1. Who we are
Carnival Lights is an independent informational journal about Thai festival culture, published at https://carnivalmagic-phuket.icu/. For privacy questions or data-subject requests, contact [email protected].
Where the EU General Data Protection Regulation (GDPR) applies, we act as a data controller for personal data collected through this website.
2. What this site is
This website provides editorial content only. We do not operate ticket sales, booking systems, payment processing, or account registration for commercial attractions. Our processing is limited to what is needed to operate an informational publication and understand aggregate readership.
3. Personal data we may process
3.1 Data you provide
- Email address and message content if you contact us (for example via editors@ or privacy@ addresses)
- Any personal details you choose to include in correspondence
3.2 Data collected automatically
- Technical logs such as IP address, browser type, device type, referring URL, pages viewed, and timestamps
- Cookie identifiers and similar technologies as described below
- Approximate location derived from IP address (city/region level) if analytics tools are enabled
We do not knowingly collect special categories of personal data (such as health, religion, or political opinions) through this website.
4. Purposes and legal bases (GDPR)
We process personal data for the following purposes:
- Operating and securing the website — Legitimate interests (Article 6(1)(f) GDPR): keeping the site available, detecting abuse, and diagnosing technical issues.
- Responding to your messages — Legitimate interests and/or steps prior to a contract at your request (Article 6(1)(f) and, where relevant, 6(1)(b)).
- Remembering cookie preferences — Legitimate interests for essential preference storage; consent (Article 6(1)(a)) for non-essential cookies where required.
- Audience measurement / analytics — Consent (Article 6(1)(a)) where required by applicable law; otherwise legitimate interests for aggregated statistics, balanced against your rights.
- Legal compliance — Legal obligation (Article 6(1)(c)) when we must retain or disclose data to meet applicable law.
5. Cookies and similar technologies
We use a cookie notice on first visit. You may accept all cookies or choose essential-only storage.
5.1 Essential cookies
- Cookie consent preference (local storage / cookie): stores whether you accepted or limited cookies. Necessary to remember your choice.
5.2 Analytics cookies (optional)
If enabled after consent, analytics tools may set cookies or use similar identifiers to help us understand which essays are read, typical session length, and general traffic sources. Data is used in aggregated form where practicable.
5.3 Managing cookies
You can clear site data in your browser, use private browsing, or block cookies in browser settings. If you previously accepted cookies and wish to change your choice, clear local storage for this site and reload the page to see the notice again.
6. Recipients and processors
We may share personal data with:
- Hosting and content-delivery providers that store or transmit website files and logs
- Email providers that deliver correspondence
- Analytics providers (only if analytics are enabled and, where required, after consent)
- Professional advisers or authorities when required by law or to protect rights and safety
We require processors to process personal data only on documented instructions and with appropriate security measures.
7. International transfers
Our hosting or service providers may process data in countries outside your own, including outside the European Economic Area (EEA). Where GDPR applies and data is transferred internationally, we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses, together with any supplementary measures recommended by guidance.
8. Retention
- Contact emails: typically retained for up to 24 months after the last message, unless a longer period is needed for an ongoing matter or legal claim.
- Server logs: typically retained for 30–180 days, unless needed longer for security investigations.
- Cookie consent records: retained until you clear them or for up to 12 months, after which the notice may be shown again.
- Analytics data: retained according to the analytics tool configuration, commonly 14–26 months in aggregated form.
When retention ends, we delete or irreversibly anonymise personal data where feasible.
9. Your rights under GDPR
If GDPR applies to you, you may have the right to:
- Access — obtain confirmation and a copy of your personal data
- Rectification — correct inaccurate or incomplete data
- Erasure — request deletion in certain circumstances (“right to be forgotten”)
- Restriction — request limited processing in certain cases
- Portability — receive data you provided in a structured, commonly used format, where processing is based on consent or contract and carried out by automated means
- Object — object to processing based on legitimate interests, including profiling related to such processing
- Withdraw consent — at any time, where processing is based on consent, without affecting prior lawful processing
- Lodge a complaint — with a supervisory authority in the EU/EEA (for example in your place of residence or work)
To exercise these rights, email [email protected]. We may ask for information to verify your identity before responding. We aim to respond within one month, or as otherwise required by law.
10. Children
This website is intended for a general audience and is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will take appropriate steps to delete it.
11. Security
We use reasonable technical and organisational measures appropriate to the risk, including HTTPS transport where configured by hosting, access controls for mailboxes, and least-privilege practices. No method of transmission or storage is completely secure; we cannot guarantee absolute security.
12. Third-party links and embeds
Articles may link to external websites. Those sites have their own privacy practices. We are not responsible for third-party content or processing. If we embed third-party media in the future, those providers may set their own cookies subject to their policies and applicable consent rules.
13. Automated decision-making
We do not use personal data for automated decision-making that produces legal or similarly significant effects concerning you.
14. Changes to this policy
We may update this Privacy Policy to reflect operational, legal, or technical changes. The “Last updated” date at the top will change when we do. Continued use of the site after updates constitutes acknowledgement of the revised policy where permitted by law. Material changes may be highlighted on the homepage or via the cookie notice where appropriate.
15. Contact
Carnival Lights
Website: https://carnivalmagic-phuket.icu/
Privacy: [email protected]
Editorial: [email protected]