Privacy Policy

The organiser of Comic Con Baltics is responsible for your data. In legal terms it is the data controller:

• MB „Renginio genas“
• Company code 304662851
• Registered office: A. Goštauto g. 8-1020, LT-01108 Vilnius, Lithuania
• Email for privacy questions and requests: info@ccbaltics.com

In this policy “we” and “Comic Con Baltics” mean MB „Renginio genas“. We process personal data under the EU General Data Protection Regulation (GDPR) and the Lithuanian Law on Legal Protection of Personal Data.

Visit statistics without cookies

We count visits with a statistics tool that runs on our own server and sets no cookies. For each visit it records the pages viewed and the website you came from. It also records the type of device, operating system and browser, and the country and city worked out from the IP address. The IP address itself is not stored. It is turned into a code that cannot be turned back into the address. These statistics are not shared with anyone.

Legal basis: our legitimate interest in knowing how the website is used and keeping it working (GDPR Article 6(1)(f)).

Technical logs and protection against abuse

Our hosting provider keeps technical server logs, which include IP addresses, to run and protect the service. To stop automated abuse of our forms we count submission attempts per IP address. The counter holds a coded form of the address, not the address itself. It is deleted one hour after the last attempt.

Legal basis: our legitimate interest in the security of the website (Article 6(1)(f)).

Necessary cookies

The website sets a small number of cookies it cannot work without. They remember your language and your cookie choice. They do not need consent.

Cookies and tracking, only with your consent

None of the tools in this group runs until you agree in the cookie banner. To switch them on and off we use Google Tag Manager, a small script that loads on every visit. It sets no cookies and records nothing about your visit, but loading it shows your IP address to Google. You choose statistics and marketing separately. If you choose “only necessary”, none of the tools run.

• Statistics: Google Analytics (Google Ireland Limited). It records page views and actions such as a click on “Buy tickets” or a submitted form. It also receives your IP address, browser details, cookie identifiers and the address you came from. If you also accept marketing, Google may use this data for our advertising on Google.
• Marketing: the advertising pixels of Meta, TikTok, Reddit and X. The companies are Meta Platforms Ireland Limited, TikTok Technology Limited, Reddit Netherlands B.V. and X Internet Unlimited Company. Each pixel records the same page views and actions and receives the same technical details. We use them to measure our advertising and to show our adverts on those platforms to people who visited the website. Neither Google Analytics nor the pixels receive your name, email address or the contents of any form.
• Google Maps, YouTube and Facebook content. The map on the Venue page and embedded videos and posts load only after you agree. The provider then receives your IP address and may set its own cookies.

Legal basis: your consent (Article 6(1)(a)). You can change or withdraw it at any time through “Cookie settings” at the bottom of every page. The full list of cookies is in our Cookie Policy.

Your schedule stays on your device

When you star events in the programme, the list is saved in your browser only. It is never sent to us.

If you subscribe, we collect your email address, the time you gave consent and the language of the page you subscribed on. We use them to send you festival news, guest announcements and ticket information.

The website has three sign-up forms: the newsletter, guest announcements and news about application dates. At present all three add your address to the same mailing list, so you may also receive our other news.

The newsletter is sent through MailerLite (MailerLite Limited, Ireland), which stores subscriber data in the European Union. MailerLite records whether an email was opened and which links were clicked. We do not keep a separate copy of your address on the website.

Legal basis: your consent (Article 6(1)(a)). Every email has an unsubscribe link, and you can also write to us. We keep your address until you unsubscribe.

What you send through a form is stored in the website’s database and is emailed to the mailbox of the organising team. Each application gets a reference number.

Fields marked with a star are needed to consider your message or application. Without them we cannot accept it. All other fields are optional.

Legal basis for all forms: your consent, which you give by ticking the box and sending the form (Article 6(1)(a)). Once we accept an application, we also rely on the agreement between us (Article 6(1)(b)).

Contact form

We collect your name, email address and message, and use them to answer you.

Artist Alley and exhibitors

• Artist Alley: name, email, artist or brand name, portfolio link, city and country, what you sell, table preferences, your notes and your logo.
• Exhibitors and vendors: the representative’s name, company name, company code and VAT code, email, phone, field of activity, website, stand preferences and comments.

We use this to choose participants, plan the floor and make an agreement with you. If you are accepted, the app shows your brand name, logo, country, what you sell and your table number. Your brand name and logo are also printed on your table sign and may appear on the website.

Press accreditation

We collect your name, email, phone, date of birth, country, city and street address. We also collect details of your media outlet, your title and position, links to earlier coverage and the coverage you plan. The form also asks for the name, title, email and phone of your editor. We use this to check that a request is genuine and to issue a press pass.

Volunteers

We collect your name, date of birth, city, gender, email, phone, T-shirt size and occupation. We also ask about earlier volunteering, your English level, whether you hold a driving licence, the areas and times you prefer, your food preference and the form’s other questions. You may add a link to your social media profile, the email address of a friend you would like to work with, and comments.

The form asks whether you have health issues we should know about. This is health data, which the law protects more strictly. We use it only to give you suitable tasks and to keep you safe during the festival. The question is required, but you can answer “none”. The form has one consent box. It covers the volunteer rules and all the data in the form, health information included. We rely on that consent (Article 9(2)(a)). You can withdraw it at any time by writing to us.

If you are accepted, the volunteering agreement and the refundable deposit involve your payment details. We keep them with our accounting records.

Cosplay and K-Pop contests

• Contact person: name, country, phone and email.
• Each participant: name, stage name and its pronunciation, date of birth, and the character or artist performed.
• The performance: group name, category, stage and lighting wishes and a short introduction.
• Files and links: photos, the audio track and links to videos of the performance.
• Participants under 18: a consent form signed by a parent or guardian, which carries that person’s name and signature.

We use this to run the contest: selection, the stage schedule, judging and awards.

• What is public. The app shows each contestant’s number, stage name, character or song, category, photos and vote total. If you chose to be announced by your own name, that name is shown. Winners are named in the app and in our coverage of the festival.
• Judging. Judges record scores and notes about each performance. Scores, notes and vote counts are stored on our server and copied to a working table in Google Sheets. Names of masquerade participants entered at the festival are kept in a similar table. If an entry is disqualified, we keep a record of the reason.
• Championships. Where a contest is a qualifier for an international championship, we pass the winners’ details to the organisers of that championship.

Health and other sensitive details in free text

Please do not put health details or other sensitive information in comment fields unless we need it to help you, for example for accessibility. If you do, we use it only to arrange what you ask for.

When you give us another person’s data

Some forms ask about other people: the members of your group, your editor, a friend or a parent. We receive their details from the person who fills in the form. Please tell them before you send their details. They have the same rights as everyone else under this policy.

You can use most of the app without an account: the schedule, guests, news, the map and your favourites. Favourites, followed guests and reminders are kept on your phone only. The app asks for two permissions only: notifications and NFC, which reads the festival’s collectible cards.

The app itself contains no advertising or analytics tools. News articles open our website inside the app, so the website part of this policy applies to them.

What every use of the app involves

• Request logs. Requests the app makes to our server are logged with the IP address, the app and device type, the address requested, the time and any error message. We use the logs to keep the service secure and to find faults.
• Notifications. When the app starts, it registers a notification address for your device and a device identifier with our server. This happens before you decide whether to allow notifications. On Android the identifier is the system Android ID. On iPhone it is a random code created by the app. You see notifications only if you allow them on your phone, and you can turn them off there at any time.

If you create an account

You sign in with Google or Apple. We receive your name, email address and profile picture from the account you choose. Our server stores your user ID, name, picture and the IP address used when the account was first used. It also stores a random “hero number” that stands for you in public lists.

Your email address is kept by our sign-in provider. Our administrators see the email addresses of people who qualify for a prize draw, to check entries and to contact winners.

An account is needed for the following:

• Card collection. We record which cards you collected and when. Automatic checks mark cards collected outside festival hours or too quickly one after another. A card collected outside festival hours always excludes the account from the prize draw. An account with more than three quick scans is left out unless an organiser checks the record and puts it back. If you think you were marked by mistake, write to us. We will check the record and explain the outcome.
• Contest voting. We record which contestants you voted for, so that each person gives one vote per contestant.
• Prize draws. Draws are run under their own terms, which name the organisers of each draw. Only hero numbers are published. For a winner we record the name and email address. We ask for a postal address if the prize has to be delivered.

Visitor survey

The survey asks about your visit and includes your gender, age group and country. We do not ask for your name. Each answer is stored with your device identifier and IP address. We use the identifier to accept one response per device. We use the IP address to limit abuse and to check prize draw entries. If you sign in to enter the survey’s prize draw, your answers are linked to your account in our database. We analyse the answers without names.

Legal basis

• Account, card collection, voting and prize draws: providing the service you asked for (Article 6(1)(b)).
• Request logs, fraud checks, device registration and the first-use IP address: our legitimate interest in a secure service and fair draws (Article 6(1)(f)).
• Showing notifications: your consent, given through your phone’s notification permission (Article 6(1)(a)).
• Survey: your consent, given by sending it (Article 6(1)(a)).

We take photos and video at the festival. We use them on our website, in social media and in our advertising, to show what the event is like. Broad shots of the crowd can include you. Stage events, including contests, may be streamed live on Twitch and recorded.

Legal basis: our legitimate interest in documenting and promoting a public event (Article 6(1)(f)).

If you do not want to be photographed, tell the photographer. If you find yourself in a published photo or video and want it removed, write to info@ccbaltics.com with a link to it and we will take it down.

We do not sell personal data. We share it with the companies that provide services to us, under their data processing terms, and only as far as each service requires.

Tickets. Tickets are sold by bilietai.lt (UAB „Bilietai PLG“, company code 302598528). When you buy a ticket, bilietai.lt is responsible for your data under its own privacy policy.

Shop. The merchandise shop at shop.ccbaltics.com has its own privacy policy, published there.

Authorities. We disclose data to public authorities only when the law requires it.

Our website, its database and the app’s server are in the European Union. Some providers are based outside the European Economic Area or belong to groups based there, so data they handle may be processed in those countries. This concerns Google (United States), because the Google Tag Manager script loads on every visit. It concerns Meta, Reddit and X (United States) and TikTok (several countries outside the European Economic Area, including the United States and China) if you accept marketing cookies. It also concerns Supabase (Singapore) and Expo (United States) if you use the app.

These transfers rely on the EU-US Data Privacy Framework where the provider is certified under it. In all other cases they rely on the standard contractual clauses approved by the European Commission. Write to us if you would like a copy of these safeguards.

We delete form entries by hand, not automatically. The periods below are the longest we keep each kind of data. They also apply to the copies in our mailbox.

We keep data longer only if a law requires it or while a dispute is being resolved.

You have the right to:

• know whether we process your data and get a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• have processing restricted;
• receive the data you gave us in a common electronic format, or have it sent to another organisation;
• object to processing that is based on our legitimate interest;
• withdraw a consent at any time. This does not affect what was done before you withdrew it.

To use any of these rights, write to info@ccbaltics.com. We may ask for information that confirms who you are. We answer within one month. If a request is complex we may need up to two more months, and we will tell you so within the first month. Requests are free of charge.

We do not make decisions about you by automated means that have legal or similarly significant effects. The automatic checks in the app’s card collection affect only the prize draw and are described in the section about the app.

Complaints

If you think we handle your data unlawfully, please contact us first so that we can put it right. You also have the right to complain to the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, LT-10312 Vilnius, ada@ada.lt, vdai.lrv.lt. You may also complain to the data protection authority of the country where you live.

App account

Open the app, go to your profile and choose “Delete account”. This deletes your sign-in account, profile, hero number, votes, collected cards and prize draw records from our live systems.

Some data remains after deletion:

• Your device’s notification address stays until a notification sent to it is refused because the app is no longer installed.
• Your hero number stays in the published lists of draws that have already taken place.
• Survey answers stay with the device identifier and IP address they were sent from.
• Request logs and backup copies are removed when their storage period ends.

If you signed in with Apple, you can also remove the app under “Sign in with Apple” in your Apple account settings.

If you no longer have the app, write to info@ccbaltics.com from the email address of your account. We will delete the account within one month and confirm it to you.

Everything else

To have an application, a contest entry, a message or any other data deleted, write to the same address. To stop the newsletter, use the unsubscribe link in any of our emails.

In Lithuania a person aged 14 or over can consent to online services on their own. If you are under 14, please ask a parent or guardian to subscribe to the newsletter or to create an app account for you.

The contests have their own age rules, set out in the contest rules. Every participant under 18 needs a consent form signed by a parent or guardian.

If you believe a child has given us data without the consent required, write to us and we will delete it.

The website and the app use encrypted connections. In the website’s admin area only administrators can read applications. A copy of each application reaches our team by email. Files you upload have long random addresses that are not listed anywhere. Anyone who has the address can open the file, so we do not share these addresses outside our team.

The app’s server and database are protected by access controls. No system is perfectly secure. If a breach puts your rights at risk, we will inform you and the Inspectorate as the law requires.

We update this policy when our services or the law change. The date at the top of the page shows the latest version. If a change affects how we use data you have already given us, we will tell you by email or in the app.