Privacy Policy

The organizer of East European Comic Con processes your contact data (e.g. name, e‑mail, ticket details) in order to ensure your participation in the event, communicate regarding the schedule, accessibility rules and other essential information.

Processing is carried out on the basis of the contract (ticket purchase) and/or the organizer's legitimate interest in ensuring the proper conduct and security of the event, in accordance with Regulation (EU) 2016/679 (GDPR) and applicable national legislation.

You have the right of access, rectification, erasure, restriction, objection and data portability, as well as the right to withdraw consent given in certain specific contexts, without affecting the lawfulness of prior processing.

For any request related to the processing of your data, you may contact us at [email protected].

Further details regarding data processing, including the types of data processed, legal bases and recipients, can be found in the Privacy Policy available on the official website.

In short

We use no analytics or tracking cookies, and there are no third-party cookies on this site: none from Facebook, none from Google, none from advertising networks.

Your information stays strictly inside the EECC platform. We do not sell it, we do not rent it, we do not export it and we do not share it with anyone for commercial or advertising purposes. Nobody outside Comic Con has access to it.

All data is kept and administered by Comic Con. The infrastructure providers listed in section 10 — hosting, file storage, email, notifications, ticketing and invoicing — process it exclusively on our instructions, strictly as far as it is needed for the service to work, and have no right to use it for their own purposes.

The only data we pass outside that circle is the data requested by the authorities on the basis of the law.

1. Preamble

Because through the use of our services we come into contact with your personal data within the meaning of EU Regulation 679/2016 (GDPR), we have prepared this Privacy Policy, which has the role of informing you about the type of data collected, the purpose and method of processing them, as well as about the rights and obligations you have as a data subject. The information thus provided will give you the opportunity to decide whether you want to use our Services and to choose how you want to use them.

The protection and confidentiality of personal data is a priority of states around the world, which has required the adoption of strict measures for accessing and processing them, especially data circulating in the online environment.

Our organization understands the importance of these measures and undertakes to make efforts to comply with them. To convince you that we act with diligence and prudence in this regard, please review this Policy. If you consider that your rights are not sufficiently protected, please do not send us personal data until we can offer you satisfactory guarantees. In this regard, you can write to us at [email protected]

If you agree with this Policy, our organization will proceed to process your data in accordance with what is accepted and included in this document.

Please note that this Policy applies exclusively to the services provided by our organization. Accessing external websites or applications from our website generates another entity capable of collecting and processing your personal data, an entity for which we are not responsible.

2. Data Controller

The commitment expressed through this Privacy Policy belongs to East European Comic Con ("EECC", "we", "us", or "our").

This Policy applies to the collection and processing of personal data through the website comic-con.ro and all related services.

• Organization: East European Comic Con
• Address: Romania
• Email: [email protected]

This policy is designed in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Romanian Law no. 190/2018 regarding measures to implement the GDPR.

3. Website Hosting Information

Our website is hosted on ROMARG SRL, headquartered at Str. Ionescu Crum nr. 1, Brasov Business Park, 6th Floor, Brasov, Romania (VAT RO6529540, Trade Register J14/900/1994).

The servers hosting the website are located in Romania, within the European Union. Website hosting therefore does not involve a transfer of personal data to a third country within the meaning of Article 44 GDPR.

For the other services we use that are located outside the EEA (for example file storage and push notifications), the European Commission has approved the use of Standard Contractual Clauses as a method to ensure adequate protection regarding data transfer outside the EEA. By incorporating standard contractual clauses into a contract concluded between the parties transferring data, personal data is considered protected when transferred outside the EEA or the United Kingdom, to countries for which an adequacy decision has not been adopted.

Data introduced on our website is stored on servers operated by our hosting providers, which comply with GDPR requirements through appropriate contractual safeguards.

4. Principles Governing the Processing of Personal Data

In accordance with the provisions of EU Regulation 679/2016, the processing of personal data is carried out in compliance with the following principles:

a. Lawfulness, Fairness and Transparency

Lawfulness is an essential principle that characterizes any conduct of the individual in society, and in the case of processing personal data it presupposes processing them based on legal provisions that are part of the community acquis that correlates with the declared purpose for processing and the legal grounds permitted by the GDPR Regulation. Fairness involves moral and ethical values, fair processing being that carried out on the basis of the same objective and honest criteria, without discrimination. Transparency requires that any information and communications relating to the processing of personal data are easily accessible and easy to understand, and that clear and plain language is used when transmitting the respective information/communications.

b. Purpose Limitation

Personal data must be collected for specified, explicit and legitimate purposes, and further processing in a manner incompatible with these purposes is prohibited, except where further processing takes place for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

c. Data Minimization

Through this principle, operators are notified that any collection of personal data must be very well analyzed before actually obtaining the data, which must be the most relevant and strictly limited to what is absolutely necessary for the purposes for which they are processed.

d. Accuracy

Operators must take all measures to ensure the validity of the data, and those proven to be inaccurate must be updated or deleted quickly. In this regard, the data subject has the right to request the modification or deletion of those inaccurate data.

e. Storage Limitation

Data must be kept only for as long as necessary for the assumed processing. Longer storage periods are exceptions and usually result from the law (e.g.: the obligation to keep the archive for a certain number of years, keeping data for research or statistical purposes).

f. Integrity and Confidentiality

The processing of personal data must be done in the most appropriate security conditions, which include "protection against unauthorized or illegal processing and against accidental loss, destruction or damage, by taking appropriate technical or organizational measures".

5. Personal Data We Collect

Personal data is collected from you in several ways, as follows:

• We collect personal data when you transmit it to us directly, for example when you create an account, when you register for an activity or when you send us a request.
• We automatically collect a limited set of technical data when you use the website or the mobile app (see section 5.20).
• We also collect personal data when you contact us in ways other than through the website and you have explicitly consented to such processing.

5.1. User Account

When you create an account on the website or in the mobile app, we collect:

• Last name and first name
• Nickname
• Date of birth
• Sex
• Phone number
• Email address
• Country
• County (for Romania only)
• City
• Password (stored only as a hash, never in plain text)
• Temporary verification codes sent by email when you create the account, reset your password or delete the account

5.2. Cosplay Parade Registration

• Registration type (solo or group)
• For each participant: last name, first name, email, phone, date of birth and nickname
• Character name and franchise
• Character reference image
• Parental consent for participants under 18 (see 5.6)
• Attendance at the event (QR code check-in, with date and time)

5.3. Cosplay Contest Registration

• Registration type (solo, group or extra category)
• For each participant: last name, first name, email, phone, date of birth and nickname
• Character name and franchise
• Character reference image
• A collage of 5-10 work in progress (WIP) costume photos, 1200x1200 recommended
• An .mp3 audio file for the stage performance
• Description of the stage performance
• Image showing props positioning (optional)
• Parental consent for participants under 18 (see 5.6)
• Checkpoint scans during the contest (checkpoint, date and time)

5.4. Cosplay Skit Showcase Registration

• Registration type (solo or group) and team name
• For each participant: last name, first name, email, phone, date of birth and nickname
• Character name and franchise
• Character reference image
• Audio file for the skit
• Description of the skit
• Image showing props positioning and props details (both optional)
• Parental consent for participants under 18 (see 5.6)

5.5. K-Pop Showcase Registration

• Group name
• For each member: last name, first name, email, phone, date of birth and stage name
• Choreography video
• Audio file
• Group photo
• Titles of the songs used
• Props and special stage elements (optional)
• Social media handles (optional)
• Parental consent for participants under 18 (see 5.6)

5.6. Parental Consent for Minors

For every participant under 18 we generate a unique, time-limited link that you pass on to the parent or legal guardian. Through that form we collect:

• Last name and first name of the parent or legal guardian
• Their phone number and, optionally, their email address
• The handwritten signature drawn on screen
• The signing date and the PDF document generated automatically

5.7. Artists Alley: Registration, Portfolio and Contract

When you register for Artists Alley or submit a portfolio we collect:

• Last name, first name, email, phone, date of birth and artist nickname
• Avatar image
• The portfolio link and an optional link to social networks
• CV (PDF file, optional)
• The description of the artist and the products, together with any notes you send us
• The registration price chosen and the extra options selected
• At contract signing: company name, tax ID (CUI/CIF) and VAT payer status, Trade Register number, bank and IBAN account
• Full address (country, county, city, street, postal code)
• Name and position of the signatory, phone, email and website
• The contact person: full name, email and phone
• What the artist or the company produces and the products sold, the handwritten signature and the resulting PDF contract
• Attendance at the event (QR code check-in)

5.8. Exhibitor Registration

For participation as an exhibitor we collect the contact person data and the company data required for the contract and for invoicing:

• Last name, first name, email and phone of the person making the registration
• Company name, tax ID (CUI/CIF), VAT payer status and Trade Register number
• Bank and IBAN account
• Full address (country, county, city, street, postal code)
• Name and position of the contract signatory, company phone, email and website
• The contact person for the event (full name, email, phone)
• What the company is (distributor, publisher, retailer and so on) and the products sold
• The stand details the form asks for: rented surface in square metres, included and additional badges, electrical connection
• For the stand shown publicly on the map: the stand name, logo, the description in Romanian and English, and the opening hours
• The handwritten signature and the resulting PDF contract
• The invoicing data is sent to our invoicing provider in order to issue the proforma invoice (see section 10)

5.9. Volunteer Registration

If you sign up as a volunteer we collect:

• Last name, first name, email, phone, date of birth and nickname
• Your motivation for volunteering, what recommends you and how you found out about the programme
• CV (PDF file, optional)
• T-shirt size
• The keyword used at registration, where registration requires one
• At the signing of the volunteering contract: personal numeric code (CNP), ID card series and number, full address, handwritten signature and the PDF contract
• Attendance at the event (QR code check-in, with date and time), the team you belong to and your break requests
• Invitations sent to friends: the email address you use to find them, the day chosen, the QR code issued and the moment of entry

5.10. Photo-Video Agreement (Accreditation)

For photo-video accreditation, the electronically signed agreement requires verifying the identity of the person entering the venue with equipment. We collect:

• Full name, phone number and email address
• Personal numeric code (CNP)
• ID card series and number
• Country, county and city
• A selfie taken or uploaded when completing the agreement
• The list of equipment you bring in (type, brand, model, quantity)
• The handwritten signature and the resulting PDF agreement
• The keyword used at registration, where one is required

5.11. Yukata Rental (Rent Yukata)

The rental starts when a volunteer scans the QR code from your account. The signing form does not ask you for new data: it shows the details from your account and asks only for the signature. We keep:

• The details taken from your account: last name, first name, email, phone and date of birth
• The handwritten signature drawn on screen, the agreement number and the resulting PDF agreement
• The rented item, the event, the rental status and the moment of return
• The volunteer who scanned the code when the item was handed over

5.12. Your Tickets

• In order to show your tickets in your account, we send your account email address to the ticketing provider, which returns the tickets associated with it (see section 10)
• We keep a log of ticket accesses: the ticket identifier, the date and time, the source (website or app) and the device identifier
• We do not process payments on our website and we do not collect card data

5.13. Vouchers

• The voucher codes assigned to your account, their type and the moment they were used

5.14. Safety Check Reports

If you submit a report through the Safety Check tool, we collect:

• Whether the report concerns you or another person
• The type of incident, the time it occurred, the location and a landmark
• The description of the situation, as you write it
• The identity of the account that submitted the report and the messages later exchanged with the team

5.15. Venue Access Reports

• The title and description of the situation at the entrance
• The photos you upload
• The items you were denied entry with, selected from the list or described by you

5.16. Bug Reports and Feedback

• The title and description you submit
• The messages later exchanged with the team about that report

5.17. Polls

• The options you choose and the values you submit, linked to your account

5.18. The Mobile App and Notifications

The EECC app uses the same accounts and the same forms as the website. In addition, in order to deliver notifications we keep:

• A device identifier and the notification token issued by the notification service
• The platform (Android or iOS) and the device model
• The app sends its own version with every request to the server, so that old versions with security problems can be blocked
• Your subscriptions to the schedule events you want to be notified about
• The app asks for camera permission (scanning QR codes and taking the selfie) and for photo library permission (choosing the images you upload). Images reach us only when you submit the form.
• The app does not access your location, contacts, microphone or messages

5.19. Messages and Conversations

• The content of the messages exchanged with the organizers regarding a registration or a report
• The correspondence carried out by email, when you write to us directly

5.20. Technical Data Collected Automatically

a. Server Logs

The servers hosting the website record, for each request, the IP address, the browser type (user agent), the address of the page accessed and the date and time. These logs serve the operation, troubleshooting and security of the service.

b. Security Log

We record events relevant to account security: successful and failed logins, password changes, changes made by administrators. For each event we keep the account involved, the IP address, the user agent, the route called and the result of the operation.

c. Cookie Consent Record

When you choose your cookie options, we keep an anonymous visitor identifier, the options chosen, the IP address, the user agent and the date of the choice. This record exists so that we can prove consent, as required by the GDPR.

d. What We Do Not Collect

We do not use traffic analytics services, tracking pixels, web beacons or third-party scripts. There are no cookies from Facebook, Google, advertising networks or other external platforms on the website. We do not track your browsing on other websites, we do not build behavioural profiles, we do not collect location data and we do not take automated decisions about you.

6. Legal Basis for Processing

We will try to maintain consent expressed in this regard as the sole basis for processing your personal data. If you withdraw your consent by following the unsubscribe instructions, by deleting the user account or by changing the rules applicable to the cookie policy, we will immediately comply with your request, except for that information for which another legal basis for processing exists (other than your consent).

The legal bases we rely on for processing your personal data include:

a. Consent (Article 6(1)(a) GDPR)

Where you have given clear consent for us to process your personal data for a specific purpose, such as participating in competitions and activities or receiving notifications about the schedule.

b. Contract Performance (Article 6(1)(b) GDPR)

Where processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract, such as processing your competition registration.

c. Legal Obligation (Article 6(1)(c) GDPR)

Where processing is necessary for compliance with a legal obligation to which we are subject.

d. Legitimate Interests (Article 6(1)(f) GDPR)

Where processing is necessary for our legitimate interests or those of a third party, provided that your interests and fundamental rights do not override those interests. Our legitimate interests include: improving our services, ensuring security, fraud prevention, and keeping participants informed about how the event unfolds.

e. Vital Interests (Article 6(1)(d) GDPR)

Where processing is necessary to protect your vital interests or those of another natural person.

7. Purposes of Processing

Personal data is processed to achieve the following objectives:

• To facilitate the creation and security of the user account
• To conclude and execute the contract for using the Services
• To identify the person as a user of the Services
• To administer the Services
• To improve the quality of the user experience when interacting with the website (easier navigation, suggestions based on browsing history, keeping user preferences, etc.)
• For proper account management, including sending administrative email notifications such as security advice or support and maintenance
• To respond to comments and questions about the website and our events
• To provide customer support service
• To send you notifications and emails about the schedule, about your registrations and about changes in how the event unfolds
• To process competition and showcase registrations (Cosplay Parade, Cosplay Contest, Cosplay Skit Showcase, K-Pop Showcase)
• To process Artists Alley applications, exhibitor registrations and volunteer applications, including the related contracts
• To comply with applicable laws, to comply with legal requests and legal process, including responding to requests from public authorities regarding the operation of the website
• To protect the rights, privacy and integrity of the website
• To accredit the people entering with photo-video equipment, to manage rentals and to verify the identity of those signing contracts and agreements
• To receive and resolve the reports submitted through the safety tools, the venue access reports, the bug reports and the feedback

8. Processing of Minors' Data

We take special care when processing personal data of minors (persons under 18 years of age). For competition registrations involving minors:

• Parental or guardian consent is required for participants under 18 years old
• The parental consent is signed electronically by the parent or guardian, through a unique time-limited link that you pass on to them
• We verify that consent has been provided before processing the registration
• Parents or guardians can request access to or deletion of their child's data at any time

In accordance with Romanian Law no. 190/2018, for information society services, we require parental consent for the processing of personal data of children under 16 years of age.

9. Data Retention

We keep the personal data we use for the purposes described in this Policy for a maximum period of 5 years, with the following exceptions:

• Consent-based processing: Until the date on which you withdraw your consent
• Account data: Until you request account deletion, or 3 years of inactivity
• Competition registrations: 3 years after the event
• Uploaded files (images, videos, audio): 1 year after the event
• Parental consent forms: 5 years after the minor reaches 18 years of age
• Contractual and fiscal documents (exhibitor, artist or volunteering contracts, photo-video agreements, rental contracts, together with the identification data they contain): 10 years, in accordance with accounting legislation
• Technical logs and the security log: 12 months
• Cookie consent records: 1 year
• Legal requirements: Where legal provisions require keeping personal data for more or less time
• Cookies: Cookies and consent-based technologies are kept for a different period of time depending on cookie settings (except for session cookies and other similar technologies that are kept for the period you are in the respective browser)

After the period expires, your personal data will be deleted, destroyed or anonymized for use for scientific, historical or statistical research purposes.

10. How We Share Your Personal Data

We do not sell, rent or trade personal data with anyone, and nobody outside Comic Con has access to it. All data is kept and administered by Comic Con. The data entered on the website or in the app stays inside the EECC platform; we only pass it to the providers without which the service could not run, which process it exclusively on our instructions as data processors, and to public authorities when the law requires it.

The providers we use are:

• Website and database hosting: ROMARG SRL (Romania). The database runs on the same server, in Romania.
• Storage of uploaded files (images, CVs, signatures, PDF contracts): Amazon Web Services, Frankfurt region, Germany (European Union).
• Sending transactional emails (account verification, password reset, status changes, vouchers): Amazon Web Services (Amazon SES), same region.
• Delivering notifications in the mobile app: Google Firebase Cloud Messaging, which receives the device token and the content of the notification.
• Displaying your tickets in your account: Entertix (Romania), the ticketing provider of the event, which receives your account email address in order to return the tickets associated with it.
• Issuing proforma invoices for exhibitors and artists: our invoicing provider (Romania), which receives the invoicing data from the contract.
• Public authorities (prosecutors, police, courts and other authorized bodies), on the basis of and within the limits of the law.

We do not pass data to advertising networks, data brokers or traffic analytics services, and we do not use your data for advertising purposes. Inside the organization, access to data is limited to the people who need it for their role, through individually granted permissions.

International Data Transfers

The data is hosted in the European Union: the website, the database and the ticketing and invoicing providers are in Romania, while uploaded files and transactional emails are processed in Germany.

The only processing that may involve a transfer outside the European Economic Area is the delivery of push notifications through Google Firebase Cloud Messaging. For this transfer we rely on the Standard Contractual Clauses approved by the European Commission and on the adequacy decision regarding the EU-US Data Privacy Framework. If you turn notifications off, this processing does not take place.

11. Cookies and Tracking Technologies

We use a small number of cookies, all of them our own. There are no third-party cookies on the website: none from Facebook, none from Google, none from advertising networks or traffic analytics services.

The Cookies We Use

a. Necessary Cookies

Without them the website cannot work, so they cannot be disabled. These are: the authentication cookie that keeps you logged in, two hints that allow the menu to be displayed correctly without waiting for the server, the cookie that protects against forged requests (CSRF) and the two cookies that remember your cookie choice.

b. Functional Cookies

They remember the preferences that make the website more comfortable to use, such as the language or interface settings. You can enable or disable them at any time from the Cookie preferences window.

c. Analytics and Marketing Cookies

We do not use such cookies. We do not measure traffic with external services, we do not track campaign effectiveness and we do not place tracking pixels or web beacons in our pages.

Managing Cookies

You can change your choice at any time from the Cookie preferences window, available in the website footer. Cookies can also be deleted or blocked from your browser settings, in the privacy section. If you block the necessary cookies, logging in will no longer work.

The mobile app does not use cookies. Your session is kept in the secure storage of the device (Keychain on iOS, Keystore on Android).

Do Not Track Signals (DNT)

DNT is a browser setting through which you ask a website not to track you. We do not track users across websites and we do not use tracking technologies, so there is no processing that the DNT signal could stop.

Automated Decision-Making or Profiling

We do not use your data for automated decision-making. We do not carry out profiling that produces legal effects or similarly significantly affects you.

12. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (HTTPS/TLS)
• Secure password hashing using industry-standard algorithms
• Access controls and authentication mechanisms
• Regular security assessments and updates
• Secure file storage with access restrictions
• Staff training on data protection procedures
• Incident response procedures for data breaches

13. Your Rights

Regarding the processing of personal data to which we have access within the limits and conditions established by this Policy, you have the following rights:

a. Right of Access (Article 15 GDPR)

To be provided with a copy of any personal data we hold about you and to receive information about the processing of your personal data.

b. Right to Rectification (Article 16 GDPR)

To request us to update or correct inaccurate personal data or to complete any incomplete personal data. You can update your profile information, such as username, address or contact information.

c. Right to Erasure (Article 17 GDPR)

To request us to delete your personal data ("right to be forgotten") in certain circumstances.

d. Right to Restriction of Processing (Article 18 GDPR)

To request us to limit the processing of your personal data in certain circumstances.

e. Right to Data Portability (Article 20 GDPR)

To request us to transmit personal data to you or to transfer them to another data controller in a structured, commonly used and machine-readable format.

f. Right to Object (Article 21 GDPR)

To object to the processing of your personal data based on legitimate interests or for direct marketing purposes.

g. Right to Withdraw Consent

Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing based on consent before its withdrawal.

h. Right to Stop Processing

To request us to stop processing personal data for: (i) sending push notifications, (ii) data analysis aimed at improving the services, (iii) any communication that is not necessary for your participation in the event.

Exercising Your Rights

If you wish to exercise any of the above rights, you can contact us using one of the options below:

• You can send us an email at: [email protected]
• Any other contact information you have obtained as a result of your interaction with us

We will respond to your request within 30 days. Please note that the rights listed above are not absolute. There are exceptions, so each request received will be analyzed to decide whether it is justified or not. To the extent that the request is justified, we will facilitate the exercise of rights. If the request is unfounded, we will reject it, but we will inform you of the reasons for the refusal and your rights to file a complaint with the Supervisory Authority and to go to court.

14. Right to Lodge a Complaint

You have the right to lodge a complaint with the competent supervisory authority (particularly in the Member State where you reside, work or where the alleged violation occurred), if you consider that any of your data is processed in a manner that constitutes a violation of the General Data Protection Regulation no. 679/2016 of 27 April 2016.

In Romania, the supervisory authority is:

• Authority: ANSPDCP - Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (National Supervisory Authority for Personal Data Processing)
• Website: www.dataprotection.ro
• Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, cod postal 010336, București, Romania
• Phone: +40.318.059.211
• Email: [email protected]

15. Applicable Law

This Privacy Policy is governed by and must be interpreted in accordance with the legislation of Romania and any other mandatory legal provisions applicable in the European Union, including the General Data Protection Regulation (EU) 2016/679 and Romanian Law no. 190/2018.

16. Changes to This Policy

You can find out when this Privacy Policy was last modified by checking the "Last updated" section at the top of the document.

If you object to any changes, you can expressly manifest your intention in this regard. Continuing to use the website after the publication of changes to this Privacy Policy means that you have read, understood and accepted the changes.

You can print, download and retain in any way a copy of the Privacy Policy (and any revised version) for your records.

We will notify you of significant changes by posting the new policy on this page and updating the "Last updated" date. For material changes that affect how we process your personal data, we may also notify you via email if you have provided one.

17. Contact Us

If you have any questions about this Privacy Policy or our data practices, or if you have any concerns related to the processing of personal data, please contact us:

• Email: [email protected]

We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy.