Privacy
policy

1. Who is responsible

This website is operated by Rising High Productions, the organiser of Urban Art Fest Malaga. You can reach our data protection contact at info@urbanartfestmalaga.com.

The festival takes place at Palacio de Congresos Torremolinos, 29620 Torremolinos (Málaga), Spain. Because we are established in Spain, this policy is written around the EU General Data Protection Regulation (GDPR) and Spanish data protection law.

2. What this site stores on your device

The site does not set any advertising or analytics cookies. It uses your browser's local storage for two small preferences, both of which stay on your own device and are never transmitted to us:

• uaf-lang — the language you chose (English or Spanish), so the site opens in the same language next time.
• uaf-cookie-consent — whether you pressed Accept or Decline on the notice, so we stop asking.

You can clear both at any time by clearing site data for this domain in your browser settings. Declining the notice does not break anything: your language choice is kept either way, because without it the site cannot remember what you asked for.

3. What we deliberately do not collect

We think it is worth being specific about the absences, because most sites of this kind do the opposite. This website contains:

• no Google Analytics or any other analytics product;
• no advertising, remarketing or conversion pixels, including no Meta/Facebook pixel;
• no session recording, heatmaps or scroll tracking;
• no cross-site tracking, profiling or automated decision-making;
• no sale or sharing of personal data with data brokers, ever.

4. Information collected automatically by our host

The site is served by Vercel (Vercel Inc., United States). Like every web host, it processes technical request data such as your IP address, the page requested, the timestamp, and your browser's user-agent string, in order to deliver the page and to protect against abuse and attacks.

We use this only in aggregate and for security. The legal basis is our legitimate interest in running a secure, working website (Art. 6(1)(f) GDPR). Vercel acts as our processor under its data processing agreement, which includes standard contractual clauses for any transfer outside the EEA, and it keeps request logs only for a short period under its own policy.

5. When you contact us

Every contact route on this site is a plain email link. If you write to us — about artist registration, a trade stand, sponsorship, crew work or anything else — we receive your email address, your name if you give it, and whatever you choose to put in the message.

We use it to answer you and to administer your request. The legal basis is either steps taken at your request before entering a contract (Art. 6(1)(b) GDPR) or our legitimate interest in responding to enquiries (Art. 6(1)(f)). We keep correspondence for up to 24 months after our last exchange, then delete it.

6. Mailing list and pre-registration

The newsletter and 2027 pre-registration forms ask for an email address, and pre-registration also asks whether you are coming as an artist, trader or sponsor.

We use it only to send you festival news and to tell you when registration opens. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by writing to us — withdrawing does not affect anything sent before.

Both lists are stored in our own database, hosted by Supabase in the EU. Only the festival team can read them: the website can add an address to the list but cannot read the list back, so no visitor can see who else has signed up. We keep an address until you ask us to remove it, or until 24 months after the last festival edition we contacted you about, whichever comes first. If we later use a mailing platform to send the emails, we will name that platform here.

7. Third parties this site touches

We keep these to a minimum, but you should know about them:

• Ticketing (CM.com). Weekend passes are sold on sales.ticketing.cm.com. Following that link takes you to a separate company that acts as its own data controller for the purchase — your payment details are handled entirely by them and never reach this website. Read their privacy policy before buying.
• Web fonts. Our typefaces are served from this website itself. Loading a page sends no request to Google Fonts or any other third-party font host.
• Supabase. The website's content — the artist lineup, the program, the trader and sponsor lists — is stored with Supabase and loaded when you open a page, and the two sign-up forms write to the same database. That request carries your IP address, as any request to any server does. The project is hosted in the EU. Supabase acts as our processor, not as its own controller.
• Outbound links. Links to Instagram profiles, Google Maps, the venue's own site and our traders' websites are ordinary links. Once you follow one you are on their site, under their policy. We do not embed Instagram or Maps content in our pages, so nothing loads from them unless you click.

We do not transfer personal data outside the EEA ourselves. Vercel, our host, is a US company and processes request data under standard contractual clauses; Supabase stores our content and sign-up lists on servers in the EU.

8. Your rights

Under the GDPR you can ask us to:

• confirm whether we hold data about you, and give you a copy (access);
• correct anything inaccurate (rectification);
• delete it (erasure);
• restrict or object to how we use it, including objecting to anything based on legitimate interest;
• hand it to you or another provider in a portable format;
• withdraw consent you previously gave.

Write to info@urbanartfestmalaga.com and we will reply within one month. There is no charge.

If you are not satisfied with our answer you can complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD), at www.aepd.es, or to the authority in your own EU country of residence.

9. Children

This site is not aimed at children and we do not knowingly collect data from them. Under-16s are welcome at the festival under the conditions set out in the house rules, but tattoo and contest participation has its own age requirements. If you believe a child has sent us personal data, tell us and we will delete it.

10. Security

The site is served over HTTPS. We hold very little personal data by design, which is the most effective protection available — data that was never collected cannot be breached.

11. Changes to this policy

If the site starts doing something new — connecting the mailing list, adding analytics, embedding a map — we will update this page and change the date at the top before that change goes live.

12. Contact

Questions about anything on this page: info@urbanartfestmalaga.com.