Privacy Policy

1Who we are

zrcespringbreak.com is the website of Zrce Spring Break Croatia, organised by Maroon Horizon Ltd, a company registered in Ireland (“we”, “us”). We are the controller of the personal data described below.

For any privacy question or request, please use the contact form.

2Visiting this website

When you open the website, our hosting provider automatically processes technical data such as your IP address, the date and time, the page requested and your browser type. This is necessary to deliver the website and keep it secure (legitimate interest, Art. 6(1)(f) GDPR). Server logs are kept only for a short period.

3Buying tickets

When you book, we process:

• the buyer’s first name, surname, email address and mobile phone number (with its country code), and the name of every ticket holder;
• your order: weekend, tickets, upgrades, prices, discount or Festival Credit codes used, name changes;
• the time, IP address and browser type when you accepted the booking conditions (proof that you saw the no-refund and Festival Credit rules);
• your booking page: your login (we keep only a secure one-way hash of your password, never the password itself), and the time and IP address of logins and ticket downloads;
• the emails we sent you, and when;
• entry check: when each QR code is scanned at the festival.

We use this data to create and send your tickets and your personal booking page, to let you change names, add extras and use Festival Credit, to check tickets at the entrance and to answer your questions (contract, Art. 6(1)(b) GDPR). We use the acceptance record and order data to defend ourselves against unjustified chargebacks (legitimate interest, Art. 6(1)(f) GDPR) and keep accounting records as the law requires (Art. 6(1)(c) GDPR).

Booking emails (tickets, passwords, changes, Festival Credit) are sent from our own website server. Your personal booking page is reached through a private link and your login, and stops working after the festival.

4Payments

Payments are handled by Stripe (cards, Apple Pay, Google Pay, Revolut Pay, Klarna) and by PayPal. You enter your payment details directly with them, under their own privacy policies; we never receive your full card details. We receive the payment result, the amount, the payment method type, the country of the card or payment account and a reference, which we need to match the payment to your booking and to handle disputes. If a payment is disputed or charged back, we give the payment provider the record of your booking (what was bought, the accepted booking conditions, emails sent and use of the booking page) to answer the dispute (legitimate interest, Art. 6(1)(f) GDPR). If you pay with Klarna, Klarna may also process your data for its payment plan.

More information: Stripe Privacy Policy · PayPal Privacy Statement.

5Google Analytics, Meta and Reddit

We use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to understand how visitors use the website, for example which pages are viewed, where visitors come from and whether a booking was completed. GA4 does not log or store full IP addresses.

We use the Meta pixel (Meta Platforms Ireland Limited) and the Reddit pixel (Reddit, Inc.) to measure our ads on Facebook, Instagram and Reddit and to show our ads to people who visited our website. These tools use cookies and similar technologies, and the providers receive data about your visit, such as the pages you view and whether you booked.

Data may be transferred to the USA. Google, Meta and Reddit are certified under the EU-US Data Privacy Framework.

More information: Google Privacy Policy · Meta Privacy Policy · Reddit Privacy Policy. You can stop Google Analytics with the Google Analytics opt-out browser add-on, and manage ad settings in your Facebook, Instagram and Reddit accounts.

6Contact form

If you send us a message, we process your name, email address, what you choose under “I am” and “Weekend”, your booking number (optional) and your message to reply to you (Art. 6(1)(b) and (f) GDPR). The message is delivered to our team by email and kept only as long as needed to handle your request and any follow-up.

Spam and fraud protection: the contact form, the ticket checkout and the booking page login use Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). It is loaded only on those pages and checks, mostly without puzzles, whether the form is used by a person, processing technical information about your browser and device (legitimate interest in preventing spam, Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework. Cloudflare Privacy Policy.

7Videos

Aftermovies and highlights are shown as a picture first. Only when you press play is the player loaded – YouTube in its privacy-enhanced mode (youtube-nocookie.com) or Vimeo. YouTube (Google) or Vimeo then receives data about your visit. Google Privacy Policy · Vimeo Privacy Policy.

8At the festival

The festival is filmed and photographed for aftermovies, our website and social media, so you may appear in photos and videos (legitimate interest in showing and promoting the event, Art. 6(1)(f) GDPR). If you do not want a particular photo of you to be used, contact us and we will remove it from our channels.

9Outside websites and partner links

The party boat, places to stay and travel are booked with outside providers. When you follow such a link, that provider receives data about your visit and handles anything you enter there under its own terms and privacy policy.

Some of these links are affiliate links. This means the partner can recognise that you came from our website, and we may earn a commission if you book. It does not change the price you pay.

10How long we keep data

• Bookings and order data: as long as needed for the festival, Festival Credit and any disputes, and accounting records for as long as Irish law requires (generally 6 years).
• Security copies (backups) of the booking database: up to 90 days.
• Contact messages: as long as needed to handle your request.
• Server logs: a short period only.

11Your rights

Under the GDPR you have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, to data portability and, where processing is based on consent, to withdraw your consent at any time. To exercise your rights, please use the contact form.

You also have the right to lodge a complaint with a supervisory authority, in Ireland the Data Protection Commission.

12Changes

We may update this policy when our website, booking or services change. The current version is always on this page.