Polski English
Register

Privacy Policy

Table of Contents

Urban Highline Festival Privacy Policy

Applies to: urbanhighline.pl and reg.firmament.org.pl

Last updated: 1.06.2026

1. General Information

  1. This Privacy Policy describes the rules for processing personal data of users of the websites urbanhighline.pl and reg.firmament.org.pl, as well as persons registering for Urban Highline Festival, contacting the Organizer or using services and functionalities available through these websites.
  2. This document applies to:
    1. the Urban Highline Festival information website available at urbanhighline.pl;
    2. the participant registration website available at reg.firmament.org.pl;
    3. contact forms, registration forms, package purchase forms, marketing consents, organizational communication and other functionalities provided by the Organizer.
  3. Using the websites may involve the processing of personal data within the scope described below.

2. Data Controller

  1. The controller of personal data is Fundacja Firmament with its registered office in Lublin, Poland.
  2. Controller details:Fundacja Firmament
    ul. Kowalska 5/203
    20-115 Lublin
    Poland
    KRS: 0000789662
    NIP: 7123388258
    REGON: 383564970
    e-mail: fundacja@firmament.org.pl
    e-Delivery address: AE:PL-93182-96702-DHCVC-29
  3. For matters related to personal data protection, you can contact the Controller at: fundacja@firmament.org.pl.
  4. The Controller has not appointed a Data Protection Officer, unless information about such appointment is published on the website or communicated to data subjects.

3. Scope of Processed Data

  1. The Controller may process the following categories of personal data:
    1. identification data, such as first name, last name, username or participant ID;
    2. contact data, such as e-mail address, phone number, country of residence or other data provided in a form;
    3. data related to participation in the Festival, such as the type of purchased package, registration status, payment status, wristband number, information about slots, selected activities or zones;
    4. data related to the Camper Pack, such as vehicle registration number, vehicle type, vehicle pass details or data of the person using the camper zone;
    5. billing and payment data, such as transaction amount, payment status, payment ID, transaction date and data necessary to handle refunds;
    6. insurance-related data, if the Organizer requires confirmation of accident or health insurance;
    7. data related to safety, incidents, accidents or assistance, if necessary for the organization of the Festival, protection of life and health, establishment of claims or defense against claims;
    8. data included in correspondence with the Controller, including the content of e-mails, contact form messages, SMS, WhatsApp messages or other communication channels;
    9. technical data related to the use of the websites, such as IP address, cookie identifiers, device data, browser data, date and time of visit, visited subpages and traffic source;
    10. the image of participants captured in photos or video recordings taken during the Festival.
  2. Providing data is voluntary, but in some cases it is necessary for registration, package purchase, participation in the Festival, receiving a response or using certain website functionalities.

4. Purposes and Legal Bases of Processing

  1. Personal data is processed for the following purposes:

4.1. Website Operation

  1. Technical data, such as IP address, device data, browser data and basic information about website activity, is processed to ensure the proper operation of urbanhighline.pl and reg.firmament.org.pl, maintain website security, diagnose errors and protect against abuse.
  2. The legal basis for processing is the Controller’s legitimate interest in ensuring the operation, security and stability of the websites.

4.2. Festival Registration and Participation Handling

  1. Data provided in the registration form is processed to accept the application, create the registration, assign a package, handle participation in the Festival, issue a wristband, identify the participant and ensure the organization of the event.
  2. The legal basis for processing is the performance of a contract or taking steps prior to entering into a contract, as well as the Controller’s legitimate interest in properly organizing the Festival.

4.3. Payment and Refund Handling

  1. Payment-related data is processed to handle the purchase of a Festival Pack, Camper Pack or other services, confirm payment, issue confirmations, handle refunds and resolve complaints.
  2. The legal basis for processing is the performance of a contract, legal obligations imposed on the Controller and the Controller’s legitimate interest in handling settlements and establishing or defending against claims.
  3. Payments may be handled by an external payment operator. In such a case, the payment operator may act as a separate data controller in relation to payment transaction processing.

4.4. Camper Pack Handling

  1. Vehicle data, in particular the registration number, is processed to assign the Camper Pack to a specific vehicle, issue a vehicle pass, control access to the camper zone and ensure order and safety in that zone.
  2. The legal basis for processing is the performance of a contract and the Controller’s legitimate interest in organizing the camper zone and controlling access to it.

4.5. Organizational Communication

  1. Participants’ contact data is processed to send organizational information related to the Festival, in particular information about registration, payment, program, organizational changes, safety rules, slot reservations, wristband collection, festival zones, the Camper Pack and other information necessary to participate in the Festival.
  2. Communication may take place via e-mail, SMS, WhatsApp, the festival app, social media or other channels indicated by the Organizer.
  3. The legal basis for processing is the performance of a contract and the Controller’s legitimate interest in properly organizing the event and providing participants with necessary information.

4.6. Contact with the Controller

  1. Data provided in e-mails, contact forms or other communication channels is processed to respond, conduct correspondence and resolve the submitted matter.
  2. The legal basis for processing is the Controller’s legitimate interest in handling correspondence and communication with persons contacting the Controller.

4.7. Safety, Incidents and Medical Assistance

  1. Data concerning incidents, accidents, violations of the rules, dangerous situations or the need to provide assistance may be processed to ensure participants’ safety, organize assistance, document events, establish claims or defend against claims.
  2. The legal basis for processing is the Controller’s legitimate interest in ensuring event safety, documenting incidents and establishing or defending against claims.
  3. If health data is processed in connection with an incident, the basis for processing may be the need to protect the vital interests of the data subject or another natural person, the establishment or defense of legal claims, or the explicit consent of the data subject where required.

4.8. Photo and Video Documentation

  1. Photos and video recordings documenting the Festival may be taken during the event.
  2. Participants’ image may be processed for informational, promotional, documentation and archival purposes related to the Festival and the Organizer’s activities.
  3. The materials may be published in particular on the Festival website, the Organizer’s website, social media, press materials, promotional materials, event reports and materials related to future editions of the Festival.
  4. The legal basis for processing may be the Controller’s legitimate interest in documenting and promoting the event, and in cases required by law — the consent of the data subject.
  5. In the case of individual photo sessions, interviews, promotional recordings or materials in which a given person is the main subject, the Controller may request separate consent.

4.9. Marketing and Information About Future Events

  1. Personal data may be processed to send marketing information concerning future events, activities, projects or offers of the Organizer only if the data subject has given appropriate consent or if another legal basis exists under applicable law.
  2. Consent to marketing communication may be withdrawn at any time by contacting the Controller or using the unsubscribe mechanism, if available.

4.10. Legal, Accounting and Tax Obligations

  1. Data may be processed to fulfill legal obligations imposed on the Controller, in particular accounting, tax, reporting and archiving obligations.
  2. The legal basis for processing is the Controller’s legal obligations under applicable law.

4.11. Establishment and Defense of Claims

  1. Data may be processed to establish, pursue or defend against claims related to the organization of the Festival, use of the websites, purchase of packages or participation in the event.
  2. The legal basis for processing is the Controller’s legitimate interest in protecting its rights.

5. Data Recipients

  1. Personal data may be disclosed to the following categories of recipients:
    1. entities providing hosting, IT, website maintenance and system security services;
    2. providers of participant registration systems;
    3. payment operators;
    4. providers of tools for sending e-mails, SMS, WhatsApp messages or other organizational communications;
    5. providers of analytical and statistical tools;
    6. accounting, legal, tax or administrative service providers;
    7. persons and entities cooperating in the organization of the Festival, to the extent necessary to perform their tasks;
    8. security, medical, rescue, technical or height safety services, if necessary for participant safety;
    9. public authorities, if the obligation to disclose data results from applicable law;
    10. media partners, photographers, filmmakers or entities preparing event documentation, within the scope related to recording and publishing Festival materials.
  2. The Controller uses only such service providers that ensure an appropriate level of personal data protection and process data in accordance with applicable law.

6. Transfers of Data Outside the European Economic Area

  1. Personal data may be transferred outside the European Economic Area if the Controller uses tools or services of providers having their registered office or infrastructure outside the EEA, in particular in the field of hosting, analytics, communication, social media, e-mail or organizational tools.
  2. In the event of data transfer outside the EEA, the Controller applies appropriate safeguards required by the GDPR, in particular standard contractual clauses, adequacy decisions or other mechanisms provided by law.

7. Data Retention Period

  1. Personal data will be stored for the period necessary to achieve the purposes for which it was collected.
  2. Data related to registration and participation in the Festival will be stored for the duration of Festival organization and then for the period necessary for settlements, complaint handling, establishment of claims or defense against claims.
  3. Accounting and tax data will be stored for the period required by law.
  4. Data processed on the basis of consent will be stored until consent is withdrawn, unless another legal basis for further processing exists.
  5. Data processed for marketing purposes will be stored until consent is withdrawn or an objection is submitted.
  6. Technical data and cookies will be stored for the period resulting from the settings of a given cookie, analytical tool or website configuration.
  7. Photo and video materials documenting the Festival may be stored for the duration of the Controller’s documentation, promotional and archival activities, unless the data subject effectively objects to such processing or requests deletion of data within the scope provided by law.

8. Rights of Data Subjects

  1. Data subjects have the following rights:
    1. the right of access to data;
    2. the right to rectification of data;
    3. the right to erasure of data;
    4. the right to restriction of processing;
    5. the right to data portability;
    6. the right to object to processing;
    7. the right to withdraw consent at any time, if processing is based on consent;
    8. the right to lodge a complaint with the President of the Personal Data Protection Office in Poland.
  2. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
  3. To exercise these rights, you can contact the Controller at: fundacja@firmament.org.pl.
  4. The Controller may request additional information necessary to confirm the identity of the person submitting the request.

9. Voluntary Provision of Data

  1. Providing data is voluntary, but may be necessary to use certain website functionalities, register for the Festival, purchase a package, handle payment, receive a response or participate in selected activities.
  2. Failure to provide data required in a registration or purchase form may prevent registration, package purchase or participation in the Festival.
  3. Failure to provide contact data may prevent receiving important organizational information.

10. Automated Decision-Making and Profiling

  1. Personal data will not be used for decisions producing legal effects concerning a person or similarly significantly affecting them solely by automated means.
  2. The Controller may use basic analytical or statistical tools to analyze how the websites are used, improve their operation and plan communication. Such activities do not significantly affect users’ rights or situation.

11. Cookies and Similar Technologies

  1. The websites urbanhighline.pl and reg.firmament.org.pl may use cookies and similar technologies.
  2. Cookies are small files stored on the user’s device that allow the website to function properly, remember settings, collect statistics, analyze traffic or enable selected functionalities.
  3. The websites may use the following types of cookies:
    1. necessary cookies — required for the proper operation of the website, forms, login, registration, payments or security;
    2. functional cookies — enabling the website to remember selected user settings;
    3. analytical cookies — used to create statistics and analyze how the website is used;
    4. marketing cookies — used for promotional activities or measuring campaign effectiveness, if applied.
  4. Necessary cookies may be used on the basis of the Controller’s legitimate interest in ensuring the operation of the website.
  5. Analytical, functional or marketing cookies may be used on the basis of the user’s consent, if such consent is required by applicable law.
  6. The user can manage cookies through browser settings or the consent management mechanism available on the website, if implemented.
  7. Limiting the use of certain cookies may affect the operation of the websites or the availability of selected functionalities.

12. Social Media

  1. The Controller may operate Urban Highline Festival or Fundacja Firmament profiles on social media platforms such as Facebook, Instagram or other platforms.
  2. Using social media profiles may involve the processing of data by the operators of those platforms under the terms set out in their own privacy policies.
  3. The Controller may process data of persons following profiles, reacting to posts, commenting on content or contacting the Controller via social media in order to manage the profiles, communicate, promote the Festival and analyze user activity.

13. Data Security

  1. The Controller applies appropriate technical and organizational measures to protect personal data against loss, unauthorized access, disclosure, alteration or destruction.
  2. Access to data is granted only to persons and entities for whom it is necessary to achieve the purposes described in this Privacy Policy.
  3. The Controller regularly analyzes the security measures used and adapts them to the nature, scope and risk related to data processing.

14. Changes to the Privacy Policy

  1. The Controller may update this Privacy Policy in the event of changes to the websites, registration processes, tools used, service providers, legal regulations or methods of data processing.
  2. The current version of the Privacy Policy will be available on urbanhighline.pl and reg.firmament.org.pl.
  3. In the event of significant changes, the Controller may inform users or participants via the website, e-mail or another appropriate communication channel.

15. Contact

For matters concerning this Privacy Policy or the processing of personal data, you can contact the Controller:

Fundacja Firmament
ul. Kowalska 5/203
20-115 Lublin
Poland
e-mail: fundacja@firmament.org.pl
e-Delivery address: AE:PL-93182-96702-DHCVC-29