How festivos.io processes personal data under the GDPR (art. 28): roles, sub-processors, transfers and security. It complements the Privacy policy and the API Terms.
1. Roles and scope
Public service without accounts: the API is free, requires no sign-up and keeps no user accounts or billing data.
The API does not process your personal data: queries are municipality codes (INE) and dates, and responses are public holidays —public information, no personal data—. In normal use, festivos.io does not act as a processor of your personal data.
Separate integration: if a specific agreement required sending us personal data outside the public API, a written data processing agreement under GDPR art. 28.3 would be signed first.
2. Sub-processors
To deliver the service we rely on the following processors/sub-processors:
Cloudflare, Inc. — infrastructure, CDN, edge compute and cookieless analytics. Processing in the EU/EEA where possible; transfers covered by Standard Contractual Clauses (SCC).
Email provider — support communications.
We will announce additions or changes of sub-processors with reasonable notice, allowing the customer to raise a reasoned objection.
3. International transfers
Processing in the EU/EEA is preferred. Where a sub-processor involves transfers outside the EEA, these rely on valid mechanisms: an adequacy decision or Standard Contractual Clauses (SCC) with supplementary measures where appropriate.
4. Security measures (art. 32)
Encryption in transit (TLS) across the service.
Public endpoints do not accept or store user credentials.
Role-based access control and data minimization: only what is necessary is collected.
Stateless serverless infrastructure at the edge; technical logs without unnecessary personal data and with limited retention.
5. Duration and end of processing
The public API does not start a processor relationship. If a separate integration had a DPA, that agreement would define its duration and the deletion or return of data.
6. Signed DPA and contact
If a separate integration requires processing personal data on behalf of another entity, asigned data processing agreement can be requested before that processing starts. Contact: privacidad@festivos.io.