1Introduction
Welcome to Blink (“we,” “our,” or “us”), a mobile application and website operated by BeLinkedIn New Kultures, based in Athens, Greece. Blink is a festival discovery platform for Greek music, food, culture, visual arts and theatre festivals.
We are committed to protecting your privacy and handling your personal data responsibly in accordance with the EU General Data Protection Regulation (GDPR) and applicable Greek law. This Privacy Policy explains exactly what data we collect, why we collect it, how we use it, and your rights regarding it.
2Data We Collect
Account Registration
When you create an account via email/password we collect:
- Email address
- Password (stored as a bcrypt hash — we never see your plain password)
- A one-time verification code (OTP) sent to your email, stored temporarily and deleted automatically once your email is verified or after 15 minutes
- Display name and username you choose
Third-Party Sign-In
If you sign in with Google (Android/iOS) or Apple (iOS), we receive from those providers your name, email address and, optionally, a profile photo URL from Google. We do not receive or store your Google or Apple password.
Profile Information
You may optionally add to your profile a photo, a bio, links to Instagram, Twitter/X or Spotify, and music genre preferences. All profile fields except email are visible to other users unless you set your profile to private.
Festival Activity
- Festivals you mark as “Attending” — stored and visible to other users on that festival's page
- Festival reviews — text and star rating (1–5) you submit, publicly visible
- Festivals you view — we record an anonymised visit count per festival
Social Activity
- Users you follow or unfollow
- Users you block (non-public, only visible to you)
- Profile views — viewing another user's profile may send them a notification
Push Notifications
If you grant permission, we store an Expo push notification token linked to your account, used for lineup updates, ticket alerts, new-follower notifications and Blink (social interaction) alerts. You can manage each category in Settings → Notifications, or revoke permission from your device settings at any time.
Location Data
We request “while using the app” location permission exclusively to show festival pins on the map relative to your current position. We do not store, transmit or share your location. Denying this permission does not affect any other app functionality.
Contact Sync (Optional)
With your explicit permission, Blink can read your device contacts to help you find friends already on the platform. Contact data is processed locally on your device and matched against hashed email/phone records. Raw contact data is never uploaded to or stored on our servers.
Camera & Photo Library
Camera and photo library access is requested only to upload your profile photo or scan another user's QR code to follow them. We do not access your camera roll beyond images you explicitly select.
Website Analytics (festivals.blinkapp.gr)
Only if you accept it in the cookie banner, this website uses Google Analytics 4 to count visits: which pages are opened, roughly from which country and device, and how visitors arrived. Google Analytics sets cookies (named _ga…) for this. We do not use it for advertising, we do not combine it with your Blink account, and Google Analytics 4 does not store IP addresses. If you decline, Google Analytics is not loaded at all. You can change your choice at any time with “Cookie settings” at the bottom of every page; withdrawing consent removes those cookies.
Device & Technical Data
- Device type and operating system (via Expo SDK, for compatibility)
- App version (for OTA update delivery)
- Crash and error reports (anonymous, via Expo)
3How We Use Your Data
We use your data only for the following purposes:
- Creating and maintaining your account
- Providing festival discovery, search and filtering
- Displaying who is attending each festival
- Showing festival reviews and ratings
- Enabling the follow/social graph (finding friends)
- Generating and displaying your QR code profile
- Sending push notifications you have opted into
- Delivering over-the-air app updates
- Improving app performance and user experience
- Preventing abuse, spam and fraudulent accounts
- Complying with legal obligations
We do not use your data for behavioural advertising or sell it to third parties.
4Legal Basis for Processing (GDPR)
- Contract performance — processing necessary to provide the service you signed up for (account, festival data, social features)
- Consent — location access, contact sync, push notifications, camera access and website analytics cookies
- Legitimate interest — security, fraud prevention, app diagnostics, improving user experience
- Legal obligation — responding to lawful requests from authorities
5How We Share Your Data
We do NOT sell your personal data. We share data only in these limited cases:
- With other Blink users — public profile info (name, username, photo, verified status, attending festivals, reviews)
- Supabase (EU data centre, Stockholm) — database hosting and file storage
- Expo / EAS — push notification delivery and OTA updates
- Google — Sign-In authentication and Maps (festival location display on Android)
- Apple — Sign-In authentication (iOS)
- Legal authorities — only if required by Greek or EU law
- Business transfer — in the event of a merger or acquisition, under strict confidentiality terms
6Data Security
- All traffic encrypted with HTTPS/TLS
- Passwords hashed with bcrypt (industry-standard)
- OTP codes stored temporarily and deleted after single use or timeout
- Supabase Row-Level Security (RLS) policies restricting data access
- Sensitive columns (password_hash, OTP) protected at database level
- Regular security reviews
No system is completely immune to breaches. In the event of a data breach affecting your rights, we will notify you and the supervisory authority within 72 hours as required by GDPR.
7Data Retention
- Account data: retained while your account is active
- OTP verification codes: deleted automatically within 15 minutes of creation
- Festival attendance and reviews: retained until you delete them or your account
- Push notification tokens: deleted when you revoke permission or delete your account
- Profile views log: retained for 90 days, then aggregated
When you delete your account via Profile → Settings → Account: all personal data is permanently removed within 30 days and database backups are purged within 90 days.
8Your Rights (GDPR)
As an EU resident you have the right to:
- Access — view all personal data we hold about you
- Rectification — correct inaccurate or incomplete data
- Erasure (“right to be forgotten”) — delete your account and all associated data
- Restriction — restrict how we process your data in certain circumstances
- Portability — receive a copy of your data in a machine-readable format
- Objection — object to processing based on legitimate interest
- Withdraw consent — withdraw consent for location, contacts or notifications at any time
To exercise these rights: go to Profile → Settings → Account in the app, or email privacy@belinkedinnewkultures.gr. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) at www.dpa.gr.
9Children's Privacy
Blink is intended for users aged 13 and older. We do not knowingly collect personal data from children under 13. If you believe a child has registered an account, please contact us at privacy@belinkedinnewkultures.gr and we will delete the account promptly.
10International Data Transfers
Our primary database (Supabase) is hosted in Stockholm, EU, ensuring data stays within the European Economic Area. Google and Apple services may process data outside the EU; in such cases, they rely on Standard Contractual Clauses (SCCs) approved by the European Commission.
11Third-Party Services
- Supabase (supabase.com/privacy) — database & storage
- Google Sign-In & Maps (policies.google.com/privacy)
- Apple Sign-In (apple.com/legal/privacy)
- Expo / EAS (expo.dev/privacy) — push notifications & updates
- Google Analytics 4 (policies.google.com/privacy) — website visit statistics, only with your consent
Each of these services is governed by its own privacy policy. We recommend reviewing them.
12Changes to This Policy
We may update this Privacy Policy to reflect changes in our app or legal requirements. For material changes we will notify you via in-app notification and/or email at least 14 days before they take effect. The “Last updated” date above always reflects the current version.
13Contact
Privacy enquiries & data requests: privacy@belinkedinnewkultures.gr
Data Protection Officer: dpo@belinkedinnewkultures.gr
General support: support@belinkedinnewkultures.gr
BeLinkedIn New Kultures, Athens, Greece