Privacy Notice for the Use of the SYD FOR SOLEN App

If you would like to stay informed about SYD FOR SOLEN events as a visitor or interested party, you can use the SYD FOR SOLEN app. The SYD FOR SOLEN app is available for download from the Google Play Store and the Apple App Store.

The following Privacy Notice applies to your use of the SYD FOR SOLEN app.

1. Overview and Scope

As the provider of the SYD FOR SOLEN app, we, Smash!Bang!Pow! ApS, would like to inform you about how we collect, use, store, and otherwise process your personal data when you use the SYD FOR SOLEN app.

This Privacy Notice contains the information required under Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation – "GDPR") and explains how your personal data is processed.

This Privacy Notice applies equally to all persons regardless of gender. Any gender-specific terms are used solely for reasons of readability and shall be understood to refer equally to all genders.

2. Identity and Contact Details of the Data Controller

This Privacy Notice is provided by:

Smash!Bang!Pow! ApS
Knabrostræde 3A, 1210 København, Danmark

Smash!Bang!Pow! ApS is the data controller within the meaning of the General Data Protection Regulation (GDPR) in relation to the processing of your personal data described in this Privacy Notice.

Throughout this Privacy Notice, "Smash!Bang!Pow! ApS", "we", "us", and "our" refer to the above data controller.

3. Purposes of Processing

When you use the SYD FOR SOLEN app, we process your personal data for the following purposes:

- Providing information and notifications relating to Smash!Bang!Pow! ApS events.
- Ensuring the availability, security, and stability of the SYD FOR SOLEN app.
- Analysing app usage for marketing purposes and to improve the performance and functionality of the SYD FOR SOLEN app using Google Analytics 4 for Firebase.
- Sending location-based notifications where you have voluntarily enabled this feature, allowing us to provide organisational information, safety-related notifications, and programme updates relevant to the event while you are present at the event venue.

If additional purposes for processing arise in the future, we will assess whether those purposes are compatible with the purposes for which your personal data was originally collected. Where they are not, we will inform you before processing your personal data for the new purpose. Unless another legal basis applies, we will not process your personal data for any new purpose without your consent.

4. Categories of Personal Data

In particular, we process the following categories of personal data:

- Usage data (e.g. IP address, date and time of access, device specifications, browser information, and the name and URL of the requested file).
- Identifiers used to identify a device or service (e.g. Firebase Cloud Messaging Token).
- Information required to ensure security and facilitate troubleshooting (e.g. crash stack traces, Firebase Installation ID, Crashlytics Installation UUID, and server log files).
- Where you have given your consent: analytics data collected through Google Analytics 4 for Firebase (e.g. Google Analytics App Instance ID, user and event analytics, and app activity).
- User support requests and correspondence (email address and, where applicable, name and other contact details).
- Where you have given your consent: location-related event data required to determine whether your device is present at the event venue (e.g. entering or leaving the venue and the time of the most recent presence), together with related anonymous device identifiers.

5. Legal Basis for Processing

5.1 Ensuring the Availability, Security, and Stability of the SYD FOR SOLEN App

We process personal data to ensure the availability, security, and operational stability of the SYD FOR SOLEN app. The legal basis for this processing is Article 6(1)(f) GDPR (legitimate interests).

Our legitimate interest is to prevent disruptions, unlawful or malicious interference, and to ensure the security of the functions and services provided through the SYD FOR SOLEN app.

For this purpose, we use Firebase Crashlytics, a real-time crash reporting service provided by Google. Firebase Crashlytics enables us to identify, analyse, prioritise, and resolve the most common application crashes.

Firebase Crashlytics is operated by Google LLC. For users in the European Union (EU), the European Economic Area (EEA), and Switzerland, the responsible Google entity is **Google Ireland Limited, Google Building Gordon House, 4 Barrow Street, Dublin D04 E5W5, Ireland**.

When Firebase Crashlytics is used, anonymised real-time crash reports are transmitted automatically. The transmitted data does not allow us to identify individual users. This information is required for maintenance and troubleshooting purposes, enabling us to improve the app and minimise future failures and service interruptions.

Accordingly, Firebase Crashlytics helps us maintain the security and stability of the SYD FOR SOLEN app and provide the service you have requested.

When carrying out these processing activities, we carefully balance our legitimate interests against your rights and freedoms. We process only the personal data that is strictly necessary for these purposes and retain it only for as long as required, unless another legal basis permits further processing.

Right to Object

Where processing is based on Article 6(1)(f) GDPR, you have the right to object to such processing at any time.

To exercise this right, please contact us by email at info@smashbangpow.dk.

5.2 Push Notifications

You may choose to enable push notifications within the SYD FOR SOLEN app.

If you enable push notifications, you will receive information relating to individual events, including safety notifications, warnings, news, promotional information, and other event-related updates.

The legal basis for this processing is your consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR.

When you first launch the SYD FOR SOLEN app, you will be asked whether you wish to receive push notifications. By confirming this request, you consent to receiving push notifications.

We use Firebase Cloud Messaging (FCM) to deliver push notifications.

Firebase Cloud Messaging is operated by Google LLC. For users in the European Union (EU), the European Economic Area (EEA), and Switzerland, the responsible Google entity is Google Ireland Limited, Google Building Gordon House, 4 Barrow Street, Dublin D04 E5W5, Ireland.

To deliver push notifications to the correct device, Firebase uses the Firebase Installation ID and the Firebase Cloud Messaging Token. The messaging token is separate from the Firebase Installation ID and changes periodically. Both identifiers are stored locally on your device within the SYD FOR SOLEN app. The messaging token is also transmitted to us and stored on our servers.

The messaging token itself does not contain personal data or a unique device identifier that can be linked to your identity by us.

All communication is encrypted using HTTPS with SSL/TLS to ensure the secure transmission of messages and tokens.

Withdrawal of Consent:

You may withdraw your consent to receiving push notifications at any time with effect for the future.

You can do so by disabling push notifications either in your device settings or in the notification settings of the SYD FOR SOLEN app.

5.3 Location Services and Map Service

You may choose to enable location services within the SYD FOR SOLEN app.

If you grant permission, we can display your current location within the event venue, suggest nearby points of interest, and provide navigation based on your current location.

To provide this functionality, we use the **Mapbox** service operated by Mapbox Inc., 740 15th Street NW, 5th Floor, Washington, DC 20005, USA.

When the SYD FOR SOLEN app asks whether you wish to enable location services and you tap the "Continue" button, your device's operating system will display the location permission dialogue.

You may then choose to:

- Allow location access once.
- Allow location access while using the app.
- Deny location access.

If you grant permission, the following personal data will be processed:

- IP address
- Location data
- Device and browser information (including the date and time of access)
- Map usage data (e.g. zoom level, visible map area, billing identifiers, and session IDs)

This data may be processed on Mapbox servers located in the United States. Mapbox is currently certified under the **EU–U.S. Data Privacy Framework (DPF)**.

The legal basis for this processing is our legitimate interest pursuant to Article 6(1)(f) GDPR together with Section 25(2) No. 2 TDDDG.

Our legitimate interest is to provide a functional and user-friendly app, facilitate efficient visitor guidance, and improve safety and visitor satisfaction throughout the event venue. Mapbox provides a high-performance, scalable, and mobile-optimised mapping solution that is particularly well suited to these purposes.

The processing of the technical data listed above takes place only after you have expressly enabled location services. Processing this data is also strictly necessary in order to provide the digital service you have requested within the meaning of Section 25(2) No. 2 TDDDG.

Right to Object:

Where processing is based on Article 6(1)(f) GDPR, you have the right to object to such processing at any time.

You can disable location services either in your device settings or within the settings of the SYD FOR SOLEN app.

5.4 Consent to the Analysis of Personal Data Using Google Analytics 4 for Firebase:

We process your personal data for the purpose of analysing app usage using Google Analytics 4 for Firebase on the basis of your consent pursuant to Section 25(1) TDDDG for the storage of technical information on your device and access to such information, as well as Article 6(1)(a) GDPR for the processing of analytics data.

Providing your consent is voluntary. You give your consent by selecting the corresponding option in the consent banner displayed within the SYD FOR SOLEN app.

Processing of Analytics Data Using Google Analytics 4 for Firebase:

Google Analytics 4 for Firebase is an analytics service provided by Google LLC. For users in the European Union (EU), the European Economic Area (EEA), and Switzerland, the responsible Google entity is Google Ireland Limited, Google Building Gordon House, 4 Barrow Street, Dublin D04 E5W5, Ireland,

The service enables us to collect, analyse, and aggregate information about how the SYD FOR SOLEN app is used for statistical purposes. For example, it allows us to analyse app launches, user interactions, and feature usage in order to determine which functions are used frequently or infrequently.

Google processes this information on our behalf to analyse the pseudonymous use of the SYD FOR SOLEN app based on the App Instance ID and to provide us with reports on app usage.

Google Analytics 4 for Firebase does not require IP address anonymisation because IP addresses are neither logged nor stored.

While you use the SYD FOR SOLEN app, your interactions with the app are recorded in the form of "events." These events may include, for example:

- App launches
- Navigation paths (for example, interactions with widgets, artists, sessions, and other content within the app)
- Clicks on external links
- Language settings
- Firebase Installation ID
- Device-specific information, such as the operating system and device model
- Number of users

Google processes this information on our behalf solely for the purpose of evaluating the pseudonymous use of the SYD FOR SOLEN app and providing us with reports on app activity.

#### Withdrawal of Consent

You may withdraw your consent at any time with effect for the future by opening the privacy settings within the SYD FOR SOLEN app and changing your preferences.

The withdrawal of your consent does not affect the lawfulness of any processing carried out before your consent was withdrawn.

Further information about Google Analytics and Google's privacy practices is available at:

- https://marketingplatform.google.com/about/analytics/terms/
- https://policies.google.com/privacy

5.5 Location-Based Notifications

If you voluntarily enable the **Location-Based Notifications** feature, we process your device's location data to determine whether your device is present at the relevant event venue. Where this is the case, we use this information to provide location-specific notifications and information relating to the event.

Location-based notifications may include, in particular:

- Information about fan activities and supporting entertainment programmes, such as activities taking place throughout the event venue, partner and sponsor promotions, schedule changes, and additional entertainment offerings (for example, stage programmes and live presentations).
- Visitor guidance and organisational information, such as crowd management measures, signage, information points, and operational updates relating to the event.
- Safety-related information and risk communications, such as temporary closure of entrances due to overcrowding, notifications about event interruptions, warnings regarding heavily congested areas, or severe weather information (particularly heat warnings).

The legal basis for this processing is your explicit consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG.

The feature is activated through a separate prompt within the SYD FOR SOLEN app ("Enable" / "Do Not Enable"). The SYD FOR SOLEN app remains fully usable even if you choose not to enable location-based notifications.

From a technical perspective, no continuous location tracking takes place. Instead, only event-related information indicating whether a device has entered or left the event venue is processed. This information is used exclusively to determine whether a push notification should be delivered.

No movement profiles or location histories are created.

Location-based notifications are delivered as standard push notifications, taking into account an additional "Event Presence" flag ("Yes" / "No").

For the technical operation of this feature, the following information is processed and stored on our servers for each device:

- Anonymous device ID
- Date and time of the first and most recent contact
- Number of entries to and exits from the event venue
- Date and time of the most recent exit
- Expiry date of the event presence status if no further location updates are received
- Whether location-based notifications are enabled ("Yes" / "No")

Withdrawal of Consent

You may withdraw your consent to receive location-based notifications at any time with effect for the future by disabling the feature within the settings of the SYD FOR SOLEN app.

If you disable the **Location-Based Notifications** feature, the corresponding "Event Presence" flag is immediately set to "No" on our servers. From that point onwards, your device will no longer be considered when determining whether location-based notifications should be delivered.

After the feature has been disabled, no further location-related event data will be processed for the purpose of providing location-based notifications.

If location services remain enabled on your device independently of this feature, location data may continue to be processed solely for other functions of the SYD FOR SOLEN app (for example, displaying maps or providing navigation), in accordance with the applicable privacy information for those features.

6. Recipients of Your Personal Data

We disclose your personal data to third parties only where:

- you have given your prior explicit consent;
- the disclosure is necessary for the preparation or performance of a contract between you and us or between you and a third party; or
- we are required to do so by applicable law.

To fulfil the purposes described in this Privacy Notice, we disclose your personal data to the following categories of recipients.

6.1 Service Providers

For the technical provision of the SYD FOR SOLEN app, we engage chaanz UG (haftungsbeschränkt), Bockenheimer Landstraße 133, 60325 Frankfurt am Main, Germany.

chaanz processes your personal data solely on our behalf and in accordance with our instructions as a data processor pursuant to Article 28 GDPR.

Where your personal data is processed through Google Analytics 4 for Firebase, Firebase Crashlytics, Firebase Cloud Messaging, or Mapbox as part of the services provided by chaanz, the following recipients may receive your personal data:

- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (processor engaged by chaanz pursuant to Article 28 GDPR)
- Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
- Alphabet Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
- Mapbox Inc., 740 15th Street NW, 5th Floor, Washington, DC 20005, USA

Personal data processed in connection with the **Location-Based Notifications** feature is processed exclusively by chaanz as our technical service provider acting on our behalf.

To operate its systems, chaanz uses the cloud infrastructure of Amazon Web Services EMEA Sàrl, 38 Avenue John F. Kennedy, L-1855 Luxembourg ("AWS"), under a data processing agreement pursuant to Article 28 GDPR.

Your personal data is stored and processed on servers located in the AWS Region **eu-central-1 (Frankfurt am Main, Germany).**

6.2 Public Authorities and Professional Advisers

Where required by law or necessary for the establishment, exercise, or defence of legal claims, we may disclose your personal data to law enforcement authorities, legal advisers, auditors, courts, expert witnesses, or other authorised recipients.

7. Transfers to Third Countries

Where we transfer personal data to processors located outside the European Union (EU) or the European Economic Area (EEA), such transfers take place only where an appropriate level of protection for your personal data is ensured.

This is achieved through the use of the European Commission's Standard Contractual Clauses or other appropriate safeguards pursuant to Articles 44 et seq. GDPR, including, where applicable, an adequacy decision adopted by the European Commission.

Where personal data is processed in the United States, such processing may additionally take place on the basis of the EU–U.S. Data Privacy Framework (DPF).

8. Data Retention

We delete your personal data as soon as it is no longer required for the purposes described in this Privacy Notice, unless statutory retention obligations or other legal requirements require us to retain it for a longer period.

General Usage Data:

General usage data (such as IP address, date and time of access, device specifications, browser information, and the name and URL of the requested file) is stored only temporarily.

Server log files (including access and error logs) are retained for 60 days.

Device and Service Identifiers:

- Firebase Cloud Messaging Token: deleted after 270 days of inactivity on the server side and immediately when the SYD FOR SOLEN app is deleted or reset on the device.

- Firebase Installation ID:** deleted after 270 days of inactivity on the server side and immediately when the SYD FOR SOLEN app is deleted or reset on the device.

- App Instance ID: retained together with analytics data for 14 months after inactivity, deletion, or withdrawal of consent on the server side and removed immediately when the SYD FOR SOLEN app is uninstalled.

- Mapbox billing identifiers, session IDs, and IP addresses: deleted after 30 days.

Security and Troubleshooting Data:

Crash stack traces, extracted minidump data, Crashlytics Installation UUIDs, Firebase Installation IDs, and related identifiers are retained for 90 days before the removal process from live and backup systems begins.

Analytics Data:

Where you have given your consent, analytics data collected through Google Analytics 4 for Firebase is automatically deleted after 14 months.

Support Requests:

Support requests and related correspondence (including email address and, where applicable, your name and contact details) are retained for three years after the request has been resolved in accordance with applicable statutory retention requirements.

Mapbox Location Data:

Location data associated by Mapbox with a session ID is disassociated after 24 hours.

Location-Based Notifications

Data processed in connection with the Location-Based Notifications feature is processed only in relation to specific events and is not retained permanently.

The following device-related event data used to determine event presence is automatically deleted no later than:

- when the relevant event is deleted by the organiser; or
- after 13 months of inactivity of the SYD FOR SOLEN app.

This data includes:

- Anonymous device ID
- Date and time of the first and most recent contact
- Number of entries to and exits from the event venue
- Date and time of the most recent exit
- Expiry date of the event presence status

If you withdraw your consent to receive Location-Based Notifications, your device will technically be treated as though it has left the event venue.

From that point onwards, no further location-related event data will be collected for this purpose.

Any personal data already stored will be deleted automatically in accordance with the retention periods described above.

## 9. Your Rights Under the GDPR

Subject to the conditions set out in the GDPR, you have the following rights in relation to the processing of your personal data:

- Right of Access (Article 15 GDPR), including the right to obtain information about the purposes of processing, the categories of personal data processed, the recipients of your personal data, the envisaged retention period, and, where applicable, the source of personal data not collected directly from you.

- Right to Rectification (Article 16 GDPR), including the right to have inaccurate or incomplete personal data corrected.

- Right to Erasure ("Right to be Forgotten") (Article 17 GDPR), provided that no legal obligation or overriding legal basis requires us to retain your personal data.

- Right to Restriction of Processing (Article 18 GDPR).

- Right to Data Portability (Article 20 GDPR), including the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format or to request its transmission to another data controller where technically feasible.

- Right to Withdraw Consent (Article 7 GDPR). Where processing is based on your consent, you may withdraw that consent at any time with effect for the future.

- Right to Object to Processing (Article 21 GDPR), where processing is based on our legitimate interests.

To exercise any of your rights, simply contact us by email at:

info@smashbangpow.dk

Last updated: April 2026

‍