16 to 20 June 2027 · Ugljan, Croatia

Privacy policy

Festival information and policies.

Last updated: 3 November 2026.

This notice explains how Sinergia handles personal information in connection with the Flows Festival website, enquiries, newsletters, applications and ticket enquiries. It also explains the choices available to you.

Who is responsible

Sinergia is responsible for the personal information described in this notice.

Sinergia
Ulica Mirana Jarca 6
1233 Dob, Domžale, Slovenia
info@sinergia.si

What we collect and why

Visiting the website

Our hosting provider, Cloudflare, processes technical information such as your IP address, browser information, requested pages and request times to deliver and protect the website. Our legal basis is our legitimate interest in operating a reliable and secure website, preventing misuse and resolving technical problems.

Contacting the team

When you contact us by email, WhatsApp or Instagram, we receive your contact details and the information you choose to share. We use it to answer your question and manage the conversation. We rely on our legitimate interest in responding to enquiries, or on taking steps at your request before entering a contract when your enquiry concerns a booking or participation.

Festival news

If you subscribe, we use your email address to send festival news, programme announcements and important festival information through Brevo. Subscription is optional and based on your consent. You can unsubscribe using the link in any newsletter or by emailing us. Withdrawing consent does not affect processing that already took place.

Applications and programme profiles

Our application links open Google Forms. Depending on the application, we collect the contact details, experience, proposals, links and other information requested in that form. We use Google Forms, Sheets and Drive to organise submissions and communicate with applicants. We process applications to consider your request to participate and prepare any resulting agreement; administrative correspondence is also based on our legitimate interest in organising the festival.

Artists, collectives and facilitators may supply photographs, biographies, logos, country information and social links for their public profiles. Information intended for publication is displayed on the website as part of the agreed programme promotion. Please do not submit information about another person unless you are entitled to do so. Contact us to correct or discuss removal of a profile.

Tickets and bookings

The ticket shop is provided through Paylogic. Information requested at checkout is processed under the notices shown there. We may receive the booking and contact information needed to administer your purchase, admission and customer support. This processing is necessary to perform the booking contract and meet applicable legal obligations. Payment card details are handled by the checkout and payment providers, not entered into this website.

Cookies and browser storage

The website remembers your privacy choice in browser local storage. That choice is treated as valid for 180 days. It also remembers a dismissed newsletter invitation for 30 days and whether the invitation has appeared during the current browser session. These preferences are not used by us to track you across other websites. Local storage can remain on your device until overwritten or cleared in your browser.

You can reopen Cookie settings in the footer or clear stored data through your browser settings. Blocking storage may mean that the website asks for your preferences again.

With your analytics consent, we use Google Analytics 4 to understand visits, pages viewed and interactions such as button clicks. Google receives technical information about your browser and device and uses cookie identifiers to measure visits. We do not intentionally send newsletter addresses or form contents to Analytics. Google advertising signals and advertising personalisation are disabled in our website integration.

With your separate marketing consent, we use Meta Pixel to send page-view events to Meta to measure advertising and support relevant advertising on Facebook and Instagram. Meta receives technical information and may associate visits with your Meta account. We do not send form contents or enable automatic advanced matching in our website code. Analytics consent does not grant marketing consent.

Neither tracking script loads before the relevant consent. You can withdraw permission using Cookie settings in the footer. On withdrawal, we stop the relevant integration, clear its accessible first-party tracking cookies and reload the page to unload the tracking code. Withdrawal does not erase information already received by a provider. Google Analytics uses cookies such as _ga; Meta uses cookies such as _fbp and _fbc. Their lifetimes depend on provider settings and browser restrictions.

Embedded content and external services

Some pages contain YouTube video players, SoundCloud audio players or images delivered by Google Drive. Loading these resources connects your browser to their providers and can disclose technical information such as your IP address, browser details and the referring page. Embedded players may connect before you press play. Their providers may also use cookies or associate activity with an account you are signed into.

The website's analytics preference does not currently block these embedded players. You can avoid loading pages with embeds, use your browser's privacy controls or visit the relevant provider directly.

Links to Google Maps, Paylogic, Instagram and WhatsApp take you to external services with their own privacy notices. If you join a WhatsApp group, other members may see your telephone number, profile information and messages depending on the group and your settings. The automatic Instagram feed is not connected yet.

Who receives information

Information is available to the festival team and service providers where needed for the purposes above. These include Cloudflare for hosting and security, Brevo for newsletters, Google for applications and programme administration, and ticketing and payment providers for bookings. Providers may act on our instructions or have their own responsibilities for particular processing, as explained in their notices. We may also disclose information where required by law or necessary to establish, exercise or defend legal claims.

Relevant provider information: Cloudflare, Brevo, Google and YouTube, Meta and SoundCloud. For ticketing, consult the privacy notice displayed in the Paylogic checkout.

International processing

Some providers process information outside the European Economic Area. Where a transfer is subject to GDPR transfer requirements, it must be covered by an applicable adequacy decision or appropriate safeguards, such as the European Commission's standard contractual clauses. You can contact us for information about the safeguards relevant to your data and how to obtain a copy.

How long information is kept

We keep information for the purpose for which it was collected, rather than indefinitely. Enquiries are kept while we resolve the matter and any related follow up. Applications are kept while participation is being considered and, for accepted applicants, while the agreement is administered. Booking and financial records may need to be retained for applicable accounting, tax and legal requirements.

Newsletter details are used until you unsubscribe. A limited suppression record and evidence of your choices may be retained to respect your unsubscribe request and demonstrate compliance. Published programme material and festival archives may remain available as a record of past editions, subject to review and your applicable rights. Information needed for an unresolved dispute may be retained until it is resolved and the applicable claim period has ended.

Your rights and choices

Depending on the circumstances, you can ask to access, correct or erase your information, restrict its use or receive a portable copy. You can object to processing based on legitimate interests, and you can object to direct marketing at any time. Where processing relies on consent, you can withdraw that consent.

Send requests to info@sinergia.si. We may need proportionate information to verify your identity. We normally respond within one month; if a lawful extension is needed, we will explain why within that period.

You can complain to the Information Commissioner of the Republic of Slovenia or the relevant supervisory authority where you live or work. You do not have to contact us first.

Providing newsletter information is voluntary. Information marked as required in a booking or application is needed to handle that request; without it, we may be unable to complete it. We do not use this website to make solely automated decisions with legal or similarly significant effects on you.

Changes to this notice

We will update this page when our services or data practices change. Material changes and any new consent choices will be brought to your attention where required. Please contact us if you have questions about this notice.

Cookie preferences

Choose which optional cookies you allow.

Necessary

Required for the website and your saved preferences.

Always on

Optional tracking starts only after you give permission.

Keep in touch with Flows.

Occasional festival news, music, island plans and crucial festival information, sent when there is something worth sharing.