Privacy Policy
Last Updated: July 23, 2026
Effective Date: July 21, 2026
1. Introduction
This Privacy Policy explains how MCC Technology Limited, a company registered in the Hong Kong Special Administrative Region (“Hong Kong,” “MCC,” “we,” “us,” or “our”), collects, uses, discloses, and protects personal data in connection with My Concert Calendar, including our website at https://myconcertcalendar.com, related web pages, mobile applications, and associated features (collectively, the “Service”).
We designed this Policy to align with:
- the Hong Kong Personal Data (Privacy) Ordinance (PDPO);
- the EU/UK General Data Protection Regulation (GDPR / UK GDPR); and
- the California Consumer Privacy Act as amended by the CPRA and subsequent updates applicable as of 2026 (CCPA/CPRA).
If you do not agree with this Policy, please do not use the Service. Our Terms of Service also govern use of the Service.
Data controller: MCC Technology Limited (Hong Kong)
Privacy contact: support@myconcertcalendar.com
2. Scope
This Policy applies to personal data we process as a controller when you visit or use the Service. It does not cover third-party websites, apps, or ticketing platforms you reach through outbound links (for example, Urbtix, Cityline, KKTIX, Ticketmaster, Live Nation, or similar providers). Those parties process data under their own policies.
3. Personal Data We Collect
We collect only what we need to operate and improve the Service. Depending on how you use My Concert Calendar, this may include:
A. Information you provide directly
| Category | Examples |
|---|---|
| Account & identity | Name or display name, email address, authentication credentials (passwords are stored using secure hashing; we cannot view your plaintext password) |
| Profile & preferences | Followed artists or concerts, saved lists, alert preferences, silence/mute settings, language or locale preferences |
| Communications | Messages you send to support, feedback, bug reports, and related correspondence |
| User submissions | Event information, comments, or other content you choose to submit |
| Marketing preferences | Opt-in or opt-out choices for email alerts or promotional messages (where offered) |
B. Information collected automatically
| Category | Examples |
|---|---|
| Device & technical data | IP address, browser type, operating system, device identifiers, app version, approximate network location derived from IP |
| Usage & diagnostics | Pages or screens viewed, features used, click-throughs on ticket or outbound links, timestamps, referral URLs, crash or performance logs |
| Cookies & similar technologies | Session identifiers, preference cookies, analytics cookies, and security cookies (see Section 6) |
C. Information from third parties
| Source | Examples |
|---|---|
| Authentication providers | If you sign in with Google or another supported provider, we receive identifiers and profile details (such as email and name) permitted by that provider and your settings |
| Infrastructure & security vendors | Fraud, abuse, or bot-detection signals from security providers |
| Public / enrichment sources | Publicly available event, artist, or venue information used to populate calendar listings (generally not used to identify you as a private individual) |
D. Calendar sync (if you enable it)
If you use calendar export or synchronisation features, we process the event details you choose to sync and technical tokens or permissions required to connect to your calendar provider. We do not use your full personal calendar contents for advertising.
E. Information we do not seek
We do not require government ID numbers, precise continuous GPS tracking, or payment card data to use core discovery features. If paid features are introduced and processed by a payment provider, card data is typically handled by that provider under its own terms.
4. Children and Minors
We do not knowingly collect personal data from children under 16. Under CCPA/CPRA standards applicable in 2026, personal information of consumers under 16 is treated as sensitive personal information where collected.
If we learn that we have collected personal data from a child under 16 without appropriate consent where required, we will delete the account and associated personal data as soon as reasonably practicable. Parents or guardians may contact us at support@myconcertcalendar.com.
5. Purposes of Use and Legal Bases
We process personal data for the purposes below. For GDPR/UK GDPR, the primary legal bases are noted.
| Purpose | Examples | Legal basis (GDPR) |
|---|---|---|
| Provide the Service | Account creation, authentication, calendar browsing, follows/lists, alerts | Contract; legitimate interests |
| Personalisation | Relevant event suggestions based on follows and interaction history | Legitimate interests; consent where required |
| Communications | Service notices, security alerts, respond to support requests | Contract; legitimate interests; legal obligation |
| Email / push alerts | Presale, on-sale, or concert updates you enable | Consent and/or contract (depending on jurisdiction and message type) |
| Security & integrity | Preventing abuse, scraping, fraud, and attacks; debugging | Legitimate interests; legal obligation |
| Analytics & improvement | Aggregated usage analysis, feature quality, performance, and web ad measurement | Legitimate interests; by using the Service you agree to these practices as described in Section 6 |
| Legal compliance | Responding to lawful requests; enforcing Terms; establishing or defending claims | Legal obligation; legitimate interests |
| Business operations | Storage, backup, vendor administration, corporate transactions | Legitimate interests; contract |
We do not use automated decision-making that produces legal or similarly significant effects about you without human involvement.
PDPO alignment: We collect personal data for lawful purposes directly related to our functions, use it in ways consistent with those purposes, take practicable steps to keep it accurate and secure, and retain it no longer than necessary.
6. Cookies and Similar Technologies
We use cookies and similar technologies to operate the Service securely, remember preferences, understand usage, and support advertising on the website.
| Type | Role | Notes |
|---|---|---|
| Strictly necessary | Authentication, security, load balancing, fraud prevention | Required for core operation |
| Preferences | Language or UI settings | May also be managed in your browser |
| Performance & analytics | Aggregated traffic, feature usage, and diagnostic signals | Used to improve the Service |
| Advertising & measurement (web) | Google AdSense (or similar) for ad delivery and related measurement on the website | Applies to the web Service; not used in the mobile app for in-app ads |
Implicit consent by use. By accessing or using My Concert Calendar, you agree that we may set and use essential cookies and similar technologies, and that we may use anonymised or aggregated analytics and web advertising measurement (including Google AdSense on the website) as described in this Policy. We do not present a separate interactive “Accept / Refuse” cookie consent banner for standard use of the Service.
AdSense clarification. On the website, Google AdSense may be used to deliver ads and measure ad performance. AdSense and related measurement operate as part of normal web usage under this Policy and do not require a blocking cookie banner for standard browsing. The mobile application does not display AdSense units.
Browser controls. You may still limit or delete cookies through your browser settings. Blocking essential cookies may break login, security, or preference features. Advertising-related controls offered by your browser or by Google (for example, ad personalisation settings) may also affect what ads you see.
7. How We Share Personal Data
We do not sell your personal data for money. We share personal data only as described below.
A. Service providers (processors)
We engage carefully selected vendors that process personal data on our instructions solely to help operate, secure, and improve the Service. Depending on how you use My Concert Calendar, these categories of recipients may include:
| Category of recipient | Role |
|---|---|
| Cloud database & authentication providers | Store account data, authenticate users, and power core backend services |
| Web hosting & deployment infrastructure | Host and deliver the website and related application services |
| DNS, content delivery & security providers | Route traffic, accelerate content delivery, and help protect against abuse or attacks |
| Backend workflow automation services | Run operational automations that support product and support workflows |
| Internal productivity & support tools | Handle internal administration and support communications |
| Transactional email delivery services | Send service notices, alert emails, and other messages you enable or that are necessary to operate the Service |
| Rate-limiting & abuse-prevention infrastructure | Help detect and limit scraping, fraud, spam, and other abusive traffic |
| Google (OAuth / Calendar, if enabled by you) | Sign-in and optional calendar sync that you choose to connect |
| Website advertising & ad measurement platforms (web) | Deliver ads and related measurement on the website (including Google AdSense) |
These providers may process data in Hong Kong, the United States, the European Union, or other regions where they operate. We do not authorise them to use your personal data for their own independent marketing purposes.
B. Legal, safety, and compliance
We may disclose personal data if we believe in good faith that disclosure is reasonably necessary to: comply with law, regulation, legal process, or governmental request; protect the rights, property, or safety of MCC, our users, or the public; investigate fraud or security incidents; or enforce our Terms.
C. Business transfers
If we are involved in a merger, acquisition, financing, reorganisation, or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate confidentiality and this Policy (or a successor policy providing equivalent protection).
D. With your direction
We may share data when you use integrations you authorise (for example, syncing selected events to a third-party calendar).
E. Aggregated or de-identified data
We may share statistics that do not reasonably identify you.
F. Outbound ticketing and third-party sites
When you leave our Service to a ticketing or organiser site, that third party may collect data under its own policy. We are not responsible for their practices. Click-through metrics we log on our side (for example, that a ticket link was selected) are used for analytics and service improvement and are not a sale of your identity to the destination site.
8. International Data Transfers
MCC Technology Limited is based in Hong Kong. Personal data may be transferred to and processed in jurisdictions outside your place of residence, including where our processors maintain servers.
For transfers of personal data from the EEA, UK, or Switzerland, we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and UK/Swiss addenda where required), or another lawful transfer mechanism.
By using the Service from outside Hong Kong, you understand that your information may be processed in Hong Kong and other countries that may have different data-protection rules than your home jurisdiction.
9. Data Retention
We retain personal data only as long as needed for the purposes described in this Policy, including:
| Data type | Typical retention |
|---|---|
| Active account profile & preferences | For the life of the account |
| Account deletion | Personal data removed from active systems within 30 days of a verified deletion request, except as noted below |
| Backups / disaster recovery | Residual copies may persist for a limited backup cycle, then expire |
| Security, fraud, and audit logs | For a period reasonably necessary for security and compliance |
| Legal holds | As required to establish, exercise, or defend legal claims, or to meet legal obligations |
| Aggregated analytics | Retained in non-identifying form as needed for product insights |
When retention ends, we delete or anonymise personal data so it can no longer reasonably identify you.
10. Security
We implement administrative, technical, and organisational measures appropriate to the nature of the data and the risks of processing. These may include encryption in transit, access controls, hashed credentials, monitoring, and vendor due diligence.
No method of transmission or storage is perfectly secure. You can help protect your account by using a strong unique password, enabling available security features with your identity provider, and logging out of shared devices. Please report suspected security issues to support@myconcertcalendar.com.
11. Your Rights
We extend core privacy rights to users globally, subject to verification and applicable legal exceptions.
A. Rights available to most users
- Access / know: Request confirmation of whether we process your personal data and obtain a copy.
- Correction / rectification: Correct inaccurate personal data (you may also update certain profile fields in-account).
- Deletion / erasure: Request deletion of personal data, subject to legal retention needs.
- Portability: Receive a copy of certain data in a commonly used format, where technically feasible.
- Restriction / objection: Object to or request restriction of certain processing based on legitimate interests, where applicable.
- Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior lawful processing.
- Opt out of marketing: Unsubscribe from non-essential promotional emails using the link in the message or by contacting us. Transactional or security messages may still be sent when necessary.
- Non-discrimination: We will not deny goods or services, charge different prices, or provide a lesser quality of service solely because you exercised a privacy right.
B. GDPR / UK GDPR
Where GDPR or UK GDPR applies, you also have the right to lodge a complaint with your local supervisory authority. You may contact us first so we can try to resolve your concern.
C. CCPA/CPRA (California and similar U.S. state laws)
If you are a California resident (or resident of another U.S. state with similar rights), you may have rights to:
- know the categories and specific pieces of personal information collected, sources, purposes, and categories of recipients;
- delete personal information;
- correct inaccurate personal information;
- opt out of sale or sharing of personal information for cross-context behavioural advertising;
- limit the use and disclosure of sensitive personal information, where applicable; and
- designate an authorised agent to submit requests on your behalf, subject to verification.
Sale / sharing disclosure: We do not sell personal information for monetary consideration. If our use of advertising or analytics technologies (including Google AdSense on the website) is construed as “sale” or “sharing” under CCPA/CPRA, you may opt out by emailing support@myconcertcalendar.com with the subject line “Privacy Request — Do Not Sell or Share.” We will confirm by email when a verified request has been honoured.
Sensitive personal information: We do not use sensitive personal information for purposes incompatible with CCPA/CPRA limitations (such as inferring characteristics beyond what is reasonably necessary to provide the Service), except as permitted by law.
D. Hong Kong PDPO
You may request access to and correction of your personal data held by us, subject to the PDPO and any permitted exceptions (including payment of a permitted fee where applicable for access requests).
12. How to Exercise Your Rights
Submit privacy requests to:
Email: support@myconcertcalendar.com
Entity: MCC Technology Limited (Hong Kong)
Please include enough detail for us to verify your identity and locate your data (for example, the email associated with your account). We will respond within the timeframes required by applicable law (typically within 30–45 days, with notice if an extension is needed).
You may also delete your account through in-product account controls where available.
13. Third-Party Links and Embedded Content
The Service may link to third-party sites or embed third-party content. Those parties’ privacy practices are outside our control. Review their policies before providing personal data or completing ticket purchases.
14. Changes to This Privacy Policy
We may update this Policy from time to time. We will revise the “Last Updated” date and, for material changes, provide a prominent notice on the Service or notify you by email where appropriate. Continued use of the Service after the effective date constitutes acceptance of the updated Policy, except where mandatory law requires a different form of consent.
15. Contact
MCC Technology Limited
Hong Kong
Email: support@myconcertcalendar.com
Website: https://myconcertcalendar.com
For privacy requests, please use the subject line “Privacy Request” to help us route your message quickly.