PRIVACY POLICY

Version 2026-09-v1. Last updated 25 September 2026.

This Privacy Policy explains how Milk and Cookies Festival (Pty) Ltd ("Milk & Cookies", "we", "us" or "our") collects, uses, shares and protects your personal information when you visit milkandcookiesfestival.com, sign up for updates, buy tickets or merchandise, attend our events, or interact with us on platforms such as Instagram, Facebook, TikTok and WhatsApp.

In this policy, "personal information" means any information that relates to you as an identifiable person, as defined in the Protection of Personal Information Act, 2013 ("POPIA"). Where we rely on your consent, we ask for it clearly, for example through our signup form or a cookie banner, and you can withdraw it at any time.

We use automated and artificial intelligence ("AI") tools to help us understand our audience, personalise our marketing and run our operations. Section 10 explains how, and the safeguards we apply.

1. WHO WE ARE AND HOW TO CONTACT US

Milk and Cookies Festival (Pty) Ltd (registration number 2024/669791/07) is the responsible party for the personal information described in this policy.

If you have a question about our privacy practices, want to exercise your rights, or would like to make a complaint, email info@milkandcookiesfestival.com.

We have an Information Officer, who should be copied on any privacy correspondence. Their details are currently:

2. WHAT THIS POLICY COVERS

This policy covers:

• milkandcookiesfestival.com, including our signup pages and any merchandise store we operate;
• the analytics and advertising tags we place on our ticket pages;
• our events, including entry, on-site purchases, and photography and filming;
• our marketing by email, WhatsApp and SMS; and
• messages, comments and direct messages you send us on social media and messaging platforms.

Tickets are sold through our ticketing partner, Howler. Howler processes your ticket purchase and payment under its own privacy policy, and shares the details of your purchase with us as the event organiser. Social media platforms such as Instagram, Facebook and TikTok also have their own privacy policies, which apply to your use of those platforms.

3. PERSONAL INFORMATION WE COLLECT

3.1 Information you give us

Signup information

Your first name, last name and email address; your phone number, if you choose to give it; which city you plan to attend; and whether you would like to receive updates by WhatsApp or SMS.

Ticket information

When you buy a ticket through Howler, we receive your name, email address, phone number, the event and ticket type, your order details, and any changes such as refunds, transfers or upgrades.

Merchandise orders

If you buy merchandise from us, your name, email address, phone number, billing and delivery address, order details and order history. Payment card details are processed by our payment provider and are not stored by us.

Communications

The content of any email, direct message, comment, WhatsApp message or chat you send us, together with your name, handle or number on that platform, and any publicly available profile information shown to us when you contact us.

Competitions and promotions

The details you give us when you enter a competition, giveaway or promotion we run.

3.2 Information collected automatically

Device and usage information

Your IP address, browser and device type, time zone, the pages you view, how you arrived, and how you interact with our website and ticket pages.

Campaign information

The campaign details in the link or poster QR code you used (for example the source, medium and campaign name), the page you arrived on, the website that referred you and, if you came from an online advert, the advertising platform's click reference.

Cookies, pixels and similar technologies

Described in section 16.

Inferred information

Interests and characteristics we infer from your activity and the information above, for example which city, events or genres you are likely to be interested in. We and our service providers may use automated and AI tools to do this (see section 10).

3.3 Information from our events

Entry and access

When your ticket or wristband is scanned, we receive a record of your entry, exits and access to areas, linked to your ticket.

On-site purchases

If you use a cashless wristband, we receive records of your top-ups, purchases and refunds, linked to your ticket.

Photos and video

Images and footage of attendees taken by our photographers and film crews. See section 7.

3.4 Consent records

When you sign up, we record the version of the wording you agreed to, the date and time, and the IP address you signed up from, so that we can show when and how you agreed to hear from us.

3.5 Information from other sources

We receive your ticket information from Howler, as described above. Advertising and social media platforms also give us reports about how our adverts and content perform. These reports are usually aggregated and do not identify you.

4. HOW WE USE YOUR INFORMATION

We use your personal information to:

• deliver our events, including entry, access control, on-site purchases, safety and customer service;
• process and fulfil merchandise orders, including delivery, returns and refunds;
• send you news, ticket releases, lineup announcements and offers by email, and by WhatsApp or SMS where you have asked us to (see section 5);
• tell you about the events in the city you plan to attend;
• respond to your messages, comments and support requests;
• understand which campaigns, posters, adverts and channels are working, and improve our marketing;
• show you relevant adverts on other platforms and measure their results (see section 6);
• build a single, accurate view of your relationship with us, so that you are not contacted twice or about events that are not relevant to you;
• run competitions and promotions you enter;
• keep a record of your consent and your marketing preferences, and make sure we stop contacting you if you ask us to;
• run, secure and improve our website and systems, and detect and prevent fraud and abuse;
• produce statistics and research about our audience and events, using aggregated information wherever possible;
• use automated and AI tools to analyse this information, personalise our communications and support our team, as described in section 10; and
• comply with our legal obligations and establish, exercise or defend legal claims.

5. MARKETING AND YOUR CHOICES

5.1 Email

We send marketing emails to people who have signed up to receive them. If you buy a ticket or merchandise from us, we may also send you information about our similar events and products, as POPIA allows for existing customers. You can say no when you buy, and in every message we send.

5.2 WhatsApp and SMS

We only send marketing by WhatsApp or SMS if you have asked us to, for example by ticking the WhatsApp or SMS box when you sign up. Messages about a ticket you have bought, such as your ticket confirmation, are sent by Howler.

5.3 How to opt out

• Email: click the unsubscribe link at the bottom of any of our emails.
• WhatsApp or SMS: reply STOP to any of our messages.
• Social media: send us a direct message saying that you no longer want to receive marketing.
• Any channel: email info@milkandcookiesfestival.com.

Opting out of marketing does not stop messages we need to send you about a ticket or order you have bought.

6. ADVERTISING, ANALYTICS AND PERSONALISATION

We use advertising and analytics tools to understand how people find and use our website and ticket pages, and to show relevant adverts to people who are likely to be interested in our events.

• Analytics. We use tools such as Google Analytics to understand visits, pages viewed, and how people move from our website to buying a ticket.
• Advertising partners. Information about your use of our website and ticket pages, the details you give us, and the interests and characteristics we infer from them, including with automated and AI tools, are shared with our advertising partners, including Meta (Facebook and Instagram), Google and TikTok. These platforms use this information to show you adverts for our events and merchandise that match your stated and inferred interests, both on their own platforms and on other websites you visit. For example, we may group our audience by the city you plan to attend, the events you have been to, or how you engage with our content. Where this includes your email address or phone number, it is hashed first, as described below.
• Retargeting. We use cookies, pixels and similar technologies to record your activity and the pages you visit on our website and ticket pages. This activity, together with how you engage with us elsewhere, such as messaging or commenting on our social media accounts, can lead to you seeing our adverts after your visit on platforms such as Instagram, Facebook, TikTok and Google, featuring events and products you may be interested in. These technologies only run where you have allowed them, for example by accepting them in a cookie banner, and you can change your choice at any time.
• Conversion measurement. To measure whether our adverts led to a signup or ticket purchase, we may send details of that action to the advertising platform directly from our systems. Where this includes your email address or phone number, it is converted into a scrambled code (hashed) before it is sent, and the platform uses it only to match the action to its own users.
• Custom audiences. We may upload hashed email addresses or phone numbers to Meta, TikTok or Google to show our adverts to existing fans, or to exclude people who have already bought a ticket. The platforms use the hashed details only to match them to their own users.

You can object to any of this at any time by emailing us. You can also manage your advertising preferences in your Meta, TikTok and Google account settings, and control cookies through our cookie banner (where shown) and your browser settings.

7. PHOTOS AND VIDEO AT OUR EVENTS

Our events are photographed and filmed, and images and footage may show attendees. We use them to share and promote Milk & Cookies on our website, social media channels and in advertising. We do this on the basis of our legitimate interest in documenting and promoting our events, and we display notices at our events to let you know.

If you would prefer not to be photographed or filmed, let our photographers or crew know. If you appear in an image we have published and would like it removed, email us with a link to it and we will take reasonable steps to remove it or crop you out. We may not be able to do this for wide crowd shots in which you are not the focus, or for content already published by others.

8. WHO WE SHARE IT WITH

We share personal information only where we need to, with the following types of recipients. We share only what each needs to do its job.

Ticketing and event operations

Howler, for ticketing, entry and cashless payments; and venues, security and production partners, where needed to run an event safely.

Email, messaging and customer relationship tools

Providers such as Mailchimp and Customer.io for email and our mailing list; Meta's WhatsApp Business platform for WhatsApp messages; and Gorgias for managing replies, comments and direct messages.

Merchandise

Shopify, which powers our online store; our payment providers; and the courier companies that deliver your orders.

Hosting, data and reporting

Vercel, which hosts our website; Google Cloud, where we store and analyse our data; and reporting tools such as Metabase.

Analytics and advertising

Google (including Google Analytics and Google Ads), Meta (Facebook and Instagram) and TikTok, as described in section 6.

AI service providers

Providers of the AI tools we use to analyse information and support our team, as described in section 10.

Professional advisers

Our lawyers, accountants and auditors, where they need it to advise us.

Authorities

Law enforcement, regulators, courts and other public bodies, where the law requires it, in response to a lawful request, or to protect our rights, our attendees or the public.

A future owner

A buyer or investor, if all or part of our business is sold or restructured, on the basis that they continue to protect your information in line with this policy.

Our service providers process your information on our behalf and only on our instructions. We do not sell your personal information, and we do not share it with sponsors or brand partners for their own marketing without your consent.

9. OUR GROUNDS FOR PROCESSING

9.1 South Africa (POPIA)

We process your personal information on one or more of the following grounds:

• your consent, for example to receive marketing by email, WhatsApp or SMS, or to non-essential cookies;
• where it is necessary to carry out a contract with you, such as delivering an event you have a ticket for or an order you have placed;
• where it is necessary to comply with a legal obligation;
• where it protects your legitimate interests; and
• where it is necessary for our legitimate interests or those of a third party we share it with, such as understanding our audience, securing our systems, documenting our events and measuring our advertising, where those interests are not overridden by yours.

9.2 European Economic Area and United Kingdom

If you are in the European Economic Area or the United Kingdom, we rely on the equivalent lawful bases: your consent, the performance of a contract with you, compliance with our legal obligations, the protection of your vital interests, and our legitimate interests where they are not overridden by your rights and freedoms.

10. ARTIFICIAL INTELLIGENCE, PROFILING AND AUTOMATED DECISIONS

10.1 How we use AI tools

We use automated and AI tools, including features built into the platforms described in this policy and general-purpose AI assistants, to:

• analyse our audience, campaign and event information, and infer interests and characteristics, such as which city, events or genres you are likely to be interested in;
• group our audience and personalise the content, timing and channel of our emails, messages and adverts;
• help our team sort, summarise and draft replies to messages, comments and support requests; and
• produce reports and insights about how our events and marketing are performing.

10.2 Safeguards

• We share only the information a tool needs for the task, and use aggregated or de-identified information wherever we can.
• Where the option is available, we use business versions of AI tools and settings that stop the provider using our information to train its general models.
• AI tools support our team rather than replace it. People remain responsible for how we use your information and for the decisions we make about you.

10.3 Automated decisions

We do not make decisions about you that have legal consequences for you or affect you to a substantial degree based solely on automated processing.

10.4 Profiling and your right to object

We use profiling for marketing, as described in section 6 and above, for example to decide which events and offers are most relevant to you. You can object to this at any time by emailing us or opting out of marketing. If you are in the European Economic Area or the United Kingdom, you also have the right to object to profiling for direct marketing.

11. TRANSFERS OUTSIDE SOUTH AFRICA

Several of our service providers, including Mailchimp, Vercel, Google, Meta, TikTok, Shopify, Customer.io and the AI service providers described in section 10, store or process information outside South Africa, mainly in the United States and Europe.

Where we transfer your personal information outside South Africa, we do so with providers that are bound by data processing agreements, or equivalent binding terms, that require them and anyone they pass information to to protect it to a standard substantially similar to POPIA. By signing up or buying from us, you also agree to your information being transferred to these providers for the purposes set out in this policy. Data protection laws in other countries may differ from those in South Africa.

12. HOW LONG WE KEEP IT

We keep personal information only for as long as we need it for the purposes in this policy, unless the law requires or allows us to keep it longer. In particular:

• Marketing: until you unsubscribe or ask us to delete it, and no longer than 24 months after your last interaction with us, such as opening an email, signing up again or buying a ticket.
• Opt-outs: if you unsubscribe, we keep a minimal record of your email address or number so that we do not contact you again.
• Consent records: for as long as we hold your information, and for as long afterwards as we need to show that we had your consent.
• Ticket, order and payment records: for as long as tax and accounting law requires, which is generally five years.
• Messages and support requests: for up to 24 months after the conversation ends.
• Photos and video: for as long as they are relevant to documenting and promoting our events, subject to any removal request.

When we no longer need your information, we delete it or make it anonymous. You can ask us to delete your information at any time (see section 15), unless we have a legal reason to keep it.

13. SECURITY

We take reasonable technical and organisational measures to protect your personal information against loss, misuse and unauthorised access. Information sent through our website is encrypted in transit, and access is limited to the people and providers who need it. If we become aware of unauthorised access to your personal information, we will notify you and the Information Regulator as POPIA requires.

14. MINORS

Our events, website and marketing are intended for people aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe that a minor has given us their personal information, contact us and we will delete it promptly.

15. YOUR RIGHTS

15.1 South Africa (POPIA)

You have the right to:

• ask whether we hold personal information about you;
• request access to the personal information we hold about you, subject to the Promotion of Access to Information Act, 2000;
• request that we correct, update, destroy or delete your personal information, subject to any legal reason we have to keep it;
• object to the processing of your personal information on reasonable grounds, and object at any time to direct marketing;
• withdraw your consent at any time;
• lodge a complaint with the Information Regulator; and
• institute civil proceedings regarding an alleged interference with the protection of your personal information.

15.2 European Economic Area and United Kingdom

If you are in the European Economic Area or the United Kingdom, you also have the right to restrict our processing, to receive your information in a portable format, and to complain to your local data protection authority.

15.3 How to exercise your rights

Email info@milkandcookiesfestival.com, copying our Information Officer. We may need to confirm your identity before we act on your request, and we will respond within a reasonable time.

16. COOKIES AND SIMILAR TECHNOLOGIES

A cookie is a small file stored on your device when you visit a website. Pixels, tags and session storage work in a similar way. We and our partners use them for the following purposes:

• Strictly necessary: to make our website work and keep it secure. These do not need your consent.
• Functional: to remember your choices, such as the campaign link you arrived from while you browse.
• Analytics: to understand how visitors use our website and ticket pages.
• Advertising: to measure our adverts and show you relevant ones on other platforms, as described in section 6.

Where we use analytics or advertising cookies on our website, we ask for your consent first and you can change your choice at any time. You can also block or delete cookies in your browser settings, although some parts of the website may not work as intended.

Our signup page does not use advertising or analytics cookies. It holds the campaign details from your link in your browser's session storage until you close the tab, so that they are included with your signup.

17. APPLICABLE LEGISLATION

In South Africa, we may be required to process or keep your personal information under laws including:

• the Protection of Personal Information Act, 2013;
• the Promotion of Access to Information Act, 2000;
• the Consumer Protection Act, 2008;
• the Electronic Communications and Transactions Act, 2002;
• the Tax Administration Act, 2011;
• the Income Tax Act, 1962; and
• the Value-Added Tax Act, 1991.

18. COMPLAINTS

If you would like to make a complaint, contact us using the details in section 1. We will try to resolve it quickly.

If you are not satisfied with our response, you have the right to complain to the Information Regulator. Its contact details are currently:

If you are in the European Economic Area or the United Kingdom, you can also complain to your local data protection authority.

19. CHANGES TO THIS POLICY

We may update this policy to reflect changes to our practices, our service providers, or for legal or regulatory reasons. When we do, we will publish the new version here and update the version number and date at the top. We record which version applied when you signed up.