NO GUESTLIST will process personal data via the following principles: (i) in a manner that is lawful, proper, and transparent with regard to the data subject, (ii) for specified, explicit and legitimate purposes, (iii) in a relevant way and limited to what is necessary for the purposes for which the data is intended; (iv) the data will be accurate and, if necessary, updated, (v) the data will be kept in a format that makes it no longer possible to identify you other than for the purposes for which the personal data has been processed, (vi) all appropriate technical or organisational measures will be taken to ensure the personal data is processed in such a way as to ensure adequate security and that it is protected against unauthorised or unlawful processing and against unintentional loss, destruction or damage.

Within the NO GUESTLIST group, your personal data is only accessible to employees who need access to it in the context of carrying out their work. These employees are bound by strict internal rules regarding the processing of personal data. When NO GUESTLIST BV relies on external parties for the purpose of processing personal data, this will only be parties that provide sufficient guarantees to ensure the processing complies with the legal requirements and guarantee your rights will be relied upon. Your personal data can be transferred to the following categories of recipients: IT suppliers, consultants, marketing companies or SAAS companies.

11. Finally

NO GUESTLIST will process personal data via the following principles: (i) in a manner that is lawful, proper, and transparent with regard to the data subject, (ii) for specified, explicit and legitimate purposes, (iii) in a relevant way and limited to what is necessary for the purposes for which the data is intended; (iv) the data will be accurate and, if necessary, updated, (v) the data will be kept in a format that makes it no longer possible to identify you other than for the purposes for which the personal data has been processed, (vi) all appropriate technical or organisational measures will be taken to ensure the personal data is processed in such a way as to ensure adequate security and that it is protected against unauthorised or unlawful processing and against unintentional loss, destruction or damage.

Within the NO GUESTLIST group, your personal data is only accessible to employees who need access to it in the context of carrying out their work. These employees are bound by strict internal rules regarding the processing of personal data. When NO GUESTLIST BV relies on external parties for the purpose of processing personal data, this will only be parties that provide sufficient guarantees to ensure the processing complies with the legal requirements and guarantee your rights will be relied upon. Your personal data can be transferred to the following categories of recipients: IT suppliers, consultants, marketing companies or SAAS companies.

10. Our obligations with respect to this processing

You have certain rights and choices in relation to the personal data we collect from you.

Within the limits defined in articles 15-22 of the GDPR, you have (amongst others) the following statutory rights regarding your personal data:

- Right of access: You have the right to obtain confirmation from us as to whether or not we are processing your personal data, to access that personal data and understand how and why it is being processed, and to receive a copy of that data.

- Right to rectification: You have the right to obtain correction of your personal data or to request that we complete your personal data if you notice that we are processing inaccurate or incomplete information about you.

- Right to erasure: You have the right to have your personal data deleted without unreasonable delay from ONTHEBEACH in case of the following: (i) the personal data is no longer required for the purposes for which it was collected, (ii) the consent on which the processing is based has been withdrawn; (iii) you object to the processing due to a general or legitimate interest justification, or pertaining to direct marketing, (iv) the personal data has been processed unlawfully, (v) the personal data must be deleted in order to comply with a legal obligation, (vi) the data has been obtained in connection with an offer of services from the information society to a child.

- Right to object to direct marketing: You have the right to object to the processing of your personal data for direct marketing purposes. This right is absolute, and we will always comply with it.

- Right to data portability: You have the right to obtain the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transfer that personal data to another data controller.

- Right to object: You have the right to object, for reasons relating to your particular situation, to the processing of your personal data based on our legitimate interests.

- Right to limited processing: You have the right to limit the processing of your personal data if (i) you dispute the accuracy of the personal data, (ii) the processing is unlawful and you oppose the erasure of the personal data, (iii) we no longer need your data for the processing purposes, but you still need them for the institution, exercise or substantiation of an action, (iv) you have objected to the processing on the grounds of the legitimate interests of NO GUESTLIST.

You may send a request to hello@25yearscultureclub.be or a letter to the NO GUESTLIST BV, FAO privacy controller, Verschansingstraat 46, 2000 Antwerp for access, correction, deletion, data transfer or limitation of your personal data or a request to withdraw your consent or objection to the processing of your personal data.

To ensure that the request for inspection has been made by you, we ask that you enclose a copy of your identity card with the request. In this copy, make your passport photo, MRZ (“machine readable zone”, the strip with numbers at the bottom of the passport), passport number and national register number black. This is to protect your privacy.

NO GUESTLIST is committed to responding as quickly as possible, and at least within 30 days, to your request. In the event the complexity and/or number of requests would require an extension of this term, NO GUESTLIST shall inform you, within (30) days of the receipt of your request, of the extension of this term (which shall not exceed two months), together with the reasons for the extension.

NO GUESTLIST would also like to draw your attention to the fact that you have the possibility of lodging a complaint with the national supervisory authority. This can be done via the following contact details:

Gegevensbeschermingsautoriteit, Drukpersstraat 35, 1000 Brussels, Belgium

Telephone: +32 (0)2 274 48 00 and +32 (0)2 274 48 35

Email: contact@apd-gba.be

9. What rights do you have?

NO GUESTLIST recognises the importance of protecting your personal data and undertakes to keep your personal data confidential. NO GUESTLIST has established a variety of technical and organisational measures to help protect your personal data. We have implemented appropriate data collection, processing practices and security measures to protect against unauthorized access, alteration, disclosure, or destruction of any personal data.

8. Protection of your personal data

NO GUESTLIST, does not transmit personal data except as described below. We may share personal data with:

· External service providers: Service providers and third parties assisting us with ticketing, event management, other event-related services, technical services, IT service providers, payment service providers, marketing and advertising partners, security service providers, catering and hospitality providers, etc.

· Professional advisors: Such as external accountants, auditors, lawyers, or other professional consultants who provide services to support our business operations.

· Partners: Partners of our events, such as sponsors (pictures and videos of the event to be used on social media and websites to promote the event).

· Authorities: Authorities, such as regulatory authorities, courts, tribunals, and governmental bodies. Note that, if the government carries out an investigation, we may share your personal information with the government if required by law. We may also disclose your personal information when absolutely necessary to prevent, detect or prosecute criminal activity.

· Group companies: Companies belonging to the group of companies to which NO GUESTLIST belongs.

Note: This list is not exhaustive. There may be other situations where we need to share personal data with third parties to provide our services as effectively as possible.

NO GUESTLIST reserves all rights to share personal data in case the company or its assets are being sold or transferred. Should such a sale or transfer occur, we will make reasonable efforts to induce the transferee to use the personal information you provide to us in a manner consistent with our privacy statement.

We process your personal data in the EU and in principle do not transfer any of your personal data outside the EU.

7. With whom do we share your data?

Your personal data is kept for as long as necessary to achieve the purpose for which it was collected, in line with the legal, regulatory, and internal requirements in this regard, and no longer than 10 years. This does not affect your rights as shown below in paragraph 9.

6. How long will your personal data be processed and stored?

We rely on the following legal bases for processing your personal data:

· Contractual necessity: Processing is necessary for the performance of a contract;

· Legal obligations: Processing is necessary to comply with legal obligations;

· Legitimate interests: Processing is necessary for our legitimate interests, in particular to promote our events, including online and on social media; and

· Consent: Your consent for specific purposes, such as direct marketing.

5. On what basis do we process these data?

We will use the personal data you provide us with for the following purposes:

4.1. For the performance of our contract with you

When you buy a ticket, we process your personal data to be able to process the purchase of your event tickets and manage registrations, follow up on payments, ensure the safety and security of our event attendees, and communicate with event visitors, for example communication of practical information.

During the event, we use your personal data to, among other things, prevent fraud and to verify compliance with applicable regulations regarding the serving of alcoholic beverages.

NO GUESTLIST also uses personal data to support and manage supplier relationships as well as customer relationships.

4.2. To comply with our legal obligations

We may collect and process your personal data to comply with our legal obligations (for example our obligations with regard to security, protection of consumer health with respect to food and beverages, and responding to lawful requests from competent regulatory or judicial authorities).

4.3. For marketing purposes and promotional services

Subject to your consent, we will collect and process personal data to contact you with information or offers regarding our upcoming events, products, or services – this may be via email, via push and web notifications, via SMS, or social media platforms.

Photographs and videos taken during the event may be used as part of our promotional materials and shared on our official social media channels and website, as well as on social media channels and websites of our partners. This is to enhance the event experience and promote future events.

4.4. For security reasons

NO GUESTLIST may process your personal data to ensure security at the event site.

4.5. To improve our services

NO GUESTLIST may process your personal data to improve our services and enhance the NO GUESTLIST experience in the future.

NO GUESTLIST will collect, use, or disclose personal data solely for the purposes disclosed to you, unless the disclosure:

· is for an additional purpose that is directly related to the original purpose for which the personal data was collected;

· is necessary to prepare, negotiate or perform a contract with you, or is required by law or by the competent governmental or judicial authorities; or

· is necessary to establish, exercise, or defend a legal claim.

4. Why do we process your personal data?

NO GUESTLIST collects personal data obtained directly from you or via third parties through (i) contracts that connect you to us (directly or indirectly), (ii) voluntary disclosure thereof by the person concerned (whether or not through contact forms), (iii) commercial activities in which you participate, (iv) the use of our website and social media (containing the related technologies, such as cookies, for which we refer to our cookie policy), (v) by you visiting one of the events we organize, (vi) third-party partners, and (vii) publicly available sources.

The categories of data processed varies depending on your interaction with us:

· You purchased a ticket to attend an event organised by NO GUESTLIST:

We will collect and process your contact information (name, age, email address), billing information and number of tickets bought;

At the event, we use the data linked to your ticket to verify your identity as a fraud prevention measure and to confirm the authenticity of your ticket. We may also verify your age during the event to ensure compliance with applicable regulations regarding the serving of alcoholic beverages;

When you attend NO GUESTLIST, we may collect your information via video surveillance cameras (we use signs indicating the use of such cameras) and during the event, we may capture photographs and videos of attendees to document, promote and celebrate the event.

· You are a visitor to our website:

We collect information such as the browser and device you are using, your IP address, your location, the site you came from, what you did and did not use our site/app for, or the site you visit when you leave us. For more information on how we collect this information, see our Cookie Policy.

· You are a supplier:

We collect and process contact information (name, address, telephone number and/or e-mail address.

· You do not wish to share any personal data?

Consequences of not providing personal data? The provision of personal data is a prerequisite to enter into an agreement. Failing to provide your personal identification data will result in no access being provided to the event site.

· Optional data

Where certain personal data is optional, we will make it clear that providing such information is voluntary, allowing you to choose whether to share it with us. This Privacy Statement does not apply to the processing of anonymous or company data.

3. What categories of personal data do we process and where do we get this data?

NO GUESTLIST BV, with registered seat's address at Verschansingstraat 46, 2000 Antwerpen (Belgium-, and with company number 0834.242.857 (hereinafter: “NO GUESTLIST”), is the controller of your personal data.

This means NO GUESTLIST is responsible for determining the purposes and means of processing of personal data it processes about its customers, prospective customers, suppliers, and website visitors in accordance with the provisions set forth in this privacy policy.

Our contact details are:

NO GUESTLIST BV

Verschansingstraat 46

2000 Antwerpen
hello@25yearscultureclub.be

2. Who are we?

We (NO GUESTLIST BV) attach great importance to your right to privacy and make every effort to protect your personal data in accordance with the applicable data protection legislation, in particular the General Data Protection Regulation, i.e. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”) as well as all applicable national regulations.

The purpose of this privacy policy is to describe

- which personal data we collect from you,

- for which purposes we process this data,

- on which legal basis we rely for such processing,

- to whom your personal data may be disclosed,

- how long we retain your data,

- how we protect your data, and

- what rights you have in relation to the processing of your personal data.