Privacy Policy

Global School Calendar publishes school term dates and holiday dates. There is no account to create, no sign-up, no paywall and no advertising on this site. This policy describes the small amount of data processing that does happen, using plain statements of what the site actually does — the mechanisms are named so you can check them against the pages and the network traffic.

The operator of Global School Calendar is the data controller for the processing described here. The controller can be reached at feedback@globalschoolcalendar.com. That address is the channel for exercising the rights set out below and for any question about this policy, including a request for the controller's identity and postal address; requests sent to it are answered.

The controller's registered legal name and postal address are deliberately not published on this site. That is a limit on what this page states, not a refusal to provide them: ask at the address above and they will be given to you.

• Analytics data — only if you allow it. Page views, approximate location derived from a truncated IP address, device and browser type, referring page, and the events listed below. This is collected by Google Analytics and it does not run until you press Accept analytics in the consent banner.
• Product events — only if you allow analytics. We record which interaction a visitor used, not who they are: that a calendar feed was subscribed to and via which client, that a PDF was downloaded, that the planner produced a comparison, that the search box returned results. Search events carry a bucketed query length and a bucketed result count — for example query_length_bucket: 4_10. The words you type are never sent to analytics, and the site's search runs entirely in your browser.
• Correction reports — only what you submit. If you send a correction, a coverage request or feedback, we store what you write, the page and region it refers to, any official source link you provide, and your email address only if you choose to give one.
• Technical data at the hosting layer. Cloudflare serves this site and, like any web host, processes requests — IP address, user agent, requested URL — to deliver the page and to protect the site from abuse.

We do not collect names, phone numbers, postal addresses or payment details, because none of them are needed: there is nothing to buy, nothing to log in to, and no profile to build.

• Analytics and product events — consent. Article 6(1)(a). Google Analytics is loaded only after you press Accept analytics in the consent banner, and it is not loaded at all if you press Reject all or simply ignore the banner. Until you accept, no request is made to Google and no analytics cookie or identifier is set. You can withdraw consent at any time with the cookie settings link, here or in the footer; withdrawal stops further collection.
• Correction reports — legitimate interests. Article 6(1)(f). The site publishes dates that families plan around, so keeping them correct is the interest being served. A report is only processed for that purpose: verifying and correcting calendar data. We use the minimum needed to act on it, and you may ask us to delete a report instead of processing it.
• Serving the site and protecting it — legitimate interests. Article 6(1)(f). Cloudflare processes request data to deliver pages and to absorb abuse, denial-of-service traffic and scraping.

Nothing here is processed on the basis of a contract, and no special-category data (Article 9) is collected at all.

Before you choose, nothing non-essential runs. The site sets no analytics cookies on load. Google Analytics (gtag.js, measurement ID G-SHGH9D96BR) is requested only after you press Accept analytics. Analytics-facing consent is declared denied by default for every category, and only analytics storage is ever granted — this site runs no advertising, so ad-related storage and personalisation stay denied permanently.

Your choice is stored in your browser. The decision is kept in localStorage under the key gsc-consent-v1. That is a value on your own device, not a cookie, and it is sent to no one. It is the only thing the site stores locally.

Changing your mind. Press cookie settings to reopen the choice — it is also linked in the footer of every page. Rejecting after having accepted stops further collection; it does not delete data already collected, which you can ask us to erase using the rights below.

With JavaScript disabled the banner never appears and analytics never loads. Nothing is collected in that case — that is the intended outcome, not a gap.

Data is processed by three service providers, and sold to nobody:

• Google Analytics (Google LLC / Google Ireland Ltd) — website analytics. It receives data only after you consent. Google acts as a processor under its own data-processing terms for Analytics.
• Google Search Console — search performance for this site. It reports on queries that led people to the site; it is not a tracking script, is not loaded in visitors' browsers, and is not linked to analytics consent. It does not identify individuals.
• Cloudflare, Inc. — hosting, delivery and security. Cloudflare processes every request, as any host does, whether or not you consent to analytics.

We do not sell, rent or share personal data for advertising, and there are no third-party advertising or social-media trackers on this site.

Three separate stores, three separate periods:

• Correction reports: up to 180 days. Reports are written to Cloudflare KV with a 180-day expiry, after which they are deleted automatically. That is long enough to work the queue of corrections and short enough not to hold on to correspondence indefinitely.
• Analytics event data: 14 months. Fourteen months is the longest retention Google Analytics 4 offers for event and user data, and it is the period set on the property. We do not export analytics data, keep our own copy of it, or build any other store from it — so Google's setting is the whole of the retention period.
• Hosting and security logs: retained by Cloudflare according to its own retention schedule for the plan this site runs on.
• Nothing else. There are no accounts and no user profiles, so there is no account data to retain.

Google and Cloudflare are US-headquartered, so using them can involve processing outside the EU/EEA. We want to be precise about what we do and do not rely on here:

• No transfer happens before you consent. Until you press Accept analytics, no request reaches Google at all, so no transfer takes place. Refusing means there is nothing to transfer. This is a technical fact about the site rather than a contractual claim.
• If you accept, the analytics data is transferred to Google in the United States, and the legal path for that transfer is your explicit consent. Article 49(1)(a) GDPR — the derogation for a transfer made with the data subject's explicit consent after being informed of the possible risks. The consent banner states, before you decide, that accepting means a transfer to Google in the US. What that means in practice: data held in the US can be subject to US legal process, and the protections applied there are not identical to those in the EU/EEA.
• We rely on no other transfer mechanism for analytics. We do not assert certification under the EU–US Data Privacy Framework, we do not use an EU-only analytics endpoint, and we do not run server-side tagging or a self-hosted analytics system. There is no data localisation and no other safeguard of our own. We are not claiming a safeguard we have not put in place.
• Cloudflare processes requests regardless of consent, because that is what serving a web page means. Cloudflare publishes its own transfer safeguards for this.

Because the analytics transfer rests on Article 49(1)(a) alone, consent is the only thing that makes it lawful, and withdrawing consent ends it. If you need the assurance of an adequacy decision or of appropriate safeguards, the practical answer today is to decline analytics — which the banner makes as easy as accepting.

The .ics files this site publishes — the permanent feeds under /feeds/, the per-language feeds, the single-year files and the school overview PDFs — are the same bytes for every visitor. They contain no identifiers, no cookies, no tokens and no per-user state, and requesting one does not create a profile. The comparison feed at /feeds/compare.ics carries the schools you selected in the URL itself; it stores nothing server-side and nothing is written down. As with any page request, Cloudflare processes the URL in order to answer it.

The site is served over HTTPS only. Report submissions are validated and length-capped before storage, stored in a private key-value namespace that is not publicly readable, and expire automatically. There is no database of user accounts to breach, because there are no accounts.

Depending on where you live — the EU/EEA and UK under the GDPR, California under the CCPA/CPRA, and comparable regimes elsewhere — you have some or all of these rights over your personal data:

• Access — to be told whether we hold data about you, and to receive a copy.
• Rectification — to have inaccurate data corrected.
• Erasure — to have data deleted, including a correction report you sent.
• Restriction and objection — to have processing limited or stopped. Objecting to analytics is done in one click in the banner; objecting to anything else can be requested through the contact form.
• Portability — to receive data you provided in a structured, machine-readable format.
• Withdraw consent — at any time, using cookie settings. Withdrawal does not affect processing carried out before it.
• Complain to a supervisory authority. If you believe our processing infringes the GDPR, you have the right to lodge a complaint with a data protection authority — in the country where you live or work, or where the alleged infringement took place. In the EU/EEA each member state has one; the European Data Protection Board publishes the list of national authorities, and in the UK it is the Information Commissioner's Office. You do not need to contact us first.

To exercise any of these, write to feedback@globalschoolcalendar.com or use the contact form. Because the site holds no accounts, a request about analytics data may be limited by what Google retains and by our inability to identify you from aggregated reports — we will tell you plainly which parts we can and cannot act on.

This site publishes school holiday dates and is not directed at children. It has no accounts, no user-generated content and nothing to sign up for, and we do not knowingly collect personal data from children. If you believe a child has submitted personal data through the correction form, contact us and we will delete it.

When this policy changes, the revision date at the top changes with it. The mechanisms described above are implemented in the site's own source — the consent gate, the 180-day report expiry and the absence of any server-side calendar storage — so a change in behaviour requires a change in code rather than a change of wording alone.

Questions about this policy, requests to exercise your rights, and requests for the controller's identity and address go to feedback@globalschoolcalendar.com or through the contact and feedback form. The form uses the same endpoint as a correction report, so a request reaches the same place that corrections do and is handled the same way.