Privacy Policy

DT Fest 2026 — the Dashain & Tihar Festival — is produced by 3e Entertainment LLC, a Virginia limited liability company (“3e Entertainment,” “DT Fest,” “we,” “us,” or “our”). We are the controller responsible for the personal information described in this Privacy Policy.

The festival takes place at 44578 Atwater Dr, Ashburn, VA 20147 on October 11, 2026. You can reach us at info@dtfest.com or by writing to us at the address above.

This Privacy Policy explains what we collect when you use dtfest.com (the “Site”), why we collect it, who we share it with, how long we keep it, and the choices and rights you have. It applies to the Site and to the application, subscription, and inquiry forms we operate on it.

This policy covers information we collect through the Site and through our email communications.

It does not cover

• Ticket purchases. Tickets to DT Fest are sold by our third-party ticketing partner, Seatium. When you click a ticket link on our Site you leave dtfest.com and complete your purchase on Seatium’s platform. Seatium collects your payment and purchaser details directly under its own privacy policy and terms. We do not receive or store your full payment card number.
• Payments by vendors, sponsors, and partners. Approved applicants receive a payment link generated by Stripe. Stripe processes the transaction and card data under its own privacy policy. We receive confirmation that a payment was made, not your card details.
• Other sites we link to. Social platforms, artist links, maps, and partner websites operate under their own policies.

We only ask for information we actually need to respond to you. Here is every form on the Site and exactly what it collects.

Email updates & festival announcements

• Your email address (required)
• Your name (optional)
• The IP address the signup came from, and the date and time you subscribed — retained to prevent abuse of the signup form and to evidence your consent to receive email

Get Involved inquiries (volunteer, idea, media, general)

• Name and email address (required)
• Phone number (optional)
• The type of involvement you selected and your message

Vendor booth applications

• Business name, contact name, email address, and phone number
• Booth category, the specific booth or booths you requested, and any message or details you provide
• Our internal review status and staff notes about your application

Sponsor and partner applications

• Company name, contact name, email address, phone number, and website
• The sponsorship tier you are interested in and your message
• Our internal review status and staff notes

Artist and performer applications

• Artist or group name, primary contact name, email address, and phone number
• Performer type, the city and state you are based in, your biography or description of your act
• Links to performance footage and social or website profiles, plus any availability and technical notes you share
• Our internal review status and staff notes

We run our own first-party analytics rather than embedding Google Analytics, advertising pixels, or third-party trackers. Nothing about your browsing on this Site is sent to an advertising network.

What our analytics record

• A random visitor identifier stored in your browser’s local storage, and a random session identifier stored in session storage that expires after 30 minutes of inactivity. These are randomly generated values. They are not derived from your name, email, or any other identifier you have given us.
• The page path and page title you viewed, the time of the view, and periodic “still here” signals while the page is visible, so we can estimate how long pages hold attention
• The referring website you arrived from, and any utm_source, utm_medium, and utm_campaign values in the link you clicked
• A coarse device category — mobile, tablet, or desktop — derived from your browser’s user-agent string
• A one-way salted hash of your IP address and of your user-agent string. We store the hash, not the underlying value. The hash lets us count unique visits and detect abuse without keeping a record of your IP address in readable form.

What our analytics do not record

• Your name, email address, or any account identity
• Precise location, GPS coordinates, or street-level geolocation
• Keystrokes, form contents, mouse movement, or session replay
• Activity on any other website — we have no visibility outside dtfest.com
• Anything at all on our staff-only areas, which are excluded from tracking

Our web host and infrastructure providers also keep standard server logs, which may include IP addresses, for security, error diagnosis, and abuse prevention.

We use no advertising cookies and no third-party tracking cookies. We use browser storage sparingly, and only for the purposes listed here.

Browser storage we set on the public site

• dtfest_visitor_id (local storage) — a random value used to count returning visits in our own analytics.
• dtfest_session_id and dtfest_session_started_at (session storage) — a random value that groups page views into a single visit and expires after 30 minutes of inactivity or when you close the tab.
• dtfest_email_dismissed (local storage) — remembers that you closed or completed the email signup prompt so we do not show it again.

Cookies we set for staff

• A signed, HTTP-only session cookie is issued when an authorized administrator, vendor manager, or sponsor manager logs in to a staff-only area. It is strictly necessary for authentication and is never set for ordinary visitors.

How to opt out

• Clear the site data for dtfest.com in your browser settings, which removes the identifiers above. New random identifiers are generated on your next visit.
• Block local and session storage for this site, or browse in a private or incognito window. The Site is built to work normally when storage is unavailable.
• Use a browser or extension that blocks analytics requests. We do not attempt to circumvent these tools.

Global Privacy Control and Do Not Track

Because we do not sell personal data, share it for cross-context behavioral advertising, or use it for targeted advertising, there is no opt-out signal for us to honor in that respect. We nevertheless treat a Global Privacy Control signal as a valid request to opt out of any such processing. Browser “Do Not Track” signals have no agreed industry standard, and our practices are the same whether or not you send one.

We use the information described above to:

• Review, respond to, and act on vendor, sponsor, partner, artist, and get-involved submissions
• Send you the festival updates and announcements you asked for, and send transactional messages about an application you submitted — including approval notices and payment links
• Operate, secure, and improve the Site, including diagnosing errors and preventing spam, fraud, and abuse of our forms
• Understand in aggregate which pages, campaigns, and referral sources bring people to the festival, so we can plan marketing and capacity
• Plan and produce the festival itself — booth assignment, lineup programming, and logistics
• Comply with law, enforce our Terms of Service, and establish or defend legal claims

We share personal information only in the circumstances below, and only to the extent needed.

Service providers acting on our behalf

• Database and web hosting. Our application data is stored in a managed MySQL database and served from our web hosting provider.
• Mailgun — sends our announcement and transactional email and processes unsubscribe requests.
• Stripe — generates and processes payment links for approved vendors, sponsors, and partners.
• Seatium — sells and fulfills festival tickets. We may receive aggregate sales figures from ticketing.
• Meta (Facebook and Instagram) — we retrieve aggregate follower and engagement metrics for our own festival accounts through Meta’s API. This tells us how our posts performed. It does not identify individual visitors to our Site.

These providers are permitted to use the information only to perform services for us, under contract, and not for their own marketing.

Other disclosures

• Festival operations. If your application is approved, we share what is necessary with the venue, county permitting or health authorities, insurers, and on-site production staff — for example, providing a health department with a food vendor’s business and contact details.
• Legal requirements. We disclose information when required by law, subpoena, court order, or valid governmental request, or where we believe in good faith that disclosure is necessary to protect the safety of any person, investigate fraud, or enforce our agreements.
• Business transfers. If DT Fest or 3e Entertainment LLC is involved in a merger, acquisition, reorganization, or sale of assets, personal information may transfer as part of that transaction. We will require the recipient to honor this policy or give you notice and a choice before materially different handling.
• With your direction. Publicly listed sponsors, partners, vendors, and artists appear on the Site with the business details supplied for that purpose.

We send two kinds of email: announcements you opted into, and transactional messages tied to something you submitted, such as confirmation that we received your vendor application or a payment link for an approved booth.

• Every marketing email includes a working one-click unsubscribe link unique to your address. Unsubscribing takes effect promptly and removes you from our announcement list.
• You may also email info@dtfest.com with “Unsubscribe” in the subject line and we will remove you manually.
• Transactional messages about an application you actively submitted are not marketing and may still be sent after you unsubscribe from announcements. If you no longer want any contact at all, tell us and we will close out your application.
• We honor the requirements of the federal CAN-SPAM Act, including accurate headers and subject lines, identification of commercial email, and a valid postal address.

We keep personal information only as long as it serves the purpose it was collected for, unless a longer period is required by law.

• Email subscribers — until you unsubscribe or ask us to delete your record, plus a short period to honor suppression so we do not re-add you.
• Vendor, sponsor, partner, and artist applications — through the festival cycle they relate to and for up to three years afterward, for accounting, tax, insurance, and returning-applicant purposes.
• Get Involved inquiries — up to two years after the inquiry is resolved.
• Analytics events and sessions — retained in detailed form for up to 24 months, after which we keep only aggregate daily totals that do not identify any visitor.
• Server and security logs — typically 30 to 90 days, depending on the provider.

When a retention period ends, we delete the information or irreversibly aggregate it so that it no longer identifies anyone.

We maintain safeguards appropriate to the information we hold:

• The Site is served over HTTPS, and our database connections use TLS
• Staff areas require authentication with hashed passwords, signed session tokens, and role-based access, and are excluded from search engines and analytics
• IP addresses and user-agent strings in analytics are stored as one-way salted hashes rather than in readable form
• Form submissions are rate-limited and validated to resist automated abuse
• Payment card data is handled entirely by Stripe and our ticketing partner and never touches our servers

No method of transmission or storage is perfectly secure. We cannot guarantee absolute security, but if a breach affecting your personal information occurs we will notify you and the appropriate authorities as required by Virginia and other applicable law.

Virginia residents (VCDPA)

Under the Virginia Consumer Data Protection Act, Virginia residents have the right to:

• Confirm whether we process your personal data and access it
• Correct inaccuracies in your personal data
• Delete personal data you provided or we obtained about you
• Obtain a copy of your personal data in a portable, readily usable format
• Opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions producing legal or similarly significant effects — none of which we engage in

Appeals. If we decline your request, we will tell you why and you may appeal by replying to our decision or emailing info@dtfest.com with “Privacy Appeal” in the subject line. We will respond in writing within 60 days. If your appeal is denied, you may contact the Virginia Attorney General at oag.state.va.us to submit a complaint.

California residents (CCPA/CPRA)

California residents have the right to:

• Know the categories and specific pieces of personal information we collected, the sources, our purposes, and the categories of parties we disclosed it to
• Delete personal information we collected from you
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information, and limit use of sensitive personal information — we do not sell or share personal information, and we do not collect sensitive personal information as that term is defined
• Not be discriminated against for exercising any of these rights. We do not deny service, charge different prices, or provide a lesser experience because you exercised a privacy right.

In the preceding twelve months we collected identifiers (name, email, phone, hashed IP), commercial information (application and sponsorship interest), and internet activity information (pages viewed, referral source), for the business purposes described in this policy.

Residents of other states

Residents of Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have comparable rights of access, correction, deletion, portability, and opt-out. We extend the rights described above to all US residents regardless of where you live, so you do not need to determine which law applies to you.

How to exercise your rights

• Email info@dtfest.com with “Privacy Request” in the subject line, telling us what you would like us to do and which email address or submission it concerns.
• We will verify your request by confirming control of the email address associated with the information, or by asking you to confirm details that match our records. We ask for no more information than is needed to verify you.
• We respond within 45 days, and may extend once by another 45 days where reasonably necessary — we will tell you if we need the extension.
• An authorized agent may submit a request on your behalf with written permission that we can verify.
• Exercising these rights is free. We may charge a reasonable fee or decline only if a request is manifestly unfounded, excessive, or repetitive, and we will explain why.

The Site is intended for a general audience and is not directed to children under 13. We do not knowingly collect personal information from children under 13 online. Our forms are for adults applying as vendors, sponsors, partners, artists, volunteers, or subscribing to festival news.

If you believe a child under 13 has provided us personal information through the Site, email info@dtfest.com and we will delete it promptly. Parents and guardians of teens under 16 may also contact us to review or delete information.

The festival itself is family-friendly, and children 10 and under are admitted free with a ticketed adult. Kids Zone activities at the event are in-person and supervised by accompanying parents or guardians. We do not create online profiles of attending children.

DT Fest is photographed and filmed. By attending, you consent to being photographed, filmed, and recorded, and to our use of that footage to promote the festival — on this Site, in our gallery and highlight reels, on social media, and in press materials — without compensation. The full terms of that release are in the photography and likeness release section of our Terms of Service.

If you appear in a photo or video on this Site and would like it removed, email info@dtfest.com describing where it appears. We will review the request and, where we can identify the content, remove it from material we control. We cannot recall media already published by press, sponsors, or attendees.

The Site links to and embeds content from other services — ticketing, maps and directions, social media profiles, artist performance links, and sponsor websites. Those services set their own cookies, collect their own data, and operate under their own privacy policies. We do not control them and are not responsible for their practices. Review the policy of any site you visit from ours.

We may update this Privacy Policy as the festival, our tools, or the law changes. When we do, we will revise the “Last updated” date at the top of this page. If the changes materially affect how we use information you already gave us, we will provide more prominent notice — by email to subscribers or a notice on the Site — before the change takes effect.

Continuing to use the Site after an update takes effect means you accept the revised policy.

Questions, privacy requests, and appeals about this policy go to our privacy contact:

• Email — info@dtfest.com
• Mail — 3e Entertainment LLC, Attn: Privacy, 44578 Atwater Dr, Ashburn, VA 20147
• Press and partnerships — press@dtfest.com

Please include “Privacy Request” or “Privacy Appeal” in the subject line so your message reaches the right person quickly.