Privacy Policy

1. Who processes your data

The controller of your personal data is FANTASTIC TECH d.o.o. za usluge i trgovinu, Buonarrotijeva ulica - Via Michelangelo Buonarroti 15, 52100 Pula, company ID (OIB): 92035950834.

For any data protection question, or to exercise your rights, contact us at info@zagrebgamesweek.com.

2. What we collect and why

We do not collect data "just in case". Every item below is tied to a specific action you take yourself.

• Newsletter signup: your email address and site language, used only to send festival news.
• Form submissions (exhibitors, cosplay, tournaments, volunteers, Creator Club, press): your name, email address and the answers you enter, used to process your application and contact you about it.
• Webshop orders: your name, email address, delivery address, ordered items and amount, used to fulfil the order, issue an invoice and communicate about it.
• Payment data: card numbers and other payment details are processed solely by Stripe. That data never reaches our servers and we have no access to it.
• Technical data: your IP address is held briefly in memory to rate-limit form submissions and prevent abuse. It is not written to our database.
• Usage data: collected only if you have accepted cookies (see section 4).

3. Our legal bases

• Consent (Art. 6(1)(a) GDPR): newsletter, analytics and advertising cookies. You can withdraw consent at any time.
• Performance of a contract (Art. 6(1)(b)): processing webshop orders and handling your form submission.
• Legal obligation (Art. 6(1)(c)): retention of invoices and accounting records.
• Legitimate interest (Art. 6(1)(f)): site security and protection against automated abuse.

4. Cookies and measurement

We set no analytics or advertising cookies without your consent. Until you decide, Google Analytics and Google Ads run in a limited, cookieless mode, and the Meta Pixel is not loaded at all.

You can change your decision at any time via the "Cookies" link in the site footer.

• Necessary: remembering your cookie choice, your shopping cart, and internal logins. The site cannot work correctly without these, and they do not require consent.
• Analytics (Google Analytics 4): how many people visit and which content they view. The data is aggregated and not used to identify individuals.
• Advertising (Google Ads, Meta Pixel): measuring campaign performance and showing more relevant ads.
• Video: the homepage teaser is embedded through YouTube's youtube-nocookie.com domain, which sets no tracking cookies unless you start the video.

5. Who we share data with

We do not sell your data or pass it to third parties for their own purposes. We share it only with service providers who process it on our instructions, limited to what their service requires:

• Supabase — the database holding submissions, newsletter signups and orders.
• Stripe — webshop payment processing.
• Resend — sending order and submission emails.
• Vercel — website hosting.
• Google (Analytics, Ads) and Meta (Pixel) — measurement and advertising, only with your consent.

6. Transfers outside the European Economic Area

Some of the providers listed above operate servers or entities in the United States. Where that applies, transfers rely on the European Commission's Standard Contractual Clauses, or on the adequacy decision for the EU–US Data Privacy Framework for providers certified under it.

7. Ticket purchases

Tickets are not sold on this site. Purchases happen through our partner ticket.io, whose system is embedded on the tickets page. Any data you enter there is collected and processed by ticket.io as an independent controller under its own privacy policy, which we recommend reading before you buy.

8. How long we keep data

• Newsletter: until you withdraw consent. You can unsubscribe at any time.
• Form submissions: until the end of the festival plus one year, for follow-up questions and planning the next edition.
• Orders and invoices: 11 years, as required for accounting records under Croatian law.
• Analytics data: according to the default retention periods of Google and Meta.

9. Your rights

In relation to your personal data you have the right to:

• access — find out what data we hold about you,
• rectification of inaccurate or incomplete data,
• erasure (the "right to be forgotten"),
• restriction of processing,
• data portability in a machine-readable format,
• object to processing based on legitimate interest,
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

10. Complaints to the supervisory authority

If you believe we are not processing your data lawfully, you may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr. We would appreciate hearing from you first — most things are resolved faster that way.

11. Data security

The site uses an encrypted HTTPS connection. Database access is server-side only and limited to people who need it for their work. We never receive or store card details.

12. Children

This site is not intended for children under 16 and we do not knowingly collect their personal data. If we learn that we have collected such data without parental consent, we will delete it.

13. Changes to this policy

We may update this policy from time to time, for example when we introduce a new service or tool. The date of the last change is shown at the top of the page. If a change materially affects processing for which we asked your consent, we will ask again.