Privacy Statement for Iora Festivals

This statement explains how we use personal data when you use the Iora Festivals mobile application and connected services (the "App"). We do not sell personal data and do not use it for third-party advertising.

1. Who we are and applicable law

IORA NETWORK LIMITED ("Iora", "we", "us") is the controller of personal data processed for the App. We are incorporated in the United Kingdom and operate from Germany. UK GDPR and the Data Protection Act 2018 apply to our UK processing. EU GDPR also applies where our EU establishment or offering to people in the EU/EEA brings processing within its scope.

2. What the App does

The App provides festival schedules, maps, search, points of interest, vendors, offers and an Ask feature. It also lets account holders save preferences and plans, join groups, exchange messages and tent notes, report or block content, receive notifications, and optionally share an approximate live area with friends through Pulse.

3. Personal data we process

Account and authentication data

When you create or use an account, we process your email address, display name, profile image where supplied, internal user identifier, organisation or festival memberships, sign-in provider details, session records and security tokens. Where you use Apple or Google sign-in, that provider processes the authentication request under its own privacy terms.

App activity and content

We process festival preferences, saved items or itinerary choices, group memberships, invitations, group names, messages, tent notes and status reports, blocks, content reports, offer claims or redemptions, notification preferences and consent records. Other group members see information you choose to share with that group. Vendors may receive the minimum claim or redemption information needed to honour an offer.

Ask questions and feedback

If you use Ask, we process the question, selected language, response, follow-up context and any rating or feedback needed to answer the request, improve answer quality and investigate abuse or faults. Do not put sensitive personal data or another person's private information into a question. Ask responses are automated informational output and may be incomplete or wrong.

Approximate location and Pulse

Location access is optional and requested in context. The App may use foreground location to sort nearby information and, when you actively start or accept a Pulse session, to share an approximate area with the relevant friends or group.

• The App requests foreground-only location, not background tracking.
• For Pulse, coordinates are reduced on the device and then snapped by our server to an area of roughly 50 metres before being shown to participants.
• Pulse positions exist only for the live session and are deleted within 24 hours. We do not create a location history.

Notifications and realtime delivery

If you enable notifications, we process a device push token and notification preferences. Apple Push Notification service (APNs) or Google Firebase Cloud Messaging (FCM) delivers the notification. Authenticated realtime connections route group messages, Pulse requests and announcements while the App is in use.

Crash, security and performance data

We use Sentry in its EU region to diagnose crashes, errors and performance. Data may include device model, operating system, app version, timestamps, error messages, stack traces, network timing and a pseudonymous hashed installation identifier. Sentry session replay may sample sessions to reproduce faults; text, images and other sensitive fields are configured to be masked. Default PII collection is disabled, and we do not intentionally send account names, email addresses or location to Sentry.

Optional product analytics

If you opt in, PostHog EU Cloud processes a pseudonymous identifier, screen and feature events, button interactions, experiment variants, app/build version, device/OS type, language and timestamps. Analytics does not include GPS coordinates and is not used for advertising. It remains off unless you consent, and you can switch it off in the App.

Device-local data

The App stores cached content and preferences on your device and stores authentication secrets using the iOS Keychain or Android Keystore. Removing the App normally removes ordinary local storage, but it does not by itself delete your server account.

Support, moderation and legal records

If you contact us or report content, we process your correspondence, identifiers, the reported material, moderation decisions and related technical records. When an account is deleted, we retain a minimised deletion audit record containing protected one-way handles and a consent/operation snapshot so we can prove, safely resume and troubleshoot the deletion without retaining a usable account.

4. Why we process data

Where processing is based on consent, withdrawal does not make earlier processing unlawful. You can change analytics, notification and location choices in the App or device settings.

5. Who receives personal data

Authorised Iora personnel and service operators receive data only where needed. We also use:

We may also disclose data where required by law, to protect people or the App, or during a corporate transaction subject to appropriate safeguards.

6. International transfers

Our controller is in Northern Ireland and operates from Germany. We favour EU-region processing. Where data is transferred outside the UK or EEA, we use an applicable adequacy regulation or decision, the EU Standard Contractual Clauses, the UK International Data Transfer Agreement/Addendum, or another lawful safeguard. You may contact us for information about the safeguard relevant to your data.

7. How long we keep data

8. Account deletion

In the App, go to Settings → Account → Delete Account. The orchestrated deletion removes your active identity and account-linked data across App services before confirming success. Shared messages and safety/moderation records may remain in anonymised form. See the full account deletion guide. If you cannot access the App, email privacy@iora.network.

9. Your data-protection rights

Depending on the law that applies, you may have rights to:

• access your personal data and receive a copy;
• correct inaccurate or incomplete data;
• ask us to erase or restrict processing;
• receive portable data you provided to us;
• object to processing based on legitimate interests;
• withdraw consent at any time; and
• complain to a supervisory authority.

Email privacy@iora.network to exercise a right. We may verify your identity. We normally respond within one month; the law permits an extension for complex or numerous requests, in which case we will tell you.

10. Complaints

Please contact us first so we can try to resolve the issue. UK users can complain to the Information Commissioner's Office. EU/EEA users can complain to the competent German state supervisory authority for our establishment or to the authority where they live, work, or believe an infringement occurred.

11. Children

The App is for people aged 18 or over and is not directed at children. If you believe a child has provided us with personal data, contact us so we can investigate and delete it where appropriate.

12. Automated decisions

We do not use personal data to make solely automated decisions that produce legal or similarly significant effects. Ask produces automated informational responses but does not make such decisions about you.

13. Security

We use technical and organisational measures designed to protect data, including encrypted network connections, access controls, protected device storage, scoped service authentication and data minimisation. No system can guarantee absolute security.

14. Changes and contact

We may update this statement as the App or law changes. We will show the new effective date and give appropriate notice of material changes.

Contact: privacy@iora.network, or IORA NETWORK LIMITED, Unit 4, 12 Spittal Hill, Coleraine, Northern Ireland, BT52 2BY.