Privacy Policy
1. Data controller
The controller of personal data processed in connection with the website www.mfluk.eu is L Društvo KR, Glavni trg 4, 4000 Kranj, Slovenia, an active association, registration number 5211590000, tax number 45090050, entered in the register on 25 December 1980 (hereinafter: the association or the controller).
For questions about privacy, requests concerning your rights or complaints, contact us at info@mfluk.eu, call +386 (0)4 281 52 81, or write to the postal address above.
2. Purpose and scope
This policy explains which personal data we process when you visit the website, use the contact form, subscribe to newsletters, apply for or take part in festival activities, and appear in festival-related content. It is prepared in accordance with Regulation (EU) 2016/679 (GDPR), the Slovenian Personal Data Protection Act (ZVOP-2), the Electronic Communications Act (ZEKom-2), and other applicable legislation.
3. Processing activities, purposes, legal bases and retention periods
3.1 Website visits and security logs
When you visit the website, the IP address, date and time of access, requested URL, referring page, browser type and version, operating system, server response code, and information about errors or security events are logged automatically. We process these data to operate and secure the website, prevent misuse, diagnose errors and protect our rights. The legal basis is our legitimate interest under Article 6(1)(f) GDPR. Technical logs are retained for no more than 30 days unless longer retention is necessary for a specific security incident, a legal obligation or a legal claim.
3.2 Essential session and security cookies
The website uses the XSRF-TOKEN and mfluk-session cookies. They are required for secure operation, protection of forms against forged requests, and maintenance of the user session. Both expire after two hours. Further details are available in the Cookie Policy.
3.3 Contact form and communication
When you use the contact form or contact us by email, we process your first and last name, email address, selected type of enquiry, message content, and any data you voluntarily include. We use the data to handle your enquiry, prepare a reply, and organise a visit, cooperation or another relationship. The legal basis is Article 6(1)(b) GDPR or our legitimate interest in effective communication under Article 6(1)(f) GDPR. Messages are retained for two years after the matter is closed, and longer only where required by law or a legal claim.
3.4 Newsletter subscription
When you subscribe to newsletters, we process your email address and, if supplied, your name. To demonstrate the lawfulness of the subscription, we record the date and time, source and method of consent, the version of the consent wording, and technical confirmation data. The subscription is confirmed through a double opt-in process.
Newsletters are sent on the basis of prior, freely given, specific and demonstrable consent under Article 6(1)(a) GDPR and Article 226 ZEKom-2. You may withdraw consent at any time through the unsubscribe link in every message or by contacting info@mfluk.eu. We retain the contact until unsubscribed and evidence of consent for five years after unsubscribing or the final message, unless longer retention is permitted for legal proceedings.
3.5 Artists, curators, partners and the media
For the presentation and delivery of the festival, we process names, professional contact details, biographies, portraits, information about artworks, statements, programme information, and photographs and recordings of events. Depending on the relationship, the legal basis is a contract, consent, a legal obligation, or the legitimate interest of the association and the public in information, documentation and promotion of the cultural programme. We retain the data for programme delivery, reporting to funders, media presentation, and the cultural or festival archive.
3.6 Photography and filming at events
Photography and filming take place at public festival events for public information, reporting, promotion and documentation of the cultural programme. Visitors are informed in an appropriate and visible manner. We obtain separate consent for prominent portraits, interviews and content for which consent is the more appropriate legal basis. Requests concerning a specific publication may be sent to info@mfluk.eu. We take particular care when processing children's data.
3.7 Applications, accreditations and cooperation
For event applications, media accreditations, open calls and cooperation, we process the data necessary to assess the application and manage the relationship. Additional information is provided with the relevant form where the purpose, scope or retention period differs from this policy. Data are retained until the activity is completed and for one further year unless legislation or a contract requires longer retention.
4. Requirement to provide data
Providing personal data is voluntary unless a particular item is necessary to deliver the requested service or comply with a legal obligation. Required fields are clearly marked. If you do not provide required data, we may be unable to provide the service or reply.
5. Authorised users, processors and recipients
Personal data are accessible only to authorised persons who need them for their work. Contracted service providers process data to the extent necessary, including hosting and website maintenance providers, email and newsletter providers, IT support, photographers, designers and festival production providers. Processing agreements under Article 28 GDPR are in place, and processors act only on our instructions.
We disclose data to competent public authorities, courts or other entitled recipients where required by law or necessary to protect rights and safety. We do not sell personal data.
6. External technical resources
The website uses the Leaflet library and OpenStreetMap maps. When these resources are loaded, the provider receives the IP address, time of the request, requested resource and standard browser information. The map is loaded in a way that limits unnecessary data disclosure. Further processing by external providers is governed by their privacy policies.
7. Transfers outside the European Economic Area
We give preference to providers that process data within the European Economic Area. Where data are transferred to a third country, we ensure an appropriate legal basis, such as an adequacy decision of the European Commission or standard contractual clauses, and apply additional safeguards where necessary. Information about a specific transfer may be requested at info@mfluk.eu.
8. Data security
We apply appropriate technical and organisational measures, including access controls, secure HTTPS connections, protection of sessions and forms, regular updates, backups, incident logging and response, and training for persons who process data. We review these measures regularly and adapt them to identified risks.
9. Your rights
Subject to the GDPR, you have the right to information, access, rectification, erasure, restriction of processing, data portability, and objection. Where processing is based on consent, you may withdraw it at any time. You may object to direct marketing at any time.
Send your request to info@mfluk.eu or by post. We respond without undue delay and no later than one month. For security reasons, we may reasonably verify your identity before acting on a request.
10. Complaint to the supervisory authority
If you believe that your data are not processed lawfully, you may contact us or lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, Slovenia, gp.ip@ip-rs.si, www.ip-rs.si.
11. Children
The website is not intended to collect children's personal data independently. Where processing connected with information society services is based on the consent of a child under 15, consent must be given or authorised by a parent, guardian or another authorised person in accordance with ZVOP-2.
12. Automated decision-making
We do not use data collected through the website for automated decision-making or profiling that produces legal or similarly significant effects for an individual.
13. Changes to this policy
We update this policy when processing purposes, providers, technologies or legislation change. The effective date and version are stated at the top. We notify users appropriately of material changes and obtain consent again where required.