Privacy and cookies
One purpose at a time and one cookie at a time. Nothing hidden in a footnote.
Last updated · August 2026
This page explains what data we collect, what for, on what legal basis, and what you can do about it. It is written to be read, not to cover us.
Who is responsible
EMEC CANARIAS PRODUCCIONES, S.L.
Tax ID B56191661
C/ Reina Sofía 3, 35510 Puerto del Carmen, Lanzarote, Spain
hola@emecfestival.com
What we do with your data
Early Bird pre-registration
What we collect: first and last name, email address, mobile number with its dialling code, the country of that code, and the language you were browsing in.
What for: to tell you the line-up, the running times and the on-sale date before everyone else, and to give you access to the Early Bird tier. The phone number is used for the SMS or WhatsApp alert when sales open, which is the part of pre-registration that arrives in time.
Legal basis: your consent (Art. 6(1)(a) GDPR), given by ticking the box on the form. You can withdraw it at any time.
How long: until you unsubscribe or ask us to delete you. Every email we send carries an unsubscribe link.
Who else sees it: Brevo (Sendinblue SAS, France), the tool we use to manage the list and send the emails, as a data processor.
Where it is stored: the list itself lives in Brevo. Each sign-up is also written to an internal log hosted by Upstash, likewise as a data processor, with the same data and with whether Brevo accepted it. That log exists so a technical failure cannot make a sign-up disappear unnoticed: if it does not go through, we can redo it. When you unsubscribe or ask us to delete you, it is deleted from that log too.
Ticket upgrade requests
What we collect: name, purchase email and both ticket IDs — the previous ticket and the new one.
What for: to process the refund for the ticket you are replacing. Without that data we cannot identify the purchase or return your money.
Legal basis: performance of the contractual relationship arising from your purchase (Art. 6(1)(b) GDPR).
How long: as long as accounting and tax law require for the refund transaction.
Where it is stored: as with contact messages, in an internal panel with username-and-password access, as well as arriving by email. It is what keeps a refund request from getting lost among emails.
Contact form
What we collect: your name, your email, the subject you pick and the message you write.
What for: to reply. Without the email address there is no way.
Legal basis: your consent (Art. 6(1)(a) GDPR), given by ticking the box on the form.
How long: one year from when the enquiry is closed.
Where it is stored: the message is recorded in an internal panel that only the team can reach, each with their own username and password, and it also arrives by email in our inbox. It is stored so enquiries do not get lost: an email can go unseen, a record cannot.
The storage provider is Upstash, as a data processor. We do not share this data with anyone else.
Cashless wristband (RFID)
If you activate wristband payment, we process the data needed to make electronic payment possible and to link the wristband to your card. This is necessary to provide that service (Art. 6(1)(b) GDPR); without it the wristband cannot be activated as a means of payment. We do not share this data with anyone.
Website measurement
Only if you accept it in the cookie notice. Full detail below.
Cookies
The first time you arrive, we ask. Until you decide, no measurement or advertising cookie is loaded, and if you choose "essential only" none is loaded afterwards either. If you change your mind, they are actually deleted — we don't just stop using them.
Essential
| Cookie | Whose | What for | Lifetime |
|---|---|---|---|
emec_consent |
EMEC (first party) | Storing your cookie decision, so we don't ask again and so the server knows what it may and may not do. | 6 months |
This one cannot be switched off: without it there is no way to remember that you said no. It is not used to profile you and it does not leave this site.
Analytics — only with your consent
| Cookie | Whose | What for | Lifetime |
|---|---|---|---|
_ga, _ga_* |
Google Analytics 4 (Google Ireland Ltd.) | Counting visits and understanding which pages get used, in aggregate. | up to 2 years |
Advertising — only with your consent
| Cookie | Whose | What for | Lifetime |
|---|---|---|---|
_fbp, _fbc, fr |
Meta (Meta Platforms Ireland Ltd.) | Measuring how the festival's campaigns perform and showing ads on Instagram and Facebook. | up to 3 months |
Measurement from our server. If you accept advertising cookies, when you complete pre-registration we also report that conversion to Meta from our own server, not only from your browser. That report includes your email and phone number one-way encrypted (SHA-256, they cannot be reversed), your IP address and your browser. It exists so we know which campaign worked. Without advertising consent, it is not sent.
Tickets
The tickets page loads the Xceed sales system, which handles the purchase and the payment, with its own cookies and its own privacy policy. It only loads on that page and only when sales are open.
From your browser
Beyond our notice, your browser lets you block or delete cookies from its privacy settings, and they all have a private browsing window. Look it up in your browser's help: Chrome, Safari, Firefox and Edge all have it under Settings → Privacy.
Transfers outside the European Union
This site is hosted by Vercel Inc. (United States), and contact messages and upgrade requests are stored with Upstash, Inc. (United States), in a database located in the European Union. If you accept measurement, Google and Meta may process data in the United States. These transfers rely on the standard contractual clauses approved by the European Commission and, for Google and Meta, on their certification under the EU–US Data Privacy Framework.
What you can do
You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, to portability, and to withdraw your consent at any time.
To exercise them, write to hola@emecfestival.com with your request and a copy of your ID, or by registered post to EMEC CANARIAS PRODUCCIONES, S.L., C/ Reina Sofía 3, 35510 Puerto del Carmen, Lanzarote, Spain.
If you think we have got something wrong, you can complain to the Spanish Data Protection Agency. We would rather you told us first: we will try to fix it without you having to go there.
We do not sell your data. We do not profile you. We will not write to you about anything other than EMEC Festival.