Privacy Policy

1. Who We Are

Movement Festival is a community-driven initiative organizing festivals, gatherings and creative experiences centered around movement, music, play, connection and regeneration.

Movement Festival is operated by Made by Jera, the business responsible for processing personal information as described in this policy.

Business name: Made by Jera Address: Ottermeerweg 2, 4725 PZ Wouwse Plantage, The Netherlands Email: jeratermorshuizen@gmail.com Website: https://movementfestival.nl

For questions about your privacy or personal information, you can contact us at the email address above.

2. What Personal Information We Collect

Depending on how you interact with our website and community, we may collect the following information.

Newsletter subscriptions

When you sign up for our newsletter, we collect:

- Your email address. - The location of your signup on our website, such as the homepage, footer or an application form. - The date and time of your subscription request. - Information about the consent you provided. - Whether your subscription request was accepted by Brevo.

The website records the email address, signup location, request time, consent wording and request outcome privately in Lovable Cloud. Brevo manages subscription and unsubscribe information. A website request record is not proof of your current subscription status.

Applications and enquiries

When you submit a volunteer, facilitator & artist or collaboration application, we collect:

- Your name and contact details. - The event you are applying for, or that your application is a general one for future opportunities. - The date and time of your application and the questions as they were worded when you answered them. - Whether you chose to also receive our newsletter. - Information about your skills, experience and interests. - Volunteer team preferences. - Workshop, performance or collaboration proposals. - Technical requirements and proposed fees. - Website, portfolio, social media and video links you choose to share. - Other information you voluntarily provide in your application or message.

We ask you not to include sensitive personal information unless it is specifically necessary and requested with appropriate safeguards.

Website usage and technical information

When you visit our website, technical information may be processed by our website and service providers, including:

- IP address. - Browser and device information. - Requested pages and resources. - Technical logs needed for website operation and security.

No advertising or visitor-analytics integration was identified in the inspected website code. Hosting and external-content providers may still process operational logs and technical information; this is not a claim that those providers collect no data.

3. Why We Process Your Information

We use personal information for the following purposes.

Newsletter and community updates

To send occasional emails about:

- Movement Festival and upcoming gatherings. - Workshops, community events and opportunities to participate. - Festival announcements and relevant community news.

We send marketing newsletters only when you have chosen to subscribe.

Applications and collaborations

To:

- Confirm by email that we received your application. - Review volunteer, facilitator, artist and collaboration applications. - Respond to proposals and enquiries. - Discuss participation and practical arrangements. - Coordinate contributions to our events. - Contact applicants about future opportunities when they have expressed interest in this.

Website operation and security

To operate the website, maintain its functionality, prevent abuse and protect our systems.

Legal obligations

To comply with applicable administrative, financial or other legal requirements.

4. Legal Bases for Processing

We process personal information only when there is a valid legal basis under the GDPR.

Depending on the purpose, we rely on:

Consent — Article 6(1)(a)

For optional marketing newsletters and other activities requiring your permission.

Steps toward or performance of an agreement — Article 6(1)(b)

Where processing is necessary to discuss, establish or carry out an arrangement with you.

Legitimate interests — Article 6(1)(f)

Where appropriate, to respond to enquiries, organize community activities, maintain website security and manage relevant communications, provided your rights and interests do not override ours.

Legal obligations — Article 6(1)(c)

Where processing is required by applicable law.

We assess the appropriate legal basis for each activity. Submitting an application does not automatically constitute consent to receive marketing emails.

5. Newsletter Subscriptions

We use Brevo for newsletter subscribers, campaigns and unsubscribe management.

You can subscribe through the homepage and footer forms. Both use the same Movement Festival — Newsletter list and require an explicit agreement to receive marketing emails.

Single opt-in

After you enter your email address, agree to receive marketing emails and submit the form, the website asks Brevo to add your address directly to the newsletter list. No confirmation email or confirmation link is required. A subscription message is shown only after Brevo accepts the request. This process records your submitted agreement but does not independently verify who controls the email address.

We never automatically clear an existing unsubscribe block during signup.

Unsubscribing

Every marketing newsletter includes a Brevo unsubscribe link. You can also ask us to stop newsletter emails at jeratermorshuizen@gmail.com.

Withdrawing consent does not affect the lawfulness of processing that took place before your withdrawal.

Each application form also has a separate, optional and unticked newsletter checkbox. Only if you tick it do we add your address to the same newsletter list through Brevo, using single opt-in, and record the consent wording, time and form as described above. Your application is handled the same way whether or not you tick it.

We do not automatically subscribe people who contact us, purchase tickets or apply to volunteer, facilitate or collaborate.

6. Applications and Future Opportunities

We use the information you provide in an application to review your submission and communicate with you about it. Our legal basis is taking steps at your request before a possible arrangement (Article 6(1)(b)) and our legitimate interest in organizing our events with the community (Article 6(1)(f)).

When we receive your application, we send you an automatic confirmation email, and the organizing team receives a short notification containing your name, application type and selected event. These are service messages, not newsletters.

If you indicate interest in future opportunities, we may contact you about relevant activities within the scope of your request.

Application information will only be accessible to authorized members of the organizing team and relevant service providers.

We do not make solely automated decisions that produce legal or similarly significant effects when reviewing applications.

Submitting an application does not require consent to marketing emails. If you would like your application removed, contact us at jeratermorshuizen@gmail.com.

7. How Long We Keep Your Information

We keep personal information only for as long as necessary for the purpose for which it was collected or as required by applicable law.

Newsletter information

Our retention procedures are carried out by an authorized operator; the website does not run an automatic deletion schedule:

- Website signup-request records: Delete request records from Lovable Cloud within 30 days of the request. For accepted subscriptions, first preserve the minimum necessary consent evidence in a restricted record. Failed requests are also deleted within 30 days. - Active subscribers: Keep the information necessary to send and manage the newsletter while you remain subscribed. Review the list at least annually; after 24 months without an affirmative interaction, request renewed confirmation and remove newsletter membership if there is no response within 30 days. Email-open tracking alone is not a reliable affirmative interaction. - Consent evidence: Keep only the evidence needed to demonstrate the newsletter consent, including the request wording and provider acceptance information, while subscribed and for three years after withdrawal or the last marketing email, whichever is later. - Unsubscribe records: Stop marketing when you unsubscribe. Remove unnecessary profile information within 30 days, but retain a minimal suppression record—such as the email address, opt-out date and suppression reason—while we continue newsletter marketing, so you are not added again accidentally. Review the need for this record annually and delete it when it is no longer necessary. It must not be used to send marketing.

These procedures cover both Lovable Cloud and Brevo. Single opt-in does not create a pending email-confirmation stage. No timed cleanup or subscriber-status reconciliation is implemented in the website.

Applications and enquiries

Our retention periods for applications are:

- Unsuccessful or inactive applications: Up to 12 months after the relevant event or last meaningful contact. - General applications for future opportunities: Up to 24 months after the most recent interaction. - Accepted applications and collaborations: As long as necessary for the arrangement and applicable legal obligations. - General enquiries: Normally up to 12 months after resolution.

Applications are not deleted automatically. The admin dashboard lists applications that have reached these periods, and an authorized person reviews and deletes them as part of the monthly review described below. Application records are kept separately from newsletter consent records.

Technical information

Technical logs and security information are retained only for as long as reasonably necessary for website operation and security, subject to the retention practices of our service providers.

An authorized person is responsible for reviewing deletion work at least monthly and recording its completion. Deletion must cover the live website records, the relevant Brevo records and any controlled exports. Provider backup and log expiry must be confirmed separately; we cannot promise immediate removal from every backup.

You may request earlier deletion where applicable under the GDPR.

8. How and Where Your Information Is Stored

Our website uses Lovable and Lovable Cloud for website hosting and technical services, including database storage, authentication, server-side functionality and uploaded media.

Newsletter requests and related records are processed server-side and stored privately in Lovable Cloud. Access rules restrict those records to authorized administrators and privileged server-side processing. The website does not currently store an authoritative subscriber register.

Applications are also stored privately in Lovable Cloud. Database access rules allow only signed-in administrators to read, update or delete them; they are not available through any public part of the website.

Brevo manages newsletter subscriptions, campaigns and unsubscribes. The website sends requests to Brevo through Lovable’s connector service, which also processes the submitted information. Private integration credentials are not sent to visitors’ browsers.

We restrict access to personal information to authorized people who need it for their responsibilities.

We do not sell your personal information.

Service providers

We may share necessary personal information with service providers that support the operation of our website and community communications.

These include:

- Lovable and Lovable Cloud for website infrastructure. - Brevo for newsletter management and email delivery, including application confirmation emails and team notifications. - Google Fonts and YouTube for the external resources described below. - Email and other providers used when you choose to contact us or follow an external link.

External ticket and Instagram links take you to another service; its own privacy information applies. These services do not automatically subscribe you to our newsletter.

We use applicable provider privacy agreements for our services. You can contact us for details about our service providers and processing arrangements. Some providers also process information for their own purposes. This policy does not promise that all data stays in a particular hosting region.

9. International Data Transfers

Some of our service providers or their subprocessors may process information outside the European Economic Area.

Where a restricted transfer occurs, an applicable GDPR transfer safeguard is required, such as an adequacy decision or the European Commission’s Standard Contractual Clauses with any additional measures required. Contact us for the arrangements applicable to our services. EU database hosting alone does not establish that all processing, support, logs or subprocessors remain in the EEA.

You can contact us for further information about applicable international transfer safeguards.

10. Cookies and External Content

Our website may use cookies or similar technologies necessary for its operation.

Essential website functionality

Administrator sign-in uses persistent browser storage for authentication. Public newsletter signup does not require an account. A short-lived cookie named __dpl was observed on the published website; its purpose and exact retention need confirmation from the hosting provider before it is classified as essential. No other cookies were observed in the limited fresh-browser visit, which does not rule out storage in other browsers or interactions.

Google Fonts

Our website currently requests DM Sans and Fraunces directly from Google on page load, before you make a choice about external content. This exposes connection information, including your IP address and request headers, to Google. A cookie-free font request can still involve personal information. We recommend hosting the fonts with the website to avoid these automatic requests; that change has not yet been made.

YouTube videos

Our website displays video content from YouTube.

Video thumbnails are requested from YouTube before playback as they load on the page. The player itself loads only after you press play, using YouTube’s privacy-enhanced domain, youtube-nocookie.com. After playback starts, additional Google and YouTube services are contacted.

Privacy-enhanced mode is not a guarantee of no data transfers, tracking, cookies or browser storage. The current play button does not provide a separate informed consent choice. We recommend website-hosted thumbnails and an explained, optional consent step before loading the player, with a way to withdraw the choice. These changes and the legal consent assessment remain outstanding.

Analytics and advertising

No advertising or visitor-analytics integration was identified in the inspected website code. Provider operational telemetry and video-provider behavior are separate from this finding.

If we introduce non-essential analytics, advertising technologies or other tracking in the future, we will update this policy and obtain consent where legally required.

No cookie or external-content consent control is currently implemented. Before enabling technologies that require consent, we must provide an informed, freely given choice and a way to withdraw it. Essential storage and cookie-free font requests require a separate assessment; the absence of a general cookie banner is not proof of compliance.

11. How We Protect Your Information

We take reasonable technical and organizational measures to protect personal information against unauthorized access, loss, misuse and disclosure.

These measures include:

- Secure website connections. - Server-side handling of private integration credentials. - Restricted access to personal information. - Access controls for administrative functions. - Input validation and measures against automated abuse.

No online system can guarantee absolute security, but we work to protect the information entrusted to us.

12. Your Privacy Rights

Under the GDPR, you may have the right to:

- Access: Request a copy of the personal information we hold about you. - Rectification: Request correction of inaccurate or incomplete information. - Erasure: Request deletion of your information where applicable. - Restriction: Request that certain processing be restricted. - Objection: Object to processing based on legitimate interests or to direct marketing. - Data portability: Receive certain information in a structured, commonly used format where applicable. - Withdrawal of consent: Withdraw your consent at any time where processing is based on consent.

To exercise these rights, please contact:

jeratermorshuizen@gmail.com

We normally respond within one month. Where the GDPR permits an extension because of complexity or the number of requests, we may extend this by up to two further months, informing you of the reasons within the first month.

We may request reasonable information to verify your identity before responding to a request.

You also have the right to lodge a complaint with the Dutch Data Protection Authority:

Autoriteit Persoonsgegevens https://autoriteitpersoonsgegevens.nl

You do not need to contact us before submitting a complaint.

13. Changes to This Privacy Policy

We may update this Privacy Policy when our website, activities, service providers or legal obligations change.

The latest version is available at /privacy-policy, with its update date, and linked from the footer and both newsletter forms.

14. Contact

If you have any questions about this Privacy Policy or how we handle your personal information, please contact:

Movement Festival — Made by Jera

Ottermeerweg 2 4725 PZ Wouwse Plantage The Netherlands

Email: jeratermorshuizen@gmail.com Website: https://movementfestival.nl