1. Scope

This privacy statement (hereinafter: “Privacy Statement”) applies to the processing of your personal data in the context of Tomorrowland Winter. Tomorrowland Winter is an event of the WEAREONE group that takes place in France, in the ski area of Alpe d’Huez (municipality of Huez, department of Isère).

The controller is WEAREONE.world BV, a private limited company under Belgian law, with registered office at Kattendijkdok-Westkaai 12, 2000 Antwerp, Belgium, registered with the Crossroads Bank for Enterprises under enterprise number 0867.239.782, and/or a company affiliated with it within the meaning of Article 1:20 of the Belgian Code of Companies and Associations. Within the group, Tomorrowland Winter is organised in particular by or on behalf of TL Winter BV. In this Privacy Statement these companies are collectively referred to as the “WEAREONE group”, “we”, “us” and “our”, and each individually as “WEAREONE” or “WEAREONE group company”, including their acquirers and legal successors.

One brand of the WEAREONE group is Tomorrowland. By “Tomorrowland” we mean all festivals, events, products and activities that are organised, produced or offered by or on behalf of the WEAREONE group under the name Tomorrowland or under affiliated brands, concepts and companies, including Tomorrowland Winter. If you take part in our activities or use our applications and services, specific terms may apply in addition to or in derogation from this Privacy Statement. We advise you to always read them carefully.

Because Tomorrowland Winter takes place in France, French law also applies to certain processing operations, in addition to the General Data Protection Regulation (GDPR). Where this is the case, we explain it below.

This Privacy Statement does not apply to websites, services or applications of others, even if they are accessible via our websites (such as third-party websites, forums, social media, newsgroups and/or apps). We have no control over the information you post there or how it is processed, nor are we responsible for it. It is up to you to consult the privacy policy of these third parties for more information on how they handle your personal data.

We may amend this Privacy Statement at any time. To check when we last updated the Privacy Statement, you can consult the “Last updated” date at the bottom of this page. All changes take effect as soon as we make them available on our websites.

If you have any questions about this Privacy Statement or about the way we process your personal data, please contact us by e-mail at dpooffice@tomorrowland.com or via the contact form if you have a Tomorrowland Account.

2. Why we process your personal data

2.1 Pre-registration and ticketing

During the pre-registration process for the ticket sales of our events and the events for which we are co-promoter, we process your personal data in order to contact you in advance when the actual ticket sale starts. To carry out the ticket sale, we process your identification data, such as your name, date of birth, gender and nationality. We also process certain specifications of your purchase, such as the ticket type you prefer. To complete the purchase process we also process necessary payment data, such as your bank card number, of the ticket buyer.

To confirm your order and send you the tickets we process your contact details. When your ticket is delivered electronically, this is your e-mail address. When your ticket is delivered physically, such as the Tomorrowland Bracelet, we process your delivery address.

During the pre-registration process we process your personal data at your request and on the basis of your consent. As soon as your pre-registration results in the purchase of a ticket, we rely on the necessity for the performance of the purchase agreement. To the extent that we are under a legal obligation to carry out fraud prevention, we rely on our legitimate interest in efficiently complying with that legal obligation. We also rely on our legitimate interest when we process your personal data to make the ticket sale run as efficiently and securely as possible, and to use statistical information about the pre-registration process and the ticket sale to evaluate and improve our processes. The ticket sale and pre-registration are managed from Belgium; Belgian data protection law applies to the ticket sale, with the Belgian Data Protection Authority (GBA/APD) as the competent supervisory authority. Processing operations that physically take place at the event in Alpe d’Huez are subject to French law and to the supervision of the Commission nationale de l’informatique et des libertés (CNIL).

2.2 Event visit

Our tickets are personalised (name-bound). This means that at the entrance to the event we may ask you for your identification data, such as your name, so that we can check whether it matches the name on your ticket. Tomorrowland Winter takes place in a mountain environment and a ski area; access control and access management are organised at the locations concerned. When you buy Pearls and/or make on-site purchases, we also process your payment data. For the secure handling of these transactions we rely on external providers.

For these processing operations we rely on the necessity for the performance of our purchase agreement. Because we aim to give our visitors unique and unforgettable moments, we may in certain circumstances, for example to accommodate your special requests, also process your personal data. In those cases we rely on our legitimate interest in providing you and other visitors with a unique experience. To the extent that we process statistical information about your visit, we rely on our legitimate interest in continuing to work on unique visitor experiences in the future.

2.3 Atmospheric images and close-ups

During our events we take atmospheric images which we use, among other things, in aftermovies and social media posts. If we bring you into focus specifically, this is on the basis of your consent. Please note that consent for the recording and use of your image is not always required and may moreover be implicit. For the processing of your personal data we rely on our legitimate interest in promoting our events to a wider audience and in keeping archives of our various events.

2.4 Special event facilities

At your request we can arrange special facilities to tailor your visit to your specific physical and/or medical needs. For the processing of your personal data to achieve this, we ask for your consent.

2.5 Travel, accommodation, and ski options

For Tomorrowland Winter we offer – whether or not through our travel, accommodation and ski partners – certain travel, accommodation and ski options, for example within the framework of the Global Journey offer. When you wish to link such an option to your visit, we process, among other things, identification data, such as your name, contact details, such as your e-mail address, and certain particulars, such as your preferred travel class, your accommodation preferences and the data required for a ski pass (lift pass) or comparable access to the ski area. We need this information in order to make and confirm the necessary reservations and links. To complete your purchase we also process necessary payment data, such as your bank account number. The legal basis for this processing is the necessity for the performance of the agreement.

For the ski pass and access to the ski area, we may exchange certain data with the operator of the ski area and/or with accommodation and travel partners, solely to the extent necessary to provide the service you have chosen. These parties may act as independent controllers for their own processing; we advise you to also consult their privacy statement.

To optimise your travel and stay, you can also share certain preferences, such as your interest in specific activities from the Global Journey offer. In that case we process your preferences in combination with your identification and contact details so that we can contact you with suggestions. For this we ask for your consent.

2.6 Communication

Customer service and complaint handling

We communicate directly with you when you contact us with questions, comments or complaints. To communicate with you we process your identification data, such as your name, contact details, such as your e-mail address, and any other information you provide to us. To handle your question, comment or complaint we also process the content of your communication and its practical details. Depending on the type of request, we may share your request, if this is necessary for handling it, with others. The legal basis for this processing is our legitimate interest in responding efficiently to questions and comments and in handling complaints smoothly. To the extent that we use contextual information from your communications to train our people internally, we rely on our legitimate interest in improving our interactions with customers.

Practical communications

We send you practical information about the events, activities and other initiatives for which you are registered. Such communications may relate, among other things, to special access conditions, accessibility, payment options, weather and snow conditions, mobility in and to the ski area, and so on. In addition, these practical communications may contain relevant details of products and services offered by our partners at or around the event, for example partners in the ski area or the accommodation location. For these communications we process identification data, such as your name, contact details, such as your e-mail address, and registration information.

We only send you our updates when you have given your consent for this or asked us to keep you up to date, for example by subscribing to a specific newsletter, unless you are an existing customer and we keep you informed of similar products and services that we think you will find interesting. You can always change your preferences or unsubscribe via the “unsubscribe” link at the bottom of our e-mails.

Targeted communications

We like to inform you about our events and activities, but also about other projects, brands and initiatives, such as Tomorrowland Store, Tomorrowland Academy, Terra Solis, Love Tomorrow, and others. When you have given your consent for this, we will also inform you about products or services of partners with whom we cooperate. For this type of communication we process identification data, such as your name, and contact details, such as your e-mail address.

Marketing based on personalised preferences

To make our messages as relevant as possible, we may, solely when you have expressly given your consent for this, combine personal data from various sources to build a profile of your interests. This concerns, among other things, preferences you have stored in your account or information about your purchases.

This data is collected via our digital channels (such as the website, e-mails, apps and purchase history) and processed via a central platform. You can change or withdraw your preferences at any time via the preference portal of your Tomorrowland account. Withdrawing consent does not affect the lawfulness of processing carried out before the moment of withdrawal.

Measuring e-mail engagement

When we send you marketing and newsletter communications, we like to know how those communications are performing. That is why we may use so-called tracking pixels in our e-mails. This is a small, invisible element that allows us to measure whether and when you open an e-mail and whether you click on links. We use this information solely to measure how our e-mails perform and to improve the quality and relevance of our communication. We do not use these pixels to build a profile of you.

We only place these tracking pixels when you have given your consent for this. This consent is separate from your choice to receive our e-mails: you can give or withdraw it separately, and withdrawing it does not affect the e-mails you continue to receive from us. You can adjust your choice at any time via the preference portal of your Tomorrowland account.

For sending our e-mails and measuring engagement we rely on an external service provider that acts as a processor (see section 5.1). We keep the opening and engagement data for a maximum of one year. If this data is processed outside the EEA, the safeguards described in section 5.2 apply.

Customer satisfaction surveys and questionnaires

To optimize our general services we may invite our existing customers to take part in satisfaction surveys or to share experiences in broader questionnaires. For this we process identification data, such as your name, and contact details, such as your e-mail address. In addition, we also process other information about you that emerges from the research and that you provide to us in this context. We rely on our legitimate interest in inviting you to voluntarily take part in our surveys. Participation is not an obligation and the choice is entirely yours. We will try as much as possible to decouple your answers from you as an individual. This does, however, imply that we will reasonably not always be able to comply with certain follow-up requests, such as an access request.

From time to time we may cooperate with academic or scientific research partners (such as universities or recognised research institutions) to conduct broader research relevant to our sector — for example research into audience experience, sustainability or innovation in the live entertainment industry. In such cases the research partner acts as an independent controller for the research itself, and we may share limited contact details (such as your name and e-mail address) with them on the basis of our legitimate interest in supporting independent scientific research relevant to our sector. You are always informed in the invitation about the partner and the purposes of the research, and participation remains entirely voluntary. You can object at any time to such use of your contact details, as further described in section 7.

2.7 Website

To provide content on our website, to make it function optimally and to enable you to browse it, we may process your personal data. This will primarily be technical data about the device you use, such as the type of browser, and technical identifiers, such as your IP address.

The legal basis for this processing is our legitimate interest in providing our website and allowing you to use it. For the placing and reading of cookies and similar technologies that are not strictly necessary, we ask for your consent, in accordance with Article 82 of the French Informatique et Libertés Act and the CNIL guidelines, whereby refusing is as easy as accepting. You will find more information about this in our cookie policy and in the cookie banner on our website.

2.8 Tomorrowland Account

When you create a Tomorrowland account, for example for purchases in the Tomorrowland Store, we process, among other things, identification data, such as your name, date of birth, gender and nationality. In addition, we process contact details, such as your (e-mail) address and telephone number. We also store certain preferences and interests, such as your music preferences, if you have shared that information with us.

For the processing necessary to manage your account, we rely on the necessity for the performance of the agreement. For the processing of your preferences we ask for your consent. If we process your account information to safeguard and improve the use and security of your account, we rely on our legitimate interest in securely offering and continuing to optimise our products and services. If you delete your account, we keep your account information at least until your account is fully closed. If we have legitimate grounds for this, we may keep your account information for a longer period on the basis of our legitimate interest, for example when we are involved in legal proceedings or a dispute is pending. In that case your account information is kept separately from other active accounts.

2.9 Tomorrowland App

To enable you to use the Tomorrowland app, we process identification data such as your first name. In addition, we process your account information (see above) and technical data of the device with which you log in. We also collect information about your use and interactions within the app. If you have given your consent for this, we process your location data.

We process your personal data in this context to provide you with the service you request, thus on the basis of the necessity for the performance of our agreement. For the data we process to safeguard and improve the use and security of the app, we rely on our legitimate interest in securely offering and continuing to optimise our products and services. For the processing of location data we ask for your consent.

2.10 Community activation

We organise contests and other initiatives to increase engagement among the People of Tomorrow. If you take part in this, we process your identification data such as your name and, where applicable, contact details such as your e-mail address. If a financial reward is linked to the initiative for certain winners, and you are one of the winners, we will also process your payment data or other necessary information to pay out the reward to you. For some initiatives we may request content, such as images. We ask you to comply with our terms and conditions and to ensure that you respect the rights of others. Finally, in this context we may also process certain personal characteristics, preferences and interests that you provide to us or that emerge from your participation, such as your favourite artist. To the extent that we do not ask for consent, we rely for this processing on our legitimate interest in strengthening engagement within our People of Tomorrow community.

2.11 Tomorrowland Store

We process your personal data when you buy items in our Tomorrowland Store, on-site or online. If desired, you can carry out the online purchase with your Tomorrowland account (see section 2.8). In addition, we process contact details, such as your e-mail address and delivery address, to confirm and deliver your purchase. For these purchases we process your bank account number to enable the financial transactions. Finally, we process certain preferences, interests and consumption behaviour, such as your personal purchase history.

The processing necessary to enable the sale of our Tomorrowland Store items is necessary for the performance of our agreement. We base the processing of your personal data for keeping your personal purchase history on our legitimate interest in offering our products and services in the most customer-friendly way possible and in optimising our services. For the processing of your preferences, interests and consumption behaviour we ask for your consent.

2.12 Matching via advertising platforms

For advertising purposes we use a special technique whereby your data is first encrypted and pseudonymised, so that it cannot be directly traced back to you. Only this encrypted data is compared, in a secure environment, with the likewise encrypted data of advertising platforms. Only when there is an exact match can the platform show you a targeted advertisement; without a match, nothing happens. During this process, name, e-mail address or other identifiable details never leave our environment.

When you have expressly given your consent for this, we may also share certain segment characteristics about you with selected partners who want to show you their own offer (outbound sharing). This may take place via a secure technical environment (such as a data clean room or a comparable method, for example a direct upload to the advertising platform). This concerns segment characteristics such as derived interests (e.g. music preferences), demographic indicators (e.g. age category or region) and engagement data (e.g. previous interactions). We do not share any name or e-mail address here, but only pseudonymised identifiers (e.g. hashed e-mail addresses or identifiers of the advertising platform).

This outbound sharing takes place per partner category and solely for the category/categories for which you have given consent. When a new partner is added within a permitted category with the same purpose, and that partner is established within the EEA or in a country for which a transfer mechanism already exists or for which an adequacy decision applies, you receive a notification of this. When a partner is added with a materially different purpose, or when a transfer takes place to a country outside the EEA without an existing transfer mechanism, we ask for your consent again.

For certain collaborations we determine, together with the platform provider and/or the partner, certain aspects of the audience definition and/or the campaigns (for example on advertising platforms such as Meta, TikTok or YouTube). To that extent we and the platform provider and/or partner concerned act as joint controllers within the meaning of Article 26 GDPR, limited to those aspects of the processing for which we jointly determine the purpose and the essential means. We make the essence of this arrangement available on request, including by e-mail at dpooffice@tomorrowland.com.

The legal basis for the outbound sharing of segment characteristics with partners is your consent (Art. 6(1)(a) GDPR). You can withdraw this consent at any time and per partner category via the preference portal of your Tomorrowland account. Withdrawal does not affect the lawfulness of the processing that took place before the withdrawal. For some advertising platforms your segment characteristics may be processed outside the EEA; you will find more information about the safeguards in section 5.2.

2.13 Safety and security

We take various safety and security measures to protect our visitors, staff and other persons, both in physical environments, such as the event sites, and in our digital environments. In addition to the protection of persons, these measures also relate to the protection of property, including buildings, sites, goods, intellectual property rights, digital environments and IT systems.

In general, for the processing of personal data in this context we rely on our legitimate interest in pursuing safety in the broadest sense of the word. In certain cases we rely on legal obligations, for example when we are required to take certain measures under the applicable French regulations or under conditions imposed by the competent authority (such as the municipality of Huez or the préfecture de l’Isère) — for example via an "arrêté préfectoral or arrêté municipal".

Special situations

Camera surveillance

We may use camera surveillance. In France, camera surveillance is legally framed differently depending on the place and the purpose. Camera surveillance on the public highway and in publicly accessible places falls, for the security purposes defined therein, under the regime of the vidéoprotection of the Code de la sécurité intérieure (Articles L251-1 et seq.), which requires prior authorisation from the préfet. Other forms of camera surveillance fall under the GDPR and the French Informatique et Libertés Act, under the supervision of the CNIL. We only activate cameras when the applicable legal conditions are met. The camera surveillance is provided by our technical partner Citymesh, which acts as a processor in this respect and holds the required authorisation. The cameras are used solely for purposes of safety and crowd management; no atmospheric images are made with these cameras.

We inform you about the camera surveillance by means of a pictogram and, where required, additional information at the entrance to the monitored area. For the processing of the image material on which you might be visible, we rely on our legitimate interest in providing for the safety of the environments for which we are responsible and of the goods and persons located there, and in efficiently complying with our legal obligations.

At certain large-scale events we may make camera images available to the competent police services, solely for the duration of the event and with a view to maintaining public order and the safety of those present. This provision takes place within the applicable legal framework and is laid down in a written agreement with the service concerned. From the moment the police or gendarmerie services gain access to the images, they act as an independent controller, to which their own legal framework applies.

Drug and alcohol checks

During certain events, drug and alcohol checks may be carried out in cooperation with the competent authorities. In doing so, personal data such as test results indicating the use of prohibited substances may be processed. The purpose of this processing is to promote safety and public order during our events.

Drug and alcohol checks are carried out by the competent authorities with whom we cooperate, such as the local police or gendarmerie. We do not receive from them any details about criminal offences linked to you. We only receive statistical information about the results of the checks.

First aid and emergency care

At the event you may come across various first aid posts. For certain events we are legally required to provide a preventive emergency response arrangement (dispositif prévisionnel de secours). If you report yourself, we will request your identification data to register you. If you cannot register yourself, we will try to identify you in another way, for example via a person who is with you. To ensure that you receive timely medical assistance, the service providers will process medical details about the nature of the injury, your medical background and the care provided. Where possible, your consent is requested for this. In exceptional cases your personal data is processed on the basis of the necessity to protect your vital interests.

First aid is provided by specialised care providers with whom we cooperate. For Tomorrowland Winter this is the French emergency service FFSS 38 (Fédération Française de Sauvetage et de Secourisme), with the support of Parcifal Consulting vzw. These services process the medical personal data under their own responsibility and shielded from us. We do not receive any individual medical data from them, but only anonymised information about the type of incidents and accidents that have been dealt with.

2.14 Compliance and legal obligations

Insofar as necessary, we also process your personal data for compliance purposes. When we are legally required to do so, we process your personal data to comply with our legal obligations, for example under the applicable legislation on the prevention of money laundering and the financing of terrorism.

In addition, we may be obliged to process your data to comply with a request from a competent authority, such as the Data Protection Authority (Belgium) or the Commission nationale de l’informatique et des libertés (CNIL, France). In that case too we process your personal data to comply with a legal obligation.

To the extent that we are not legally obliged to comply with requests from authorities, or we take the initiative ourselves to share certain information about you with competent government agencies, for example when there are justified suspicions of an unlawful act or offence, we rely on our legitimate interest in helping competent authorities to prevent or investigate illegal activities, in protecting our property in the broad sense and in enforcing our own policy.

2.15 Fraud prevention, incidents and access management

We process your personal data such as your identification and contact details, ticket and order data, data about your use of our ticket and sales channels and the information and documents you provide to us in this connection (such as an identity document, proof of residence, proof of payment or other documents needed to check whether you comply with our terms and conditions), in order to prevent, detect and investigate fraud, ticket misuse and serious breaches of our terms and conditions, and to take and manage measures, such as temporary or permanent access bans.

For these processing operations we rely on our legitimate interest in safeguarding the safety and security of our events and services, preventing misuse and fraud and enforcing our terms and conditions, in particular our strict zero-tolerance policy against fraud and misuse of the sales process. Where applicable, we also process your data because this is necessary to comply with legal obligations and to cooperate with competent government agencies.

We may keep a register of access bans (a “blacklist”), containing your identification data, the reason for and the duration of the access ban and, where relevant, information about the underlying incident or breach and the documents collected in that connection. We keep this information for up to three years after the end of the access ban, unless a longer retention period is legally required or necessary for the establishment, exercise or substantiation of legal claims.

2.16 Management and organisation of business activities

In addition to the purposes specified above, we process your personal data — albeit to a limited extent, and only when strictly necessary — to organise, manage and further develop our business activities. This includes, among other things, that we process your personal data to carry out quality customer management, to approach you as a supplier or partner to maintain our professional relationship, to monitor compliance with our own procedures and policies (for example in the context of audits and reporting), and to inform relevant parties in the context of business transactions, such as a possible merger, acquisition or reorganisation.

For these processing operations we rely on our legitimate interest in carrying out our business activities and organising and managing them efficiently, in enforcing our own policy, and in continuously evaluating and improving the functioning of our business processes and objectives.

3. How we obtain your personal data

In most cases we obtain the personal data we process about you directly from you. This happens, for example, when you buy a ticket, register to receive certain communications, or contact us for information or support.

There are, however, situations in which we receive your personal data from others. This may be the case when someone else buys a ticket for you or when we receive information about you via our partners, for example when purchasing a travel, accommodation or ski package that we offer in cooperation with external parties.

In addition, in specific circumstances we may also receive information about you from official bodies, such as the police or other competent government authorities, for example in the context of legal obligations or in the event of security incidents.

Minors. Our services and communications are in principle not directed at children. In the few cases where we would process the personal data of minors online on the basis of consent, we take into account the applicable age threshold for “digital majority”. For information society services offered in France, that threshold is 15 years (Article 45 of Act No. 78-17 of 6 January 1978, “Informatique et Libertés”): for a minor under the age of 15, the consent of the minor together with that of the holder(s) of parental authority is required. Where we do not base the processing of children’s data on consent, this is done with the necessary safeguards and, where relevant, with the involvement or approval of a parent or guardian.

4. How long we keep your personal data

We keep your personal data for as long as necessary to achieve the purposes set out above or as required by applicable regulations. In determining the appropriate retention period, we take into account various factors, such as the purposes for which we process the data and the categories of personal data. For example, we keep the atmospheric images we make for our aftermovies much longer than the images we make with surveillance cameras.

The retention period may also vary depending on applicable legal and statutory obligations, such as accounting requirements, which require us to keep your data for a certain period.

When the processing of your personal data is based on your consent, we will no longer keep your personal data as soon as you withdraw your consent, unless there are other grounds that allow or require us to keep your data longer.

After expiry of the retention period, your personal data is anonymised or deleted. This does not happen, however, when there is an overriding interest for us or for someone else in continuing to keep your data, or when a legal obligation or a judicial or administrative order prevents us from de-identifying or deleting your personal data.

5. How we share your personal data with others

5.1 Recipients of your personal data

We ensure that access to your personal data remains limited to those persons and departments that need to process this data to achieve the aforementioned purposes. When we share your personal data with others, this too is done solely for the same purposes. Possible recipients include service providers, partners, advisers and government agencies.

For example, we may share your data with external service providers who support us, such as IT service providers, logistics companies, financial institutions, mobility partners and — in the context of Tomorrowland Winter — the operator of the ski area and accommodation and travel partners. These parties help us to manage our services and infrastructure that are essential to our operation.

In addition, solely when you have expressly given your consent for this, we may share certain personal data about you with selected, trusted partners so that they can show you their own offer or provide promotional communication. We do this solely on the basis of your consent (Art. 6(1)(a) GDPR), per partner category, and always in accordance with the principle of minimal data sharing.

Depending on the collaboration, the shared data may be pseudonymised segment characteristics (without name or e-mail address) or more direct identification and interest data, when the partner wishes to approach you directly. The form of collaboration may range from independent controllership to joint controllership within the meaning of Article 26 GDPR. For each collaboration involving joint controllership we make the essential content of the mutual arrangement available to you (see section 2.12). We ask for your consent each time per partner category; you can change or withdraw it at any time via the preference portal of your Tomorrowland account. When a partner is established outside the EEA, the safeguards described in section 5.2 apply.

We may also share limited contact details (such as your name and e-mail address) with academic or scientific research partners, for the sole purpose of inviting you to take part in research relevant to our sector. These partners act as independent controllers with regard to the research. We share solely what is strictly necessary and do not share the content of your account, your purchase history or your marketing profile.

We also cooperate with various advisers, such as accountants, lawyers and other professionals who assist us in protecting our interests or enforcing our rights. In certain cases we may share your personal data with courts and authorities when this is legally required or necessary to safeguard our rights, and with government agencies when we are legally obliged to provide certain data, for example to comply with our tax or administrative obligations. Finally, we may share your data when you have requested us to do so, when this is necessary for the performance of our agreement, or when we are legally required to do so.

5.2 Transfer of personal data outside the European Economic Area

Some recipients of your personal data may be established in a country outside the European Economic Area (hereinafter: “EEA”). For certain third countries the European Commission has determined that they ensure an adequate level of protection. Such an adequacy decision exists, among others, for the United Kingdom and Switzerland.

If we transfer personal data to a recipient in a third country for which no adequacy decision exists, and no derogations for specific situations apply, we observe appropriate safeguards, such as the standard contractual clauses for the international transfer of personal data as adopted by the European Commission, or another mechanism in accordance with the applicable data protection legislation. When, in the context of advertising purposes (see section 2.12), we have segment characteristics processed by advertising platforms or partners in the United States, we rely on the EU-US Data Privacy Framework when the recipient is certified under it, on the standard contractual clauses, or on an adequacy decision where available. We point out that in certain cases access by authorities in third countries cannot be entirely excluded; we take appropriate safeguards to limit those risks.

When we base the transfer on appropriate safeguards, we assess whether these do not undermine the level of protection guaranteed within the EEA. If they do, we take the necessary additional measures; if that is not possible, we do not transfer your personal data. For more information about the applicable safeguards, you can send a request by e-mail to dpooffice@tomorrowland.com.

6. How we protect your personal data

We treat the personal data we process confidentially and protect it in accordance with the applicable regulations and our internal policy and internal procedures for data security.

We make commercially reasonable efforts to ensure that your personal data is stored securely and protected against loss or unauthorised disclosure and use. You understand, however, that security is an obligation of means and that the result thereof can never be guaranteed.

7. Your choices and rights

In accordance with the applicable data protection legislation, you have, if and to the extent applicable, the following rights with regard to the processing of your personal data:

You have the right to request access to the personal data we process about you. We provide this information free of charge in principle. Only where a request is manifestly unfounded or excessive, in particular because of its repetitive character, may we charge a reasonable fee or refuse to act on it, in accordance with Article 12(5) GDPR.

You have the right to obtain, free of charge, the rectification of inaccurate personal data about you, as well as to have incomplete personal data completed.

When we process your personal data on the basis of your consent, you have the right to withdraw that consent at any time.

Under certain conditions you have the right to obtain the erasure of your personal data. After receipt of your request we assess whether there are compelling reasons, such as legal or regulatory obligations, judicial or administrative orders, or legitimate interests of ours or of someone else, that require or allow us to keep your personal data in an identifiable form.

In certain circumstances you have the right to restriction of the processing of your personal data, including when you contest the accuracy of your personal data or when your personal data is no longer needed for the described purposes but you still need it in legal proceedings.

When we process your personal data on the basis of our legitimate interest, you have the right to object to the processing on grounds relating to your particular situation. You can object at any time, without cost or justification, to processing for direct marketing purposes.

If we process your personal data on the basis of your consent or to perform an agreement and the processing is carried out by automated means, you have the right to obtain the personal data you have provided to us in a structured, commonly used and machine-readable form and to transmit it to another controller.

You have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you, unless such a decision is necessary for entering into or performing our agreement or when you have given your explicit consent. At present we do not use such decision-making; should we do so, you have the right to object to it.

You can exercise your request to invoke the above rights by sending an e-mail to dpooffice@tomorrowland.com. Clearly state in your request which right you wish to exercise and provide the necessary explanation if required. We confirm receipt of your request. If your request is valid, we will comply with it. If we have doubts about your identity, we may ask you for additional information to verify your identity.

If you are not satisfied with the way we process your personal data, we ask you to notify us of this via dpooffice@tomorrowland.com. You also have the right to lodge a complaint with a competent supervisory authority. As the main establishment of the controller is located in Belgium, the Belgian Data Protection Authority (GBA/APD) is the lead supervisory authority. You may, however, also lodge your complaint with the supervisory authority of your habitual residence or of the place of the alleged infringement. For data subjects in France this is the Commission nationale de l’informatique et des libertés (CNIL), www.cnil.fr. In Belgium this can be done via the complaints procedure on the website of the Data Protection Authority, www.gegevensbeschermingsautoriteit.be.

Last updated: 8 September 2026

Privacy Policy