Privacy
Policy.

Slovensko kosmatinsko društvo, a registered non-profit organization with registration number 2708957000.

All the revenues made during the event will be used for equipment or services to improve the next editions of SFC.

We will never sell your personal data to anyone.

In order for us to provide you the best possible experience on our websites, we need to collect and process certain information. Depending on how you use our websites and services, that may include:

• ▸Contact us via email. For example, when you ask for support, send us questions or comments, or report a problem, we will collect your name, email address, message, etc. We use this data solely in connection with answering the queries we receive.
• ▸Account and registration data. When you create an account and register for the convention, we collect your nickname (badge name), email address, full name, date of birth (used to verify that all attendees are at least 18), postal address, phone number, emergency contact details (used only if something happens to you at the convention), an optional Telegram handle, your registration preferences, and a badge photo. The free-text "additional information" field is entirely voluntary and contains only what you choose to share with us.
• ▸Usage data. Our site is served through Cloudflare, which acts as a content delivery and security proxy. For aggregated traffic statistics (such as pages visited, approximate country, device and browser type, and the referring website) we use Cloudflare's privacy-preserving Web Analytics, which does not use cookies and does not build individual visitor profiles. We have configured Web Analytics to exclude visitors located in the European Union: for these visitors, the analytics metrics are dropped at Cloudflare's EU data centers and are never collected or reported to us. Any statistics that are collected are used for statistical purposes, to improve our site, and to detect and stop misuse.
• ▸Error and performance data. To keep our sites and services working reliably, we use Sentry (EU region) to collect technical diagnostic information when an error or performance issue occurs. This may include your IP address and details about the request and your device. We use this solely to detect, diagnose and fix technical problems.

We use your provided data in order to:

• ▸Process payments (e-mail address),
• ▸send you important updates regarding your account or future/ongoing events (e-mail address),
• ▸verify your account in any support inquiries (e-mail address, telegram),
• ▸create official documents regarding the convention (full name, address, e-mail address),
• ▸liability waiver (all attendees are required to sign a physical copy of this waiver when signing in at the actual convention),
• ▸dealer's agreement (all Dealer's Den sellers are required to sign this agreement),
• ▸official warnings, restraining orders, banishment / expulsion notices (appropriate action will be taken, based on the convention rules and regulations and will be enforced by our security).

To ensure the safety and well-being of our participants, Slovensko kosmatinsko društvo may collect your contact information for emergency purposes. In the event of an emergency situation, we may need to reach out to you promptly and provide necessary assistance. Additionally, if any disputes or damages occur during our events, we may need to report relevant information to the appropriate authorities for resolution. Please be assured that we handle such sensitive data with the utmost care and in compliance with applicable privacy laws and regulations.

Hosting and infrastructure. Our public website (slofluffcon.org) is a static site served through Cloudflare Pages and does not itself store any personal data. Our registration application (reg.slofluffcon.org) and its database are hosted on servers operated by Hetzner Online GmbH, located in Germany (European Union), so your registration data is stored within the EU.

Content delivery and security. Our websites are served through Cloudflare, Inc. (United States, certified under the EU-US Data Privacy Framework), which acts as a processor for content delivery and security. As a proxy in front of our sites, Cloudflare processes visitors' IP addresses for the purpose of routing traffic, protecting against attacks and abuse, and keeping our sites available.

File storage. Badge photos and invoice documents are stored in Cloudflare R2 object storage, covered by the same Cloudflare safeguards described above.

Email delivery. To send transactional emails (for example, account or event updates and support replies), we use Amazon Simple Email Service (Amazon SES) on EU infrastructure as an email delivery processor. The recipient email address and message content are processed for the sole purpose of delivering these messages. We do not send marketing email.

Payments. When you register for the convention, you can pay by card or by bank transfer:

• ▸Card payments (Stripe). Card payments are handled by Stripe. Stripe receives the details necessary to process your payment, such as your name, email address and billing address. Slovensko kosmatinsko društvo does not handle or store any card or payment-instrument data.
• ▸Bank transfer (IBAN/SWIFT). If you pay by bank transfer, we receive and store the information shown on the incoming transfer, such as the payer's name, account details (IBAN) and the payment reference, in order to match and confirm your payment.
• ▸Invoicing (Čebelca). Invoices for your registration are issued through Čebelca, a Slovenian invoicing service, which processes the name and billing details shown on the invoice as required by Slovenian fiscal legislation.

Public attendee list. Unless you choose the "stay anonymous" option during registration, your nickname, badge photo, country and ticket type appear in the public attendee list on our website once your registration is paid. Attendees who stay anonymous are only included in overall counts and are never listed. You can opt out when registering, or later by contacting us.

Wallet passes. If you choose to add your ticket to Apple Wallet or Google Wallet, your name and ticket details are processed by Apple or Google at your request in order to display the pass on your device.

Under the GDPR, every use of personal data needs a legal basis. We rely on the following:

• ▸Contract (Article 6(1)(b)). Creating and managing your account, processing your registration, payments and tickets, and sending transactional email such as registration or payment updates and support replies.
• ▸Legal obligation (Article 6(1)(c)). Issuing and retaining invoices and accounting records under Slovenian fiscal legislation, and responding to lawful requests from competent authorities.
• ▸Legitimate interest (Article 6(1)(f)). Serving and securing our websites (Cloudflare), error monitoring (Sentry), aggregated traffic statistics, strictly necessary cookies, internal audit logging, attendee safety (including collecting your emergency contact details), enforcing our convention rules, and the public attendee list described above, from which you can opt out at any time.
• ▸Vital interests (Article 6(1)(d)). Using your emergency contact details if something happens to you at the convention.

We do not currently process any personal data on the basis of consent, and we do not send marketing communications.

Cookies are small text files that are placed on the user's device when they visit a site. Their purpose is to analyze web traffic, improve user experience, save user settings and to carry out other tasks.

No third party cookies are placed on our site without the user's consent. We do not use any advertising, analytics or cross-site tracking cookies.

We only use strictly necessary cookies. These are required for our sites to work and to keep them secure, they do not track you across other websites, and they do not require consent. The following cookies are in use:

On our main website (slofluffcon.org):

• ▸cf_clearance is set by Cloudflare after you pass a security check, so that you are not challenged again on every request.

On our registration site (reg.slofluffcon.org):

• ▸cf_clearance is set by Cloudflare after you pass a security check, as described above.
• ▸slofluffcon-session identifies your session while you are logged in to your registration account.
• ▸XSRF-TOKEN protects forms you submit against cross-site request forgery attacks.
• ▸remember_web_* keeps you signed in between visits if you choose the "remember me" option when logging in.

You can change the way your browser uses cookies in its settings at any time, or disable the placement of cookies in your browser for all visited sites. Note that blocking the cookies listed above may prevent parts of our sites, such as logging in to your registration account, from working.

You have the right to be informed of personal data processed by SFC, a right to rectification/correction, erasure and restriction of processing. You also have the right to ask from us a structured, common and machine-readable format of personal data you provided to us, and the right to object to processing we carry out on the basis of our legitimate interests.

You can exercise most of these rights yourself. In your registration account settings you can download a copy of all personal data we hold about you (a ZIP archive generated on request; the download link stays valid for 5 days), and you can delete your account after confirming your password. Deleting your account removes your registrations, badge photos, wallet passes and related data. Records of completed payments and issued invoices are kept for as long as fiscal law requires (Article 17(3)(b) GDPR). Account deletion is not available while you hold a paid registration for the current event; in that case, please contact us instead.

To exercise any of the rights mentioned in this Privacy Policy and/or in the event of questions or comments relating to the use of personal data you may contact the SFC support team: info@slofluffcon.org.

In addition, you have the right to lodge a complaint with a data protection authority. In Slovenia, the supervisory authority is the Information Commissioner (Informacijski pooblaščenec, www.ip-rs.si). You may also lodge a complaint with the authority in your own jurisdiction.

We keep personal data only for as long as we need it for the purposes described in this Policy:

• ▸Account and registration data. For as long as your account exists. You can delete your account yourself at any time, subject to the limitation described under "Your rights".
• ▸Payment records and invoices. 10 years, as required by Slovenian tax legislation (ZDDV-1).
• ▸Internal audit logs. 365 days, after which they are deleted automatically.
• ▸Personal data export archives. 5 days, after which they are deleted automatically.

Beyond these periods, we retain information only to the extent necessary to comply with our legal obligations, resolve disputes, enforce our agreements and protect SFC's legal rights.

We also collect and maintain aggregated, anonymized or pseudonymized information which we may retain indefinitely to protect the safety and security of our Site, improve our Services or comply with legal obligations.

We may update this Policy from time to time. If we do, we'll let you know about any material changes by notifying you on the website. The most recent changes are listed below:

• ▸07.07.2026 · Major accuracy update: described our Cloudflare setup (analytics excluded for EU visitors, proxy and file storage), listed the cookies actually in use, enumerated the account and registration data we collect, disclosed the public attendee list and its opt-out, added legal bases and concrete retention periods, described the self-service data export and account deletion tools, and removed the outdated EU representative and external data protection officer entries.
• ▸07.06.2026 · Republished on our new website, with expanded details on hosting, error monitoring, email delivery and payments.
• ▸10.07.2023 · Original publication.

E-Mail: info@slofluffcon.org

If you have any questions or concerns regarding your information, please contact info@slofluffcon.org.