1. Introduction

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data in accordance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and the Irish Data Protection Act 2018. We are committed to protecting your privacy and ensuring transparency in our data processing activities.

2. Data Controller Information

For any questions regarding this Privacy Policy or our data processing practices, please contact us using the details above.

3. Information We Collect

We may collect and process the following categories of personal data:

• Identity Data: Name, username, title
• Contact Data: Email address, telephone number, postal address
• Technical Data: IP address, browser type and version, device information, operating system
• Usage Data: Information about how you use our website and services
• Marketing Data: Your preferences for receiving marketing communications
• Account Data: Registration details, login credentials (encrypted)

4. Purpose of Data Processing

We process your personal data for the following purposes:

• To provide and maintain our services
• To manage your account and verify your identity
• To process transactions and send transaction notifications
• To respond to your enquiries and provide customer support
• To comply with legal obligations
• To improve our website and services
• To send marketing communications (with your consent)
• To protect against fraud and ensure security

5. Legal Basis for Processing

Under GDPR, we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to fulfil our contractual obligations
• Consent: You have given explicit consent for specific processing activities
• Legal Obligation: Processing required to comply with Irish and EU law
• Legitimate Interest: Processing necessary for our legitimate business interests (e.g., fraud prevention, security)

6. Data Storage and Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication mechanisms
• Employee training on data protection
• Secure backup procedures

Your data is stored on secure servers located within the European Economic Area (EEA) or with adequate safeguards in place for international transfers.

7. Your Rights Under GDPR

Under the GDPR, you have the following rights regarding your personal data:

To exercise any of these rights, please contact us at nathan@carlowdigital.com. We will respond to your request within one month.

8. Cookie Policy

Our website uses cookies to enhance your browsing experience. Cookies are small text files stored on your device.

Types of Cookies We Use:

• Essential Cookies: Necessary for the website to function properly
• Performance Cookies: Help us understand how visitors interact with our website
• Functional Cookies: Remember your preferences and settings
• Marketing Cookies: Track your browsing to deliver relevant advertisements (only with consent)

You can manage your cookie preferences through our cookie consent banner or by adjusting your browser settings. Note that blocking certain cookies may impact website functionality.

9. Third-Party Services

We may share your data with trusted third-party service providers who assist us in operating our website and conducting our business:

• Hosting and infrastructure providers
• Payment processors
• Analytics services
• Customer support platforms
• Email service providers

All third-party providers are required to maintain appropriate data protection standards and process data only as instructed by us.

10. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this policy, unless a longer retention period is required by law. When data is no longer needed, we securely delete or anonymise it. Specific retention periods vary based on the type of data and legal requirements, typically ranging from 1 to 7 years for business records.

11. International Data Transfers

We primarily store and process data within the European Economic Area (EEA). If we transfer data outside the EEA, we ensure appropriate safeguards are in place, such as:

• EU-approved Standard Contractual Clauses
• Adequacy decisions by the European Commission
• Binding Corporate Rules

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the updated policy on our website and updating the "Last Updated" date. We encourage you to review this policy periodically.

13. Contact Information and Complaints

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us:

You also have the right to lodge a complaint with the Irish Data Protection Commission: