GDPR Compliance

Last Updated: July 13, 2025

Christmas Command Center™ ("we," "our," or "us"), a product of iBitola, is committed to complying with the European Union's General Data Protection Regulation (GDPR). This page outlines our data processing practices and your rights under the GDPR.

1. Our Role Under GDPR

We act as a Data Controller for the personal data we collect from our customers and Site visitors. This means we determine the purposes and means of processing your personal data.

2. Lawful Basis for Processing

We process your personal data under the following lawful bases:

• Performance of a Contract: Processing your order, delivering your digital products, and providing customer support.
• Consent: Sending you marketing communications, quiz results, or newsletters (when you have explicitly opted in).
• Legitimate Interest: Improving our Site, analyzing usage patterns, and protecting against fraud — provided these interests do not override your rights and freedoms.
• Legal Obligation: Retaining transaction records for tax and accounting compliance.

3. What Data We Collect

We collect the following categories of personal data:

• Identity Data: Name
• Contact Data: Email address, billing address
• Transaction Data: Purchase history, payment amounts (we do not store full card numbers)
• Technical Data: IP address, browser type, device information
• Usage Data: Pages visited, time on site, interaction patterns

4. Your GDPR Rights

Under the GDPR, you have the following rights:

Right of Access

You may request a copy of the personal data we hold about you, free of charge. We will respond within 30 days.

Right to Rectification

You may request that we correct any inaccurate or incomplete personal data we hold about you.

Right to Erasure ("Right to be Forgotten")

You may request that we delete your personal data in certain circumstances, such as when the data is no longer necessary for the purpose it was collected. This right is not absolute — we may retain data required for legal obligations (e.g., tax records).

Right to Restrict Processing

You may request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.

Right to Data Portability

You may request a copy of your personal data in a structured, commonly used, machine-readable format, and have the right to transmit that data to another controller.

Right to Object

You may object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests.

Rights Related to Automated Decision-Making

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

5. How to Exercise Your Rights

To exercise any of your GDPR rights, contact us at [email protected]. We may need to verify your identity before processing your request. We will respond within one month of receiving a valid request.

6. International Data Transfers

Our Site is hosted and operated in the United States. If you are located in the EU/EEA, your personal data will be transferred to and processed in the United States. We ensure appropriate safeguards are in place for such transfers, including using service providers that adhere to standard contractual clauses or equivalent mechanisms.

7. Data Retention

We retain your personal data only as long as necessary:

• Transaction records: 7 years (for tax and accounting compliance)
• Marketing consent records: Until you withdraw consent
• Support communications: 2 years after last contact
• Analytics data: 26 months

8. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach poses a high risk to you, we will also notify you without undue delay.

9. Complaints

If you believe our processing of your personal data violates the GDPR, you have the right to lodge a complaint with the supervisory authority in your EU member state. We encourage you to contact us first so we can address your concerns directly.

10. Contact Our Data Protection Officer

For GDPR-related inquiries, please contact:

• Email: [email protected]
• Phone: 800-414-1059