Last Updated: November 17, 2025
1. Introduction
This document outlines the policy of FestiveCal (https://festivecal.com, “we,” “us,” “our”) regarding the collection, processing, and protection of personal data for individuals residing in the European Economic Area (EEA), as required by the General Data Protection Regulation (GDPR).
This GDPR Policy is a supplement to our main Privacy Policy. Where this policy applies, its provisions take precedence over any conflicting provisions in the main Privacy Policy.
If you are a resident of the European Economic Area (EEA), you have certain data protection rights covered by the GDPR.
2. Who We Are: Data Controller
For the purposes of the GDPR, FestiveCal is the “Data Controller” of the personal data you provide to us or that we collect when you use our Site.
- Data Controller: FestiveCal
- Contact: info@festivecal.com (Use your actual contact email)
3. Data Protection Officer (DPO)
[Legal Warning: A DPO is a formal role. You cannot simply invent one. This is a placeholder that MUST be updated with your legally appointed DPO if your site’s processing activities require one. For most small blogs, a DPO is not required, but you must still provide a point of contact for data protection matters.]
We have appointed a Data Protection contact point for any questions or complaints regarding our handling of your personal data.
- Data Protection Contact: privacy@festivecal.com (We recommend creating a dedicated email for this)
4. Legal Basis for Collecting and Processing Personal Data
We collect and process personal data about you only where we have a legal basis for doing so. Our legal bases under the GDPR include:
- Consent: We will process your data if you have given us explicit consent to do so for a specific purpose. This includes:
- Subscribing to our newsletter.
- Leaving a comment (where you consent to your name/email being stored).
- Consenting to the use of non-essential cookies for advertising or analytics. You have the right to withdraw your consent at any time.
- Legitimate Interests: We may process your data when it is necessary for our “legitimate interests,” provided your fundamental rights and freedoms do not override those interests. This includes:
- Operating, maintaining, and improving our Site and Services.
- Understanding how users interact with our Site (analytics).
- Responding to your comments or inquiries (customer service).
- Protecting the Site from spam, fraud, and security threats.
- Serving contextual (non-personalized) advertising.
- Legal Obligation: We may process your data where it is necessary for compliance with a legal or regulatory obligation to which we are subject.
5. Your Data Protection Rights Under GDPR
If you are a resident of the EEA, you have the following data protection rights. We are committed to facilitating the exercise of these rights.
- The Right to Access: You have the right to request copies of your personal data that we hold.
- The Right to Rectification: You have the right to request that we correct any information you believe is inaccurate. You also have the right to request that we complete information you believe is incomplete.
- The Right to Erasure (The “Right to be Forgotten”): You have the right to request that we erase your personal data, under certain conditions.
- The Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data, under certain conditions.
- The Right to Object to Processing: You have the right to object to our processing of your personal data, under certain conditions, particularly where we are processing based on legitimate interests.
- The Right to Data Portability: You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.
To exercise any of these rights, please contact our Data Protection Contact at privacy@festivecal.com. We will respond to your request within one month.
6. International Data Transfers
FestiveCal is based outside the European Economic Area (EEA). The data that we collect from you may be transferred to, and stored at, a destination outside the EEA (for example, on servers hosted in the United States by our web hosting provider or analytics provider).
When we transfer your data outside the EEA, we will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this policy and the GDPR. We will do this by ensuring that the third-party providers are compliant with data protection frameworks (such as the EU-U.S. Data Privacy Framework) or by using Standard Contractual Clauses (SCCs) approved by the European Commission.
7. Data Retention
We will only retain your personal data for as long as is necessary for the purposes set out in this policy and our main Privacy Policy.
- Comment Data: If you leave a comment, the comment and its metadata are retained indefinitely.
- Analytics Data: Anonymized or pseudonymized analytics data (like Google Analytics) may be retained for a longer period (e.g., 26 months) to help us understand long-term trends.
- Contact Form/Email: If you contact us, we may keep a record of that correspondence for a reasonable period.
8. Data Security
We have put in place appropriate technical and organizational security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way. However, no method of transmission over the Internet is 100% secure.
9. Your Right to Lodge a Complaint
If you are an EEA resident and you believe that we are processing your personal data in violation of the GDPR, you have the right to lodge a complaint with your local Data Protection Authority (Supervisory Authority).
A list of Supervisory Authorities in the EU can be found here: https://edpb.europa.eu/about-edpb/board/members_en
We would, however, appreciate the chance to deal with your concerns before you approach the Supervisory Authority, so please contact us in the first instance at privacy@festivecal.com.