Privacy · ECHOO Nature Fest

Who is responsible

The controller of the data collected on this site is 03 Creative, Portuguese VAT number 510148662, the organisation behind ECHOO Nature Fest. For anything about your data, write to echofestmadeira@gmail.com.

What we keep and why

The free ticket

When you request a ticket we keep your name, your e-mail, the days you are coming, the language you used and the date. They tell us how many people to expect — the grounds, the buses and the cups are prepared from that —, let us send you the ticket by e-mail, and let us give it back to you if you lose it. The ticket carries a QR code that lets us confirm on the day that we issued it; the code holds no personal data, only the ticket number and a signature.

Each ticket belongs to one person. A child is registered with an adult's e-mail, and the adult accepts this policy on their behalf.

We do this on the basis of our legitimate interest in organising the festival safely and with the right resources (Article 6(1)(f) GDPR).

At the entrance, at the activities that need booking and as you board the bus, the team scans the QR code with a phone and records the time you came in (and, at activities, that you attended; on the bus, that you boarded). This tells us how many people are on site and stops the same ticket from entering twice. To work without signal in the hills, the team's phones keep, during the festival, the list of tickets, bookings and bus tickets (number, name, days, activity or trip, and number of seats) and the entry times already recorded — no e-mails — and delete it at the end.

Photographs and videos

Photographs and videos are taken during the festival. When you request a ticket, book an activity or book a bus ticket you accept this policy, which includes the following permission: “I allow photographs and videos taken during the festival in which I appear to be used in ECHOO Nature Fest communication — website, social media and press.” The basis is the festival's legitimate interest in documenting and promoting the event (Article 6(1)(f) GDPR). You always have the right to object: if you do not want to appear, tell us at the entrance or write to us, and we will not use images in which you can be identified; if one is already published, we take it down when you ask.

News by e-mail (optional)

If you tick that permission, we keep your e-mail on a list to send you festival news — programme, bookings, buses, future editions. This is also consent: optional, and you can unsubscribe whenever you like, by writing to us or using the link in every e-mail. We never sell or hand the list to anyone.

Activity bookings and payments

When you book an activity or workshop we keep your name, your e-mail, the activity, the number of places, the language and the date — and, for paid activities, the amount paid and the payment identifier at Stripe. They let us hold your place, send you the booking by e-mail with its QR code, and know whom to expect at each activity. This is what is needed to carry out what we agreed with you (Article 6(1)(b) GDPR).

Payment is made at Stripe: that is where you enter your card details, which never pass through our site and are never stored by us. Stripe sends you a receipt and keeps the payment record for as long as it is required to.

A confirmed booking is linked to your entry ticket. If you do not have one yet, we issue one in your name with the same details (name, e-mail, activity day) and with the same acceptance of this policy; you join the news list only if you tick that box when booking. If you already have one for a single day, it becomes valid for both. This ticket is deleted by 31 December 2026, like the others.

If you ask for an invoice, we also keep your Portuguese tax number (NIF), only so that 03 Creative can issue it. The invoice is issued by 03 Creative within 2 to 3 working days and sent to your e-mail. Invoicing records are kept for the period tax law requires (10 years).

Bus tickets

When you book a bus ticket we keep your name, your e-mail, the trips you chose (day, direction and time), the number of seats on each, the language and the date — and, for paid trips, the amount paid and the payment identifier at Stripe. They let us hold your seats, send you the tickets by e-mail, with one QR code per trip, and know whom to expect on each bus. This is what is needed to carry out what we agreed with you (Article 6(1)(b) GDPR).

Payment is made at Stripe, as for activities: your card details never pass through our site. If you enter your Portuguese tax number (NIF) to get an invoice, we keep it on the same terms as for paid bookings.

The passenger list for each trip — name and number of seats only — is shared with the transport company hired by the festival, so that it knows whom it is carrying on each trip. Your e-mail, tax number and payment details are not handed over.

The free 09:20 trip up on Saturday is only for those booked on the Tree planting: to confirm it, we look for a confirmed booking for that activity with the same e-mail. A bus ticket is not an entry ticket, and does not issue one: festival entry is requested separately.

Artist applications

The open-call application form sends what you write, by e-mail, to the organisation, through the Web3Forms service. That data is used only to assess the application and reply to you, and stays in the organisation's mailbox.

For how long

Ticket records are deleted by 31 December 2026, together with the entry times recorded at the gate.
Free activity bookings are deleted by 31 December 2026. Paid ones lose the name and e-mail from then on; the payment record and the invoice, if any, are kept for the tax period (10 years).
Bus tickets follow the same rule as bookings: free ones are deleted by 31 December 2026, paid ones lose the name and e-mail from then on, and the boarding times recorded go with them.
Published photographs and videos stay for as long as they are useful to festival communication, or until you ask us to take them down. Your acceptance of this policy is recorded with the entry ticket (date and text version) until that record is deleted; for a booking or a bus ticket, the version accepted is the one published on that date.
If you want e-mails: your address stays on the list until you unsubscribe.
To prevent abuse, the site keeps for one hour a code derived from the Internet address of whoever makes requests — never the address itself.

Who else handles the data

Nobody uses it for other purposes. For the site to work, it passes through these providers, all bound by GDPR contracts:

Vercel — hosts the site and runs the code that issues tickets, in Frankfurt (European Union).
Neon — the database where ticket records are stored, in Frankfurt (European Union).
Resend — sends the e-mail with your ticket, booking or bus tickets (name, e-mail and number), from servers in Ireland (European Union). The company is based in the United States.
Stripe — takes the payments for activities and bus tickets. It handles the card details, the e-mail and the amount, from Ireland (Stripe Payments Europe); the parent company is based in the United States and is covered by the EU-US Data Privacy Framework. We never see the card number.
The transport company hired by the festival — receives the passenger list for each bus trip: name and number of seats, and nothing else.
Web3Forms — delivers artist applications by e-mail.
Google Fonts — the site's typefaces are served by Google, which therefore receives the Internet address of each visitor. It receives nothing else.

Cookies and visit counting

The public site uses no cookies. Only the admin panel, reserved for the organisation, uses a session cookie to know who is signed in.

We count visits ourselves, with no third-party tools: for each page viewed we keep the page, the day, where the visit came from (the domain only, for example "instagram.com"), whether it was on a phone or a computer, and the language. To tell whether the same person comes back on the same day, we use a code computed from the Internet address and the browser; it is never stored, cannot be traced back to the address, and expires at the end of the day. None of this identifies anyone.

On the ticket, we also record whether the PDF was downloaded and whether the QR code was read, and when.

Your rights

At any time you can ask us: to see the data we hold about you; to correct it; to delete it; to stop using it for a given purpose; to receive it in a file; and to withdraw any permission you gave. Just write to echofestmadeira@gmail.com from the e-mail you used to register. We reply within one month.

If you believe we have not handled your data properly, you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (cnpd.pt).

Changes

If this policy changes, the date below changes, and the new text applies from then on.

Version of 28 September 2026.

← Back to the festival