Open Arms Fest —
Privacy Policy
Last updated: 4 November 2026
This Privacy Policy explains how we collect, use, share and protect personal data when you visit the Open Arms Fest website openarmsfest.com (the "Website"), register for the event, or attend it. It is written in line with the EU General Data Protection Regulation 2016/679 ("GDPR") as applicable across the European Economic Area, and the national data protection laws of Estonia, Finland, Sweden and Norway, where Open Arms Fest events take place.
1. Who we are
The controller responsible for your personal data is:
Public Organisation “Victory Drones”, the controller responsible for the Website and registration form.
Registered address: 01014, Ukraine, Kyiv, 61 Zvirynetska Street, flat 41
Registration number: 39795066
Contact for privacy matters: support@victory-drones.com
Open Arms Fest is organised together with Public Union “Ukrainian Council of Defence Industry”.
2. What personal data we collect
Data you give us through the registration form:
Identity and contact data: full name and e-mail address.
Event choices: the festival days and individual programme events you select.
E-mail preference: whether you agree to receive e-mails from the organisers about Open Arms Fest.
Security screening at the venue: entry to the venue and concerts involves metal-detector screening and bag checks. We do not record your identity or keep any personal data from these checks.
Photos and video: we take photographs and video recordings at the event, in which you may appear.
No payment data: admission is free with registration. We do not sell tickets and do not collect any payment information.
Website usage data: IP address, browser type, device information, pages visited and cookie data. See our Cookie Policy.
Communications: the content of e-mails or messages you send us.
3. Why we use your data and on what legal basis
To register you and manage your participation (confirmation, practical information and programme updates by e-mail) — our legitimate interest in organising the event and admitting registered participants, Art. 6(1)(f). .
To send you e-mails about Open Arms Fest — programme, reminders, updates and opportunities to take part in festival-related activities — your consent, Art. 6(1)(a), which you can withdraw at any time.
Where we rely on consent, you provide it by actively selecting an unticked checkbox or making another clear affirmative indication during registration, as applicable. You may withdraw your consent at any time by using the unsubscribe link or contacting us. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before withdrawal, nor does it affect processing that continues on a separate valid legal basis.
To take photographs and videos at the event and use them for reporting and promotion — our legitimate interest in documenting and promoting the event, Art. 6(1)(f). You may object at any time (see Section 8).
To operate, secure and improve the Website — legitimate interest, Art. 6(1)(f); non-essential cookies only with consent.
To respond to enquiries and handle legal claims — legitimate interest, Art. 6(1)(f).
Fields marked as mandatory in the registration form are needed to register you. E-mail updates are optional and do not affect your registration. All other fields are optional.
We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.
4. Who we share your data with
We share personal data only where needed for the purposes above:
Service providers acting on our behalf under data processing agreements (Article 28 GDPR): website hosting (GoDaddy), which stores registration data; e-mail service (Google); spam protection for the registration form (Google reCAPTCHA).
Public Union "Ukrainian Council of Defence Industry", as co-organiser of the festival (see Section 1).
Public authorities, law enforcement or courts, where required by law.
Professional advisers (lawyers, auditors) under confidentiality obligations.
We do not sell your personal data.
5. International data transfers
Your data may be transferred to, and processed in, countries outside the European Economic Area, including Ukraine, where an organiser may process registration data, and the United States, where Google may process or store data. Ukraine is not covered by a European Commission adequacy decision under Article 45 GDPR. Where transfers to Ukraine take place, we will use appropriate safeguards under Article 46 GDPR, in particular the European Commission’s Standard Contractual Clauses (SCCs), together with any supplementary measures required following an assessment of the transfer. The relevant SCCs were adopted by Commission Implementing Decision (EU) 2021/914: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj/eng. For transfers to Google in the United States, where the relevant services and data transfers are covered by Google’s certification under the EU–US Data Privacy Framework, we may rely on that framework; transfers outside its scope are protected through applicable SCCs or other valid safeguards under GDPR. In exceptional circumstances, a transfer may rely on a derogation under Article 49 GDPR, such as explicit informed consent after the individual has been told of the possible risks arising from the absence of an adequacy decision and appropriate safeguards; such derogations are not intended to replace the safeguards for regular transfers. You may request information about the applicable safeguards or a copy of them by contacting us.
6. How long we keep your data
Registration and attendance data: 12 months after the event, so we can manage follow-up and future editions.
Newsletter data: until you unsubscribe.
Event photos and videos: up to 5 years in our archive.
After that, data is deleted or anonymised. This includes the Website database and, within 30 days, backups.
7. How we protect your data
We use appropriate technical and organisational measures, including encrypted connections (HTTPS), access controls, and limiting access to staff and providers who need it.
8. Your rights
Under the GDPR you have the right to:
access your personal data and receive a copy;
correct inaccurate or incomplete data;
have your data erased;
restrict processing;
receive your data in a portable format;
withdraw consent at any time, without affecting the lawfulness of processing based on consent before withdrawal or processing carried out on another valid legal basis;
object to processing based on our legitimate interests, including photography and video at the event.
To exercise your rights, write to support@victory-drones.com. We will reply within one month. We may ask you to confirm your identity.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live, work or where the event takes place:
Estonia — Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee
Finland — Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), www.tietosuoja.fi
Sweden — Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se
Norway — Norwegian Data Protection Authority (Datatilsynet), www.datatilsynet.no
9. Age restriction
The event is open only to persons aged 18 and over. We do not knowingly collect data from minors.
10. Changes to this policy
We may update this Privacy Policy. The current version is always available on the Website, with the date of the last update shown at the top. We will notify registered participants of material changes by e-mail.
11. Contact
Questions about this policy: support@victory-drones.com.