OpsCalendar

What OpsCalendar does

OpsCalendar, originally part of NewsCred, is a software as a service editorial calendar used by enterprise marketing and communications teams. It centralises campaign briefs, editorial timelines, asset approvals, and channel scheduling across blogs, social, email, and paid media. Users log in with corporate credentials, collaborate on tasks, and export plans to downstream tools. Because the platform sits behind authentication, it is a back office solution: it does not place advertising tags on the public websites of its customers, but it does process personal data of internal users (employees, contractors, agencies) and any contacts referenced in editorial briefs.

Cookies and data collected

The application sets first party session cookies, CSRF tokens, and remember me cookies on the OpsCalendar domain. Optional third party widgets such as Intercom, HubSpot, or Google Analytics may be loaded for in app support and product analytics, each setting their own cookies. OpsCalendar processes user account data (name, email, role, IP address, login timestamps), product usage logs, and the customer content uploaded into the calendar (campaign briefs, copy drafts, attached files). Public visitors of the OpsCalendar marketing website are also tracked through standard marketing pixels.

GDPR and ePrivacy implications

For the core SaaS, the GDPR lawful basis is contract performance under Article 6(1)(b), since the customer needs an account to use the tool. Strictly necessary session cookies are exempt from consent under Article 5(3) ePrivacy. Analytics, marketing, and support cookies on the public site or embedded in app widgets require prior, freely given consent. Customers acting as controllers must execute a Data Processing Addendum with NewsCred, since OpsCalendar is the processor handling employee and contact personal data.

Roles, contracts, and sub-processors

The customer is the controller for content stored in the calendar and for its own user accounts. NewsCred / OpsCalendar acts as a processor under Article 28 GDPR. A signed DPA, an up to date list of sub-processors (AWS, Intercom, HubSpot, Stripe for billing, Sentry, transactional email providers), and SCCs are required. Document the technical and organisational measures: encryption in transit and at rest, role based access, audit logs, SOC 2 or ISO 27001 certifications, breach notification timelines.

International data transfers

OpsCalendar runs primarily on AWS in the United States. EU customer data is therefore transferred outside the EEA. Compliance relies on Standard Contractual Clauses, supplementary measures (encryption, access controls), and where applicable the EU US Data Privacy Framework certification of NewsCred and its sub-processors. Run a Transfer Impact Assessment covering FISA 702 risks, document the safeguards, and inform internal users in the privacy notice.

Practical compliance steps

Restrict OpsCalendar access through SSO, configure role based permissions, and avoid uploading sensitive personal data into editorial briefs. Sign the DPA, attach the SCC and DPF documentation, and keep an updated Record of Processing Activities. Configure cookie banners on the marketing site to gate analytics and chat widgets. Review NewsCred security documentation annually and align retention settings with internal policies.