Version 2026-08-18
Privacy Notice
This notice explains how Stories From Mexico uses personal data through this website and its events in Ireland.
1. Who is responsible
STORIES FROM MEXICO LIMITED, 49 North Main Street, Y35 YT44, Wexford, Ireland, is the data controller for the activities described here. Privacy requests can be sent to storiesfrommexicoie@gmail.com.
2. Data we use and why
| Activity | Data | Purpose and legal basis |
|---|---|---|
| Accounts | Name, email, authentication and profile information. | Create and secure an account and prepare ticket services. Steps requested before, and performance of, a contract. |
| Contact enquiries | Name, email, subject and message. | Answer the enquiry. Our legitimate interest in responding to people who contact us. |
| Volunteer applications | Name, email, optional phone, nationality, languages, interests and motivation. | Assess and coordinate volunteers. Steps requested by the applicant and our legitimate interest in organising the festival. |
| Newsletter | Email, optional name, audience preference and consent record. | Send festival and cultural updates only after affirmative consent. Consent can be withdrawn at any time. |
| Devlin Cinema orders | Buyer details, order, ticket and transfer reference information. | Reserve capacity, review payment and issue admission. Performance of a contract and applicable accounting obligations. |
| Ticket QR and check-in | Random ticket token, ticket status, event, scan operator and time. | Validate admission and prevent duplicate use. Performance of the ticket contract and security interests. |
| Security | Temporary one-way IP hashes, request counters and anti-bot verification results. | Prevent spam, abuse and attacks. Our legitimate interest in protecting the website and its users. |
The Sugar Club uses its own external ticketing service. If you follow that link, its own privacy information applies and no local ticket order is created by this website.
3. Service providers and disclosures
We use service providers only as needed to operate the website. These currently include Supabase for database, authentication and server functions; Cloudflare Turnstile for anti-bot checks; Hostinger for domain, hosting or organisational email; and, once activated, Brevo for newsletter and transactional email delivery. Venue or event personnel receive only the information needed for admission and event operations.
We do not sell personal data. Providers may use infrastructure or subprocessors outside the European Economic Area. Where required, processing must be covered by an appropriate data-processing agreement and lawful transfer safeguards.
4. Retention
- Contact enquiries: normally deleted within 12 months after the enquiry is closed.
- Volunteer applications: normally deleted within 12 months after the relevant festival or application process, unless a longer relationship is agreed.
- Unconfirmed newsletter requests: normally deleted after 30 days. Active subscriptions remain until consent is withdrawn. A minimal suppression record may be retained to respect an opt-out.
- Inactive accounts without orders: reviewed for deletion after 24 months of inactivity.
- Orders and financial records: retained only for the period required for contractual, dispute and Irish tax or accounting obligations; relevant business records may need to be kept for six years.
- Rate-limit records: expire automatically after their short protection window.
5. Your rights
Depending on the circumstances, you may request access, correction, deletion, restriction, portability or object to processing. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. We may need to verify your identity before acting on a request.
You may also complain to Ireland’s Data Protection Commission.
6. Cookies and local storage
The current website uses storage required to maintain secure Supabase account sessions and anti-abuse functionality. We do not currently use advertising or behavioural analytics cookies. If optional analytics or marketing cookies are introduced, this notice and the consent controls will be updated before they are enabled.
7. Changes
This notice will be reviewed when services, providers, retention rules or processing activities change. Material changes will be shown by updating the version date.