Privacy notice

Who is responsible?

The controller is Bank Holidays UK (bankholidays-uk.co.uk). We are based in the Netherlands and do not have an establishment in the United Kingdom.

For questions about privacy or to exercise your rights, use the contact form.

When you visit the website

To display the website, our hosting provider Vercel Inc. processes technical data such as your IP address, browser type, the page requested and the time of your visit. This is needed to deliver the site, investigate faults and prevent abuse. These server logs are kept for a short time and are not used to track you. Lawful basis: our legitimate interest in a secure, working website (Article 6(1)(f) UK GDPR).

Statistics (Google Analytics)

With your consent, we use Google Analytics 4 to understand how the site is used, for example which pages are visited most. Google Analytics then sets cookies and processes data about your device and your visit. Google Analytics does not store IP addresses.

If you do not consent, Google Analytics does not set any cookies. Through Google Consent Mode, only anonymous signals without identifiers are sent, which Google uses to estimate overall usage.

Lawful basis: your consent (Article 6(1)(a) UK GDPR), as required for cookies under the Privacy and Electronic Communications Regulations (PECR). You can withdraw your consent at any time using the cookie settings on our cookie page. Data in Google Analytics is kept for a maximum of 14 months.

Advertising (Google AdSense)

We show adverts through Google AdSense. To ask for your consent, we use Google's consent message (Privacy & messaging), which works under IAB Europe's Transparency & Consent Framework.

If you consent, Google and its advertising partners may use cookies and similar technologies to show and measure adverts and to tailor them to your interests. If you do not consent, you will only see limited, non-personalised adverts.

Lawful basis: your consent (Article 6(1)(a) UK GDPR and PECR). You can read more about how Google uses data at policies.google.com/technologies/partner-sites.

When you use the contact form

If you send us a message, we process your name, email address and message in order to answer your question. To prevent spam and abuse, Cloudflare Turnstile checks that the form is being filled in by a person; this involves processing technical data from your browser, without tracking cookies. We only store your IP address in encrypted form (as a hash), to stop anyone from using the form in bulk.

Lawful basis: our legitimate interest in answering questions and preventing abuse (Article 6(1)(f) UK GDPR). Messages are deleted automatically after 12 months; messages identified as spam after 30 days.

Who we share data with

We do not sell personal data. We work with the following processors and partners: Vercel Inc. (hosting), Convex, Inc. (database for contact messages), Cloudflare, Inc. (protecting the contact form) and Google (statistics, advertising and consent management). We have agreements with our processors covering security and confidentiality.

Some of these companies are based in the United States. Transfers take place under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge) or under standard contractual clauses together with the UK International Data Transfer Addendum.

Security

The website can only be reached over an encrypted connection (HTTPS). Access to contact messages is limited to the administrators who need it, and every time a message is viewed in the admin area, this is logged.

Your rights

You have the right to access, correct and erase your data, the right to restrict or object to its processing and the right to data portability. You can withdraw your consent at any time; this does not affect processing carried out before then. Send your request using the contact form; we will respond within one month.

We do not make decisions based solely on automated processing.

Making a complaint

If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

Changes

We update this notice when the way we work changes. The date at the top shows when it was last updated.