Privacy Policy

The data controller responsible for processing your personal data is:

We have not appointed a Data Protection Officer (DPO) — our processing does not meet the thresholds in GDPR Art. 37. You can reach the controller directly at the email above.

When you buy a pass or a hotel pack, you buy it in the seller’s own shop (which opens inside this website), not from this website itself: passes from Casa Luna's ticket shop and hotel packs from Casa Luna's ticket shop. That shop collects your order and payment details, and its own terms and privacy notice apply to the purchase. Any order details it passes to us (such as your name, email and pass) are used only to run the festival and let you in.

The shop opens inside this website (on the Tickets page); you pay on the card-payment page and come back here. To show your tickets in My Ticket, this site reads them from Casa Luna's ticket shop’s ticket system when you sign in: for each ticket bought with or for your email, the holder’s name, the ticket’s name and order number, the dance role, whether it has been checked in, and its QR code. We keep a short-lived copy so My Ticket still works if that system is briefly unreachable. Phone numbers, gender, passport and residence details from your order are not copied. The copy is deleted 30 days after the festival.

When you sign in with Google or Apple (for the attendee account, admin tools, or onboarding wizard), we receive from the provider:

• Email address
• Display name and profile picture (where the provider returns them)
• A signed authentication token, stored in a session cookie

You can also sign in with a one-time email code (attendee accounts), without Google or Apple. In that case we use:

• Your email address, and a 6-digit code we send to it — the code is stored only as a one-way hash, can be used once, and expires after 10 minutes
• A signed authentication token, stored in a session cookie (as above)

If you bought a ticket with a different email, you can add that address to your account to see its ticket — confirmed by the same kind of one-time code. You can remove a linked address at any time, and it is erased when you delete your data.

If you opt in to the attendee directory or social features, we additionally store:

• The profile fields you choose to share (city, dance level, social handles, and an optional profile photo — visible only to people you connect with)
• Your connections, pending connection requests (incoming and outgoing), connection invite links, and the sessions you star on the schedule
• In-app notifications you receive (e.g. “X wants to connect”), which include the display name of the attendee who triggered them
• Push-notification subscription tokens (where you grant push permission)
• Reviews you submit after the festival (a star rating, an optional written review, and an optional display name). Once an organizer approves it, the review — including the display name you enter — is published publicly on our Reviews page and is kept until erased (see Sections 6 and 7). If you are signed in when you submit, we also store a one-way hash of your account email with the review so that deleting your data also removes your reviews.

If you join Social Stars (on My Page, by ticking the box), we create your Social Stars account: we store your email, when you joined, the version of the text you agreed to and the festival you joined at, and we will share that account with the Social Stars platform and the Social Stars festivals you sign in to, so your dance profile, connections and saved sessions can come with you. Joining is optional and nothing else changes if you don’t. You can leave on My Page at any time, and Delete my data removes it too. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw by leaving.

If you volunteer, work or perform at the festival and sign in with the email the organiser has for you, the Schedule tab can show you your own shifts or sessions. We store a one-way hash of your email (not the address itself) and, for each shift, only its day, time, role and place; for an artist, which artist you are. Only you can see your schedule, and it never shows other people’s names. It is deleted 7 days after the festival. A copy is saved on your device so it works offline, and it is removed when you sign out.

When you apply to hold private lessons (the Apply to hold privates form), we collect:

• Your name (or both names, if you teach as a couple) and your Instagram handle
• The country you’re from and, if you give them, your city and whether you dance as a leader, follower or both
• What you teach (bachata, kizomba or both) and which days you can hold privates
• The link you send to a video of your dancing (Google Drive, Instagram or YouTube) — we store the link, not the video
• What you tell us about you and your teaching, and whether you’ve been to La Luna or a Casa Luna event before
• You sign in to send it, with Google or a one-time email code. The application is saved with that account (and your profile name), so you can update it until applications close, and we store the account’s email address to answer you by email. One application per account.
• A photo of yourself. We remove location and device data from it and store it with our hosting provider (Vercel Blob). You choose whether it is shown on your listing. The photo also becomes your La Luna profile photo: a small copy, visible only to people you connect with in the festival app. You can change or remove it on My Page, and it stays with your profile until you do or you delete your data.
• The statements you tick (that you are 18 or older, that we may store and review your application, and that you will follow the Code of Conduct), word for word, with when you ticked them
• Optional, and separate from applying: your permission for us to use the photo, video and text you send on the festival’s website and social media to promote this year’s festival. You can withdraw it at any time by unticking the box and updating your application, or by emailing us.
• The team’s internal score of your application (1 to 10), used only to choose the teachers and deleted with the application. It is included when you download your data.
• Your hourly rate, and whether you allow us to show it on the site. If we accept you, we publish a listing on the private lessons page with your name, what you teach, your days and a button to message you on Instagram, plus your rate and your photo only if you chose to show them. We show you your listing before it goes live. Otherwise only the festival team sees your details.

If you use “find my contacts” to see which of your contacts are attending, your device computes a one-way hash of your contacts’ email addresses and sends only those hashes for matching. We never receive or store the actual email addresses, and the hashes are discarded immediately after matching.

Technical data we process automatically when you visit the site:

• IP address — used briefly for rate-limiting, fraud prevention, and abuse logs
• Browser, device type, and operating system (from request headers)
• Service-worker installation and PWA install events
• Anonymous traffic counts via Vercel Analytics — no cross-site tracking
• First-party interaction events — when you tap key buttons (buy a pass, join the waitlist, install the app) we record the action name, a timestamp, and a “surface” label. No name, email, cookie, or device fingerprint is attached. Kept for 90 days for conversion measurement. Lawful basis: legitimate interest (Art. 6(1)(f))

• Check your pass on entry and answer questions about your order
• Send event communications: schedule updates, city guide, urgent notices during the event
• Operate the admin and onboarding tools used to run the festival
• Review applications from teachers who want to give private lessons, and reply to them by email
• Protect the site from abuse (rate-limiting, fraud detection, session revocation)
• Power optional social features (attendee directory, connections, push alerts) — only with your opt-in
• Comply with Swedish accounting and tax obligations

• Contract performance (Art. 6(1)(b)) — delivering the event you bought a pass for, and reviewing a teacher’s application to give private lessons (steps you ask us to take before an agreement).
• Consent (Art. 6(1)(a)) — optional features (attendee directory, push notifications, marketing emails), and a teacher’s optional permission to use their application’s photo, video and text to promote the festival. You can withdraw consent at any time without affecting prior lawful processing.
• Legitimate interest (Art. 6(1)(f)) — site security, fraud prevention, anonymous traffic measurement.
• Legal obligation (Art. 6(1)(c)) — Swedish bookkeeping law (bokföringslagen) requires us to retain payment records.

We share specific data with the processors below. Each is bound by a data-processing agreement (DPA) where required. International transfers outside the EEA rely on Standard Contractual Clauses (SCCs) and, where available, the EU-US Data Privacy Framework.

• Google Ireland Ltd. — OAuth sign-in (admin, onboarding, and attendee accounts). policies.google.com/privacy
• Apple Distribution International Ltd. — OAuth sign-in. apple.com/legal/privacy
• Vercel Inc. (USA) — website hosting, privacy-friendly analytics, and Blob storage for uploaded images. vercel.com/legal/privacy-policy
• Upstash Inc. (with EU data residency) — Redis storage for live event data (rate limits, schedule patches, attendee directory) and private-lesson teacher applications. upstash.com/trust/privacy-policy
• Resend, Inc. (USA) — transactional email delivery: sign-in codes, and account/service notices. Receives your email address and the message content. resend.com/legal/privacy-policy
• SMHI (Swedish Meteorological and Hydrological Institute) — weather data for the event page. No personal data is sent to SMHI; the call is server-to-server.
• Meta Platforms Ireland Ltd. — Instagram feed embeds on the landing page, loaded only after you accept optional cookies (or tap “Allow and load the feed”). When loaded, Meta receives your IP address and sets its own cookies. instagram.com/policy

• Ticket and payment records: 7 years after the financial year ends (Swedish bookkeeping law). This legal obligation overrides erasure requests for these specific records.
• Sign-in session tokens: up to 30 days (rolling — the session refreshes while you stay signed in; signing out ends it immediately)
• Attendee-directory profile data, connections, and starred sessions: kept while your account remains active, so your profile, connections, and linked-email ticket access keep working across editions (like the next La Luna edition). Delete them yourself at any time via My Page → Delete my data — it takes effect immediately.
• In-app notifications: auto-expire about a week after they arrive, and are removed when you delete your data
• The copy of your tickets read from the ticket shop for My Ticket: deleted 30 days after the festival (the shop keeps its own order records under its own terms)
• Your Social Stars account (if you joined): until you leave Social Stars or delete your data
• Your crew or artist schedule (if the organiser listed your email): deleted 7 days after the festival
• Push-notification tokens: until you revoke push permission, uninstall the app, or delete your data (whichever comes first)
• Reviews (rating, written review, display name): published reviews are retained indefinitely as they are public feedback about the event. If you were signed in when you submitted, deleting your data also removes your reviews; otherwise email us (Section 13) or ask an organizer and we will remove a review for you.
• Waitlist sign-ups: removed when you delete your data, otherwise cleared after the event
• Private-lesson teacher applications (with their email, statements and the team’s score) and their photos: automatically deleted one month after the festival. Your application is saved with your account, so My Page → Delete my data removes it straight away; for one sent without signing in (the old form), email us (Section 13) and we’ll delete it sooner. The copy of its photo on your profile stays with your profile until you change or remove it on My Page, or delete your data.
• Onboarding submissions (organizer/partner content): 12 months after your last edit, then automatically deleted
• Anonymous traffic data (Vercel Analytics): only loaded if you accept analytics cookies; aggregated only, no per-user retention

You may request earlier deletion at any time — see Section 7.

You have the following rights regarding your personal data:

• Access — receive a copy of the data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion (subject to retention obligations)
• Restriction — limit how we process your data
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interest
• Withdraw consent — at any time, without affecting prior lawful processing

To exercise any of these rights, email orders@casaluna.se. We respond within 30 days.

You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) at imy.se.

We use a small number of cookies and storage entries — all either essential or based on legitimate interest:

• authjs.session-token — admin / onboarding / attendee OAuth session (essential)
• nbc-cookie-consent — stores your cookie choice (essential / accepted) for 1 year; first-party, not shared
• Service-worker cache — offline schedule and event data (essential, no personal data)
• Your own shifts or sessions, saved on your device so they work offline (essential; removed when you sign out)
• Vercel Analytics — anonymous aggregate traffic (no cross-site tracking; loaded only after you accept)
• Vercel Speed Insights — anonymous Core Web Vitals performance metrics (no cookies; loaded only after you accept)

We do not use advertising or third-party tracking cookies.

We protect your data with TLS encryption in transit, rate-limiting against abuse, Argon2id-hashed credentials for any break-glass paths, signed and rotated session tokens, and strict role-based access control. Session revocation is enforced on every privileged action.

No system is perfectly secure. If a breach affects you, we will notify you within 72 hours per GDPR Art. 33–34 and inform the Swedish Authority for Privacy Protection.

This event and website are intended for adults (18+) and minors attending with a guardian. We do not knowingly collect personal data from children under 18. If you believe a child has provided data, email us and we will delete it.

Some of our processors are based in or transfer data to the United States (Google, Apple, Vercel). These transfers rely on the EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. You can request copies of the relevant transfer safeguards at orders@casaluna.se.

We may update this policy as our practices evolve. The “Last updated” date at the top reflects the most recent change. We will notify ticket holders by email of material changes at least 14 days before they take effect.

For privacy questions or to exercise your rights, contact:

orders@casaluna.se