1Introduction
Welcome to Blink (“we”, “us”), a mobile app and website run by BeLinkedIn New Kultures, based in Athens. Blink is a platform for discovering Greek festivals of music, food, culture, visual arts and theatre.
We are committed to protecting your privacy and handling your personal data responsibly, in line with the EU General Data Protection Regulation (GDPR) and applicable Greek law. This Privacy Policy explains exactly what data we collect, why we collect it, how we use it and what rights you have over it.
2Data we collect
Account sign-up
When you create an account with an email and password, we collect:
- Your email address
- Your password (stored as a bcrypt hash; we never see your password)
- A one-time confirmation code (OTP) sent to your email, stored temporarily and deleted automatically once your email is confirmed or after 15 minutes
- The display name and username you choose
Signing in with third parties
If you sign in with Google (Android/iOS) or Apple (iOS), we receive your name and email address from these providers and, optionally, the URL of your Google profile photo. We never receive or store your Google or Apple password.
Profile information
You can optionally add a photo, a bio, links to Instagram, Twitter/X or Spotify and the music genres you like to your profile. All profile fields except your email are visible to other users, unless you set your profile to private.
Festival activity
- Festivals you mark as “Going”: stored and visible to other users on the festival's page
- Festival reviews: the text and rating (1–5) you submit, visible publicly
- Festivals you view: we count visits per festival anonymously
Social activity
- Users you follow or unfollow
- Users you block (not public, visible only to you)
- Profile views: when you view another user's profile, they may be sent a notification
Push notifications
If you give permission, we store an Expo push notification token linked to your account, used for lineup updates, ticket alerts, new follower alerts and Blink (social interaction) alerts. You can manage each category in Settings → Notifications or withdraw permission in your device settings at any time.
Location data
We ask for “while using the app” location permission only to show festivals on the map relative to where you are. We do not store, transmit or share your location. If you do not give this permission, no other feature of the app is affected.
Contact sync (optional)
With your explicit permission, Blink can read your device's contacts to help you find friends who are already on the platform. Contact data is processed locally on your device and compared with email/phone records in hashed form. Raw contact data is never uploaded to or stored on our servers.
Camera and photos
We ask for access to the camera and photo library only so you can upload a profile photo or scan another user's QR code to follow them. We have no access to your photos beyond the ones you explicitly choose.
Website statistics (festivals.belinkedinnewkultures.gr)
Only if you accept it in the cookie message, this website uses Google Analytics 4 to count visits: which pages are opened, roughly from which country and device, and how visitors arrived. For this, Google Analytics sets cookies (named _ga…). We do not use it for advertising, we do not combine it with your Blink account, and Google Analytics 4 does not store IP addresses. If you reject it, Google Analytics does not load at all. You can change your choice at any time from “Cookie settings” at the bottom of every page. If you withdraw your consent, these cookies are deleted.
Device and technical data
- Device type and operating system (through the Expo SDK, for compatibility)
- App version (to deliver OTA updates)
- Error and crash reports (anonymous, through Expo)
3How we use your data
We use your data only for the following purposes:
- Creating and maintaining your account
- Discovering, searching and filtering festivals
- Showing who is going to each festival
- Showing festival reviews and ratings
- The follow feature (finding friends)
- Creating and showing your profile with a QR code
- Sending the push notifications you have chosen
- Delivering over-the-air app updates
- Improving the app's performance and user experience
- Preventing abuse, spam and fake accounts
- Meeting legal obligations
We do not use your data for behavioural advertising and we do not sell it to third parties.
4Legal basis for processing (GDPR)
- Performance of a contract: processing needed to provide the service you signed up for (account, festival data, social features)
- Consent: location access, contact sync, push notifications, camera access and the website's statistics cookies
- Legitimate interest: security, fraud prevention, app diagnostics, improving the user experience
- Legal obligation: responding to lawful requests from the authorities
5How we share your data
We do NOT sell your personal data. We share data only in the following limited cases:
- With other Blink users: your public profile details (name, username, photo, verification badge, festivals you are going to, reviews)
- Supabase (EU data centre, Stockholm): database hosting and file storage
- Expo / EAS: sending push notifications and OTA updates
- Google: Sign-In and Maps (showing festival locations on Android)
- Apple: Sign-In on iOS
- Authorities: only where Greek or EU law requires it
- Business transfer: in the event of a merger or acquisition, under strict confidentiality terms
6Data security
- All traffic is encrypted with HTTPS/TLS
- Passwords are stored as bcrypt hashes (an industry standard)
- OTP codes are stored temporarily and deleted after one use or when they expire
- Supabase Row-Level Security (RLS) policies restrict access to data
- Sensitive columns (password_hash, OTP) are protected at database level
- Regular security reviews
No system is completely safe from breaches. If a data breach affecting your rights occurs, we will inform you and the supervisory authority within 72 hours, as the GDPR requires.
7Data retention
- Account data: kept while your account is active
- OTP confirmation codes: deleted automatically within 15 minutes of being created
- Festival attendance and reviews: kept until you delete them or delete your account
- Push notification tokens: deleted when you withdraw permission or delete your account
- Profile view log: kept for 90 days, after which only aggregate figures are kept
When you delete your account from Profile → Settings → Account, all your personal data is permanently deleted within 30 days and database backups are cleared within 90 days.
8Your rights (GDPR)
As an EU resident you have the right to:
- Access: see all the personal data we hold about you
- Rectification: correct inaccurate or incomplete data
- Erasure (“right to be forgotten”): delete your account and all related data
- Restriction: restrict the processing of your data in certain cases
- Portability: receive a copy of your data in a machine-readable format
- Objection: object to processing based on legitimate interest
- Withdrawal of consent: withdraw your consent for location, contacts or notifications at any time
To exercise these rights, go to Profile → Settings → Account in the app or email privacy@belinkedinnewkultures.gr. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) at www.dpa.gr.
9Children's privacy
Blink is for users aged 13 and over. We do not knowingly collect personal data from children under 13. If you believe a child has created an account, contact us at privacy@belinkedinnewkultures.gr and we will delete the account straight away.
10International data transfers
Our main database (Supabase) is hosted in Stockholm, in the EU, so the data stays within the European Economic Area. Google and Apple services may process data outside the EU. In those cases they rely on the Standard Contractual Clauses (SCCs) approved by the European Commission.
11Third-party services
- Supabase (supabase.com/privacy): database and storage
- Google Sign-In and Maps (policies.google.com/privacy)
- Apple Sign-In (apple.com/legal/privacy)
- Expo / EAS (expo.dev/privacy): push notifications and updates
- Google Analytics 4 (policies.google.com/privacy): website visit statistics, only with your consent
Each of these services is governed by its own privacy policy. We suggest you read them.
12Changes to this policy
We may update this Privacy Policy to reflect changes to the app or to legal requirements. For material changes we will let you know with an in-app notice and/or by email at least 14 days before they take effect. The “Last updated” date above always shows the current version.
13Contact
Privacy questions and data requests: privacy@belinkedinnewkultures.gr
Data Protection Officer (DPO): dpo@belinkedinnewkultures.gr
General support: support@belinkedinnewkultures.gr
BeLinkedIn New Kultures, Athens, Greece