Privacy and cookies

How festivos.io handles personal data, under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). In short: we collect the minimum and we do no advertising tracking.

1. Data controller

2. What data we process and why

• Technical browsing data (IP address, user agent, access logs): processed by our infrastructure provider to deliver the service, ensure its security, prevent abuse (e.g. API usage limits) and produce aggregated traffic statistics via cookieless analytics (Cloudflare).
• Contact data: if you email us, we process your address and the content of your message to handle your enquiry.
• Holiday page ratings: if you rate a page (1–5 stars), we store only aone-way visitor hash (derived from IP and user agent with a salt; the raw IP is never kept), the score and the page slug. This feature uses no cookies; browser local storage only remembers your last score on that device. Purpose: improve content. Legal basis: legitimate interest (art. 6.1.f) and consent-by-action when you vote (art. 6.1.a).
• Chat assistant (holidays): if you use the chat or voice mode embedded on festivos.io, we process the content of your messages and, if you enable the microphone, audio converted to text, to answer about Spanish working calendars and public holidays. Processing is done by an AI assistant and, when needed, a human operator.We do not ask for health data or other special categories (GDPR art. 9); please do not send them. Conversations are kept as long as needed to provide the service and for security; you may exercise your rights as described below.

We do not build commercial profiles nor make automated decisions with legal effects on you. The assistant replies automatically from your messages and our public holiday data; it does not produce legal effects or profile you.

3. Legal basis

• Legitimate interest (art. 6.1.f GDPR): service security, abuse prevention and aggregated traffic analytics.
• Consent (art. 6.1.a): when you contact us voluntarily; when you accept the chat-assistant notice; or for non-essential cookies, should any be used.
• Legal obligation (art. 6.1.c): compliance with accounting and tax obligations where applicable.

4. Retention

We keep data only as long as needed for the purpose that justifies it: technical logs for short periods for security; contact data while we handle your enquiry; chat-assistant conversations as long as needed to provide the service and for security.

5. Recipients and transfers

We do not sell or share your data. Only providers acting as data processors access it (e.g. infrastructure, CDN and analytics —Cloudflare—; the chat-assistant platform and AI / voice model providers; and email), under contract and with GDPR safeguards. Where a provider involves international transfers, these rely on valid mechanisms (standard contractual clauses or an adequacy decision). The list of sub-processors is in the Data Processing Agreement (DPA).

6. Your rights

You may exercise the rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent, by writing to privacidad@festivos.io. If you believe your request was not properly handled, you may lodge a complaint with the Spanish Data Protection Agency (aepd.es).

7. Cookies

festivos.io uses no tracking or advertising cookies. Our traffic analytics (Cloudflare) is aggregated and uses no cookies, so it does not require your prior consent. Only strictly necessary cookies or local storage for the site to work (e.g. preferences, security, or recording that you accepted the chat notice) might be used; these technical stores are exempt from prior consent. Local storage used to remember your rating of a holiday page is technical (a device preference) and is not a tracking cookie. If analytics or third-party cookies are added in the future, we will ask for your consent via a notice and update this policy.

Last updated: September 2026.

Legal notice →