This policy explains what personal data __BRAND__ (the "site", "we") collects, why, for how long, and what rights you have. We operate in accordance with the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018. Our Data Protection Officer can be reached at __EMAIL__.
Data we collect
We collect a deliberately small amount of personal data. Specifically:
- Contact form submissions. If you submit the contact form, we process your name, email address, subject and message, plus the date and time of submission. This is necessary to respond to your enquiry (Article 6(1)(b) GDPR — taking steps at your request before a contract, or Article 6(1)(f) — our legitimate interest in replying to correspondence).
- Server logs. Our hosting provider records standard request logs (IP address, user agent, requested URL, timestamp) for security and operational purposes, retained for a short period. This is processed on the basis of our legitimate interest in securing and operating the site (Article 6(1)(f)).
- Analytics, if enabled. If we enable privacy-friendly analytics, we will disclose the provider and the data it collects here. We do not use cross-site tracking cookies.
Cookies
The site itself sets only an essential preference cookie, if any, to remember your menu state. We do not set advertising or tracking cookies. If we later add analytics that use cookies, we will display a cookie banner with the option to accept or refuse non-essential cookies, and we will update this policy accordingly.
Purposes of processing
- Responding to your message or correction request.
- Operating and securing the website.
- Aggregate, anonymised analysis of site usage, where enabled.
We do not sell personal data, and we do not share it with third parties for their own marketing.
Retention periods
- Contact form messages: retained for up to 12 months after our last reply, then deleted unless required for a legitimate ongoing matter.
- Server logs: retained by the hosting provider for up to 30 days, then automatically deleted.
- Analytics data, if enabled: retained in aggregate for up to 14 months.
Sharing and transfers
We do not transfer personal data outside the European Economic Area except where our hosting or processing provider does so under standard contractual clauses or an adequacy decision. If you submit the contact form to a third-party form handler (configured by the site owner at build time), that handler's privacy policy also applies — we will name the provider in this section if one is configured.
Your rights
Under GDPR you have the right to: access your data; rectify inaccurate data; erase your data ("right to be forgotten"); restrict processing; data portability; object to processing; and withdraw consent at any time without affecting processing already carried out. To exercise any right, email __EMAIL__. We respond within one month, as required by Article 12.
You also have the right to lodge a complaint with the Data Protection Commission, the Irish supervisory authority, at www.dataprotection.ie.
Children
The site is not directed at children under 16 and we do not knowingly collect their personal data. If you believe a child has submitted data to us, contact __EMAIL__ and we will erase it.
Changes to this policy
If we materially change this policy we will update the "last updated" date at the top and, where appropriate, notify you through a site notice. Continued use after a change constitutes acceptance of the updated policy.
Contact
Questions about this policy or any data matter: __EMAIL__, or by post at the address on the contact page.