Privacy Policy

This service is operated by Mar&Co Management B.V., registered in the Netherlands, Chamber of Commerce (KvK) number 94664404("Pin the Date", "we", "us", "our"). We are the data controller for the processing described in this policy unless stated otherwise. You can contact us about privacy at hi@pinthedate.com.

This policy explains what personal data we process, why, on what legal basis, who we share it with, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act (UAVG).

Pin the Date is used in two ways, and our role differs between them.

Community calendars. We run free calendars, such as football fixtures, that anyone can add to their own calendar app. For the personal data of people who sign up to these, Pin the Date is the controller. This is the processing most of this policy describes.

Brand accounts.Where an organisation uses Pin the Date to publish its own calendars to its own audience, that organisation is the controller of its subscribers' personal data and we act as its processor, handling that data only on its documented instructions and under a data processing agreement. In that case the organisation's own privacy notice governs, not this one.

When you sign up for a community calendar, Pin the Date is the controller of your personal data. The fixture information in these calendars is publicly available factual schedule data, match dates, times and results, which we compile from third-party sources. We do not create it, and neither we nor anyone else owns the underlying facts, so there is no separate calendar rights-holder involved.

By default we do not share your personal data with clubs, leagues or competition organisers. We do so only with your separate, explicit consent, only for the club whose calendar you chose, and only in the way you opted into. You can withdraw that consent at any time from your private link, and we stop. Until you opt in, your data stays with Pin the Date.

A club or organisation may in time come to run its own calendar through Pin the Date. If that happens for a calendar you follow, that club becomes the controller of sign-ups to it under its own privacy notice, and we act only as its processor (see section 2). We will tell you before any such change affects data you have already given us, and your existing choices stay yours.

The only other recipients of your data are the service providers listed under Sub-processors below, who process it solely on our instructions and may never use it for their own purposes. They are not additional parties who may contact you.

From community subscribers, when you sign up:

• Your email address and your first and last name.
• Your date of birth. Pin the Date includes birthday-related calendar features, so we use it for those, and we also use it to make sure marketing is not sent to under-16s (see Children below).
• The community calendars, such as clubs, that you choose to sync.
• If you opt in to marketing, or to the separate club-connect option, a consent record for each: the fact and time of your opt-in, the version of the consent wording you agreed to, and the sign-up IP address, which we one-way hash before storage so it cannot be read back.

Your email address, name, date of birth, and the calendars you pick are all needed to set up the service. Marketing is optional, and the service works without it.

Automatically, as the service runs: we log when your calendar feed is fetched and when tracked links are clicked, for security and for aggregate, non-identifying statistics. Where we derive coarse location, such as country, we do so from your IP at the time of the request and keep only the region. IP addresses are stored only in one-way hashed form, never raw.

From brand-account operators: name, email, organisation details and the authentication data needed to run the account.

When you sync a calendar, we generate a private feed address containing a long, random, unguessable token (a version-4 UUID). Your calendar app uses it to fetch updates. Anyone holding that address can view the calendar it points to and use it to manage or delete your subscription, so treat it as private. The feed itself carries only public event information, never your name, email or other personal details.

To provide the calendar you asked for, by creating and keeping your feed in sync. Legal basis: our legitimate interest in providing the calendar sync you asked us to set up (GDPR Article 6(1)(f)), which we act on at your request.

To send you marketing, only if you opt in. Legal basis: your consent (Article 6(1)(a)). We confirm your email with a one-time code, a double opt-in, so your consent is verifiable, and we record the wording you agreed to and when. You can withdraw at any time, which does not affect processing carried out before withdrawal.

To connect you with a club, if you choose it, we may share your details with the club behind a calendar you follow, only where that club has partnered with us and only on your separate, explicit opt-in, which is distinct from the marketing opt-in. Legal basis: your consent (Article 6(1)(a)), which you can withdraw at any time from your self-service page.

To offer birthday-related calendar features, which are part of Pin the Date and use your date of birth. Legal basis: our legitimate interest in providing the features you signed up for (Article 6(1)(f)).

To protect younger users, we offer marketing only to people who confirm they are 16 or over, and where a date of birth is given we use it to double-check this. Legal basis: our legitimate interest in not marketing to children (Article 6(1)(f)), reflecting the age-of-consent rule in Article 8 GDPR and Dutch law.

To keep the service secure and to measure it through hashed, aggregate analytics. Legal basis: our legitimate interest (Article 6(1)(f)) in protecting and improving the service, balanced against your rights by the fact that we hash IP addresses and report only in aggregate.

To comply with the law, where we must keep or disclose data to meet a legal obligation (Article 6(1)(c)).

We do not sell personal data, and we do not use it for automated decisions that produce legal effects for you.

Marketing is off unless you turn it on, and neither opt-in box at sign-up is pre-ticked. In our own marketing, where a message includes an offer from a partner, we send it on the partner's behalf and the partner does not receive your details. The one case where a club does receive your details is the separate club-connect option described in section 3, and only if you opt into it. These are two distinct choices, each optional and each withdrawable at any time using the unsubscribe link in every message or from your self-service page.

Marketing is available only to people aged 16 and over. Where your date of birth shows that you are younger, we do not send marketing and we record no marketing consent, as explained under Children.

The community calendars are intended for people aged 16 and over, which is the age of consent for information society services under the UAVG.

Marketing is offered only to people aged 16 and over. We use the date of birth given at sign-up to check this, and if it shows you are under 16 we block marketing and record no marketing consent, even if the box was ticked. A child's consent to marketing is only valid with the authority of a person holding parental responsibility, so we do not rely on it. You can still add the free calendar you asked for.

We do not knowingly process a child's personal data for any purpose that requires consent without that parental authority. If we learn that we hold a child's data without the required consent, we will erase it. If you believe a child has provided us their data, contact hi@pinthedate.com and we will act promptly.

We use the following service providers, each under a data processing agreement:

• Hetzner Online GmbHApplication and database hosting, in the EU (Germany)
• ResendSending transactional email, including the sign-up verification code and confirmations (US, under the EU-US Data Privacy Framework)

We will update this list before adding a new sub-processor. When paid brand accounts become available, a payment processor will be added here.

Application and database hosting is in the EU, so no international transfer arises there. Our email provider, Resend, is in the United States and is certified under the EU-US Data Privacy Framework, which we rely on as the primary safeguard, with the European Commission's Standard Contractual Clauses and additional measures as a fallback. A copy of the relevant safeguards is available on request at hi@pinthedate.com.

We keep your personal data for as long as you have an active subscription and for as long as we need it for the purposes above. When you delete your data, your identity and your feed are removed. Aggregate statistics that can no longer identify you may be retained. We may keep limited records for longer where the law requires it.

To put concrete limits on this: if you begin a sign-up but never confirm it, we delete those details within 30 days. If you unsubscribe or your account becomes inactive, we remove your personal data after 18 months. Active subscribers are kept for as long as the subscription lasts. These clean-ups run automatically.

You have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data erased;
• restrict our processing;
• object to processing based on our legitimate interest, including the calendar delivery and analytics described above;
• data portability, receiving your data in a structured, machine-readable format;
• withdraw consent at any time, without affecting processing before withdrawal.

Community subscribers can exercise most of these directly from a self-service page. From it you can change the calendars you sync, download a full export of your data, unsubscribe, and permanently delete everything we hold about you. You can reach that page from the Manage your calendar link in our footer, where you paste the calendar link from your calendar app, or directly from the private link shown to you when you sign up. For anything else, email hi@pinthedate.com and we will respond within the time the GDPR allows.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or the supervisory authority where you live.

We use appropriate technical and organisational measures, including encryption in transit, one-way hashing of IP addresses, unguessable per-subscriber feed tokens, and access controls. No system is perfectly secure, but we work to protect your data and to meet our breach-notification duties under the GDPR.

The public site and the community calendars set no tracking, analytics or advertising cookies. See our cookie policy for the detail.

We version this policy and show the version and effective date at the top. If we make a material change to how we use your data, we will tell you before it takes effect, for example by email or a notice on the site.

For any privacy question or request, email hi@pinthedate.com. If you are not satisfied with our response, you may contact the Autoriteit Persoonsgegevens.