Privacy Policy

The data controller responsible for processing your personal data is:

We have not appointed a Data Protection Officer (DPO) — our processing does not meet the thresholds in GDPR Art. 37. You can reach the controller directly at the email above.

When you buy a ticket, we collect:

• Name and email address
• Phone number (optional) — only if you choose to provide it at checkout, used solely to contact you about your order or urgent event matters; stored with the purchase record (5 years, bookkeeping law) and shared with Stripe as part of the payment
• Optional details you may be asked for at checkout — dance role (leader/follower), gender, and country/city of residence — only if the organizer enables them, used for event planning and the attendee mix. These are kept in a record separate from your payment receipt and are erased when you delete your data (unlike the receipt itself, which bookkeeping law requires us to retain for 5 years)
• Payment details — handled directly by Stripe; we never see or store your card number
• QR ticket code and Wallet pass identifiers

When you sign in with Google or Apple (for the attendee account, admin tools, or onboarding wizard), we receive from the provider:

• Email address
• Display name and profile picture (where the provider returns them)
• A signed authentication token, stored in a session cookie

You can also sign in with a one-time email code (attendee accounts), without Google or Apple. In that case we use:

• Your email address, and a 6-digit code we send to it — the code is stored only as a one-way hash, can be used once, and expires after 10 minutes
• A signed authentication token, stored in a session cookie (as above)

If you bought a ticket with a different email, you can add that address to your account to see its ticket — confirmed by the same kind of one-time code. You can remove a linked address at any time, and it is erased when you delete your data.

If you opt in to the attendee directory or social features, we additionally store:

• The profile fields you choose to share (city, dance level, social handles, and an optional profile photo — visible only to people you connect with)
• Your connections, pending connection requests (incoming and outgoing), connection invite links, and the sessions you star on the schedule
• In-app notifications you receive (e.g. “X wants to connect”), which include the display name of the attendee who triggered them
• Push-notification subscription tokens (where you grant push permission)
• Posts you add to the Lost & Found board (text and an optional photo) are visible to anyone with the link. The board listing is removed automatically within 24–48 hours; to have an uploaded photo taken down sooner, contact us.
• Reviews you submit after the festival (a star rating, an optional written review, and an optional display name). Once an organizer approves it, the review — including the display name you enter — is published publicly on our Reviews page and is kept until erased (see Sections 6 and 7). If you are signed in when you submit, we also store a one-way hash of your account email with the review so that deleting your data also removes your reviews.
• Guest-dancer applications (your name, Instagram handle, Google account email, the country you are from and, if you give it, your city, the dance styles you enjoy, whether you dance as a leader, follower or both (if you say), a link to a video of you dancing if you add one — or, if you don’t, your answer that you want to apply without a video — a photo you upload, your comment, whether you would like to hold privates during Nordic (applications sent on 7 October 2026 may instead list the dance styles you would like to do privates in), whether you have attended before, your confirmation that you are 18 or older, that you agree to follow our Code of Conduct and that, if you are accepted, your account may be given access to the festival app, and the wording and time of each statement you agreed to). Used by organizers to select guest dancers and to contact you about your application. To compare applications, organizers give each one an internal score from 1 to 10; it is stored with your application, used only for selection, and deleted with it. Separately, and only if you tick the optional box, we may use your photo, video and text on the festival’s website and social media to promote Nordic 2027 — applying never depends on it, and you can withdraw it at any time by unticking it and updating your application, or by emailing us (Section 13). The application is linked to your account so deleting your data removes it and its photo.

If you use “find my contacts” to see which of your contacts are attending, your device computes a one-way hash of your contacts’ email addresses and sends only those hashes for matching. We never receive or store the actual email addresses, and the hashes are discarded immediately after matching.

Technical data we process automatically when you visit the site:

• IP address — used briefly for rate-limiting, fraud prevention, and abuse logs
• Browser, device type, and operating system (from request headers)
• Service-worker installation and PWA install events
• Anonymous traffic counts via Vercel Analytics — no cross-site tracking
• First-party interaction events — when you tap key buttons (buy a pass, join the waitlist, install the app) we record the action name, a timestamp, and a “surface” label. No name, email, cookie, or device fingerprint is attached. Kept for 90 days for conversion measurement. Lawful basis: legitimate interest (Art. 6(1)(f))

• Issue your ticket, deliver the Apple/Google Wallet pass, and verify it on entry
• Send event communications: schedule updates, city guide, urgent notices during the event
• Operate the admin and onboarding tools used to run the festival
• Protect the site from abuse (rate-limiting, fraud detection, session revocation)
• Power optional social features (attendee directory, connections, push alerts) — only with your opt-in
• Review guest-dancer applications and contact applicants — and, only with an applicant’s separate optional consent, use their photo and video to promote the festival
• Comply with Norwegian accounting and tax obligations

• Contract performance (Art. 6(1)(b)) — issuing tickets and delivering the event you paid for.
• Consent (Art. 6(1)(a)) — optional features (attendee directory, push notifications, marketing emails). You can withdraw consent at any time without affecting prior lawful processing.
• Legitimate interest (Art. 6(1)(f)) — site security, fraud prevention, anonymous traffic measurement.
• Guest-dancer applications — reviewing your application is a step you ask us to take before a possible guest-dancer agreement (Art. 6(1)(b)); the required boxes record that request and that you are 18 or older. Using your photo, video or text to promote the festival relies only on your separate, optional consent (Art. 6(1)(a)); you can withdraw it at any time and it never affects whether we consider your application.
• Legal obligation (Art. 6(1)(c)) — Norwegian bookkeeping law (bokføringsloven) requires us to retain payment records.

We share specific data with the processors below. Each is bound by a data-processing agreement (DPA) where required. International transfers outside the EEA rely on Standard Contractual Clauses (SCCs) and, where available, the EU-US Data Privacy Framework.

• Stripe Payments Europe Ltd. (Ireland, with US sub-processors) — payment processing. stripe.com/privacy
• Google Ireland Ltd. — OAuth sign-in (admin, onboarding, and attendee accounts) and Google Wallet pass delivery. policies.google.com/privacy
• Apple Distribution International Ltd. — OAuth sign-in and Apple Wallet pass delivery. apple.com/legal/privacy
• Vercel Inc. (USA) — website hosting, privacy-friendly analytics, and Blob storage for uploaded images. vercel.com/legal/privacy-policy
• Upstash Inc. (with EU data residency) — Redis storage for live event data (rate limits, schedule patches, attendee directory). upstash.com/trust/privacy-policy
• Resend, Inc. (USA) — transactional email delivery: ticket confirmations, sign-in codes, and account/service notices. Receives your email address and the message content. resend.com/legal/privacy-policy
• MET Norway — weather data for the event page. No personal data is sent to MET; the call is server-to-server.
• hCaptcha (Intuition Machines, Inc.) (USA) — anti-abuse CAPTCHA on anonymous posts to the Lost & Found board. Receives your IP address and a challenge token. hcaptcha.com/privacy
• Meta Platforms Ireland Ltd. — Instagram feed embeds on the landing page, loaded only after you accept optional cookies (or tap “Allow and load the feed”). When loaded, Meta receives your IP address and sets its own cookies. instagram.com/policy

• Ticket and payment records: 5 years after the financial year ends (Norwegian bookkeeping law). This legal obligation overrides erasure requests for these specific records.
• Sign-in session tokens: up to 30 days (rolling — the session refreshes while you stay signed in; signing out ends it immediately)
• Attendee-directory profile data, connections, and starred sessions: kept while your account remains active, so your profile, connections, and linked-email ticket access keep working across editions (like Social Stars 2027). Delete them yourself at any time via My Page → Delete my data — it takes effect immediately.
• In-app notifications: auto-expire about a week after they arrive, and are removed when you delete your data
• Push-notification tokens: until you revoke push permission, uninstall the app, or delete your data (whichever comes first)
• Reviews (rating, written review, display name): published reviews are retained indefinitely as they are public feedback about the event. If you were signed in when you submitted, deleting your data also removes your reviews; otherwise email us (Section 13) or ask an organizer and we will remove a review for you.
• Guest-dancer applications (including the uploaded photo): deleted automatically 30 days after the 2027 festival ends (1 September 2027); our weekly clean-up removes them within the following 7 days. Deleting your data removes them earlier. Material we have already published with your optional consent is not automatically withdrawn — email us (Section 13) to ask for it to be taken down.
• Waitlist sign-ups: removed when you delete your data, otherwise cleared after the event
• Onboarding submissions (organizer/partner content): 12 months after your last edit, then automatically deleted
• Anonymous traffic data (Vercel Analytics): only loaded if you accept analytics cookies; aggregated only, no per-user retention

You may request earlier deletion at any time — see Section 7.

You have the following rights regarding your personal data:

• Access — receive a copy of the data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion (subject to retention obligations)
• Restriction — limit how we process your data
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interest
• Withdraw consent — at any time, without affecting prior lawful processing

To exercise any of these rights, email hello@nordicoslo.com. We respond within 30 days.

You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no.

We use a small number of cookies and storage entries — all either essential or based on legitimate interest:

• authjs.session-token — admin / onboarding / attendee OAuth session (essential)
• nbc-cookie-consent — stores your cookie choice (essential / accepted) for 1 year; first-party, not shared
• Service-worker cache — offline schedule and event data (essential, no personal data)
• Vercel Analytics — anonymous aggregate traffic (no cross-site tracking; loaded only after you accept)
• Vercel Speed Insights — anonymous Core Web Vitals performance metrics (no cookies; loaded only after you accept)

We do not use advertising or third-party tracking cookies.

We protect your data with TLS encryption in transit, rate-limiting against abuse, Argon2id-hashed credentials for any break-glass paths, signed and rotated session tokens, and strict role-based access control. Session revocation is enforced on every privileged action.

No system is perfectly secure. If a breach affects you, we will notify you within 72 hours per GDPR Art. 33–34 and inform the Norwegian Data Protection Authority.

This event and website are intended for adults (18+) and minors attending with a guardian. We do not knowingly collect personal data from children under 18. If you believe a child has provided data, email us and we will delete it. Guest-dancer applications are only open to people 18 or older: we ask every applicant to confirm this, and we delete any application we learn came from someone younger.

Some of our processors are based in or transfer data to the United States (Stripe, Google, Apple, Vercel). These transfers rely on the EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. You can request copies of the relevant transfer safeguards at hello@nordicoslo.com.

We may update this policy as our practices evolve. The “Last updated” date at the top reflects the most recent change. We will notify ticket holders by email of material changes at least 14 days before they take effect.

For privacy questions or to exercise your rights, contact:

hello@nordicoslo.com