PRIVACY POLICY

The Data Controller of your personal data is Burcor Producciones S.L., located at DS 363 Calahorra, 26500, La Rioja.

(We currently do not have a Data Protection Officer (DPO), as it is not required under applicable regulations. If one is appointed, we will update this policy with their contact details.)

Privacy principles

At Holika Festival, we are committed to ensuring the confidentiality and security of your personal data, applying the principles set out in the General Data Protection Regulation (GDPR) and the Spanish Data Protection Act (LOPDGDD).

Our commitments are:

We only request personal data when strictly necessary to provide the services you require.
We do not share personal data with third parties, except under legal obligation or with your explicit authorization.
We will never use your data for purposes other than those specified in this policy.
We guarantee an adequate level of security in line with current legislation.
We will not make automated decisions without informing you in advance.

Applicable legislation

This policy complies with:

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).
Spanish Organic Law 3/2018 of 5 December on Data Protection and Digital Rights Guarantee (LOPDGDD).

Data processing activities

1. Contacts

Purpose: To respond to your requests, inquiries, or questions via the website, email, or telephone.
Legal basis: Consent of the data subject.
Recipients: No data will be shared with third parties.
Retention: For as long as necessary to fulfill the purpose and for potential legal obligations.

2. Clients

Purpose: Managing contractual relationships, billing, and payments. Sending information about similar or complementary services.
Legal basis: Contract performance, legal obligation, and legitimate interest.
Recipients: Public authorities where legally required, and third parties essential for service provision.
Retention: For the duration of the contractual relationship and for the legally required retention periods (e.g. 6 years for tax obligations).

3. Marketing

Purpose: To send commercial information about products, services, and activities we believe may interest you.
Legal basis: Consent of the data subject.
Recipients: No data will be shared with third parties.
Retention: Until you withdraw your consent or after 3 years of inactivity.

(In some cases, we may create basic profiles to segment content according to your interests. No automated decisions producing legal effects will be taken.)

4. Human Resources (HR)

Purpose: To evaluate CVs received for recruitment processes.
Legal basis: Consent of the data subject.
Recipients: No data will be shared with third parties.
Retention: For a maximum of 2 years.

Our website uses cookies and similar technologies to enhance browsing, analyze traffic, and display personalized advertising.

International data transfers

In some cases, we use third-party service providers located outside the European Economic Area (EEA), such as cloud storage, email marketing, analytics, or social networks.

These transfers are based on:

Standard Contractual Clauses (SCCs) approved by the European Commission, or
Countries declared as having an adequate level of protection by the European Commission.

In all cases, appropriate safeguards are applied to protect your personal data.

Data subject rights

You have the right to:

Obtain confirmation of whether we process your data.
Access your personal data.
Rectify inaccurate or incomplete data.
Request the deletion of your data when no longer necessary.
Restrict processing in certain circumstances.
Object to processing, especially for direct marketing purposes.
Request the portability of your data in a structured and machine-readable format.
Not be subject to automated decisions with legal or significant effects.

You may withdraw your consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise your rights, please contact us at privacidad@holikafestival.com, attaching a copy of your ID document.

If you believe your rights have been violated, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with your local data protection authority.

Links and third party data

Our website may include links to third-party websites. We recommend reviewing their privacy policies.
If you provide us with personal data of third parties, you guarantee that you have previously informed them and obtained their consent, in compliance with Article 14 of the GDPR.

Validity and updates

This policy was last updated on September 29, 2025.
We may update this policy in the future to reflect legal or operational changes, in which case the new revision date will be displayed.