EUROPA CANTAT 2027 — Privacy Policy

This Privacy Policy explains how personal data of participants, contact persons and other people registering for the EUROPA CANTAT 2027 Festival (9–15 August 2027, Liepāja, Latvia) is processed. It applies in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the laws of the Republic of Latvia. It forms part of the Festival’s Terms and Conditions.

We use your data only for the purposes described below. You can visit the Festival website without providing personal data; where a service requires personal data, this policy explains it.

1. Who we are


Data controller	Association “Dziesmu svētku biedrība” (Latvian Song Celebration Society)
Reg. No.	40008147829
Legal address	Krišjāņa Barona iela 39–1, Riga, LV-1011, Latvia
Festival co-organisers	European Choral Association (Haus der Kultur, Weberstr. 59a, 53113 Bonn, Germany) and Foundation “Liepāja 2027” (Reg. No. 40008325039, Rožu iela 6, Liepāja, LV-3401, Latvia) — recipients of registration data needed for organisational and artistic decisions (Section 4)
Contact for data protection questions	info@europacantat2027.com

The Organiser organises the Festival together with the European Choral Association and Foundation “Liepāja 2027”. In this policy, “we” and “the Organiser” mean Dziesmu svētku biedrība.

2. What personal data we collect

We collect the data you enter in the registration form, the documents you upload, and data created during payment and communication with you. For group and choir registrations, the contact person enters the data of all members and confirms that they have informed them about this policy.

Category	Data	Source
Identity and contact	First name, surname, gender, date of birth, e-mail, phone, address, city, postal code, country of residence	Registration form
Registration and choir	Registration type (individual, group, choir), choir or organisation name, number of participants, conductor’s name, category (singer, conductor, composer, manager, accompanying person, other), voice, choir voice type	Registration form
Age verification	Copy of ID card or passport (all data except full name and date of birth may be covered)	Upload in registration form
Membership	ECA membership status and proof of membership (invoice, proof of payment or membership card)	Upload in registration form
Artistic programme	Atelier choices, interest in concerts, links to audio or video recordings (C-level ateliers and concert applications)	Registration form
Travel and logistics	Planned arrival and departure dates, travel mode, airport, interest in airport transfers and charter flights, preferred departure city and country	Registration form; travel information sent to the Organiser by e-mail
Accommodation	How you plan your accommodation, accommodation preferences, name and address of your own accommodation, registration number used for bookings through the Festival	Registration form; accommodation booking
Meals	Meal package choice and dietary requirements (regular, vegetarian, vegan, gluten-free, lactose-free)	Registration form
Payment and invoicing	Payment type, payer type, payer name, payer ID number, payer address, invoices, payment status, refunds	Registration form; payment provider; bank
Visa	Full name, date and place of birth, citizenship, passport number, place of stay, embassy or consulate where the visa application will be submitted	Invitation request sent by e-mail (Terms and Conditions, Section 6.5)
Communication	E-mails and other correspondence with us	You
Photos, video and audio	Images and recordings made at the Festival	Festival photographers and recording teams (Section 6)

Dietary requirements may reveal information about health or religious belief. We use this information only to provide meals.

We do not collect your data from other sources, except where your choir, group or organisation registers you, or where accommodation providers confirm your stay.

3. Why we process your data and on what legal basis

Purpose	Legal basis (GDPR)
Handling your registration, assigning ateliers, organising concerts, meals, transfers and accommodation, communicating about the Festival	Performance of a contract (Art. 6(1)(b))
Calculating the participation fee, checking age and membership status	Performance of a contract (Art. 6(1)(b))
Invoicing, collecting payments, refunds and keeping accounting records	Legal obligation (Art. 6(1)(c)) under Latvian accounting and tax law
Issuing visa invitations at your request	Performance of a contract (Art. 6(1)(b)) and your request
Reporting to funders, including the Investment and Development Agency of Latvia (LIAA), on the number of foreign guests and their length of stay, and verification of this by a certified auditor	Legal obligation (Art. 6(1)(c)) under Cabinet of Ministers Regulation No. 99 and the funding agreement with LIAA
Processing dietary requirements	Your explicit consent (Art. 9(2)(a))
Photos, video and audio recordings of the Festival	Legitimate interest in documenting and promoting the Festival (Art. 6(1)(f))
Statistics and planning of future EUROPA CANTAT festivals	Legitimate interest (Art. 6(1)(f))
Newsletters and information about future events	Your consent (Art. 6(1)(a)), see Section 8.5

Where processing is based on consent, you can withdraw your consent at any time. Withdrawal does not affect processing carried out before it.

You are not legally required to provide your data. Without the data marked as required in the registration form, we cannot complete your registration.

We do not use automated decision-making or profiling. The fee is calculated automatically from the data you provide, but age and membership are checked by a person.

3.1 Participant survey after the Festival. After the Festival, the Organiser, Foundation “Liepāja 2027” or an organisation contracted by them may use your e-mail address to send you a participant survey. The survey helps evaluate your experience, the organisation of the Festival and its impact on the development of Liepāja and the region. Taking part is voluntary, and the results are used only as anonymised statistics. The legal basis is our legitimate interest in evaluating the Festival and reporting to funders (Art. 6(1)(f)). You can object at any time by writing to or by using the opt-out link in the e-mail.

4. Who receives your data

We share your data only to the extent needed to organise the Festival or to meet legal obligations. Our processors act only on our instructions under a data processing agreement.

Recipient	What and why	Role
Mitto Events (mittoevents.com) — registration platform and tavirekini.lv — invoicing service, both operated by SIA ABC idea, Reg. No. 40103285126, Katlakalna iela 9A, Riga, LV-1073, Latvia	All registration data, to run the registration system. Payer name, address and ID number, invoice amounts, to issue invoices.	Processor
EveryPay, in cooperation with Swedbank AS — card payments	Payment data, to process payments	Processor
Banks	Payment and refund data	Separate controllers
European Choral Association (co-organiser)	Registration data needed to take organisational and artistic decisions about the Festival together with the Organiser	Joint controllers
Foundation “Liepāja 2027” (co-organiser)	Registration data needed to take organisational decisions about the Festival together with the Organiser, and data needed for its reporting, monitoring and research on the Liepāja 2027 European Capital of Culture programme, including by organisations contracted by it for this purpose	Joint controllers
ECA member organisations and Friends of the ECA	Name and membership details, only to verify membership status	Separate controllers
Atelier conductors and the Festival Music Commission	Name, voice, choir, atelier choices, recording links	Within the Organiser’s team
Hotels and other accommodation providers	Name, registration number, booking details	Separate controllers
Meal providers	Name, meal package and dietary requirements, to provide meals	Processors
Transport and charter flight providers	Name and travel details, only if you book a transfer or charter flight	Processors
Office of Citizenship and Migration Affairs (PMLP), Ministry of Foreign Affairs and Latvian embassies and consulates	Visa invitation data, only at your request	Separate controllers
Investment and Development Agency of Latvia (LIAA) and our certified auditor	Registration, accommodation and payment data needed to verify the number of foreign guests, their length of stay and Festival costs	Separate controllers
Other funders and cooperation partners	Data needed for reporting on the Festival or for delivering their part of the Festival, only where necessary	Separate controllers
Accountant, IT and e-mail service providers	Data needed for their service	Processors
Public authorities	Where required by law	Separate controllers

On request, we will provide the essence of the arrangement between the joint controllers.

We do not sell your data.

5. Transfers, retention and security

5.1 Where your data is stored and transferred outside the EU/EEA. Registration data is stored in the EU/EEA by our registration platform provider, SIA ABC idea (Mitto Events), in a data centre in the Netherlands operated by DigitalOcean, with backup copies in a data centre in Latvia. The registration platform provider is not authorised to transfer data outside the EU/EEA.

If data is transferred outside the EU/EEA, we use an adequacy decision of the European Commission or Standard Contractual Clauses (Art. 45–46 GDPR). Visa invitation data is sent to Latvian embassies and consulates or to embassies of other Schengen states in the country where you apply.

5.2 Retention. We keep your data only as long as needed for the purposes above:

Data	Retention
Copies of ID documents for age verification	Deleted after the Festival (by 31 August 2027)
Proof of ECA membership	Deleted after the Festival (by 31 August 2027)
Data needed to prove the number of foreign guests and their stay: name, country of residence, arrival and departure dates, accommodation	10 years from the date state co-financing was granted to the Festival (2026), as required by the funding agreement with LIAA and Cabinet of Ministers Regulation No. 99 of 11 February 2025 “Procedures for Granting State Budget Co-financing to Large, Significant Public Events and the Production of Foreign Films in Latvia”.
Other registration and participation data (e.g. phone, voice, atelier choices, travel preferences)	Deleted after the final reports to funders have been accepted (by 31 December 2027)
Invoices, payment and accounting records	At least 5 years under the Latvian Accounting Law; 10 years where they relate to the state co-financing
Visa invitation data	Deleted after the Festival (by 31 December 2027)
Dietary requirements	Deleted after the Festival (by 30 September 2027)
Photos, video and audio	See Section 6
E-mail correspondence	Deleted after the Festival (by 31 December 2027)

In general, we keep data only as long as needed for the purpose or to meet contractual and legal obligations. Data related to consents, complaints and claims is kept for the statutory limitation period. After that, data is deleted or anonymised.

5.3 Security. Uploaded identity and membership documents are stored with restricted access and used only to verify age and membership. Access to registration data is limited to the people who need it for their tasks. Only authorised users can access the registration system, which is protected by two-factor authentication (2FA). The registration platform provider continuously monitors the system and takes preventive measures to ensure its performance and data security.

5.4 Backups. Backup copies of registration data are kept for 7 days. When data is deleted, it remains in backup copies for up to 7 days and is then permanently removed from all storage media.

6. Photos, video and audio; participants under 18

6.1 Recordings at the Festival. The Festival will be photographed, filmed and recorded, and may be broadcast or streamed. Participants may appear in this material. The Organiser, the European Choral Association and Foundation “Liepāja 2027” may use it for documentation, reporting to funders, and promotion of the Festival and future EUROPA CANTAT festivals, as set out in the Terms and Conditions (Section 7.5).

You are informed that during Festival events you will be recorded in audio, audiovisual and visual form (photographs, video recordings) (“Recordings”).
Use of Recordings. The Organiser may use the Recordings in any form, in whole or in part, allow or prohibit their use with or without remuneration, and receive remuneration for their use. The Organiser may use these rights freely at its own discretion, including by transferring them to third parties. On request, the Organiser will inform you about these third parties.
Where the material is published: on social media, in Festival recap videos and photo galleries, and to announce future EUROPA CANTAT festivals on websites, social media and other channels.
Legal basis and duration. The legal basis is the Organiser’s legitimate interest in documenting the Festival and promoting it and future EUROPA CANTAT festivals (Art. 6(1)(f)). The use is valid in all countries of the world, without a time limit. Recordings are kept as part of the Festival’s archive.
You may object to these activities and ask the Organiser to stop them only where you are directly identifiable in a specific Recording and the Organiser is technically able to remove you from that Recording or to stop using it. To do so, write to .

6.2 Recording links you submit. Links to audio or video recordings submitted for C-level ateliers or concert applications are viewed only by the Festival Music Commission and atelier conductors, to assess the application.

6.3 Participants under 18. Participants under 18 are registered by a choir or group leader, or together with a parent, legal guardian or other responsible adult (Terms and Conditions, Section 6.6). The choir or group leader, or the adult registering a minor, confirms that they have the consent of the parents or legal guardians to the processing of the minor’s data, and that they have informed them about photos and recordings (Section 6.1).

7. Your rights

Under the GDPR you have the right to:

Access (Art. 15): to get confirmation whether we process your data, access to it and a copy.
Rectification (Art. 16): to have incorrect data corrected without undue delay. You can also update most data yourself by logging into your registration.
Erasure (Art. 17): to have your data deleted, unless we must keep it by law or under the funding agreement (Section 5.2).
Restriction (Art. 18): to ask us to limit the processing of your data.
Data portability (Art. 20): to receive the data you gave us in a structured, commonly used and machine-readable format.
Objection (Art. 21): to object at any time, on grounds relating to your situation, to processing based on our legitimate interest (Art. 6(1)(f)). If we use your data for direct marketing, you can object at any time without giving reasons.
Withdrawal of consent (Art. 7(3)): to withdraw consent at any time, where processing is based on consent.

To use your rights, write to . We will reply within one month. We may ask you to confirm your identity.

Complaints. You can lodge a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija), www.dvi.gov.lv, or with the supervisory authority in your country of residence. We would appreciate the chance to resolve your concern first.

8. Website and cookies

8.1 Server log data. When you visit the Festival website, the web server collects technical data: browser type and version, operating system, referring page, pages visited, date and time of access, IP address and internet service provider. We use this data to display the website correctly, keep our systems working and secure, and prevent misuse. The legal basis is our legitimate interest (Art. 6(1)(f)).

8.2 Contact by e-mail. When you write to us, we process your message and contact details to answer you. If your question concerns your registration, the legal basis is performance of a contract (Art. 6(1)(b)); otherwise it is our legitimate interest in answering (Art. 6(1)(f)).

8.3 Cookies. Cookies are small text files stored by your browser. The Festival website uses two categories of cookies:

Required cookies are necessary for the website to work and are set without your consent (legitimate interest, Art. 6(1)(f)).

Statistical cookies help us understand how visitors use the website. They are set only if you accept them in the cookie banner (consent, Art. 6(1)(a)).

When you first visit the website, the cookie banner lets you choose “Required cookies”, “Statistical cookies”, “Accept all” or “Accept selected”. You can change or withdraw your consent at any time in the cookie settings. You can also delete or block cookies in your browser; some functions may then not work fully. Details are given in the Cookie Policy on the Festival website (europacantat2027.com/en/cookie-policy).

8.4 Google Analytics. With your consent, we use Google Analytics, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to compile statistics on website use. It sets the following statistical cookies:

Cookie	Provider	Purpose	Duration
_ga	Google Analytics	Assigns a randomly generated identifier to distinguish unique users for analytics reports	Up to 2 years
_ga_P9N4T18VQE	Google Analytics	Same purpose as _ga	Up to 2 years
_gid	Google Analytics	Distinguishes users and groups behaviour into sessions within one day	1 day
_gat	Google Analytics	Limits data collection on high-traffic websites to maintain performance	1 minute

Data may be transferred to Google LLC in the USA. This transfer is based on the EU–US Data Privacy Framework, under which Google LLC is certified. More information: policies.google.com/privacy. You can prevent Google Analytics from collecting data by not accepting statistical cookies or by withdrawing your consent in the cookie settings.

Links to the Festival’s pages on Facebook, Instagram, YouTube, X and LinkedIn are simple links. These platforms process your data under their own privacy policies only when you visit them.

8.5 Registration website. The registration form is hosted by Mitto Events on mittoevents.com. Its own cookie and privacy information also applies.

9. Changes to this policy

We may update this policy, for example when the registration process changes. The current version is always published on the Festival website with its date.