Privacy policy

1. Controller

The controller responsible for processing personal data on kalender.wiki is:

You can also use this address for all privacy enquiries.

2. Website delivery and server logs

When you request a page, the server and hosting infrastructure processes connection data needed for delivery. This may include the IP address, date and time, requested address including URL parameters, transferred data volume, HTTP status, referrer, browser and operating-system information. This data is used to deliver content, detect faults, prevent attacks and demonstrate secure operation.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is a secure, stable and abuse-resistant website. Article 6(1)(b) GDPR may also apply where processing is directly necessary to provide a function you requested.

Recipients may include hosting, data-centre and technical maintenance providers where used for operation. kalender.wiki does not combine these logs into advertising or user profiles.

3. Calendars, calculators and planners

The calendars, date calculators and planning tools process your choices to calculate and display the requested result. Depending on the tool, this may include country, region, dates, date of birth, working hours, leave periods, locations, shift patterns, calendar name or custom labels. Input is processed during the request and is not stored as a user account or personal profile in the application database.

The legal basis is Article 6(1)(b) GDPR where processing is needed to provide the expressly requested function, and otherwise Article 6(1)(f) GDPR based on our interest in providing the requested tools.

4. Local dashboard preferences

When you choose to save a dashboard selection, your browser stores the selected country, year, optional region and preferred calendar types in localStorage under kalender-wiki-dashboard-{language}. The values remain on your device until you remove them through the reset function or browser settings. There is no automatic expiry.

Storage occurs only following your explicit action and is necessary for the preference feature you requested (section 25(2)(2) TDDDG). Selection values are sent to our server only when you open a link generated from those preferences.

5. Local location search

When you submit the sunrise and sunset location search, our server processes the place name and language to find matching entries in a locally stored place database. The place data originates from the GeoNames data export (CC BY 4.0) and is imported separately by an administrator. Your specific search query is not sent to GeoNames or another external geocoding service.

The input is processed to provide the location search you expressly requested (Article 6(1)(b) GDPR) and is not stored as a user profile in the application database. Like other URL parameters, it may nevertheless appear temporarily in browser history and technical server logs. The application uses the selected local record’s place name, coordinates and time zone; sunrise and sunset are then calculated locally.

6. PDF and ICS downloads; webcal subscriptions

PDF and ICS files are generated server-side from your selections and delivered directly. The underlying parameters may form part of the download address and therefore server logs; the application does not retain a personal copy.

When you open a webcal link, you independently pass the calendar address to the calendar application or cloud provider of your choice. That provider may receive the full URL including preferences and retrieve it repeatedly from kalender.wiki. Its own privacy terms apply to its processing.

7. Public API and embedded widget

Requests to the public calendar API involve the usual connection and log data, and requests are rate-limited to prevent abuse. If another website embeds the kalender.wiki holiday widget, that site's visitors' browsers connect directly to our server. This may process their IP address, time, widget address, browser data and embedding origin as referrer. The operator of the embedding site must inform its visitors about the integration.

Our legal basis is Article 6(1)(f) GDPR; our legitimate interest is securely providing the API and the expressly embedded widget.

8. Contact by email or WhatsApp Business

kalender.wiki does not use a contact form. If you contact us by email or WhatsApp Business, we process your sender address or telephone number, profile details, message content, attachments, timestamps and technical metadata to answer your request. Do not send confidential content or special-category personal data unless it is necessary for your enquiry.

WhatsApp communications additionally use WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. WhatsApp states that personal messages and calls are end-to-end encrypted; it nevertheless processes account, device, connection and usage data and works with other Meta companies, including outside the EEA. WhatsApp is optional and you can contact us by email instead. See the WhatsApp privacy policy for details.

The legal basis is Article 6(1)(b) GDPR for contractual or pre-contractual matters, Article 6(1)(c) for legal duties, and otherwise Article 6(1)(f) based on our interest in appropriate communication. Correspondence is deleted once the matter is concluded unless legal retention duties or evidentiary needs continue to apply.

9. Google CMP, Google AdSense, Google Tag Manager and Google Analytics 4

Google CMP and separate choices

To fund the website, we integrate Google AdSense on approved content pages. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The AdSense code also delivers the Google consent management platform configured under “AdSense → Privacy & messaging”. Google operates this CMP within the IAB Transparency and Consent Framework v2.3 as Google LLC under CMP ID 300.

Google's CMP explains the relevant purposes and vendors and allows you to consent, decline consent or manage individual choices. It can translate your choices into separate Consent Mode v2 signals for ad_storage, ad_user_data, ad_personalization and analytics_storage. It may process your choice and consent status, TCF and Additional Consent signals, timestamp, approximate region and technical device, browser and connection data.

Advertising and analytics consent are evaluated independently. Advertising consent is not analytics consent. Conversely, declining analytics does not automatically prevent every form of advertising.

Google AdSense and possible ad-serving modes

Depending on your choices, Google and participating advertising partners may process IP address, device and browser information, requested page, cookie or similar identifiers, consent signals, ad impressions and interactions. Purposes include ad delivery and measurement, audience measurement, fraud and abuse prevention and—only in line with your choice—personalisation. Where the required consent has been granted, third-party vendors including Google may use cookies to select ads based on previous visits to this or other websites.

Non-personalised ads and Limited Ads are different ad-serving modes. If the choices permit neither personalised nor non-personalised ads, Google may attempt to serve an eligible Limited Ad where the required TCF transparency signals are present. Limited Ads do not use personal data for advertising personalisation; however, the IP address is still processed for technical delivery, and advertising scripts and creatives are transferred to and may be cached by the browser. Declining consent therefore guarantees neither a Limited Ad nor that any ad will be served.

If the optional “Programmatic Limited Ads” feature is enabled in the AdSense account, Google may use cookies, localStorage and Shared Storage solely for invalid-traffic detection and fraud prevention, including on traffic without consent. Use of this optional feature depends on the current AdSense configuration and must be assessed by the operator under the applicable law.

We rely on Article 6(1)(f) GDPR to provide and document the choice-management mechanism, based on our interest in effectively and demonstrably managing privacy choices. Storage strictly necessary to remember the choice relies on section 25(2)(2) TDDDG. Consent-dependent advertising, personalisation, analytics and device-storage access rely on Article 6(1)(a) GDPR together with section 25(1) TDDDG.

Google Tag Manager and Google Analytics 4

We use Google Tag Manager, also provided by Google Ireland Limited, to technically manage and consent-conditionally activate optional services. Tag Manager is not an analytics service in its own right, but loads a container containing rules and tags. The currently published container GTM-TVKGW5JR includes in particular Google Analytics 4 and Google Ads measurement and conversion tags.

For analytics we use Basic Consent Mode: all four signals initially default to “denied” and are updated individually when the CMP choice becomes available. The GTM container is requested only on approved content pages without URL query parameters and only where analytics_storage is reported as granted or not applicable to the request. A denied, unknown or unconfigured analytics status keeps GTM blocked. GA4 is therefore not executed and no cookieless Analytics measurement pings are sent. We do not use a consent-free noscript fallback.

Google Analytics 4 is used for statistical audience and usage analysis. When GA4 is active, Google may process IP address, technical device and browser information, page address and title, referrer, timestamp, approximate region, consent signals, interactions and events, and cookie or similar identifiers. The legal basis is consent under Article 6(1)(a) GDPR together with section 25(1) TDDDG.

The advertising signals are passed to Consent Mode independently of analytics_storage. AdSense ad serving is not controlled by the GTM loader and may therefore continue in line with the advertising choice where analytics has been declined. The Google Ads measurement tags currently present in the GTM container receive the separate advertising signals whenever the container is loaded; they do not control AdSense ad serving.

Changing or withdrawing only the advertising choice leaves the analytics decision unchanged. If analytics is withdrawn after GTM was active on the current page, the integration reloads the page and blocks the container on later visits. You can change your choices for the future at any time through privacy and cookie settings; you can additionally delete previously stored cookies or identifiers through your browser settings.

Further details are available in Google's information about data from partner sites, cookies, advertising, Google ad settings and its privacy policy. The vendors, purposes and retention periods displayed in the consent interface form part of your selection.

10. Recipients and international transfers

Personal data is received only by parties that need it for the purposes described: hosting and IT providers, WhatsApp Ireland and participating Meta companies for WhatsApp communications, the calendar provider you choose for a webcal subscription and—only when the integration is active and in line with your choice—Google for AdSense, Tag Manager, Google Analytics 4 and Google Ads, plus advertising partners listed in the consent interface. Authorities or legal advisers receive data only where legally required or needed to establish, exercise or defend legal claims. Local location search does not send search queries to GeoNames.

Transfers outside the European Economic Area may occur in particular with WhatsApp or Meta, Google and advertising partners. The providers state that, depending on the recipient, they use adequacy decisions, the EU–US Data Privacy Framework and/or EU Standard Contractual Clauses with supplementary safeguards. See Google's legal frameworks for data transfers and the WhatsApp privacy policy linked above.

11. Retention

We retain personal data only for as long as required by the relevant purpose, legal duties or the establishment and defence of claims. In particular:

• Calculator and planner input is processed for the request only; URL parameters may additionally appear in server logs.
• Server logs are deleted through the configured log rotation once no longer needed for operation, troubleshooting and security. Extracts relating to an incident may be retained until it is resolved and potential claims expire.
• Local dashboard preferences remain in your browser until you delete them.
• Email and WhatsApp correspondence is deleted after the matter is completed unless statutory retention periods or evidentiary interests continue; the communication provider's own retention periods also apply to data it controls.
• The CMP choice remains stored until it is withdrawn, collected again, expires under the CMP configuration or is removed with the browser data. External recipients also apply their stated retention periods; Google services use the periods shown in the consent interface and relevant Google settings.

12. Your privacy rights

Subject to the statutory conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18), data portability (Article 20) and objection (Article 21). You may withdraw consent for the future at any time (Article 7(3)). You also have the right not to be subject to a solely automated decision producing legal or similarly significant effects; kalender.wiki does not carry out such decision-making.

To exercise your rights, email info@enetmedia.de. You may also lodge a complaint with a data protection authority, in particular where you live or work or where the suspected infringement occurred. Germany's Federal Commissioner explains complaint routes and supervisory responsibilities.

13. Security, external links and policy changes

We use appropriate technical and organisational measures, including encrypted HTTPS connections, restrictive security headers and separation of internal services. Absolute security of data transmissions over the internet cannot nevertheless be guaranteed.

Fonts, stylesheets and application logic are served locally. We use no analytics independent of Google such as Matomo. Google Analytics 4 is loaded through Google Tag Manager only with approved analytics_storage; Google AdSense and Google's CMP are separate from that gate. We embed no third-party maps, videos or social-media plugins. Ordinary external links transfer data only after you open them. Holiday, school-break and geographic data is imported separately from visitor traffic; these offline imports contain no website visitor input.

We update this privacy policy when features, providers or the legal framework change. The version published on this page is authoritative.