Skip to content
Festivity

Privacy Policy

Last updated: 1 October 2026

Who we are

Festivity (the "Platform", "we", "us") is an online marketplace that connects event organisers with performers and entertainment professionals.

Data controller: Lev Skrjabin, operating as a private individual in Estonia.

Contact email: info@festivity.ee

If you have questions about this Privacy Policy or how your personal data is handled, contact us at the email address above.

What personal data we collect

We collect personal data that is necessary to operate and provide the Platform.

When you create an account

We may collect:

  1. email address;
  2. password credentials, which are securely hashed by our authentication provider and are not stored by us in readable form;
  3. full name;
  4. role (Client or Artist);
  5. phone number, if you choose to provide it;
  6. city.

When you create an Artist profile

We may additionally collect:

  1. stage name;
  2. description of services and performance conditions;
  3. performance categories;
  4. starting price;
  5. travel radius;
  6. years of experience;
  7. languages spoken;
  8. profile photo;
  9. gallery photos, if you choose to upload them;
  10. availability calendar dates you choose to mark;
  11. links to your social media profiles and website, if you add them;
  12. links to videos and audio tracks hosted on YouTube, Vimeo, Spotify or SoundCloud, if you add them.

When you send a Booking Request

We may collect:

  1. your name;
  2. email address and/or phone number;
  3. event date;
  4. event location;
  5. event type;
  6. your message;
  7. budget, if you choose to provide it;
  8. if you cancel the request, the date of cancellation and the reason, if you give one.

The Artist you contact may receive the information necessary to respond to your Booking Request.

When you use messaging

We collect the content of messages and relevant timestamps.

When you rate an Artist

After a booking is marked as finished, we collect the numeric Rating (1 to 5) you submit, the text of your Review if you write one, the booking it relates to, and the date it was submitted, so we can display it and calculate the Artist's average rating.

When you report a profile

If you report an Artist profile, we collect the profile concerned, the reason you choose, any details you add, your account and the date of the report. Reports are seen only by Festivity administrators; the reported Artist is not told who sent the report, unless we are required by law to disclose it.

When you contact us

If you write to us through the contact form or by email, we collect your name, email address, the topic and content of your message, the language of the site you used and, if you are logged in, your account. We use this information only to answer you and to improve the Platform.

When you save Artists to Favorites

If you save Artists to your Favorites, we store which Artist profiles you saved and when. Your Favorites list is visible only to you; Artists are not told who saved them.

Technical data

We may process technical information necessary to authenticate your account and maintain the security of the Platform, including authentication session data stored in your browser. Our infrastructure providers may also process basic request-level technical data, such as IP address and timestamps, as part of operating and securing the underlying servers — this happens at the infrastructure level rather than being something we separately collect or analyse ourselves.

See "Cookies and browser storage" below for details on the analytics technology we use.

How we collect personal data

Most personal data is collected directly from you when you register, create or update your profile, submit a Booking Request, rate an Artist, or use the Platform's messaging features.

In some cases, personal data may be provided by another Platform user. For example, when a Client submits a Booking Request, the Artist contacted may receive the Client's name and contact details as part of that request.

Why we process your data and on what legal basis

We process personal data for the following purposes:

Account creation and management — to create and maintain your account and provide account-related functionality. The legal basis is performance of a contract under GDPR Article 6(1)(b).

Marketplace functionality — to display Artist profiles, allow Clients to discover Artists, and provide relevant profile and availability information. The legal basis is performance of a contract under GDPR Article 6(1)(b).

Booking Requests and messaging — to deliver Booking Requests and messages between Clients and Artists and enable communication concerning potential bookings. The legal basis is performance of a contract under GDPR Article 6(1)(b).

Ratings and reviews — to allow Clients to rate and review Artists after a completed booking, to display Reviews, and to calculate and display an Artist's aggregate rating to help other Users make informed decisions. The legal basis is our legitimate interest under GDPR Article 6(1)(f), namely maintaining trust and transparency in the marketplace.

Answering your messages — to respond to questions, problems and suggestions you send us. The legal basis is our legitimate interest under GDPR Article 6(1)(f), namely being able to answer and support Users.

Sending transactional emails — to deliver account-related and marketplace notifications, such as new Booking Requests, booking decisions, profile status updates, and message notifications. The legal basis is performance of a contract under GDPR Article 6(1)(b). Most notification emails can be turned off in your dashboard or with the link at the bottom of each email; account and security emails are always sent. Emails are sent in the language you choose in your dashboard (initially the language you signed up in).

Platform security and abuse prevention — to protect accounts, prevent unauthorised access, detect fraud or abuse, enforce our Terms of Use, including reviewing reports about profiles, and maintain the security and integrity of the Platform. The legal basis is our legitimate interest under GDPR Article 6(1)(f).

Our legitimate interests include maintaining a secure and reliable service, protecting Users and the Platform from fraud and abuse, maintaining trust and transparency through Ratings, and enforcing our Terms of Use.

Legal obligations — where necessary, we may process personal data to comply with legal obligations applicable to us. The legal basis is GDPR Article 6(1)(c).

We do not sell your personal data.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

Which information is required

Some personal data is necessary to provide particular Platform features.

For example, an email address is required to create and maintain an account. Certain information is also necessary to create an Artist profile, submit a Booking Request, or submit a Rating.

Where information is optional, we will indicate this where reasonably possible.

If you do not provide information that is necessary for a particular feature, we may not be able to provide that feature or complete the relevant action.

Who can see your data

Certain Artist profile information is publicly visible on the Platform, including:

  1. stage name;
  2. description;
  3. performance categories;
  4. city;
  5. starting price;
  6. travel radius;
  7. years of experience;
  8. languages spoken;
  9. profile photo;
  10. availability information;
  11. the Artist's aggregate rating (average score and number of Ratings), if any Ratings have been submitted; and
  12. gallery photos, social media and website links, and videos and audio tracks, if added.

This information may be visible to anyone visiting the Platform, including visitors who are not logged in.

If you write a Review, it is shown publicly on the Artist's profile together with your first name, the initial of your last name, your score and the date. Your full name, email address and account details are never shown. Ratings without a Review are not publicly visible. Ratings and Reviews are visible to the Client who submitted them, the Artist they concern, and Festivity administrators.

Do not include information in your public profile that you do not wish to make publicly available.

When you send a Booking Request, the Artist you contacted receives your name, contact details and the information contained in the request that is necessary to respond to it.

Messages you send are visible to the other participant in that conversation.

Your password and authentication credentials are not shown to other Users. Users cannot access conversations or Booking Requests in which they are not participants.

Service providers

We use third-party service providers to operate the Platform.

Supabase provides database, authentication and file-storage infrastructure. Our current Supabase project is hosted in the EU, in the Ireland region.

Vercel hosts the Platform's website and runs its server-side code. Our server functions run in the EU (Dublin, Ireland). To deliver pages quickly and securely, Vercel's global network processes technical request data, such as your IP address, browser type and the page requested.

Sentry provides error monitoring. When a page on the Platform encounters a technical error, technical information about that error — such as the page address, browser and device type, and your IP address — is sent to Sentry so we can find and fix the problem. Our Sentry data is stored in the EU (Germany).

Resend provides the email-delivery infrastructure we use to send transactional notification emails, such as new Booking Request, booking decision, booking cancellation, event reminder, profile published, and message-digest notifications, and to forward contact form messages to our team. Sending these emails necessarily involves processing the recipient's email address, name, and the relevant notification content (for example, a booking's event details).

Google Analytics 4 (GA4) provides web analytics services, described in "Cookies and browser storage" below.

These providers may process personal data on our behalf as service providers/data processors and are subject to applicable contractual and data-protection requirements.

We do not sell or otherwise disclose your personal data to third parties for their own advertising or profiling purposes.

International data transfers

We aim to keep personal data within the European Economic Area (EEA) wherever possible, and our database and file storage (Supabase) are hosted in the EU (Ireland).

Some of our service providers, including our hosting, email-delivery and analytics providers, may process personal data outside the EEA as part of delivering their service. Where this occurs, we rely on appropriate safeguards recognised under GDPR, such as the European Commission's Standard Contractual Clauses, or an applicable adequacy decision (including the certification of Google and Vercel under the EU-U.S. Data Privacy Framework), to ensure your personal data continues to receive an equivalent level of protection.

You can contact us at info@festivity.ee for more information about the safeguards that apply to a specific transfer.

How long we keep your data

Account data is kept for as long as your account exists.

Artist profile information is kept for as long as the relevant profile or account exists, subject to applicable deletion or moderation requirements.

Booking Requests and messages are kept for as long as the associated accounts exist so that Users can retain their booking and communication history.

Ratings and Reviews are kept for as long as the associated Artist profile or account exists, in the same way as other booking-related records.

Reports and the decisions taken on them are kept for as long as needed to handle them, detect repeated abuse and defend legal claims.

Messages you send us are kept for as long as needed to answer them and to handle any follow-up questions or claims.

Your Favorites are kept until you remove them or your account is deleted.

When you request account deletion, we will delete your personal data within 30 days, except where certain information needs to be retained for a longer period to comply with legal obligations, resolve disputes, prevent fraud or abuse, or protect our legal rights.

Where information is retained for these purposes, it will be kept only for as long as reasonably necessary.

You can request deletion of your account at any time by contacting us at info@festivity.ee.

Special categories of personal data

Festivity does not intentionally request or require Users to provide special categories of personal data, such as information concerning health, biometric data, political opinions, religious beliefs or sexual orientation.

Users should avoid including such information in public profiles, Booking Requests, messages, Ratings or Reviews unless it is necessary and there is an appropriate legal basis for processing it.

Your rights under GDPR

Depending on the circumstances and applicable legal requirements, you have the right to:

  1. access a copy of the personal data we hold about you;
  2. request correction of inaccurate or incomplete personal data;
  3. request deletion of your personal data;
  4. request restriction of processing;
  5. receive certain personal data in a structured, commonly used and machine-readable format (data portability);
  6. object to processing based on our legitimate interests;
  7. withdraw consent where processing is based on your consent; and
  8. lodge a complaint with a data protection supervisory authority.

To exercise your rights, contact us at: info@festivity.ee

We may need to verify your identity before fulfilling certain requests.

We will normally respond to a request within one month. Where permitted by GDPR, this period may be extended by up to two additional months where the request is particularly complex or we receive a large number of requests. We will inform you if an extension is necessary.

Right to lodge a complaint

If you believe that your personal data has been handled unlawfully, you have the right to lodge a complaint with a competent data protection supervisory authority.

As the Platform is operated from Estonia, you may contact the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

Website: www.aki.ee

You may also have the right to lodge a complaint with the supervisory authority in the EU country where you live, work or believe that an infringement has occurred.

Cookies and browser storage

We use strictly necessary cookies and browser storage required for authentication and maintaining your logged-in session. These do not require your consent under applicable law.

We also use Google Analytics 4 ("GA4"), a web analytics service provided by Google, to understand how visitors use the Platform (for example, which pages are visited, where traffic comes from, and aggregate usage patterns) and to improve it. GA4 sets the following cookies on your device: _ga and _ga_<container-id>, used to distinguish visitors and sessions, retained for up to 14 months.

These analytics cookies are not strictly necessary and are only set with your consent. When you first visit the Platform you will be asked to accept or decline them; you can change your choice at any time via the "Cookie settings" link in the footer. If you decline, only strictly necessary cookies are used and no GA4 cookies are set.

Data collected through GA4 is processed by Google. Google LLC is certified under the EU-U.S. Data Privacy Framework, which provides a recognised safeguard for this transfer.

Embedded videos and music. Artist profiles may include videos and audio tracks from YouTube (Google), Vimeo, Spotify or SoundCloud. These players are not loaded when you open a page: until you press play, your browser does not connect to these services (YouTube preview images are delivered through our own servers). When you press play, the player is loaded directly from the provider, which may receive your IP address and technical data and may set its own cookies or use similar technologies under its own privacy policy. YouTube videos are embedded in privacy-enhanced mode (youtube-nocookie.com) and Vimeo videos with the "do not track" setting.

We do not use advertising cookies or third-party tracking/profiling cookies, apart from the embedded players described above, which load only when you press play.

Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

These measures include encrypted HTTPS connections, secure password hashing performed by our authentication provider, and database-level access controls, including row-level security where applicable.

No online service can be guaranteed to be completely secure.

Personal data breaches

If we become aware of a personal data breach, we will assess the breach and take the measures required by applicable law.

Where GDPR requires notification to a supervisory authority, we will make the notification within the applicable legal timeframe.

Where a breach is likely to result in a high risk to the rights and freedoms of affected individuals, we will notify affected individuals as required by GDPR.

Children

The Platform is not intended for people under the age of 16.

We do not knowingly collect personal data from children under 16.

If you believe that a person under 16 has provided personal data to us, please contact us at info@festivity.ee and we will take appropriate steps, including deletion where required.

Automated decision-making and profiling

We do not currently use automated decision-making or profiling that produces legal or similarly significant effects on Users.

Artist profiles, Booking Requests and other Platform content are not ranked or accepted through automated decisions that have legal or similarly significant effects on Users.

Language of this Privacy Policy

This Privacy Policy is available in multiple languages, for the convenience of Users.

In the event of any conflict, ambiguity or discrepancy between the English version of this Privacy Policy and a translated version, the English version prevails, except where applicable law requires that a local-language version control.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

When we make material changes, we will update the "Last updated" date at the top and, where appropriate, notify registered Users by email or through the Platform.

The updated Privacy Policy will apply from the date stated in the updated version.

Contact

For any questions about this Privacy Policy or your personal data, contact:

Festivity

Data controller: Lev Skrjabin

Location: Estonia

Email: info@festivity.ee