

5. Transfers outside the EEA

If personal data is processed outside the European Economic Area, it will only occur with appropriate safeguards in place, such as Standard Contractual Clauses or an adequacy decision.

6. Retention periods

We do not retain personal data longer than necessary for the purposes for which it was collected:

• Ticketing and invoicing data: 7 years (statutory accounting obligation)
• Customer service and complaints: 2 to 3 years after resolution
• Newsletter and marketing data: Until you unsubscribe.
• Website and analytics data: 12 to 14 months
• Food and Drink Credits / cashless data: 12 to 24 months (for settlement, refunds and disputes)
• Access logs (ticket scans): 30 to 90 days after the event
• Security logs: 6 to 12 months
• Incident and security reports: 3 to 5 years, depending on severity and potential liability
• Contests and promotions: participants: 6 months after the promotion ends. Winners: 1 to 2 years
   

7. Cookies

We use necessary cookies and, subject to consent, analytical and marketing cookies. More information is available in our Cookie Statement, where you can also manage your preferences.

8. Security

We implement appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. Absolute security can never be guaranteed.

9. Your rights

You have the right to:

• access your personal data
• rectify inaccurate data
• request deletion of data
• restrict processing
• object to processing
• data portability
• withdraw consent (where applicable)
• You can exercise these rights by contacting info@paradisecity.be. To prevent misuse, we may request proof of identity.
• Image and video material at the festival: If you are recognisably depicted and have a serious objection based on valid arguments, you may contact us with as much detail as possible (date, location, context). Each request is assessed on a case-by-case basis, and there is no guarantee for deletion from our accounts.
   

10. Minors

Our website, services, and events are intended exclusively for persons 18 years of age or older. We do not knowingly collect personal data from minors. If you believe we are processing data relating to a minor, please contact us.

11. Complaints

If you believe your rights are not respected, you may lodge a complaint with the Belgian supervisory authority:

Belgian Data Protection Authority (GBA/APD)
Drukpersstraat 35
1000 Brussels, Belgium

12. Changes

We may update this Privacy Policy from time to time. The most recent version is always available on our website and will indicate the date of the latest update.