Privacy notice
How information is handled through the FIDAF Albania website, festival applications, suggestions, and email updates.
2026-11-11
Who is responsible
Gëzim Alimehmeti
“Abdi Toptani” Street, TORRE DRIN Shopping Center, Tirana, Albania
Privacy contact: fidaf.albania@gmail.com
Applications and participant information
The form collects group and contact details, participant lists (including names, passport numbers, birth dates and places), repertoire, shirt sizes, photos/videos, and travel details when supplied. Organisers use this information to review applications and arrange participation. Required fields are marked in the form; travel details can be completed later through a private email link.
Identity details are used where needed for accommodation, transport and visa assistance. Enter a passport number or place of birth only if the organiser has specifically requested it for an official or visa procedure relevant to your group. These fields are optional in the application. This website does not request passport scans; do not upload identity documents as application photos or videos. If an official procedure requires a scan, the organiser must explain the requirement and arrange a suitable separate channel.
For a person requesting participation or entering participation arrangements with us, we process the necessary information to take steps at their request and administer those arrangements. For information supplied about other group members, our basis is the legitimate interest in evaluating groups and coordinating their participation, subject to their rights and the particular protection owed to children. Newsletter consent and permission for promotional publication are separate from applying.
Informing participants and handling minors’ information
If you apply for a group, give participants this notice before sharing their information. Do not upload identity-document scans in the photo fields or provide more information than requested. A group application does not by itself authorise every future use.
Where a group includes minors, a group leader or another designated adult from the group is responsible for supervising and coordinating them. Before submitting a child’s information, the leader must inform the parent or legal guardian and obtain the authority or permission required for that child’s participation and data use. A supervision arrangement does not by itself establish parental authority or authorise promotional publication. Separate appropriate permission is needed for identifiable children in public media.
Service emails and newsletters
Submitting an application can generate a receipt email and a private link for completing travel details. These are messages about your application. Festival newsletter signup is optional, relies on your consent, and is not a condition of applying. Each newsletter includes an unsubscribe link. Festival participation does not automatically subscribe you without the relevant choice.
Suggestions and technical information
Suggestions include your name, message, and email if supplied. Email is required if you choose newsletter signup. The service also uses technical information to deliver the website and limit abuse.
We use suggestions and contact details to consider feedback and respond where appropriate. Our basis is the legitimate interest in improving the festival, handling enquiries and protecting the service against abuse. Do not include passport details or sensitive personal information in a suggestion.
Recipients and processing locations
Applications and their attachments are private and are not automatically published in website galleries. Authorised administrators can review and export information. Hosting, storage and email services process information to operate the website.
The organiser shares participant spreadsheets with the hotel for accommodation arrangements. Email and WhatsApp are used for communication with group leaders and festival coordination. Participant lists are not shared publicly or with sponsors. Share only the details a recipient needs; the full application and passport details are not routine hotel or WhatsApp attachments. Any additional disclosure for visa or official procedures must be explained for the relevant group.
The production application, database and private files are hosted on a netcup server in Nuremberg, Germany. Authorised festival organisers access them for festival work, including from Albania. The Supabase database and storage components are self-hosted on this server; the separate development database is not used for production applications.
Cloudflare provides the public static website and DNS through its distributed infrastructure and receives technical request information to deliver and protect those services. Private applications are submitted to the separate application API and are not stored in the public website build. Namecheap provides domain registration, not the application database.
Google Gmail sends festival application messages, administrator alerts and newsletters to people who have agreed to receive them. The organiser’s Google connection supplies the account email identity and sending permission; the website does not request permission to read the Gmail inbox. The service handles the recipients, composed message content and delivery information for those functions. Gmail connection credentials are encrypted in the private database and accessible only to authorised server processes.
A separate Google Drive connection stores encrypted recovery packages in the festival account. Its permission is limited to files created or authorised for this backup app. A new package is downloaded, authenticated and tested in an isolated recovery before the previous marked copy is removed. If replacement fails, the previous working copy remains. Backup credentials are kept in restricted private server configuration. Separately held recovery keys and copies are restricted to recovery work and are subject to the organiser’s retention and erasure procedures.
Google account data is used only for the disclosed sending and recovery functions. It is not sold or used for advertising. Its use and transfer follow the Google API Services User Data Policy, including the Limited Use requirements. The connected account holder can revoke access in Google Account settings; this stops future authorised access but does not by itself erase existing festival applications or recovery files. Contact the organiser about removal requests.
Cloudflare and Google operate international infrastructure, so their processing may occur outside Albania and the European Economic Area. Their applicable service terms and privacy arrangements govern their handling of information; the organiser remains responsible for assessing the transfer requirements that apply to this use. This notice does not promise that all processing remains in Germany. The organiser can provide further information about the providers and applicable arrangements at the privacy contact above.
Public photographs and videos
Photographs and videos submitted with an application are used for evaluation and selection; submission does not grant promotional publication permission. Festival photographs and videos may appear on official websites, social media and promotional materials only with appropriate permission. Groups retain ownership of their music, logos and artwork. Contact fidaf.albania@gmail.com about removal or rights requests. Existing archives and material featuring children require the relevant permissions too.
How long information is kept
Submitted applications are needed through the cycle from applications opening in November to the summer festival and related follow-up. The 24-hour device-draft limit does not apply to submitted applications.
Unsuccessful or withdrawn applications: 12 months after the application cycle ends, for administrative reference and follow-up.
Accepted applications and correspondence: 3 years after the festival, for organisational records and possible disputes. The shorter periods below apply to identity/travel details and private attachments within these records.
Passport numbers, identity and travel details: 3 months after the festival, for travel and visa arrangements; longer only where a continuing, specific need is documented.
Private application photographs and videos: 12 months after the festival, for evaluation and selection records. A separately authorised public festival archive has a different purpose.
Visitor suggestions and associated contact details: 12 months after the final response, for follow-up and organisational reference.
Newsletter subscriptions: until you unsubscribe or withdraw consent. After withdrawal we stop newsletters; only the minimum suppression and consent evidence needed to respect that choice and address claims may be retained.
Records needed for an active dispute or a grant obligation may be kept until that matter is resolved or the requirement is fulfilled, with access restricted to that purpose. Anonymous historical statistics may be kept for festival planning. Retention also needs to cover organiser-held exports and backup copies.
Your rights and contact
Subject to applicable law and its conditions, you can request information and access, correction, erasure, restriction, objection, or portability where relevant. Where processing relies on consent, you can withdraw it for future processing. Erasure is not unconditional where there are lawful reasons to retain information. The organiser may need appropriate identity verification.
Send requests to fidaf.albania@gmail.com.
You can complain to Albania’s Information and Data Protection Commissioner (idp.al). Do not send passwords or full identity documents with an initial request.
Device storage and changes
See Cookies & device storage for preferences, optional drafts, and deletion controls. This notice must be updated when purposes or providers change.
Back to the festival