Privacy Policy

Effective Date: 3 September 2026
Last Updated: 22 October 2026
Version: 1.5

---

1. Introduction and Scope

1.1. This Privacy Policy explains how Péter Cselőtei, the developer and operator of Prime Calendar (also called PrimeCal) (the "Operator", "we", "us", "our"), collects, uses, discloses, transfers, retains and protects personal data in connection with the Prime Calendar application at app.primecal.eu, the website at www.primecal.eu, and the associated applications and application programming interfaces (together, the "Service").

1.2. This Privacy Policy is issued in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR"), the UK GDPR and the Data Protection Act 2018 where applicable, and applicable national implementing legislation.

1.3. This Privacy Policy does not apply to:

• (a) the processing of payment, billing, invoicing, taxation and payment-fraud data carried out by Paddle, which acts as an independent data controller in respect of that processing (see Section 3);
• (b) the processing carried out by any Upstream Provider to which your Inputs are transmitted, each of which applies its own privacy notice and retention practices (see Section 7); or
• (c) any third-party website, application or service that you access via a link from the Service.

1.4. Capitalised terms not defined in this Privacy Policy bear the meanings given to them in the Terms of Service, of which this Privacy Policy forms an integral part, with one exception: in this Privacy Policy, "Inputs" never includes Google user data or any other data obtained from a connected calendar account. Google user data is governed exclusively by Section 4A, and nothing said here about Inputs, Outputs or Upstream Providers applies to it.

---

2. Identity and Contact Details of the Controller

Data Controller: Péter Cselőtei (Prime Calendar)
Budapest, Hungary
Contact for privacy matters: info@primecal.eu

All requests concerning your personal data, including the exercise of the rights described in Section 11, should be addressed to info@primecal.eu with the subject line "Data Protection Request".

Where we are required to designate a representative in the European Union or the United Kingdom pursuant to Article 27 GDPR, the identity and contact details of that representative are published on our website alongside this Privacy Policy.

---

3. Allocation of Data Protection Roles — Critical Distinction

The Service involves multiple independent actors. It is essential to understand which entity is responsible for which category of data.

3.1. Paddle as Independent Controller of Financial Data

Paddle.com Market Ltd and/or the relevant Paddle affiliate ("Paddle") acts as our Merchant of Record and as the seller of record for every purchase transaction. In that capacity:

• Paddle is an independent data controller in respect of all payment, billing, invoicing, taxation, fraud-screening, refund and chargeback data. Paddle is not our processor for that data, and we do not determine the purposes or means of Paddle's processing of it.
• Paddle determines its own lawful bases, retention periods and security measures for that data, and applies its own privacy notice, which you accept when you complete checkout.
• Requests to access, rectify, erase, restrict, port or object to the processing of payment and billing data must be directed to Paddle, not to us. We will assist by signposting you to Paddle, but we cannot action such requests on Paddle's behalf and we have no ability to alter Paddle's records.

3.2. No Payment Card Data on Our Systems

We do not collect, receive, process, store, transmit, log, cache or otherwise have access to your payment card number, card verification value, expiry date, cardholder data, bank account number, IBAN, or any other payment instrument data. At no point does such data traverse, or come to rest upon, any server, database, log, backup or endpoint operated or controlled by Péter Cselőtei (Prime Calendar).

The payment interface presented to you is rendered and operated by Paddle. Payment credentials are captured directly by Paddle within Paddle's own environment.

From Paddle we receive only the following limited, non-financial transaction metadata, for the sole purpose of provisioning and administering your entitlement to the Service:

• a Paddle-generated transaction, customer and subscription identifier;
• the email address associated with the purchase;
• the product, plan or add-on purchased, and the quantity;
• the subscription status (active, past due, paused, cancelled, refunded) and the next billing date;
• the currency and gross amount, for reconciliation and entitlement purposes only; and
• the country of the buyer, as declared to Paddle, for the purposes of applying regional entitlements and legal notices.

3.3. Stripe, where a business customer takes payment from its own customers

Where you operate an organisation within the Service and enable the taking of payment at the moment a booking is made, a connected account is opened for that organisation with Stripe, and payment is taken from your own customer on a payment page hosted by Stripe.

• Stripe determines the means and purposes of the processing of the payment data, of the identity and verification data it collects during onboarding, and of the associated fraud-prevention data. In respect of that data Stripe acts as an independent controller and its own privacy notice applies.
• You, as the operator of the organisation, are the controller in respect of your own customer's booking data.
• We receive and store only what is needed to record whether a booking has been paid: the checkout session reference, the payment reference, the amount, the currency and the payment status. Section 3.2 applies equally to this route: no payment instrument data reaches our systems.

---

4. Categories of Personal Data We Collect

4.1. Data you provide directly

• Account identity data: name or display name, email address, password (stored only as a salted cryptographic hash, never in plaintext or reversible form).
• Profile and preference data: language, locale, time zone, display and notification preferences, and any optional profile information you choose to supply.
• Authentication data: multi-factor authentication secrets, recovery codes, session tokens, and, where you use single sign-on, the identifiers returned by your identity provider.
• Credentials you supply for third-party integrations: where the Service permits you to connect your own third-party accounts or supply your own API keys, we store those credentials encrypted at rest and use them solely to execute the operations you request.
• Support and correspondence data: the content of tickets, emails and messages you send us, and our replies.
• Inputs: the content you submit to the Service for processing (see Section 6).

4.2. Data we collect automatically

• Technical and device data: IP address, browser type and version, operating system, device type, screen dimensions, language headers and referring URL.
• Usage and telemetry data: pages and features accessed, actions performed, timestamps, session duration, request counts, quota consumption, error events and performance metrics.
• Security and audit data: authentication events, failed login attempts, IP addresses associated with sessions, administrative actions, and records maintained for abuse prevention and forensic purposes.
• Cookies and similar technologies: see Section 12.

4.3. Data we receive from third parties

• From Paddle: the transaction metadata enumerated in Section 3.2.
• From identity providers: where you authenticate via a third-party single sign-on provider, the identifier, email address and basic profile fields that provider releases to us in accordance with your authorisation.
• From security and anti-abuse providers: reputation signals concerning IP addresses, domains or devices, used solely for fraud and abuse prevention.

4.4. Data we do not want and ask you not to submit

We do not require, and expressly ask you not to submit through the Service, any of the following unless expressly agreed with us in writing under a separate data processing agreement:

• special categories of personal data within the meaning of Article 9 GDPR (data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of unique identification, data concerning health, or data concerning a person's sex life or sexual orientation);
• personal data relating to criminal convictions and offences (Article 10 GDPR);
• payment card data or full financial account credentials;
• government-issued identification numbers; and
• data concerning children, save only for the limited, guardian-supervised Kid Mode use described in Section 14.1A — the Kid Mode usage data generated when a guardian enables that feature (for example, a timestamp recorded when a child marks a task done) is the guardian's own Account data, not the kind of unsolicited third-party child data this Section 4.4 is intended to discourage.

If you submit such data notwithstanding this request, you do so on your own responsibility and warrant that you have a valid lawful basis for doing so.

This request does not apply to events synchronised from a connected calendar account. A calendar naturally holds entries such as a medical appointment or a religious holiday, and Prime Calendar receives them only because you asked it to synchronise that calendar. We process them only to provide the features you use (Section 4A), and we never analyse them to infer anything about you. It also does not apply to Kid Mode usage data, which is addressed in Section 14.1A.

4.5. Data from connected external calendar accounts

Where you use External Sync to connect a Google or Microsoft calendar account, we additionally process:

• Authorisation data: the access token and refresh token issued to us by that provider, the identifier and email address of the connected account, and the expiry and status of the authorisation. Tokens are stored encrypted at rest and are used solely to perform the synchronisation you have configured.
• Calendar content: for each event in the calendars you select, the title, description, location, start and end times and time zone, recurrence, reminder settings, the organiser, and the attendee list.
• Synchronisation metadata: the mapping between an event in the Service and the corresponding event at the provider, together with timestamps, synchronisation status and error records needed to keep the two in step and to avoid duplication.

Calendar content routinely contains personal data relating to other people — the organisers and attendees of your meetings, who are not our users. You determine which calendars are synchronised, and you are responsible for having a lawful basis for the inclusion of those people's data in the Service.

---

4A. Google User Data and Limited Use

This section is the complete statement of how Prime Calendar handles data it receives from Google. Where anything elsewhere in this Privacy Policy, or in the Terms of Service, appears to permit a broader use, disclosure or transfer of Google user data, this section governs and the narrower rule applies. Everything in this section applies equally to Google user data in its original form and to any data aggregated, anonymised or derived from it.

Limited Use. Prime Calendar's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4A.1. What Google user data we access

• Google Sign-In (if you choose to sign in with Google): your Google account identifier, email address, name and profile picture.
• Google Calendar, under the https://www.googleapis.com/auth/calendar scope, only if you connect a Google account through External Sync: the identifiers and names of the calendars you select, and for each event in them the title, description, location, start and end times, time zone, recurrence, reminders, organiser and attendees (participants), together with the OAuth access and refresh tokens Google issues to us.

We access only the Google data strictly necessary to provide Prime Calendar's scheduling features, and nothing else from your Google account. Availability is calculated from the events listed above; we do not request Google's separate free/busy data.

4A.2. How we use it — only to provide the features you use

We use Google user data only to provide and improve the user-facing features of Prime Calendar that you have chosen to use:

• Google Sign-In data — to create your account, sign you in and show your name in the app.
• Google Calendar data and OAuth tokens — to connect your Google Calendar account and maintain that connection; to synchronise events and keep Prime Calendar and Google Calendar in step in the direction you configure; to display your events and your availability; to create, update and delete events, including events for the bookings you manage in a connected calendar; to send you the reminders you set on those events; and to run the features you yourself apply to them, such as conflict checks, search, scheduling and the automation rules you create.
• To keep those features secure and working: preventing abuse, and diagnosing a fault you report or that affects the synchronisation.

We do not use Google user data for any other purpose. In particular, we never use Google user data for:

• targeted advertising;
• selling to data brokers;
• providing to information resellers;
• determining credit-worthiness;
• lending purposes;
• user advertisements;
• personalized advertisements;
• retargeted advertisements;
• interest-based advertisements;
• ad personalization or audience profiling;
• sale, rental or licensing of the data;
• creating databases, or building or improving general-purpose datasets; or
• training non-personalized AI and/or ML models.

Nor do we use it for analytics, profiling, marketing, research, or product development beyond the user-facing features described above, or for any other purpose not listed in this section.

AI and machine learning. Google Workspace APIs are not used to develop, improve, or train non-personalized AI and/or ML models. We do not use Google user data to develop, improve, train, fine-tune, evaluate or benchmark any artificial intelligence or machine learning model of any kind, and we have no model or training pipeline of our own.

4A.3. Who receives Google user data, and why

Google user data is disclosed only to:

1. Our hosting providers, acting as our processors under Article 28 GDPR: Microsoft Azure, which runs the Service, and our database hosting provider in Hungary, which stores its data.

2. Google itself, when the Service writes your changes back to your Google Calendar.

3. Our email and push-notification delivery providers, acting as our processors, solely to deliver a reminder or notification you have asked for (for example, the title and time of the event a reminder is about).

   The service providers in points 1 and 3 may access Google user data only on our documented instructions, only when strictly necessary to provide Prime Calendar's scheduling features, and for no purpose of their own.

4. Recipients you choose, only with your consent, in features that are visible in the app and that you switch on yourself. Switching the feature on is the consent, and switching it off withdraws it:

   • other Prime Calendar users with whom you share a calendar;
   • a web address you enter in an automation rule you create, if you choose to include event details; and
   • an AI assistant you connect to your own account through the Prime Calendar MCP integration. This is off by default. An assistant receives events synced from Google only after you grant it that specific permission; you can revoke it at any time, and each disclosure is logged. The assistant receives only what it asks for through the tools you have allowed it to use, in order to answer your own requests. We do not choose the assistant or its provider, and it is not one of our Upstream Providers.

5. Authorities, where we are required to by applicable law, or to establish, exercise or defend legal claims.

6. A successor, as part of a merger, acquisition or sale of assets of the developer, and only after obtaining your explicit prior consent. Any Google user data transferred this way remains subject to the same Limited Use restrictions and may be used only to continue providing Prime Calendar's user-facing features.

We do not transfer or disclose Google user data to third parties for any purpose other than those listed above. In particular, we never transfer Google user data for:

• targeted advertising;
• selling to data brokers;
• providing to information resellers;
• determining credit-worthiness;
• lending purposes;
• user advertisements;
• personalized advertisements;
• retargeted advertisements;
• interest-based advertisements; or
• training generalized machine-learning (ML) or artificial intelligence (AI) models.

Google user data is never disclosed to our Upstream Providers, to analytics or marketing providers, to advertising platforms, to data brokers or to information resellers.

4A.4. Human access

Prime Calendar's administrators do not view the content of your events, including events synchronised from Google. The content can be reached only through direct access to the database, which only the operator holds, and is accessed only:

• with your affirmative agreement to view specific data (for example, when you ask support to look at a particular event);
• where it is necessary for security purposes, such as investigating abuse or a bug;
• where it is necessary to comply with applicable law; or
• where the data has been aggregated and is used for internal operations, in accordance with applicable privacy law.

Each such access is recorded.

4A.5. How we protect it

Security procedures are in place to protect the confidentiality of your data. Google user data travels over TLS between your browser and the Service, and between the Service and Google. OAuth access and refresh tokens are encrypted with AES-256-GCM before they are stored, and are used only by the synchronisation service. Google user data is stored in the European Union: the Service runs on Microsoft Azure in its North Europe region, and its database is hosted in Hungary. Access to the systems that hold Google user data is restricted to the operator, and administrative actions are recorded in an audit log.

4A.6. Retention and deletion

We keep Google user data only for as long as it is needed to provide the features you use, and delete it when that need ends.

• OAuth tokens are kept only while your Google Calendar connection is active. They are deleted as soon as you disconnect the Google account in Prime Calendar, and are deleted together with your account if you delete it. Either way, Prime Calendar stops accessing your Google Calendar from that moment. If you instead revoke access at Google, the stored tokens stop working at once and are deleted when you disconnect the account or delete your account.
• Synchronisation records are deleted with the connected account.
• Events already synchronised remain in your Prime Calendar account until you delete them, or until your account is deleted, after which they are erased within 30 days (backups within a further 35 days).
• The only exception to these periods is data we are required by law to keep.
• You can revoke Prime Calendar's access at any time at Google account permissions, and ask us to delete your data at info@primecal.eu.

4A.7. Changes to how we use Google user data

If we ever change how Prime Calendar uses Google user data, we will update this section and tell you in the app and by email before the change takes effect. No new use will be applied to Google user data already obtained without your consent.

---

5. Purposes of Processing and Lawful Bases

Legitimate interests balancing. Where we rely on Article 6(1)(f), we have carried out a balancing assessment and concluded that our legitimate interests are not overridden by your interests or fundamental rights and freedoms. You may request a summary of that assessment, and you may object to such processing, at info@primecal.eu.

Google user data. The table above describes the Service as a whole. Google user data is used only as set out in Section 4A — to provide and improve the features you use — and for no other purpose in this table.

---

6. Inputs, Outputs and Transmission to Upstream Providers

6.1. The Service is a pass-through and orchestration layer. To deliver the functionality you request, we transmit your Inputs to one or more Upstream Providers, and we receive and display the resulting Outputs.

6.2. By submitting an Input, you instruct and authorise us to transmit that Input to the relevant Upstream Provider or Providers, which may be located in a country other than your own. This transmission is necessary for the performance of our contract with you (Article 6(1)(b) GDPR).

6.3. Once an Input reaches an Upstream Provider, that provider processes it in accordance with its own terms, privacy notice, retention schedule and security posture, over which we exercise no control. We are not able to guarantee, and do not represent, that any Upstream Provider will delete, restrict, anonymise or refrain from retaining your Inputs.

6.4. You should not submit any confidential, proprietary, sensitive or personal information that you would not be prepared to disclose to a third-party processor located outside your jurisdiction.

6.5. Where a business customer submits Inputs containing personal data relating to that customer's own data subjects, that customer is the controller and we act as processor. In that case, the customer is responsible for establishing the lawful basis, providing notice to data subjects, and concluding a data processing agreement with us pursuant to Article 28 GDPR.

6.6. Connected calendar accounts are not Upstream Providers. Sections 6.1 to 6.5 govern Inputs submitted for processing by an Upstream Provider. They do not apply to data synchronised to or from a connected Google or Microsoft calendar account. That synchronisation is a direct, bilateral exchange between the Service and the provider you have authorised, carried out only to the extent and in the direction you configure. It is two-way: where you enable it, the Service creates, updates and deletes events in the connected calendar as well as reading from it.

6.7. Google API Services — Limited Use. Prime Calendar's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Section 4A sets out in full what we access, how we use it, who receives it, and what we never do with it.

6.8. Microsoft Graph. Data obtained through the Microsoft Graph API under the Calendars.ReadWrite and User.Read permissions is used solely to deliver the synchronisation features you have enabled, is requested on a least-privilege basis, and is not used for advertising, sold, or used to train models. Our access is subject to the Microsoft APIs Terms of Use and to the permissions you granted.

6.9. Withdrawing access. You may disconnect a calendar account at any time within the Service, which deletes the tokens stored for that account. You may additionally, and independently, revoke our access with the provider itself — for a Google account at Google account permissions, and for a personal Microsoft account at Microsoft account app consents; access granted from a work or school Microsoft account is managed by that organisation's administrator. Section 10.5 explains what happens to data already synchronised.

---

7. Recipients and Categories of Recipients

We disclose personal data to the following categories of recipient, in each case limited to what is necessary for the stated purpose:

7.1. Every processor engaged by us is bound by a written contract satisfying Article 28(3) GDPR, imposing obligations of confidentiality, security, sub-processor control, assistance and deletion or return of data. A service provider may access Google user data only when strictly necessary to provide Prime Calendar's scheduling features, and only under our instructions (Section 4A.3).

7.2. A current list of our sub-processors is available on request at info@primecal.eu. We will endeavour to give notice of the addition of a new sub-processor, but reserve the right to substitute an Upstream Provider without notice where operationally necessary in accordance with the Terms of Service.

7.3. We do not sell personal data, and we do not share personal data for cross-context behavioural advertising.

7.3a. Google user data is disclosed far more narrowly than this table: only to the recipients listed in Section 4A.3, and never to Upstream Providers, analytics or marketing providers, advertising networks, data brokers or information resellers.

7.4. Endpoints you enable yourself. Where you create an automation rule with a webhook trigger, the Service exposes a public, token-authenticated endpoint at which it receives whatever you or a third party send to it, and treats it as an Input. You are responsible for keeping that webhook token confidential and for the lawfulness of the data sent to it.

---

8. Artificial Intelligence Processing and Model Training

This section is provided in the interests of full transparency and constitutes an important disclosure.

8.0. Google and Microsoft calendar data is excluded from everything in this section

Google Workspace APIs are not used to develop, improve or train generalised or non-personalised AI and/or ML models. We do not use Google user data — including Google Calendar data obtained under the https://www.googleapis.com/auth/calendar scope — to develop, improve, train, fine-tune, evaluate or benchmark any artificial intelligence or machine learning model, and it is never transmitted to an Upstream Provider. The same applies to data obtained from the Microsoft Graph API.

The only way Google Calendar data can reach an AI system is the one you control yourself: an AI assistant you connect to your account through the Prime Calendar MCP integration, and only after you explicitly grant it permission to read events synced from Google (Section 4A.3). That permission is off by default and can be revoked at any time.

The remainder of this Section 8 concerns Inputs — material you type or submit to the Service yourself for processing by an Upstream Provider. It does not apply to Google user data or to any other connected calendar data (Section 1.4).

8.1. Our own use of your data for model training

We do not use your Inputs, Outputs or Account data to train, fine-tune, or develop any artificial intelligence or machine learning model of our own. We have no proprietary model and no training pipeline.

8.2. Upstream Provider use of your data for model training

We are a pass-through layer. Your Inputs are transmitted to Upstream Providers, and whether those Inputs are used for model training, evaluation, abuse monitoring or product improvement is determined by each Upstream Provider under its own terms, not by us.

Our policy is as follows:

• Where an Upstream Provider offers a commercial, enterprise or API tier under which customer data is contractually excluded from model training by default, we procure and use that tier. For the principal Upstream Providers on which the Service depends, we rely upon the provider's standard commercial API terms, under which submitted data is not used to train or improve that provider's general-purpose models.
• We cannot and do not guarantee this outcome. Upstream Providers may unilaterally alter their terms, data-use policies or default settings at any time, with or without notice. We do not control, audit or verify their internal practices.
• Certain Upstream Providers retain submitted data for a limited period for the purposes of abuse monitoring, safety review, legal compliance or service operation, notwithstanding any exclusion from model training. Such retention typically involves the possibility of human review of flagged content.
• Where the Service exposes a feature designated as experimental, free, community or consumer-tier, data submitted through that feature may be subject to less restrictive Upstream Provider terms, including use for model training. Such features are labelled accordingly at the point of use.

8.3. Your controls and opt-out

• Account-level control: where the Service exposes a setting governing data retention, telemetry, analytics or optional data sharing, you may exercise that setting at any time in your account settings. Changes take effect prospectively.
• Objection: you may object at any time to processing based on our legitimate interests, including product analytics, by contacting info@primecal.eu.
• The most effective control is at the point of submission. Because the transmission of Inputs to Upstream Providers is inherent to the Service and is necessary for the performance of the contract, the only complete means of preventing an Input from reaching an Upstream Provider is not to submit it. We invite you to exercise data minimisation in what you submit.
• Enterprise customers may request that we route their traffic exclusively through Upstream Provider tiers offering zero-retention or contractual no-training commitments, subject to availability, feasibility and commercial terms. Enquiries to info@primecal.eu.

8.4. Automated decision-making

We do not carry out automated decision-making producing legal effects concerning you or similarly significantly affecting you within the meaning of Article 22(1) GDPR. Outputs generated by Upstream Providers are informational and are not applied by us to make any determination about you. Automated processes are used only for security, abuse prevention, quota enforcement and fraud detection; where such a process results in account suspension, you may request human review by contacting info@primecal.eu.

8.5. Connected calendar data

Data synchronised from a connected Google or Microsoft calendar account is never used to train, fine-tune or evaluate any artificial intelligence or machine learning model, and is never transmitted to an Upstream Provider. It is used only to provide the features you use, as set out in Section 4A.

---

9. International Transfers of Personal Data

9.1. The Service is inherently international. Personal data, including Inputs, is transferred to and processed in countries outside the European Economic Area and the United Kingdom, including the United States, wherever our Upstream Providers, hosting providers and sub-processors operate.

9.2. Where we transfer personal data outside the EEA or the United Kingdom, we rely on one or more of the following transfer mechanisms:

• an adequacy decision of the European Commission or the UK Secretary of State pursuant to Article 45 GDPR (including, where applicable, the EU–US Data Privacy Framework and the UK Extension thereto, in respect of certified recipients);
• Standard Contractual Clauses adopted by the European Commission pursuant to Article 46(2)(c) GDPR, together with the UK International Data Transfer Addendum where applicable, supplemented by a transfer impact assessment and, where appropriate, supplementary technical and organisational measures; or
• a derogation under Article 49 GDPR, in particular Article 49(1)(b) (transfer necessary for the performance of a contract concluded in the interest of the data subject), where no other mechanism is available and the transfer is necessary to deliver the functionality you have requested.

9.3. Paddle determines its own transfer mechanisms in respect of payment and billing data as an independent controller.

9.4. You may request a copy of the safeguards applicable to a given transfer, redacted as necessary for commercial confidentiality, by writing to info@primecal.eu.

9.5. Hosting. The Service is hosted on Microsoft Azure. In that capacity Microsoft acts as our processor under Article 28 GDPR, on the terms of its data protection addendum, and any transfer outside the European Economic Area or the United Kingdom arising from that hosting is covered by the mechanisms described in Section 9.2.

---

10. Data Retention

10.1. We retain personal data only for as long as is necessary for the purposes for which it was collected, subject to the following indicative schedule:

10.2. Retention by Paddle of payment, invoice and tax records is determined solely by Paddle in accordance with its own retention policy and applicable financial and tax legislation, which commonly requires retention for seven (7) to ten (10) years. We cannot shorten or override that period.

10.3. Retention by Upstream Providers of Inputs transmitted to them is determined solely by each such provider. We cannot compel deletion from an Upstream Provider's systems.

10.4. We may retain personal data beyond the periods above where necessary to comply with a legal obligation, to respond to a lawful request from a competent authority, or to establish, exercise or defend legal claims.

10.5. Connected calendar accounts. The tokens for a connected calendar account are deleted when you disconnect it, or when the authorisation is revoked at the provider or otherwise ceases to be valid. Events already synchronised into the Service remain in your account as ordinary Service data, subject to the periods set out above, until you delete them: disconnecting an account stops further synchronisation but does not retrospectively remove what has already been synchronised. We cannot delete data held in your Google or Microsoft account — that remains under your control with the provider.

---

11. Your Rights as a Data Subject

11.1. Subject to the conditions and exceptions in applicable data protection law, you have the following rights:

• Right of access (Art. 15 GDPR) — to obtain confirmation of whether we process your personal data, a copy of that data, and the supplementary information set out in Article 15.
• Right to rectification (Art. 16) — to have inaccurate personal data corrected and incomplete data completed.
• Right to erasure (Art. 17) — to have your personal data erased in the circumstances specified in Article 17, including where it is no longer necessary for the purposes for which it was collected.
• Right to restriction of processing (Art. 18) — to require us to restrict processing in the circumstances specified in Article 18.
• Right to data portability (Art. 20) — to receive personal data you provided to us, in a structured, commonly used and machine-readable format, and to transmit it to another controller, where processing is based on consent or contract and is carried out by automated means.
• Right to object (Art. 21) — to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests; and to object at any time, absolutely and without justification, to processing for direct marketing purposes.
• Right to withdraw consent (Art. 7(3)) — to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.
• Right not to be subject to automated decision-making (Art. 22) — as described in Section 8.4.
• Right to lodge a complaint (Art. 77) — see Section 11.6.

11.2. How to exercise your rights. Send your request to info@primecal.eu with the subject line "Data Protection Request", identifying the right you wish to exercise and the personal data concerned. Certain rights may also be exercised directly within your account settings (including data export and account deletion).

11.3. Identity verification. We will take reasonable steps to verify your identity before actioning a request. Where we have reasonable doubts, we may request additional information pursuant to Article 12(6) GDPR. We will not use verification data for any other purpose.

11.4. Timescale. We will respond within one (1) month of receipt. That period may be extended by up to two (2) further months where necessary, taking into account the complexity and number of requests; we will inform you of any extension and the reasons for it within the first month.

11.5. Cost. Requests are actioned free of charge. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, we may charge a reasonable fee or refuse to act, in each case in accordance with Article 12(5) GDPR and with reasons.

11.6. Right to lodge a complaint. You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement. Because the Operator is established in Hungary, the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, "NAIH") is a competent supervisory authority for the Operator's own establishment, regardless of where you yourself reside — this does not replace or limit your right to complain instead to the supervisory authority of your own Member State. In the United Kingdom, the competent authority is the Information Commissioner's Office. We would, however, appreciate the opportunity to address your concerns first at info@primecal.eu.

11.7. Requests concerning payment and billing data must be directed to Paddle, which is the independent controller of that data. We will signpost you to Paddle but cannot action such requests.

11.8. Withdrawing an integration authorisation. You may withdraw your authorisation for a connected calendar account at any time, in the Service or directly with the provider, as described in Section 6.9. Withdrawal takes effect prospectively and does not affect the lawfulness of processing carried out before it.

---

12. Cookies and Similar Technologies

12.1. We use cookies, local storage, session storage and similar technologies, as further described in our Cookie Policy. The categories used are as follows:

12.2. Consent. Where required by Article 5(3) of Directive 2002/58/EC (the ePrivacy Directive) and national implementing law, non-essential cookies are set only after you have given consent through our cookie banner. Consent is not pre-ticked, is as easy to refuse as to give, and may be withdrawn at any time through the cookie preferences control available in the Service.

12.3. Website cookies and analytics do not include Google Calendar event contents, Google OAuth tokens, or other Google user data obtained through Google APIs.

12.4. Third-party cookies. Certain processors listed in Section 7 may set cookies from their own domains. Paddle sets its own cookies within the checkout interface, governed by Paddle's own cookie and privacy notice.

12.5. Browser controls. You may block or delete cookies through your browser settings. Blocking strictly necessary cookies will prevent the Service from operating.

12.6. Do Not Track and Global Privacy Control. We honour the Global Privacy Control signal where applicable law requires it. There is no industry-accepted standard for responding to "Do Not Track" browser headers, and we therefore do not respond to them.

---

13. Security

13.1. We implement technical and organisational measures appropriate to the risk, in accordance with Article 32 GDPR, including:

• encryption of data in transit using industry-standard TLS;
• encryption at rest of databases, backups and sensitive fields, including third-party credentials and authentication secrets;
• storage of passwords only as salted cryptographic hashes using a memory-hard algorithm;
• role-based access control, least-privilege provisioning and multi-factor authentication for administrative access;
• network segmentation, firewalling, rate limiting and denial-of-service mitigation;
• audit logging of administrative and security-relevant events;
• regular dependency vulnerability scanning and patching;
• backup, restoration and business continuity procedures; and
• confidentiality obligations binding all personnel and contractors.

13.2. No system is completely secure. While we take security seriously, we cannot and do not guarantee the absolute security of any data, and we expressly disclaim any such warranty in accordance with the Terms of Service. Transmission of data over the internet is at your own risk.

13.3. Personal data breaches. Where a personal data breach is likely to result in a risk to the rights and freedoms of natural persons, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, in accordance with Article 33 GDPR. Where the breach is likely to result in a high risk, we will also communicate it to affected data subjects without undue delay in accordance with Article 34 GDPR.

13.4. Breaches occurring at Paddle or at an Upstream Provider are the responsibility of that entity as controller or processor of the data concerned. We will cooperate with such entity and will notify you where we are legally obliged to do so, but we accept no liability for such incidents in accordance with the Terms of Service.

---

14. Children

14.1. The Service is not directed at, intended for, or available to persons under the age of eighteen (18), and we do not knowingly collect personal data from children, save only for the limited, guardian-supervised Kid Mode use described in Section 14.1A. We do not permit a child to register for, or hold, their own Account.

14.1A. Kid Mode. A parent or legal guardian who holds an Account may choose to enable Kid Mode: a restricted, view-only interface of the guardian's own Account that a child may use on a device the guardian controls. The child does not register and has no account or login of their own; the guardian is the data subject in respect of the Account, and remains the controller's point of contact for, and responsible for, any data generated through the child's use of Kid Mode (for example, timestamps recorded when a task is marked done). We treat this data as the guardian's own Account data, collected because the guardian chose to enable Kid Mode, and not as the kind of unsolicited data concerning children described in Section 4.4.

14.1B. Kid Mode protections. Kid Mode can only be exited with a PIN set by the account holder; it does not allow creating, editing or deleting events, calendars or settings — only marking existing tasks done; and repeated wrong PINs lock entry for five (5) minutes.

14.2. If we become aware that we have collected personal data from a child outside the Kid Mode use described above, and without valid parental consent, we will delete that data without undue delay. If you believe a child has provided us with personal data other than through a guardian's own Kid Mode-enabled Account, contact info@primecal.eu immediately.

---

15. Marketing Communications

15.1. We send service, security, billing and legal notices as a necessary part of the contractual relationship; these cannot be opted out of while your account remains active.

15.2. Marketing communications are sent only with your consent, or on the basis of the soft opt-in permitted by applicable law in respect of existing customers for similar products. Every marketing communication contains a one-click unsubscribe mechanism, and you may withdraw consent at any time in your account settings or by writing to info@primecal.eu, without detriment.

---

16. Changes to This Privacy Policy

16.1. We may update this Privacy Policy from time to time. The "Last Updated" date at the head of this document indicates when it was last revised.

16.2. Where a change is material — in particular where it introduces a new purpose of processing, a new category of recipient, or a materially extended retention period — we will notify you by email or in-application notice not less than thirty (30) days before the change takes effect, save where an earlier effective date is required by law or by the act of an Upstream Provider.

16.3. Continued use of the Service after the effective date constitutes acknowledgement of the revised Privacy Policy. Where the change requires consent, we will seek that consent separately, and the absence of consent will not be treated as acceptance.

16.4. Prior versions of this Privacy Policy are retained and are available on request at info@primecal.eu.

---

17. Contact

Data Controller: Péter Cselőtei (Prime Calendar)
Budapest, Hungary
Privacy and data protection enquiries: info@primecal.eu
Data subject requests: info@primecal.eu — subject line "Data Protection Request"

Payment, billing, invoicing and taxation data: these are controlled independently by Paddle. Please direct all such enquiries and data subject requests to Paddle using the contact details shown on your invoice or purchase receipt, or via Paddle's published privacy contact channel.