Cookies & Privacy Policy

This page explains what personal data Shockholm Halloween Parade 2026 Photo Contest collects, why, and how you can exercise your rights over it. It is a companion to our Terms of Entry, which cover the contest's data-handling rules in more detail.

Who is responsible Patrick Österlund runs this photo contest in collaboration with Shockholm Halloween Parade (SHP) and is responsible for your personal data (the data controller). Questions or requests: use the contact page. What we collect, and why • Account: email address, display name, optional phone number and optional password (stored only as a one-way hash), and that you accepted the terms of entry. Used to run the contest, let you sign in and contact winners. Legal basis: performing the contest you entered. • Photos: the image you upload. The stored copy is re-encoded and contains no metadata (no location). From the original file we keep only the capture time, time zone and camera make/model, to check that the photo was taken during the event. Photos are shown publicly with your display name once approved, as agreed in the terms of entry. • Votes, likes and reports: which photos you voted for or liked, linked to your account or, for open voting, to a random ballot ID with no name attached. With each vote we store salted one-way hashes of the IP address and browser type, only to investigate ballot stuffing (legitimate interest: a fair contest). If you report a photo, we store the report and your account. • Contact form: your name, email and message are emailed to the organizer and not stored on the site. To stop spam, the form uses Cloudflare Turnstile, which checks your browser (including your IP address) when you open the page; we receive only a pass/fail answer (legitimate interest: keeping the form usable). • Sign-in links: your email and a one-time code that expires shortly after it is sent. • Feedback buttons: only up or down is stored, with no link to you. • Analytics: only if you accept it in the cookie notice (consent). See the cookie section below. Who receives the data We do not sell or share your data for marketing. These service providers process it on our behalf: • Render — hosts the website and its database (Virginia, USA). • Cloudflare — delivers and protects the site, stores the photo files (Cloudflare R2) and runs the contact form's spam check (Turnstile). • Mailjet (Sinch) — sends the site's emails. • Google — Google Analytics, only if you accept analytics. Some of these providers are based outside the EU/EEA. Where data is transferred outside the EU/EEA, it is covered by the EU Commission's standard contractual clauses or an adequacy decision. The site does not record IP addresses in its own logs. Our hosting and network providers may process IP addresses briefly in their technical logs to run and protect the service. How long we keep it • Once the organizer marks the contest concluded, your email, phone number and login are automatically anonymized 3 months later. The vote hashes are deleted at the same time. • Your approved photos, display name and vote counts stay in the public entries and results, unless you ask for erasure. • If you only ask for your personal details to be removed ("Ask to be deleted" on My page), your photos stay in the contest without your name. Even after a full erasure, the organizer may keep photos already used to promote the event, since published material cannot always be withdrawn. • Analytics data is kept by Google for 2 months. • Cookie lifetimes are listed in the cookie section below. Your rights You have the right to access your data, have it corrected or erased, restrict or object to its use, receive a copy (data portability), and withdraw consent at any time (for analytics: “Cookie settings” in the footer). Use the contact page; requests are handled by the organizer. You can also complain to the Swedish Authority for Privacy Protection (IMY), imy.se. Changes We may update this policy; the current version is always on this page.

Cookies & browser storage

This site stores only what is strictly necessary to make it work, or what you've explicitly chosen yourself (like your language). The one optional exception is Google Analytics, which stays off unless you accept it in the cookie notice. We use no advertising cookies.

• Session cookie (connect.sid) — keeps you signed in and protects forms against forgery. Expires after 1 hour of inactivity.
• Language cookie (locale) — remembers whether you're viewing the site in English or Swedish. Kept for 1 year.
• Voting ballot cookie (ballot) — set only if you open the voting page without being signed in, when the organizer has opened voting to everyone. It holds a random ID with no name or email attached, so the site can count your votes against the per-person limit and let you change them. Kept for 90 days.
• Google Analytics cookies (_ga and _ga_LD8VTR4S78) — only set if you accept analytics in the cookie notice. They give Google Analytics a random ID so we can count visits and see which pages are used. Kept for up to 2 years, or until you withdraw under “Cookie settings”. Never used for signed-in administrators or judges.
• Theme preference (stored in your browser, not a cookie) — remembers your light/dark mode choice. Kept until you clear your browser data.
• Cookie choice (stored in your browser, not a cookie) — remembers whether you accepted or declined analytics, so the notice doesn't keep reappearing. Kept until you clear your browser data.
• Voting reminder (stored in your browser, not a cookie) — remembers that you've already seen the "voting is open" pop-up. Cleared when you close this browser tab.

The necessary items and your own preferences don't need separate consent under EU and Swedish law (the ePrivacy rules, implemented via Lagen om elektronisk kommunikation). Analytics cookies do, so they are only set after you click “Accept analytics”. You can withdraw that at any time under “Cookie settings” in the footer.

What we do with this information

• We use the necessary items only to run the site: keep you signed in, show the site in your language and theme, and count each person's votes once. None of it is used for advertising or profiling, and none of it is sold or passed on to advertisers or other third parties.
• Your session cookie ties your browser to a login session held in the site's own database. The ballot ID is only linked to the votes cast with it, never to a name or email address.
• If you accept analytics, Google Analytics receives information about your visit — pages viewed, approximate location, device and browser type — tied to a random ID, so the organizer can see usage statistics. We don't use it for advertising: ads personalization and Google signals are switched off, and Google keeps the data for 2 months. Google acts as our processor and the data may be processed outside the EU. If you decline or withdraw, no further analytics data is sent and the analytics cookies are removed from your browser.
• When a vote is cast, we also store scrambled one-way (salted hash) versions of the voter's IP address and browser type with it, so ballot stuffing can be investigated afterwards. The original IP address is not stored with the vote. The hashes are deleted automatically 3 months after the contest is concluded; the votes themselves remain part of the results.
• The site is delivered through Cloudflare, which handles visitors' IP addresses in transit in order to serve and protect it. We set no other cookies. Cloudflare sets none on normal visits; only if it needs to check that a visitor is not a bot can it set a security cookie (cf_clearance), which is needed for that check alone.

In the meantime, see the GDPR section of our Terms of Entry for how your data is collected, used, retained, and can be removed.