Privacy Policy
LEVINALE Film Festival
Last updated: October 29, 2026
1. Data Controller
Protecting your personal data is important to us. We process personal data in accordance with the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG), and the Telecommunications Act 2021 (TKG 2021).
The data controller responsible for processing personal data on this website is:
MRIJA Sport-, Kultur-, Wirtschaft- und Integrationsverein
Association Register Number (ZVR): 1256846024
Bräuhausgasse 40
1050 Vienna, Austria
Phone: +43 681 813 131 12
Email: [email protected]
Website: https://levinale.at/
If you have any questions about data protection or wish to exercise your rights, you can contact us using the email address above.
2. Hosting and Technical Maintenance
Our website is hosted and technically maintained by PixelMind GmbH.
Hosting and IT Service Provider:
PixelMind GmbH
Erzherzog-Karl-Straße 19a/2/2
1220 Vienna, Austria
Website: https://pixelmind.at/
The server is located in Helsinki, Finland, within the European Union.
As part of technical maintenance, PixelMind GmbH may have access to personal data where necessary for the secure operation, maintenance, and technical support of the website.
Personal data processed by PixelMind GmbH on behalf of the data controller is processed according to the controller’s instructions and on the basis of an agreement pursuant to Article 28 GDPR.
3. Server Log Files
When you visit our website, the web server automatically processes technical information necessary for secure and uninterrupted operation.
This information may include:
- IP address
- Date and time of access
- Pages and files accessed
- Browser type and version
- Operating system
- Referrer URL, where transmitted
- HTTP status code
This data is processed to ensure the technical functionality and security of our website, identify errors, and detect and prevent unauthorized access.
The legal basis is Article 6(1)(f) GDPR, reflecting our legitimate interest in providing a secure and functional website.
Server logs are retained only for as long as necessary for these purposes. They are subsequently deleted unless legal obligations or specific security-related circumstances require further retention.
4. Contact and Contact Forms
If you contact us by email or through a contact form, we process the personal data you provide.
This may include:
- Name
- Email address
- Message content, where provided
Information submitted through the contact form is forwarded to the festival’s email address. Form submissions are not permanently stored in the WordPress database.
The data is used exclusively to process your inquiry and communicate with you in connection with it.
The legal basis is Article 6(1)(b) GDPR where your inquiry relates to a contract or pre-contractual measures. For general inquiries, processing is based on our legitimate interest under Article 6(1)(f) GDPR.
Messages are retained only for as long as necessary to handle the inquiry and any required follow-up communication. Statutory retention obligations remain unaffected.
5. Ticket Purchases and Payment Processing via Stripe
We use the external payment service provider Stripe for the purchase of tickets to the LEVINALE Film Festival.
The event organizer and payment recipient is MRIJA Sport-, Kultur-, Wirtschaft- und Integrationsverein.
When you click the relevant payment link, you are redirected to an external payment page provided by Stripe.
Payment Processing
During the payment process, Stripe processes the information required for the selected payment method. This may include:
- Name and contact details of the payer
- Payment information, including card details
- Billing information, where applicable
- Payment amount, payment status, and transaction information
Full payment card details are processed directly by Stripe and are neither stored on our website nor by the event organizer.
Ticket Holder Information
To create and deliver a ticket, the following additional information is collected:
- Full first and last name of the ticket holder
- Email address of the ticket holder
- Booked event or film
The payer and the ticket holder may be different individuals.
Ticket holder information is used to create and deliver the ticket, organize the event, and verify admission eligibility.
Ticket Creation and Delivery
Following successful payment, the ticket is created manually and sent to the email address of the ticket holder provided during the purchase.
Each ticket is assigned an individual QR code containing a unique identifier.
The QR code does not directly contain identifying personal information such as the ticket holder’s name or email address.
A local list is maintained on a computer belonging to the organizer for ticket administration. This list contains the necessary information, including name, email address, event, and ticket identifier.
The list is used exclusively for event organization and ticket verification at the venue.
This information is not used for advertising purposes or the creation of personal profiles.
Legal Basis and Data Retention
Booking and payment data is processed under Article 6(1)(b) GDPR for the performance of the ticket purchase agreement.
Where ticket holder information is provided by another person, its processing for ticket creation, delivery, and administration is based on Article 6(1)(f) GDPR. Our legitimate interest is to properly fulfil the ticket purchase and provide the ticket to its intended holder.
The local ticket administration list and other working copies of personal ticket data that are no longer required are deleted after the festival and the necessary organizational follow-up, unless statutory retention obligations or other legal grounds require continued storage.
Payment and accounting records subject to statutory retention obligations remain unaffected. In Austria, the general statutory retention period for relevant tax and accounting records is seven years, unless longer periods apply.
Stripe’s independent processing and retention of personal data is governed by its privacy policy and applicable legal obligations.
Further information:
6. Information for Ticket Holders
A ticket may be purchased by one person on behalf of another.
In such cases, we receive the ticket holder’s personal information from the purchaser.
We process only the information necessary to create, deliver, and administer the ticket.
At the time of our first contact, particularly when delivering the ticket by email, we provide the ticket holder with information about the processing of their personal data and a link to this Privacy Policy.
7. External Links
Our website contains links to third-party websites, including cinemas, venues, and partner organizations.
When you click an external link, you leave our website. Any subsequent processing of personal data is generally the responsibility of the respective external provider.
We recommend reviewing the privacy policies of the relevant external websites.
8. Cookies and Technically Necessary Functions
Our website is based on WordPress and may use technically necessary cookies and similar technologies.
These technologies are used to provide essential website functions and to ensure the security and stability of the website.
Strictly necessary cookies and similar technologies may be used without prior consent where the applicable legal requirements are met.
If non-essential cookies or similar technologies are used, they will only be activated after obtaining prior consent where required by law.
Any consent given may be withdrawn at any time with effect for the future.
9. Recipients of Personal Data
Personal data is disclosed or made accessible to other recipients only to the extent necessary for the stated purposes or to comply with legal obligations.
Recipients may include:
- Hosting and IT service providers
- Email and communication service providers
- Payment service providers in connection with ticket purchases
- Competent public authorities where legally required
Where external service providers process personal data on our behalf, appropriate agreements are concluded pursuant to Article 28 GDPR.
Any transfer of personal data outside the European Economic Area is carried out in accordance with Articles 44 et seq. GDPR.
10. Data Retention and Security
We process and store personal data only for as long as necessary to fulfil the respective processing purposes.
Once the purpose of processing no longer applies, the data is deleted unless statutory retention obligations or other lawful grounds justify continued storage.
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or unlawful disclosure.
These measures include suitable access restrictions and security safeguards for the technical systems used and the local storage of data.
Statutory retention obligations remain unaffected.
11. Your Rights
Under the GDPR, and subject to the applicable legal requirements, you have the following rights:
- Right of access under Article 15 GDPR
- Right to rectification under Article 16 GDPR
- Right to erasure under Article 17 GDPR
- Right to restriction of processing under Article 18 GDPR
- Right to data portability under Article 20 GDPR
- Right to object under Article 21 GDPR
- Right to withdraw consent under Article 7(3) GDPR
You may withdraw any consent you have given at any time with effect for the future. This does not affect the lawfulness of processing carried out before the withdrawal.
To exercise your rights, please contact:
12. Right to Lodge a Complaint
If you believe that the processing of your personal data violates applicable data protection law, you have the right to lodge a complaint with a competent supervisory authority.
In Austria, the competent authority is:
Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42
1030 Vienna, Austria
Email: [email protected]
Website: https://www.dsb.gv.at/
13. Changes to This Privacy Policy
We reserve the right to update this Privacy Policy where necessary due to technical changes to our website, the introduction of new services, or changes in legal requirements.
The version published on our website at any given time shall apply.
Last updated: October 29, 2026