EUROPEAN CAPITAL OF CULTURE ORGANISATION – LARNACA 2030
1. Introduction
The protection of personal data is a fundamental priority for the EUROPEAN CAPITAL OF CULTURE ORGANISATION – LARNACA 2030, Registration No. 439357 (hereinafter the “Organisation”).
The Organisation has undertaken the implementation and delivery of the cultural programme of the European Capital of Culture – Larnaca 2030.
This Privacy Policy explains, in a concise and transparent manner, how the Organisation collects, uses, stores, discloses and protects personal data.
The processing of personal data is carried out in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), the Protection of Natural Persons with regard to the Processing of Personal Data and the Free Movement of Such Data Law of 2018 (Law 125(I)/2018), as amended from time to time, and any other applicable legislation of the Republic of Cyprus.
This Policy applies, inter alia, to website visitors, participants in activities and events, artists, associates, sponsors, suppliers, representatives of organisations and any other natural person whose data are processed by the Organisation.
Depending on the specific activity, additional or more specific privacy information may be provided.
2. Data Controller
The Data Controller of the personal data is:
EUROPEAN CAPITAL OF CULTURE ORGANISATION – LARNACA 2030
Registration No.: 439357
Address: Zouhouri Square, Nicolaou Rossou, 6021 Larnaka, Cyprus
Telephone: ………………………………….
Email: info@larnaka2030.eu.
Website: www.larnaka2030.eu
Data Protection Officer (DPO): Stavros G. Mavromatis.
DPO Email: stavros@mcllc.com.cy
3. What personal data we collect
Depending on your relationship with the Organisation and the specific activity, we may collect:
• full name and identification details,
• contact details, such as address, telephone number and email address,
• professional capacity and the organisation or body you represent,
• participation, registration or booking details relating to events and activities,
• information contained in requests, applications or messages you send to us,
• information required for entering into or performing contracts and processing financial transactions,
• photographs, videos and/or audio recordings made in the context of events and activities, in accordance with this Policy and applicable law,
• technical data relating to use of the website, such as IP address, device type, browser and cookie data, where applicable.
The Organisation applies the principle of data minimisation and collects only data that are adequate, relevant and necessary for the respective purpose.
4. Data we receive from third parties
In certain cases, the Organisation may receive personal data from third parties, such as partners, artistic bodies, producers, suppliers, public authorities or other collaborating organisations.
In such cases, the data are processed in accordance with the GDPR and, where required, the information prescribed by Article 14 GDPR is provided.
5. Purposes and legal bases of processing
| Purpose | Indicative data | Legal basis |
|---|---|---|
| Organisation and management of events and activities | Participation and contact details | Performance of a contract, consent or legitimate interest, as applicable |
| Registrations, participation and bookings | Full name, email, telephone | Performance of a contract or taking steps prior to entering into a contract |
| Communication and response to requests | Name, contact details, message content | Legitimate interest, consent or performance of a contract, as applicable |
| Contracts, payments and accounting administration | Identification and financial details | Compliance with a legal obligation or performance of a contract |
| Information systems security | Technical data, logs | Legitimate interest and, where required, another lawful basis |
| Newsletter and information material | Email and contact details | Consent or another lawful basis, where applicable |
| Photographs, videos and audio recordings | Image and/or voice | Consent, legitimate interest or another applicable lawful basis, as applicable |
When processing is based on the Organisation’s legitimate interests, those interests are assessed and balanced against the rights and freedoms of the data subjects.
The Organisation does not use personal data for purposes incompatible with the purpose for which they were collected.
6. Special categories of personal data
The Organisation does not seek to collect special categories of personal data.
If, due to a specific activity, the processing of such data becomes necessary, such processing is carried out only where an appropriate legal basis exists under Articles 6 and 9 GDPR and the required safeguards are implemented.
7. Data relating to children and minors
The Organisation may organise activities aimed at children or minors.
In such cases, appropriate safeguards are applied and, where required by law or by the nature of the processing, the consent or involvement of a parent or legal guardian is sought.
The processing of minors’ data is limited to what is strictly necessary for the specific purpose.
For specific activities, a dedicated privacy notice may be provided to parents/guardians.
8. Photographs, videos and audio recordings
The Organisation may take photographs, make video recordings and/or audio recordings in the context of public cultural events, festivals, conferences, educational, artistic and other activities.
The relevant material may, depending on the circumstances, be used for:
• documentation and archiving,
• information and promotion of activities,
• communication and publicity concerning the Organisation’s work,
• historical and cultural documentation,
• publication on the Organisation’s website and official social media channels.
Processing is carried out taking into account the nature of the event, the reasonable expectations of participants and their rights.
Where consent is required, it is obtained before the processing.
For targeted photography, interviews, personal testimonials, specific promotional use or activities involving minors, more specific information and consent procedures may apply.
9. Cookies and tracking technologies
The Organisation’s website may use cookies and similar technologies for the operation, security and improvement of the website and, where permitted, for statistical analysis or other purposes.
Strictly necessary cookies may be used where permitted by applicable law.
For non-essential cookies or other technologies requiring prior consent, consent is requested through an appropriate consent management mechanism.
Further information is provided in the Organisation’s Cookie Policy.
10. Recipients and Processors
Personal data may be disclosed, to the extent necessary for the purposes of processing, to:
• IT service providers,
• providers of registration, booking or event-management systems,
• accountants, auditors and legal or other professional advisers,
• partners supporting the organisation and implementation of activities,
• public authorities or other bodies where required by law.
Where third parties process data on behalf of the Organisation, they are selected on the basis of appropriate safeguards and, where required, the agreements prescribed by Article 28 GDPR are entered into.
The Organisation does not sell or commercially exploit personal data.
11. Transfers outside the European Economic Area
The Organisation seeks to keep the processing of personal data within the European Economic Area.
Where personal data are transferred outside the EEA, such transfer takes place only in accordance with the GDPR requirements and using appropriate safeguards, such as an adequacy decision, Standard Contractual Clauses or another transfer mechanism provided for by the GDPR.
Where required, further information concerning the specific transfer is provided.
12. Retention period
The Organisation retains personal data only for as long as necessary to achieve the purpose for which they were collected or for as long as required by applicable law.
The retention period is determined on the basis of, inter alia:
• the purpose and nature of the processing,
• any contractual obligations,
• tax, accounting or other legal obligations,
• the need to manage or defend legal claims,
• archiving and cultural documentation requirements.
After the relevant period has elapsed, the data are securely deleted, destroyed or anonymised in accordance with the Organisation’s internal procedures.
13. Data security
The Organisation implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration, unlawful processing or disclosure.
Security measures are reviewed and updated having regard to the risks, the nature of the processing and technological developments.
In the event of a personal data breach, the Organisation applies the prescribed procedures and makes the required notifications to the competent supervisory authority and/or affected persons, where required by the GDPR.
14. Automated decision-making and profiling
The Organisation does not make decisions producing legal effects or similarly significantly affecting data subjects based solely on automated processing, including profiling.
If such processing is introduced in the future, the required information will be provided and the relevant GDPR provisions will be applied.
15. Your rights
Subject to the conditions laid down in the GDPR, you have the right to:
• access personal data concerning you,
• rectify inaccurate or incomplete data,
• erase your data where the legal requirements are met,
• restrict processing,
• object to processing where provided for by the GDPR,
• data portability, where applicable,
• withdraw your consent at any time where processing is based on consent.
Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
These rights may be subject to limitations provided for by the GDPR or other applicable law.
16. Exercising your rights
To exercise your rights, you may contact the Organisation:
Email: info@larnaka2030.eu
Postal address: Zouhouri Square, Nicolaou Rossou, 6021 Larnaka, Cyprus.
Telephone: ……………………………………………………..
The Organisation may request reasonable information to verify the identity of the applicant, particularly where there are reasonable doubts concerning the applicant’s identity.
Requests are considered and answered in accordance with the time limits and other requirements of the GDPR.
17. Right to lodge a complaint
If you consider that the processing of your personal data infringes the GDPR or applicable law, you have the right to lodge a complaint with the competent supervisory authority of the Republic of Cyprus:
Commissioner for Personal Data Protection.
Exercising the right to lodge a complaint does not affect any other administrative or judicial remedy available to you.
18. Social networks and external services
The Organisation may use official accounts or third-party services, such as social media, video platforms, communication tools or other online services.
Use of such services may involve the processing of personal data by the respective providers in accordance with their own privacy policies and terms.
Where required, the Organisation provides more specific information regarding the relevant processing.
19. Advertising, Retargeting and Similar Technologies
With your prior consent, we may use advertising cookies, tracking pixels, tags and other similar technologies provided by [identify each provider, e.g. Google Ads and Meta Platforms].
These technologies may collect and process information such as:
• your IP address and approximate geographical location,
• cookie, browser and device identifiers,
• your device type, operating system and browser,
• the pages you visit, including your interaction with the Larnaca 2030 page,
• the links, advertisements and content you view or select,
• the date, time and duration of your visit,
• the website or advertisement from which your visit to our website was referred, and
• actions you take on the website, such as registrations, submission of enquiries or requests, and purchases.
We use this information for the following purposes:
• to measure the reach and effectiveness of our advertising campaigns,
• to assess whether an advertisement led to a visit to our website, an enquiry, registration or purchase,
• to create advertising audiences based on users’ activity on our website,
• to display relevant advertisements to persons who have previously visited our website,
• to exclude existing users or customers from specific advertising campaigns,
• to limit the frequency with which an advertisement is shown, and
• to prepare reports on advertising campaign performance and audience characteristics.
This processing may involve profiling, as information about your activity on our website may be used to assess your interests and preferences and to determine which advertisements may be more relevant to you.
We do not use advertising profiles to make decisions that produce legal effects concerning you or similarly significantly affect you.
Advertising and retargeting technologies are not activated before your consent is obtained through the cookie management banner, where consent is required. The legal basis for processing personal data through these technologies is your consent pursuant to Article 6(1)(a) GDPR.
You may refuse advertising cookies without affecting your access to our website. You may also withdraw or modify your consent at any time through the [link to or name of Cookie Settings tool].
Withdrawal of your consent does not affect the lawfulness of processing carried out before its withdrawal.
Consent must be capable of being withdrawn as easily as it was given.
Information collected through these technologies may be disclosed to the following providers:
• [Advertising service provider and link to its Privacy Policy]
• [Advertising service provider and link to its Privacy Policy]
• [Analytics service provider and link to its Privacy Policy, if applicable]
Depending on the service they provide and the manner in which processing is carried out, such providers may act as processors on our behalf, independent controllers or joint controllers.
Further information regarding individual cookies, providers, processing purposes and retention periods is provided in the [Cookie Policy/Cookie Settings Panel].
Data collected through advertising cookies are retained for the period stated in the Cookie Policy or Cookie Settings Panel. Records relating to advertising campaigns and conversions that we retain are kept for [insert intended period], after which they are deleted or anonymised unless a longer retention period is required or permitted by law.
Certain advertising service providers may process personal data outside the European Economic Area (“EEA”). Where such a transfer occurs, we apply the appropriate safeguards described in the “International Data Transfers” section of this Privacy Policy.
20. Customer-list-based advertising — include only if applicable
Where you have provided the required consent, we may securely transfer certain identifiers, such as your email address or telephone number, to [Meta/Google/other provider] for customer matching, creation of advertising audiences, measurement of advertising effectiveness or exclusion of specific persons from advertising campaigns.
Such identifiers are generally hashed before or during transfer.
The advertising service provider compares these identifiers with information held on its platform. We receive statistical information concerning advertising campaigns and advertising audience results and do not obtain access to other information contained in your account on that platform.
You may withdraw your consent or object to this specific use of your data at any time by contacting us at [privacy email].
21. Online Purchases, Merchandise and Event Tickets
When merchandise, event tickets or other products are offered for purchase through our website, we may collect and process the following information:
• your full name and contact details,
• billing and delivery address,
• the products, merchandise or tickets you order,
• ticket-holder or participant details, where required,
• the date of the order, quantities and prices,
• payment status and the transaction number or other transaction identifier,
• information relating to delivery, collection or admission to the event,
• information concerning refunds, cancellations and product returns,
• communications relating to your purchase, and
• information required for issuing documents/receipts, tax compliance, fraud prevention and compliance with our legal obligations.
We process this information for the following purposes and on the corresponding legal bases:
• Processing and fulfilment of your order: processing is necessary for entering into and/or performing our contract with you pursuant to Article 6(1)(b) GDPR.
• Delivery of merchandise or issue of tickets: processing is necessary for the performance of our contract with you pursuant to Article 6(1)(b) GDPR.
• Processing payments, refunds and cancellations: processing is necessary for the performance of our contract with you pursuant to Article 6(1)(b) GDPR.
• Keeping invoices, tax and accounting records: processing is necessary for compliance with our legal obligations pursuant to Article 6(1)(c) GDPR.
• Prevention and detection of fraud, protection of transactions and management of legal claims: processing is based on our legitimate interests pursuant to Article 6(1)(f) GDPR, in particular to protect our organisation, our customers and our services.
• Sending promotional communications: where required by applicable law, processing is based on your consent pursuant to Article 6(1)(a) GDPR. You may withdraw your consent at any time.
Providing information marked as mandatory during checkout is necessary to complete the transaction. If you do not provide the required information, we may be unable to process your order, deliver the merchandise or issue the relevant ticket.
22. Payment Processing
Payments are processed through [payment provider]. Payment details are submitted directly to the payment provider and processed in accordance with its Privacy Policy, available at [link].
[We do not receive or store your full payment-card details / specify exactly which payment details we receive].
We may receive limited transaction information, such as payment status, payment method, transaction reference number, card type and the last digits of the payment card.
23. Ticketing or E-Commerce Platforms
Select the applicable version:
Direct sales through the website
Our website and the e-commerce service provider, [provider], process information relating to your orders on our behalf in order to facilitate checkout and the management and fulfilment of orders.
Sales through an external platform
When a purchase is completed through the [ticketing/e-commerce platform], that platform collects your information directly.
The platform may act as an independent controller for processing relating to payments and account management. The processing of your personal data by the platform is governed by its own Privacy Policy, available at [link].
We receive only [describe the information received], to the extent necessary for fulfilment of the order, customer service or management of admission to the event.
24. Sharing Information relating to Purchases
We may disclose relevant purchase information to the following recipients:
• payment processing service providers,
• e-commerce or ticketing service providers,
• delivery, courier or order-fulfilment service providers,
• event admission-control and ticket-validation service providers,
• email and customer-support service providers,
• website hosting and technical-support service providers,
• professional advisers, including accountants, auditors and legal advisers, and
• public authorities where disclosure is required by law.
These recipients receive only the information reasonably necessary to provide their respective services and, where applicable, act as processors on our behalf.
25. Retention of Purchase Information
Order, transaction and invoice records are retained for [insert applicable statutory period] in order to comply with our obligations under accounting, tax, consumer and other applicable legislation.
Customer-service, refund and cancellation records are retained for [insert period] after completion or closure of the relevant matter.
Information relating to incomplete or abandoned purchase processes is retained for [insert period] and is then deleted or anonymised, unless further retention is justified by a legal obligation or another lawful ground.
Payment, delivery and ticketing service providers may apply their own retention periods as set out in their respective Privacy Policies.
26. Accessibility Information
If an event participant voluntarily provides us with information concerning their accessibility needs, which may reveal data relating to health or disability, we collect and process only the information necessary to accommodate the relevant request.
Where required, such information will be processed with the participant’s explicit consent pursuant to Article 9(2)(a) GDPR and retained only for as long as necessary to provide the requested accommodation.
The purchase of merchandise or tickets is not conditional upon acceptance of advertising cookies or retargeting technologies.
27. Amendment of the Policy
The Organisation may amend this Policy, in particular where applicable legislation, its activities or the manner in which it processes personal data changes.
The version in force from time to time is published on the Organisation’s website and states the date of the latest update.
28. Applicable law
This Policy is governed by the laws of the Republic of Cyprus and the applicable law of the European Union concerning the protection of personal data.
Any disputes fall within the jurisdiction of the competent courts of the Republic of Cyprus, without prejudice to the rights and remedies available to data subjects under the GDPR and applicable law.
Version: 09/09/2026