RELEASE SOFIA

PRIVACY AND PERSONAL DATA PROTECTION POLICY

Effective as of 01.11.2026

Main Stage Ltd., with registered office and management address at Industrialna str.#1, Sofia 1202, Bulgaria, email [email protected] (hereinafter referred to as the “Company” or “we”), as the owner of the website https://www.releasesofia.bg  (hereinafter referred to as the “Website”) and organiser of Release Sofia, informs visitors, users and customers of the Website about the personal data we collect and process when purchasing tickets, subscribing to our newsletter and using the Website.

The Company is a data controller within the meaning of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter referred to as the “GDPR”) and the Bulgarian Personal Data Protection Act. We process your personal data lawfully, fairly and transparently, in accordance with the principles of purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and we apply appropriate technical and organisational measures for its protection.

Below you will find information about how we process your personal data, including its collection, use, storage, disclosure to third parties and protection, how long we retain it, and what rights you have at any time.

1. KEY DEFINITIONS

  • Personal data means any information relating to an identified or identifiable natural person (“data subject”), directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier or one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity.
  • Processing means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making data available, alignment or combination, restriction, erasure or destruction.

2. WHAT DATA WE COLLECT

When purchasing a ticket online through More.com (hereinafter referred to as the “Ticketing Partner”) or subscribing to our newsletter, you provide us with your email address and name.

IMPORTANT: Of all the data requested by the Ticketing Partner, we receive and process only the data specified above. Your payment card details are processed solely by the Ticketing Partner and its payment service provider and are not provided to the Company.

When attending our Events, photographs and video recordings in which you may appear may also be processed (see Section 5).

When using the Website, cookies may be used. More information is available in our Cookie Policy: https://www.releasesofia.bg/en/cookie-policy/

3. PURPOSES AND LEGAL GROUNDS FOR PROCESSING

  • Performance of the ticket purchase contract (Article 6(1)(b) GDPR) – to send you important information relating to the Event for which you have purchased a ticket, including programme changes, schedules, access conditions, postponement or cancellation, and refunds.
  • Sending news, event information and offers (newsletter) – only on the basis of your explicit prior consent (Article 6(1)(a) GDPR and Article 6 of the Bulgarian Electronic Commerce Act). Consent is given when subscribing to the newsletter or by separately opting in when purchasing a ticket. You may withdraw your consent at any time, free of charge and easily, by using the unsubscribe link in any email or by writing to [email protected]. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
  • Photographs and video recordings from Events – on the basis of the Company’s legitimate interest (Article 6(1)(f) GDPR) in documenting and promoting its Events.
  • Compliance with legal obligations (Article 6(1)(c) GDPR) – for example, accounting and tax obligations relating to refunds.

4. RECIPIENTS OF THE DATA

We do not sell or disclose your personal data to third parties for their own purposes.

Access to your data may be granted only to:

  • authorised employees of the Company who are bound by confidentiality obligations;
  • data processors providing technical services to us and acting solely on our instructions under an agreement pursuant to
  • data processors providing technical services to us and acting solely on our instructions under an agreement pursuant to Article 28 GDPR, including hosting provider Superhosting and email newsletter service provider Moosend.
  • public authorities where disclosure is required by law.

If you have any questions regarding the processing of your personal data, please contact us at [email protected].

5. PHOTOGRAPHS AND VIDEO RECORDINGS FROM EVENTS

Photographs and video recordings are made during our Events and may be used to document and promote the Events, including on the Website, social media and in advertising materials.

Information notices will be displayed at the entrance to the Event venue. If you do not wish to be identifiable in a specific photograph or video, please contact us at [email protected], and we will remove or blur the relevant image where technically feasible.

6. TRANSFERS OF DATA OUTSIDE THE EU

As a general rule, your personal data is stored and processed within the European Union / European Economic Area.

If any of our service providers processes data outside the EU/EEA, this will take place only where appropriate safeguards are in place in accordance with Chapter V GDPR, such as an adequacy decision issued by the European Commission or Standard Contractual Clauses.

7. RETENTION PERIODS

  • Newsletter data – until you withdraw your consent or until [3] years after your last interaction with us, such as opening an email or purchasing a ticket, after which the data will be deleted.
  • Data relating to a purchased ticket – until [6] months after the relevant Event has taken place or until any refund procedure has been completed.
  • Accounting documents (e.g. in relation to refunds) – for the periods required under the Bulgarian Accounting Act.

After the relevant retention periods expire, your data will be permanently and irreversibly deleted.

8. DATA SECURITY

Your personal data is processed only by authorised employees of the Company who are bound by confidentiality obligations and only for the purposes stated above.

We apply appropriate technical and organisational measures to protect your data against accidental or unlawful destruction, loss, alteration, disclosure or access, including physical security, differentiated access controls, protection of software systems and network equipment, and encryption where applicable.

These measures are reviewed and updated where necessary.

In the event of a personal data breach, we notify the Bulgarian Commission for Personal Data Protection within 72 hours where required under Article 33 GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay in accordance with Article 34 GDPR.

9. YOUR RIGHTS

In relation to your personal data, you have the following rights:

  • Right to information – to receive the information required under Articles 13 and 14 GDPR, as set out in this Policy. The Policy is available at all times at https://www.releasesofia.bg/en/privacy-policy/.
  • Right of access – to obtain confirmation as to whether we process your data and, if so, information about the purposes, categories of data, recipients, retention period, your rights and a copy of the data.
  • Right to rectification – to request correction of inaccurate or incomplete data, for example an incorrectly spelled name.
  • Right to erasure (“right to be forgotten”) – to request deletion of your data where it is no longer necessary for the purposes for which it was collected or where you withdraw your consent.
  • Right to restriction of processing – for example, while an objection or rectification request is being reviewed.
  • Right to data portability – to receive the data you have provided to us in a structured, commonly used and machine-readable format, or to request that we transmit it to another controller.
  • Right to object – to object to processing based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms. You may object to processing for direct marketing purposes at any time without providing a reason.
  • Right to withdraw consent – at any time, without affecting the lawfulness of processing carried out before the withdrawal.

How to exercise your rights

For any request relating to your personal data, including checking the status of an existing request, please contact us at [email protected].

We may request additional information in order to verify your identity.

Response period

We respond to your requests free of charge, without undue delay and in all cases within one (1) month of receipt.

Where the request is complex or a large number of requests have been received, we may extend this period by a further two (2) months, and we will inform you of the extension within the first month.

Where requests are manifestly unfounded or excessive, in particular because of their repetitive nature, the Company may charge a reasonable fee taking into account the administrative costs or refuse to act on the request, in which case we will provide you with a reasoned response in accordance with Article 12(5) GDPR.

Automated decision-making and profiling

We do not make decisions or carry out profiling based solely on automated processing of your personal data.

Right to lodge a complaint with the supervisory authority

If you believe that the processing of your personal data infringes applicable law, you have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP):

Sofia 1592
2 Prof. Tsvetan Lazarov Blvd.
Email: [email protected]
Website: www.cpdp.bg

You also have the right to seek judicial protection.

10. CHANGES TO THIS POLICY

We update this Policy when necessary.

Where there are material changes to this Policy or to the way in which we use your personal data, we will publish the updated version at https://www.releasesofia.bg/en/privacy-policy/ before the changes take effect and will notify you in an appropriate manner.

We recommend that you review this Policy periodically to remain informed about how we protect your personal data.