1. Scope

This privacy statement (hereinafter: “Privacy Statement”) applies to the processing of your personal data by WEAREONE.world BV, a private limited company incorporated under Belgian law, having its registered office at Kattendijkdok-Westkaai 12, 2000 Antwerp, Belgium, and registered with the Crossroads Bank for Enterprises under company number 0867.239.782 and/or its affiliated companies within the meaning of Article 1:20 of the Belgian Code on Companies and Associations (such as TL International BV, TL Travel CommV, TL Winter BV, Lemon BV, Magnashow, LoT BV and MNKY BZZ BV), including its acquirers and legal successors (hereinafter collectively referred to as “WEAREONE

Group”, “we”, “us”, “our” and each individually as “WEAREONE” or “WEAREONE Group Company”), and your rights in relation to that processing. If you use our services, purchase our products, or participate in our activities, we will inform you of any special conditions that apply to the processing of your personal data, in derogation or addition to what is stipulated in this Privacy Statement. We advise you to consult all the documents provided.

A brand of the WEAREONE group is Tomorrowland. By “Tomorrowland” we mean all festivals, events, products, and activities that are organized, produced, or offered by or on behalf of the WEAREONE group under the name Tomorrowland or under related brands, concepts, and companies. If you participate in our activities or make use of our applications and services, specific terms and conditions may apply in addition to, or by way of derogation from, this privacy statement. We strongly advise to review these terms carefully.

This Privacy Statement does not apply to websites, services or applications of others, even if they are accessible through our websites (such as third-party websites, forums, Facebook, X, newsgroups and/or apps). We have no control over the information you post there and how it is processed, nor are we responsible for it. It is up to you to deal with this and to consult the privacy policies of these third parties for more information about how they handle your personal data.

We may change this Privacy Statement at any time. To find out when we last updated the Privacy Statement, please refer to the “Last Updated” date at the bottom of this page. Any changes to this Privacy Statement will become effective as soon as we make them available on our websites.

If you have any questions about this Privacy Statement or about the way in which we process your personal data, please contact us by email at dpooffice@tomorrowland.com or via the contact form if you have a Tomorrowland account.

2. Why we process your personal data

2.1 Pre-registration and ticketing processing

During the pre-registration process for ticket sales for our events and events we co-promote, we process your personal data to contact you prior to the start of the actual ticket sale. To carry out the ticket sales, we process your identification details such as your name, date of birth, gender and nationality. We also process certain specifics of your purchase, such as the type of ticket you prefer. To complete the purchase process, we need to process necessary payment details, such as credit card number of the ticket buyer.

To confirm your order and send your tickets, we process your contact details. If your ticket is delivered electronically, this will be your email address. If your ticket is delivered physically, such as the Tomorrowland Bracelet, we process your delivery address.

When we process your personal data during the pre-registration process, we do so at your request and based on your consent. Once your pre-registration leads to the purchase of a ticket, we rely on the necessity to execute the purchase agreement for processing your personal data. To the extent that we are subject to a legal obligation to perform fraud prevention and we process your personal data for this purpose, we rely on our legitimate interest in efficiently fulfilling that legal obligation. We also rely on our legitimate interest when we process your personal data to make the ticket sales as efficient and secure as possible, and to use statistical information about the pre-registration process and ticket sales to assess and improve our procedures for the future.

2.2 Event attendance

Our tickets are issued in the registered name. This means that we may ask you for your identification details such as your name, at the entrance to our events to verify whether it matches the name on your ticket. When you purchase Pearls and/or make purchases on-site, we also process your payment details. We rely on external suppliers for the secure processing of these transactions.

For these processing activities, we rely on the necessity to execute our purchase agreement. Since we are highly committed to providing our visitors with unique and unforgettable moments, we may also process your personal data in certain circumstances, such as when responding to your special requests. In these cases, we rely on our legitimate interest in providing you and other visitors with a unique experience. To the extent that we process statistical information about your visit, we rely on our legitimate interest in continuing to create unique visitor experiences in the future.

2.3 Atmospheric images and close-ups

During our events, we capture atmospheric images which we use in content such as aftermovies and social media posts. If we feature you specifically, this is based on your consent. Please note that permission to capture and use your image is not always required and can also be implicit. For the processing of your personal data, we rely on our legitimate interest in promoting our events to a wider audience and keeping archives of our various events.

2.4 Special Event Accommodations

At your request, we can arrange special needs accommodations to tailor your visit to your specific physical and/or medical needs. For processing your personal data for enabling such accommodations, we ask for your consent.

2.5 Travel and accommodation

For some events, we offer certain travel and accommodation options, whether or not through our travel and accommodation partners. When you wish to link such an option to your visit, we process, among other things, identification details such as your name, contact details such as your email address, and certain specifics such as your preferred travel class. This information is necessary for making the required reservations and confirming them to you. To complete your purchase, we also process necessary payment details, such as your bank account number. The legal basis for processing these personal data is the necessity to execute the agreement.

To optimize your travel and accommodation experience, you can also share certain preferences, such as your interest in specific Global Journey activities. In this case, we process your preferences along with your identification and contact details so that we can contact you with suggestions. For this, we ask for your consent.

2.6 Communication

Customer service and complaint handling

We communicate directly with you when you contact us with questions, comments or complaints. To communicate with you, we process your identification details such as your name, contact details such as your email address, and any other information you provide to us. To handle your question, comment or complaint, we also process the content of your communication and its practical details. Depending on the type of request, we may share your request with others if necessary for handling it. The legal basis for this processing is our legitimate interest in responding to questions and comments and in handling complaints smoothly. To the extent that we use contextual information from your communications to train our staff internally to provide better customer service, we rely on our legitimate interest in improving our customer interactions.

Practical communications

We send you practical information about the events, activities and other initiatives for which you are registered. These communications may include, among other things, special access conditions, and information about accessibility, payment options, weather conditions, public transport strikes, etc. Additionally, these practical communications may also contain relevant details about products and services offered by our partners at the event for which you are registered, such as the supermarket at DreamVille. For these communications, we process identification details such as your name, contact details such as your email address, and registration information.

We only send you our updates if you have given your consent or have requested to stay informed, for example by subscribing to a specific newsletter, unless you are an existing customer and we keep you informed about similar products and services that we believe may be of interest to you. If we are mistaken in this, you can always adjust your preferences or unsubscribe by clicking the “unsubscribe” link at the bottom of our emails.

Targeted communications

We would like to keep you informed about our events and activities, as well as our other projects, brands and initiatives such as the Tomorrowland Store, Tomorrowland Academy, Terra Solis, Love Tomorrow and beyond. Where you have provided your consent, we will also inform you about products or services of partners with whom we collaborate. For this type of communication, we process identification data such as your name and contact details such as your email address

Marketing based on your personal preferences

In order to make our messages as relevant as possible, we may, but only where you have given your explicit consent, combine personal data from different sources to create a profile of your interests. This may include preferences you have stored in your account or information about your purchases.

This data is collected via our digital channels (such as the website, emails, apps, and purchase history) and processed through a central platform. You can modify or withdraw your preferences at any time via the preference portal of your Tomorrowland account. Withdrawal of consent does not affect the lawfulness of processing carried out before the moment of withdrawal.

E-mail engagement measurement

When we send you our marketing and newsletter communications, we would like to know how those communications are performing. For this reason, we may use so-called tracking pixels (also known as “pixel tags”) in our emails. This is a small, invisible element that allows us to measure whether and when you open an email and whether you click on links. We use this information solely to measure how our emails perform and to improve the quality and relevance of our communications. We do not use these pixels to build a profile of you.

We only place these tracking pixels where you have given your consent to this. This consent is separate from your choice to receive our emails: you can give or withdraw it separately, and withdrawing it does not affect the emails you continue to receive from us. You can adjust your choice at any time via the preference portal of your Tomorrowland account.

To send our emails and measure engagement, we rely on an external service provider that acts as a processor (see section 5.1). We retain the open and engagement data for a maximum of one year. If this data is processed outside the EEA, the safeguards described in section 5.2 apply.

Customer satisfaction surveys and broader inquiries

To optimize our overall services, we may invite our existing customers to participate in satisfaction surveys or to share experiences in broader inquiries. For this, we process identification details such as your name, and contact details such as your email address. Additionally, we process any other information about you that emerges from the research and that you provide to us in this context. We rely on our legitimate interest in inviting you to voluntarily participate in our inquiries. Participation is, of course, not mandatory, and the choice is entirely yours. We will try as much as possible to dissociate your responses from you as an individual. However, this also means that we may not always be reasonably able to respond to certain follow-up requests, such as an access request.

From time to time, we may collaborate with academic or scientific research partners (such as universities or recognized research institutions) to carry out broader research relevant to our sector — for example, research into audience experience, sustainability or innovation in the live entertainment industry. In such cases, the research partner acts as an independent controller for the research itself, and we may share limited contact details (such as your name and email address) with them on the basis of our legitimate interest in supporting independent scientific research relevant to our sector. You will always be informed in the invitation about the partner and the purposes of the research, and participation remains entirely voluntary. You can object at any time to such use of your contact details, as further described in section 7.

2.7 Website

To provide content on our website, optimize its functionality, and allow you to browse it, we may process your personal data. These will primarily be technical data about the device you use, such as the type of browser, and technical identifiers like your IP address.

The legal basis for this processing is our legitimate interest in offering our website and allowing you to use it. If legally required, for example, for placing analytical cookies, we ask for your consent for this processing.

2.8 Tomorrowland Account

When you create a Tomorrowland account, for example, to make purchases in the Tomorrowland Store, we process identification details such as your name, date of birth, gender and nationality. We also process contact details such as your (email) address and phone number. Furthermore, we store certain preferences and interests, such as your music preferences if you have shared this information with us.

For the processing necessary to manage your account, we rely on the necessity to execute the agreement. For the processing of your preferences, we ask for your consent. If we process your account information to ensure the security of your account and safeguard its use, we rely on our legitimate interest in providing our products and services securely and in continuously optimizing them. If you delete your account, we will keep your account information for at least as long as it takes to fully close the account. If we have legitimate grounds, we may retain your account information for a longer period based on our legitimate interest. This could include situations where we are involved in legal proceedings or an ongoing dispute. In such cases, your account information will be stored separately from other active accounts.

2.9 Tomorrowland App

To enable you to use the Tomorrowland app, we process identification details such as your first name. We also process your account information (as mentioned above) and technical data from the device you use to log in. Additionally, we collect information about your usage and interactions within the app. If you have given your consent, we process your location data.

We process your personal data in this context to provide you with the requested service, based on the necessity to fulfill our agreement. For the data we process to ensure the use and security of the app, we rely on our legitimate interest in offering our products and services securely and in continuously optimizing them. For processing location data, we ask for your consent.

2.10 Community activation

We organize contests and other initiatives to increase engagement among the People of Tomorrow. If you participate in these, we process your identification details such as your name, and where applicable, your contact details such as your email address. If a financial reward is associated with certain winners and you are one of the winners, we will also process your payment details or other necessary information to transfer the prize to you. For some initiatives, we may request content, such as images or other visuals. We ask you to follow our terms and conditions and ensure that you respect the rights of others. Lastly, in this context, we may also process certain personal characteristics, preferences, and interests that you provide to us or that emerge from your participation, such as your favorite artist. To the extent that we do not ask for your consent for the processing of your personal data, such as for the processing of your personal characteristics and preferences, we rely on our legitimate interest in enhancing engagement within our People of Tomorrow community.

2.11 Tomorrowland Store

We process your personal data when you purchase items in our Tomorrowland Store, either on-site or online. You can make your online purchase using your Tomorrowland account (see section 2.9). Additionally, we process contact details such as your email address and delivery address to confirm and deliver your purchase. For these purchases, we process your bank account number to enable financial transactions. Finally, we process certain preferences, interests, and consumption behavior, such as your personal purchase history.

The processing necessary to facilitate the sale of our Tomorrowland Store items is based on the necessity to execute our agreement. The processing of your personal data for keeping track of your purchase history is based on our legitimate interest in offering our products and services as customer-friendly as possible and in optimizing our services. For the processing of your preferences, interests, and consumption behavior, we ask for your consent.

2.12 Matching through advertising platforms

We employ a secure matching technique in which your data is first encrypted and pseudonymized so they can no longer directly be linked back to you. Only this hashed information is compared, within a protected environment, with equally encrypted data held by advertising platforms. The platform will display a targeted advert only if an exact match is found. If there is no match, nothing happens. At no point do your name, e‑mail address or any other identifying details leave our systems.

Where you have given your explicit consent, we may also share certain segment characteristics about you with selected partners that wish to show you their own offers (outbound sharing). This may take place via a secure technical environment (such as a data clean room or a comparable method, for example a direct upload to the advertising platform). This concerns segment characteristics such as inferred interests (e.g. music preferences), demographic indicators (e.g. age category or region) and engagement data (e.g. previous interactions). In doing so, we do not share your name or email address, but only pseudonymized identifiers (e.g. hashed email addresses or advertising platform identifiers) that allow the platform to match your profile to the partner’s audience criteria without directly revealing your identity. The partner displays advertisements to individuals in your segment solely for the specific partner campaign, and not for other or subsequent marketing activities without additional consent.

This outbound sharing takes place per partner category and only for the category or categories for which you have given your consent. The partner categories are: retail partners (currently active: MediaMarkt), travel partners (airlines, hotels, mobility), telecom and connectivity, gaming and e-sports, audio and consumer electronics, and food and beverage partners. You can find the current list of partners per category in the management center of your Tomorrowland account. Where a new partner with the same purpose is added within a permitted category, and that partner is established within the EEA or in a country for which a transfer mechanism already exists or for which an adequacy decision applies, you will receive a notification of this. Where a partner is added with a materially different purpose, or where a transfer takes place to a country outside the EEA without an existing transfer mechanism, we will ask you for your consent again.

For certain collaborations, we determine, together with the platform provider and/or the partner, certain aspects of the audience definition and/or the campaigns (for example, on advertising platforms such as Meta, TikTok or YouTube). To that extent, we and the platform provider and/or partner concerned act as joint controllers within the meaning of Article 26 GDPR, limited to those aspects of the processing for which we jointly determine the purpose and the essential means. We make the essence of this arrangement available upon request.

You can consult the essential content of the joint controllership arrangements (Article 26 GDPR) that we have concluded with advertising platforms and partners via the following link: [LINK — description of the essence of the Article 26 collaborations]. You can also request this description free of charge by email at dpooffice@tomorrowland.com. For the other processing that the partner or platform carries out independently, they act as an independent controller.

The legal basis for the outbound sharing of segment characteristics with partners is your consent (Article 6(1)(a) GDPR). You can withdraw this consent at any time and per partner category via the preference portal of your Tomorrowland account. The withdrawal of your consent does not affect the lawfulness of the processing that took place before the withdrawal. For some advertising platforms, your segment characteristics may be processed outside the EEA; you can find more information about the safeguards we apply in this respect in section 5.2.

2.13 Safety and security

We take various safety and security measures to protect our visitors, employees and others, both in physical environments such as festival grounds, concert halls, and office buildings, and in our digital environments. In addition to the protection of individuals, these measures also relate to the protection of property, including physical property such as buildings, land, and goods, as well as other property such as intellectual property, digital environments, and IT systems.

In general, we rely our legitimate interest in pursuing safety and security in the broadest sense of the word for processing personal data in this context. In certain cases, we rely on legal obligations, such as when we are required to take certain measures in compliance with the Municipal Police Regulations of Boom.

Special situations

Camera surveillance

We may use camera surveillance. For large events, we are even legally required to do so. We only use surveillance cameras when we meet the conditions of the Camera Act. You will be informed about the camera surveillance with a sign at the entrance of the monitored area. For the processing of footage in which you may appear, we rely on our legitimate interest in pursuing the safety of the environments for which we are responsible, as well as the safety of the goods and individuals present, and in efficiently meeting our legal obligations.

At certain large-scale events, such as Tomorrowland, we also make the camera footage available in real time to the competent police services. This means that the police can view the footage simultaneously, solely for the duration of the event and with a view to maintaining public order and the safety of those present. This provision of footage takes place within the framework and under the conditions of the Camera Act and its implementing decrees, and is set out in a written agreement with the police service concerned. From the moment the police obtain access to the footage, they act as an independent controller for their own processing, to which their own legal framework (including the Act on the Police Function) applies.

Drug and alcohol checks

During certain events, we carry out drug and alcohol checks in cooperation with the competent authorities. This involves the processing of personal data such as test results indicating the use of

prohibited substances. The purpose of this processing is to promote safety and public order during our events. This contributes to a safer environment for all visitors and our staff.

Drug and alcohol checks are conducted by competent authorities with whom we collaborate, such as local police. We do not receive details about criminal offenses linked to you from them. We only receive statistical information about the results of the checks.

First aid

You will encounter first aid posts at several of our events. For some events, we are even legally required to provide first aid stations. This ensures that in the event of an incident or accident, you have quick access to medical assistance. If you report to a first aid station, we will ask for your identification details to register you. If you are unable to register yourself, we will try to identify you in other ways, such as through a person accompanying you. To ensure you receive timely medical assistance, service providers will process medical details regarding the nature of the injury, your medical history, and the care provided. Where possible, we will ask for your consent to this. In exceptional cases, your personal data will be processed based on the necessity to protect your vital interests.

First aid is provided by specialized care providers with whom we work, such as the Red Cross. We do not receive medical details about you from them, but we do receive an overview of the types of incidents and accidents that were treated by the first aid services.

2.14 Compliance and legal obligations

Where necessary, we process your personal data for compliance purposes. This means that when we are legally required, we will process your personal data to comply with our legal obligations. This is the case, for example, when we process your personal data to comply with our obligations under applicable legislation to prevent money laundering and the financing of terrorism.

Additionally, we may be required to process your data to comply with a request from a competent authority, such as a competent data protection authority. In such cases, too, we process your personal data to meet a legal obligation.

To the extent that we are not legally required to comply with government requests, or if we take the initiative to share certain information about you with competent authorities (e.g., when there are reasonable suspicions of an illegal act or crime linked to you), we rely on our legitimate interest in helping authorities prevent or investigate illegal activities, protecting our property in the broadest sense from misuse and illegal activities, and enforcing our own policies.

2.15 Fraud prevention, incidents and access management

We may process your personal data, such as identification and contact details, ticket and order information, information about your use of our ticketing and sales channels, and information and documentation you provide in this context (such as proof of identity, proof of residence, proof of payment or any other supporting documents necessary to verify compliance with our General Terms and Conditions), to prevent, detect and investigate fraud, ticket abuse and serious breaches of our General Terms and Conditions, and to manage measures such as temporary or permanent access bans.

For this processing, we rely on our legitimate interest in promoting safety and security of our events and services, preventing misuse and fraud, and enforcing our terms and conditions, in particular our strict zero-tolerance policy towards fraud and misuse of the sales process as described in our General Terms

and Conditions, and where applicable, on the necessity to comply with legal obligations and to cooperate with competent authorities.

We may keep a record of access bans (a “blacklist”), including your identification data, the reason and duration of the ban, and, where relevant, information about the underlying incident or breach and the documentation collected in that context. This information is retained for up to 3 years after the end of the ban, unless a longer retention period is required by law or necessary to establish, exercise or defend legal claims.

2.16 Administration and organization of business activities

We believe it is important to continue growing in a creative and innovative manner. This means that we are constantly focused on further developing and expanding our business activities and strengthening our relationships with others. In addition to the purposes specified above, we therefore also process your personal data – albeit to a limited extent, meaning only when strictly necessary –to generally manage, organize, and develop our business activities.

This includes, for example, processing your personal data to ensure high-quality customer management, and approaching you as a supplier or partner to maintain our professional relationship. Furthermore, we may use your personal data to monitor compliance with our internal procedures and policies, for example in the context of audits and reporting, and to verify if they comply with applicable regulations. Where necessary, we may also use your personal data to inform relevant parties in the context of business transactions, such as a possible merger, acquisition, or reorganization.

For these data processing activities, we rely on our legitimate interest in conducting and organizing our business activities efficiently, enforcing our policies, and continually evaluating and improving our business processes to remain flexible and future-oriented as an organization.

3. How we obtain your personal data

In most cases, we receive the personal data we process about you directly from you. This happens, for example, when you purchase a festival ticket, register to receive certain communications, or contact us for information or support.

However, there are situations where we receive your personal data from others. This can happen when someone else purchases a festival ticket for you or when we receive information about you from our partners, such as when purchasing a Global Journey package offered in collaboration with external parties.

In specific circumstances, we may also receive information about you from official authorities such as the police or other competent government bodies. This can occur in the context of legal obligations or during security incidents where your personal data is relevant.

In the few cases where we collect personal data from children, such as for the organization of the Neighborhood Party, this will be done through and/or with the approval of a parent or guardian.

4. How we keep your personal data

We retain your personal data for as long as necessary to achieve the purposes outlined above or as required by applicable regulations. When determining the appropriate retention period for your personal data, we consider various factors, such as the purposes for which we process the data and the categories

of personal data. For example, we naturally retain atmospheric images created for our aftermovies much longer than the footage captured by surveillance cameras.

The retention period may also vary depending on applicable legal and regulatory obligations, such as accounting requirements, which may require us to keep your data for a certain period.

When the processing of your personal data is based on your consent, we will no longer retain your personal data once you withdraw your consent, unless other grounds permit or require us to retain your data longer.

After the retention period expires, your personal data will be anonymized or deleted. However, this will not happen if there is an overriding interest for us or for someone else in continuing to retain your data, or when a legal obligation or a judicial or administrative order prevents us from de-identifying or deleting your personal data.

5. How we share your personal data with others

5.1 Recipients of your personal data

We ensure that access to your personal data is limited to those persons and departments that need to process these data in order to achieve the above-mentioned purposes.

Even when we share your personal data with others, this is done exclusively for the same purposes. Possible recipients of your personal data include service providers, partners, advisors, and government authorities.

For example, we may share your data with external service providers who support us in our business operations, such as IT service providers, logistics companies, financial institutions, and mobility partners. These parties help us to manage our services and infrastructure that are essential for our day-to-day operations.

In addition, but only where you have given your explicit consent, we may share certain personal data about you with selected, trusted partners so that they can show you their own offers or send you their own promotional communications. We do this solely on the basis of your consent (Article 6(1)(a) GDPR), per partner category, and always in accordance with the principle of minimal data sharing: we do not share more data than is necessary for the agreed purpose.

Both the data shared and the form of collaboration and the technique used may differ from one collaboration to another.

What data is shared. Depending on the collaboration, this may be pseudonymized segment characteristics (e.g. inferred interests, demographic indicators or engagement data, without name or email address) or more direct identification and interest data (such as your name, email address or preferences), where the partner wishes to approach you directly. In each case, we share only what is strictly necessary for the agreed purpose, and when we ask for your consent you are informed about which data will be shared.

Who is responsible for what. The form of collaboration can range from independent controllership — where the partner processes the data in its own name and under its own responsibility — to joint controllership within the meaning of Article 26 GDPR, for those aspects for which we, together with the partner and/or the platform provider, determine the purpose and the essential means. For each collaboration involving joint controllership, we make the essential content of the mutual arrangement available to you (see section 2.12).

How the data is shared. The technique used may also differ. A secure technical environment, such as a data clean room or a direct upload to an advertising platform in which only pseudonymized identifiers are matched, is one possible method, but not the only one; in other cases the data is provided directly to the partner for its own communication.

The specific data, the partner concerned, the form of collaboration and the technique used are determined for each collaboration. For this reason, we ask for your consent per partner category, and you can adjust or withdraw that consent at any time and per category via the preference portal of your Tomorrowland account. The withdrawal of your consent does not affect the lawfulness of the processing that took place before the withdrawal. Where a partner is established outside the EEA, the safeguards for international transfers described in section 5.2 apply. You can find an extensive description of this processing and of the partner categories in section 2.12.

We may also share limited contact details (such as your name and email address) with academic or scientific research partners — for example universities or recognized research institutions — for the sole purpose of inviting you to participate in research relevant to our sector. With regard to the research, these partners act as independent controllers. We share only what is strictly necessary for the invitation and the research, and we do not share the content of your account, your purchase history or your marketing profile. The research partner will inform you separately about how it processes your data, and you can object at any time to this use of your contact details.

We also work with various advisors, such as accountants, lawyers, and other professionals who assist us in protecting our interests or enforcing our rights. We may share your personal data with potential parties in the context of business transactions, such as a possible merger, acquisition, or reorganization.

In certain cases, we may share your personal data with courts and authorities where this is required by law or when it is necessary to protect our interests or safeguard our rights. We also share your personal data with government authorities when we are legally required to provide certain data, for example, to meet our tax or administrative obligations.

Finally, we may also share your data with others if you have requested us to do so, if this is necessary to execute our agreement, or if we are legally obliged to do so.

5.2 Transfer of personal data outside the European Economic Area

Some recipients of your personal data may be located in a country outside the European Economic Area (hereinafter: “EEA”). For certain third countries, the European Commission has determined that they provide an adequate level of protection of personal data. Such adequacy decisions exist for countries such as the United Kingdom and Switzerland.

If we transfer personal data to a recipient in a third country for which no adequacy decision exists, and no exemptions for specific situations apply, we are required to observe appropriate safeguards for the processing of your personal data. Such safeguards may be provided, inter alia, by a contractual arrangement between us and the recipient in the third country that is based on the standard contractual clauses for international transfers of personal data established by the European Commission, or any other mechanism that allows for the international transfer of your personal data in accordance with applicable data protection laws.

Where, for advertising purposes (see section 2.12), we have segment characteristics processed by advertising platforms or partners in the United States, we rely on the EU-US Data Privacy Framework where the recipient is certified under that framework, on the European Commission’s standard contractual clauses, or on an adequacy decision where available. We point out that, in certain cases, access by authorities in third countries cannot be entirely excluded; we take appropriate safeguards to limit those risks.

Where we rely on appropriate safeguards for the transfer of your personal data, we will assess whether these safeguards can provide sufficient protection for your personal data so that the level of protection guaranteed in the EEA is not undermined by the transfer. If this is not the case, we will take the necessary additional measures to provide adequate protection. If this is not possible, we will not transfer your personal data to that recipient, or will only transfer your personal data if and to the extent another mechanism makes the transfer possible. For more information about these applicable safeguards, you can send a request by email to dpooffice@tomorrowland.com.

6. How we protect your personal data

We treat the personal data we process confidentially, and we protect it in accordance with applicable regulations and our internal policies and procedures for data security.

We use commercially reasonable efforts to ensure that your personal data is securely stored and protected against loss or unauthorized disclosure and use. However, you understand that security is an obligation of effort, not result, and that the outcome can never be guaranteed.

7. Your choices and rights

In accordance with applicable data protection legislation, you have the following rights, if and to the extent applicable, regarding the processing of your personal data:

You have the right to request access to the personal data we process about you. We may charge an administrative fee if we consider your repeated requests to be unfounded or excessive, or if we believe that your request is intended to harm our business or impose an administrative burden on us.

You have the right to request the correction of inaccurate personal data about you, free of charge. You must provide proof of the inaccuracies you want to have corrected.

When we process your personal data based on your consent, you have the right to withdraw that consent at any time.

Under certain conditions, you have the right to obtain the deletion of your personal data. Upon receiving your request, we will assess whether there are compelling grounds, such as legal or regulatory obligations, judicial or administrative orders, or a legitimate interest of us or someone else, that allow or require us to retain your personal data in an identifiable form rather than deleting it.

In certain circumstances, you have the right to restrict the processing of your personal data. This can be done, for example, if you contest the accuracy of your personal data or if your personal data is no longer necessary for the purposes described above, but you still require it in a legal proceeding.

When we process your personal data based on our legitimate interest, you have the right to object to the processing of your personal data on grounds relating to your particular situation. You can object to processing for the purpose of direct marketing at any time without cost or justification.

If we process your personal data based on your consent or to execute an agreement, and the processing is carried out by automated means, you have the right to obtain the personal data that you have provided to us in a structured, commonly used, and machine-readable format and to transmit it to another controller.

You have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you, unless such a decision is necessary for the conclusion or performance of our agreement or if you have expressly consented to this type of processing. Currently, we do not engage in such decision-making, but if we were to do so, you have the right to object to it.

You can send your request to exercise the above rights by email to dpooffice@tomorrowland.com. In your request, clearly state which right you wish to exercise, and if required, provide the necessary explanation. We will acknowledge receipt of your request. If your request is valid, we will grant it. If we have any doubts about your identity, we may ask you for additional information to verify your identity.

If you are not satisfied with the way we process your personal data, we ask you to let us know about your concern by sending an email to dpooffice@tomorrowland.com. You have the right to lodge a complaint with a competent supervisory authority. In Belgium, this can be done via the complaints procedure on the website of the Data Protection Authority.

Last Updated: July 13, 2026

Privacy Policy