Privacy Policy

1. Our Commitment to Your Privacy

Boracay SBKZ World Fiesta 3 respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, disclose, and protect personal data when you:

• Visit our website;
• Purchase or receive a festival pass;
• Register for workshops, competitions, parties, or other festival activities;
• Apply as an artist, DJ, performer, instructor, volunteer, ambassador, vendor, sponsor, media representative, or partner;
• Subscribe to our mailing list;
• Contact us through email, social media, messaging platforms, forms, or other communication channels; or
• Attend or otherwise participate in Boracay SBKZ World Fiesta 3.

This Policy is intended to comply with Republic Act No. 10173, or the Data Privacy Act of 2012, its Implementing Rules and Regulations, applicable issuances of the Philippine National Privacy Commission, and other applicable privacy laws.

2. Who We Are

Boracay SBKZ World Fiesta 3 is organised and managed by:

Personal Information Controller: SBKZ PHILIPPINES OPC
Event: Boracay SBKZ World Fiesta 3
Festival dates: 5–10 May 2027
Main festival dates: 7–9 May 2027
Primary venue: Boracay Ocean Club Resort & Spa, Station 3, Boracay Island, Malay, Aklan, Philippines
Email: info@boracaysbkzworldfiesta.com
Telephone: +63 917 519 0040
Website: www.boracaysbkzworldfiesta.com

For purposes of applicable data protection laws, SBKZ PHILIPPINES OPC is the Personal Information Controller responsible for determining why and how personal data is processed in connection with the festival.

Our authorised ticketing, payment, website, email, accommodation, production, and technology providers may act as Personal Information Processors when processing personal data under our instructions.

3. Scope of This Privacy Policy

This Privacy Policy applies to personal data collected through:

• The official festival website;
• Online registration and ticketing forms;
• Payment and booking platforms;
• Email subscriptions and enquiries;
• Official Facebook, Instagram, TikTok, YouTube, LinkedIn, WhatsApp, Viber, and other communication channels;
• Artist, DJ, performer, volunteer, vendor, ambassador, sponsor, and partner applications;
• Workshop, performance, competition, and activity registrations;
• Surveys, feedback forms, promotions, contests, and giveaways;
• Accreditation, check-in, access-control, and attendee-support systems; and
• Photographs, video recordings, livestreams, interviews, and other content produced during the festival.

This Policy does not automatically apply to independent websites, businesses, hotels, airlines, tour operators, payment providers, social media platforms, or other third parties that maintain their own privacy policies.

4. Personal Data We May Collect

The personal data we collect depends on your interaction with us.

4.1 Identity and contact information — We may collect: full name; preferred name; date of birth or age, when necessary; gender or preferred dance role, when voluntarily provided and relevant; nationality and country of residence; residential, billing, or business address; email address; telephone or mobile number; social media username; and emergency-contact name, relationship, and contact details. Please obtain permission from your emergency contact before giving us their information.

4.2 Ticketing and registration information — We may collect: festival pass type; ticket or order number; registration date; workshops, parties, competitions, or activities selected; dance style, role, category, or experience level; group or dance-school affiliation; promotional or ambassador code; pass-transfer or name-change information; check-in and attendance records; wristband, accreditation, or access-control information; and requests for participant support.

4.3 Payment and transaction information — We may collect: amount paid; currency; payment date; payment method; transaction or reference number; billing information; discount or promotional code; refund, cancellation, chargeback, or transfer information; and limited payment-confirmation details supplied by our payment provider. Payments may be processed by banks, e-wallets, online payment gateways, or other authorised providers. We generally do not directly store complete credit or debit card numbers, card security codes, passwords, PINs, or online-banking credentials. You should never send passwords, PINs, card security codes, or complete payment-card details through email, social media, WhatsApp, Viber, or unsecured forms.

4.4 Artist, DJ, performer, instructor, and applicant information — When you apply or contract to participate professionally, we may collect: professional or stage name; biography and portfolio; photographs, videos, and promotional materials; professional experience and dance specialisation; contract, fee, commission, or compensation information; passport, visa, permit, tax, and travel information when necessary; flight and accommodation requirements; technical rider, music, lighting, staging, and equipment requirements; dietary, accessibility, or health-related requirements voluntarily disclosed; bank or payment details; and contractual correspondence and performance records.

4.5 Competition and performance information — For Jack & Jill competitions, showcases, team performances, or similar activities, we may collect: dance category and level; partner or team information; music and performance materials; scores, rankings, results, and awards; judges’ comments; photographs and recordings of the competition or performance; and information necessary to verify eligibility. Competition results, award recipients, and selected performance content may be published on our website and official social media channels.

4.6 Sensitive personal information — Where necessary and legally permitted, we may process sensitive personal information such as health, disability, accessibility, allergy, dietary, or medical-emergency information; government-issued identification information; passport, visa, and travel-document details; tax or financial-account information; and other information classified as sensitive under applicable law. We will collect sensitive personal information only when necessary and when a lawful basis exists. Access will be limited to authorised persons who reasonably need the information. The festival does not provide medical advice. Health information disclosed to us will normally be used only for reasonable accommodation, safety, emergency response, or legal compliance.

4.7 Website and technical information — When you visit our website, certain technical information may be collected automatically, including: Internet Protocol address; browser and device type; operating system; device identifiers; approximate location based on IP address; pages visited; links clicked; referring website; date, time, and duration of visits; language and display preferences; and cookie and similar-technology information.

4.8 Communications and marketing information — We may collect: email and mailing-list preferences; messages and enquiries; customer-service correspondence; survey and feedback responses; contest or promotional entries; records of consent; marketing preferences; and information about your interaction with our emails and promotional content.

4.9 Photographs, videos, and audio recordings — The festival may be photographed, filmed, livestreamed, or otherwise recorded by authorised photographers, videographers, media partners, sponsors, venues, and production teams. These materials may include identifiable images, voices, performances, interviews, testimonials, crowd scenes, workshops, parties, competitions, and other festival activities. We will provide appropriate event notices and obtain specific permission where consent is required, particularly for directed interviews, testimonials, close-up promotional productions, minors, or sensitive situations.

5. How We Collect Personal Data

We may collect personal data:

• Directly from you;
• From a person purchasing or registering on your behalf;
• From your dance school, team, partner, group leader, or festival ambassador;
• From artists, agencies, managers, sponsors, vendors, or event partners;
• Through ticketing, payment, accommodation, or registration providers;
• Through social media and messaging platforms;
• Through cookies and website technologies;
• From public professional profiles and websites when relevant to legitimate festival activities; and
• From lawful public or government sources when required for permits, travel, contracting, safety, or compliance.

If you provide information about another person, you confirm that you are authorised to provide it and that the person has been informed about this Privacy Policy.

6. Why We Process Personal Data

We process personal data for the following purposes:

• To process ticket purchases, registrations, payments, refunds, and pass transfers;
• To verify orders, prevent duplicate registrations, and detect fraud;
• To create attendee records and manage festival check-in;
• To provide access to workshops, parties, competitions, and other activities;
• To communicate schedules, venue information, programme changes, safety notices, and important updates;
• To answer enquiries and provide customer support;
• To manage artists, DJs, performers, instructors, volunteers, ambassadors, sponsors, vendors, and partners;
• To arrange travel, accommodation, transfers, meals, technical production, accreditation, and event logistics;
• To administer competitions, performances, results, prizes, and certificates;
• To accommodate reasonable accessibility, dietary, or emergency requirements;
• To manage venue capacity, security, crowd safety, and emergency response;
• To issue invoices, receipts, accounting records, and contractual documents;
• To fulfil legal, tax, regulatory, insurance, and reporting obligations;
• To promote the festival through photographs, videos, testimonials, and event highlights;
• To send promotional information where permitted;
• To administer surveys, promotions, contests, and giveaways;
• To evaluate and improve the website, programme, services, and attendee experience;
• To protect our legal rights, property, systems, personnel, attendees, and partners;
• To investigate complaints, misconduct, fraud, security incidents, or violations of festival policies; and
• To establish, exercise, or defend legal claims.

We will not process personal data for a new and incompatible purpose without providing appropriate notice and obtaining consent where required.

7. Lawful Bases for Processing

Depending on the circumstances, we may rely on one or more of the following lawful bases:

• Consent: You have freely given specific and informed permission for a stated purpose.
• Contractual necessity: Processing is necessary to complete your registration, deliver your festival pass, provide requested services, or perform an agreement with you.
• Legal obligation: Processing is necessary to comply with tax, accounting, regulatory, safety, employment, immigration, or other legal requirements.
• Legitimate interests: Processing is necessary for legitimate festival operations, security, fraud prevention, customer service, event improvement, or appropriate promotion, provided that these interests do not override your fundamental rights.
• Protection of vital interests: Processing is necessary to protect someone’s life, health, or safety, including during an emergency.
• Establishment or defence of legal claims: Processing is necessary to protect or enforce legal rights.
• Other grounds authorised by law: We may process data where another lawful ground under applicable legislation permits or requires it.

Where processing is based on consent, you may withdraw consent at any time. Withdrawal will not affect processing lawfully carried out before consent was withdrawn.

8. Ticket Purchases Made for Other People

If you purchase or register a festival pass for another person, you must:

• Provide accurate information;
• Have authority to submit that person’s information;
• Inform the person that their information has been provided to us;
• Direct the person to this Privacy Policy; and
• Obtain any consent required before providing sensitive personal information.

We may contact the named attendee to verify registration details and communicate information necessary for the festival.

9. Marketing Communications

With your consent, or where otherwise permitted by law, we may send: festival announcements; artist and DJ reveals; schedule and programme updates; ticket offers and price-increase reminders; partner offers; future-event announcements; and related dance, tourism, or community updates.

You may unsubscribe at any time by clicking the unsubscribe link in an email, adjusting available communication settings, or contacting us at info@boracaysbkzworldfiesta.com.

Operational messages relating to an existing ticket, booking, schedule change, emergency, safety issue, or contractual matter are not marketing messages. You may continue to receive these while your registration remains active.

We will not sell your personal data or permit unrelated third parties to use it for their own direct marketing without an appropriate lawful basis.

10. Cookies and Similar Technologies

Our website may use cookies, pixels, tags, local storage, and similar technologies, including:

• Strictly necessary cookies: Required for website security, navigation, forms, ticketing, and essential functionality.
• Preference cookies: Remember language, location, or display settings.
• Analytics cookies: Help us understand how visitors use the website.
• Marketing cookies: Measure campaign performance and support relevant advertising.
• Third-party cookies: May be placed by embedded videos, social media platforms, ticketing services, payment providers, maps, or other integrated services.

Where required, non-essential cookies will be used only after you have provided consent. You may manage cookie preferences through our cookie banner or browser settings. Disabling certain cookies may affect website functionality.

11. Photographs, Videos, and Festival Media

Because Boracay SBKZ World Fiesta 3 is a public-facing cultural and dance event, photography and video recording are expected in event areas.

We may use festival media for: event documentation; news and public-information reporting; livestreams and event recaps; festival promotion; social media; websites and advertisements; sponsor and partner reports; tourism-promotion materials; and promotion of future editions of the festival.

We will process identifiable media only when an appropriate lawful basis exists and in accordance with the principles of transparency, legitimate purpose, and proportionality.

If you have a reasonable concern about a photograph or recording featuring you, contact us at info@boracaysbkzworldfiesta.com. We will assess the request in light of applicable law, contractual obligations, journalistic or artistic considerations, technical feasibility, public-interest considerations, and the rights of others. Removal from our own active channels may not remove copies already lawfully published, shared, downloaded, archived, printed, or controlled by independent third parties.

12. When We Share Personal Data

We may share personal data, only as reasonably necessary, with:

• Ticketing and registration providers;
• Payment processors, banks, and financial institutions;
• Website-hosting, cloud-storage, email, analytics, and information-technology providers;
• Festival venues, hotels, transport providers, and travel coordinators;
• Artists, agencies, production personnel, and authorised event staff;
• Security, medical, insurance, and emergency-response providers;
• Competition judges and administrators;
• Sponsors and partners when necessary for an agreed activation or benefit;
• Photographers, videographers, livestream providers, and media partners;
• Professional advisers, including lawyers, accountants, auditors, and consultants;
• Government authorities, regulators, law-enforcement agencies, courts, and the National Privacy Commission when required or legally permitted;
• A successor organisation in connection with a lawful reorganisation, merger, transfer, or similar transaction; and
• Other parties where you have provided consent or instructed us to disclose the information.

Service providers that process personal data on our behalf are expected to use it only for authorised purposes and to implement appropriate security and confidentiality measures.

Sponsors and commercial partners will not automatically receive our complete attendee database. Any sharing for their independent marketing will require an appropriate lawful basis and clear notice.

13. Social Media Platforms and Third-Party Services

Our website may contain links to or integrations with Facebook, Instagram, TikTok, YouTube, payment services, maps, accommodation platforms, and other third-party services.

When you interact with these services, the third party may independently collect and process your information under its own terms and privacy policy. We do not control the privacy practices of independent third parties. You should review their privacy policies before providing personal data.

14. International Data Transfers

The festival welcomes international attendees, artists, DJs, and partners. Some service providers may store or process personal data outside the Philippines.

Where personal data is transferred internationally, we will take reasonable and appropriate steps to ensure that:

• The transfer has a lawful purpose and basis;
• The receiving party is subject to appropriate confidentiality and security obligations;
• Contractual or other safeguards are used when necessary; and
• Data-subject rights remain enforceable to the extent required by law.

15. Data Retention

We retain personal data only for as long as necessary to: fulfil the purpose for which it was collected; provide festival services; complete contractual and financial obligations; resolve enquiries, disputes, refunds, or chargebacks; maintain appropriate event, competition, consent, and safety records; comply with tax, accounting, regulatory, insurance, and legal requirements; and establish, exercise, or defend legal claims.

Retention periods vary according to the nature of the information, the purpose of processing, legal requirements, and potential disputes.

When personal data is no longer required, we will securely delete, anonymise, destroy, or archive it in accordance with applicable law and our records-management procedures.

Anonymised information that can no longer reasonably identify an individual may be retained for statistical, historical, or analytical purposes.

16. Data Security

We use reasonable and appropriate organisational, physical, and technical safeguards designed to protect personal data against accidental or unlawful destruction, loss or alteration, unauthorised disclosure, unauthorised access, misuse, fraud, and other unlawful processing.

Safeguards may include: role-based access restrictions; password and account controls; secure storage and transmission methods; confidentiality obligations; staff and contractor training; provider due diligence; data minimisation; secure disposal procedures; system monitoring and backups; and security-incident and breach-response procedures.

No website, email system, payment platform, or electronic transmission is completely secure. While we take reasonable measures to protect personal data, we cannot guarantee absolute security.

17. Personal Data Breaches

If a personal data breach occurs, we will assess and respond to it in accordance with our incident-response procedures and applicable law.

Where legally required, we will notify the National Privacy Commission and affected individuals within the prescribed period. Notifications may include the nature of the incident, the data potentially affected, steps taken, recommended protective measures, and contact information for further assistance.

18. Your Rights as a Data Subject

Subject to applicable law, you may have the right to:

• Be informed about how your personal data is collected and processed;
• Access personal data we hold about you;
• Object to certain processing activities;
• Withdraw consent where processing depends on consent;
• Correct or rectify inaccurate, incomplete, or outdated information;
• Request erasure, blocking, or deletion where legally justified;
• Request data portability when legally applicable;
• Claim compensation or damages for harm caused by unlawful processing; and
• File a complaint with the National Privacy Commission.

These rights are not absolute and may be subject to lawful limitations, including legal-retention requirements, contractual obligations, public interest, the rights of other individuals, fraud prevention, and the establishment or defence of legal claims.

19. How to Exercise Your Rights

To submit a privacy request, contact:

SBKZ PHILIPPINES OPC
Organiser of Boracay SBKZ World Fiesta 3
Email: info@boracaysbkzworldfiesta.com
Telephone: +63 917 519 0040
Website: www.boracaysbkzworldfiesta.com

Your request should include: your full name; your contact details; a clear description of your request; relevant ticket, registration, or transaction information; and reasonable proof of identity.

We will use identity-verification information only to verify and process your request. We may request additional information when necessary to prevent unauthorised access or fraudulent requests.

We will acknowledge and respond within the period required by applicable law. If we cannot fully grant a request, we will explain the lawful reason, where appropriate.

Authorised representatives may submit requests on behalf of a data subject, subject to proof of authority and identity.

20. Complaints

We encourage you to contact us first so that we can attempt to resolve your concern.

You also have the right to submit a complaint to the National Privacy Commission: privacy.gov.ph

Submitting a concern to us does not prevent you from exercising your right to approach the National Privacy Commission or another competent authority.

21. Children and Minors

Our website and services are not primarily directed at children below 18 years old.

If a minor is permitted to attend or participate in a festival activity, registration and any required consent must be completed by a parent or legal guardian. We may request proof of age, identity, guardianship, or consent when reasonably necessary.

We will not knowingly use a minor’s identifiable image for directed commercial promotion without an appropriate lawful basis and required parental or guardian authorisation.

If you believe that we have collected a child’s personal data without appropriate authority, contact us immediately.

22. Automated Decision-Making

We do not currently make decisions that produce legal or similarly significant effects solely through automated processing.

We may use automated tools for ordinary functions such as email delivery, fraud screening, registration confirmation, website analytics, audience measurement, or advertising. Where applicable, these activities remain subject to appropriate safeguards and your available rights.

23. Accuracy of Information

You are responsible for ensuring that personal data submitted to us is accurate, complete, and current.

Please inform us promptly if your name, contact information, emergency contact, ticket assignment, travel arrangements, accessibility requirements, or other relevant details change.

24. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in festival operations, website functions, service providers, data-processing activities, security practices, or legal and regulatory requirements.

The updated version will be posted on the official website with a revised “Last updated” date. If a change materially affects how we use personal data, we will provide additional notice or request new consent where required.

25. Contact Us

For questions, concerns, requests, or complaints relating to this Privacy Policy or our handling of personal data, please contact:

SBKZ PHILIPPINES OPC
Organiser of Boracay SBKZ World Fiesta 3
Email: info@boracaysbkzworldfiesta.com
Telephone: +63 917 519 0040
Website: www.boracaysbkzworldfiesta.com