This Notice explains how DataFort Solutions Ltd. (“DataFort”, “we”, “us”) processes personal data when we act as a controller — that is, where we decide why and how personal data is processed. It covers visitors to this website, people who make enquiries, newsletter subscribers, client and prospective-client contacts, partner and supplier contacts, and candidates.
When we are a processor, this Notice does not apply. Where we process personal data on a client's behalf during an engagement — for example personal data encountered inside a client system during an audit or a penetration test — the client is the controller, that client's own privacy notice governs the processing, and our obligations are set out in the Data Processing Agreement. If you are a data subject of one of our clients, please direct your request to that client in the first instance.
1. Who is responsible for your data
DataFort Solutions Ltd., a private company limited by shares incorporated in Ireland with its registered office at 12 Emerald Square, Dublin 4, Ireland, is the controller for the processing described in this Notice. Our lead supervisory authority is the Data Protection Commission of Ireland.
We have not appointed a statutory Data Protection Officer under Article 37 GDPR, because our core activities do not consist of processing operations that require regular and systematic monitoring of data subjects on a large scale, nor of large-scale processing of special-category data for our own purposes. We have nevertheless designated a privacy contact who is responsible for this Notice and for handling requests; reach them through our contact page or by post to the registered office. We keep the need for a formal appointment under review.
2. What personal data we collect
We collect only what we need for the purposes described in section 3. We do not purchase personal data from data brokers and we do not build advertising profiles.
2.1 Data you give us
- Enquiry and proposal data: name, work email address, telephone number, employer or organisation name, job title where you provide it, and the content of your message including any details you choose to share about your situation.
- Client relationship data: contact details of the individuals who act for a client organisation, correspondence, meeting notes, engagement documentation, instructions and approvals.
- Billing data: billing contact, purchase-order references and payment records. We do not collect or store payment-card numbers on this website.
- Newsletter data: email address and the record of your consent, including the date and the version of the notice you were shown.
- Candidate data: where you apply to work with us, your CV and the information in your application.
2.2 Data collected automatically
- Technical and server-log data: IP address, user-agent string, browser and device characteristics, operating system, referring page, requested URLs, response codes, and the date and time of each request.
- Approximate location: derived from the IP address at country or region level. We do not collect precise geolocation.
- Interaction data: pages viewed, navigation paths and interface preferences. Interaction data beyond what is strictly necessary is collected only where you have given consent through the cookie banner.
- Consent record: your cookie choices, the time you made them and the policy version in force, stored locally on your device as evidence of consent.
2.3 Data we ask you not to send
Please do not include passwords, private keys, payment-card details, or unnecessary special-category personal data (Article 9: health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation) in an enquiry. We do not seek special-category data from website visitors and we have no general lawful basis to hold it. If you send it anyway, we will delete it unless we are required to retain it, and we will tell you that we have done so.
3. Why we process it, and on what lawful basis
Every processing activity below is tied to a specific purpose and a specific lawful basis under Article 6(1) GDPR.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Responding to enquiries and preparing proposals | Enquiry data | Article 6(1)(b) — steps taken at your request prior to entering a contract; and Article 6(1)(f) legitimate interests in responding to business enquiries addressed to us |
| Delivering engagements and administering the client relationship | Client relationship data, correspondence | Article 6(1)(b) — performance of a contract; Article 6(1)(f) where the contract is with the organisation rather than the individual |
| Invoicing, accounting and tax records | Billing data | Article 6(1)(c) — compliance with a legal obligation (including Irish company and tax law) |
| Sending the newsletter | Email address, consent record | Article 6(1)(a) — consent, withdrawable at any time |
| Operating the website securely and preventing abuse | Technical and server-log data | Article 6(1)(f) — legitimate interests in network and information security, as recognised by Recital 49 |
| Measuring how the website is used | Interaction data, statistics cookies | Article 6(1)(a) — consent, given through the cookie banner and withdrawable at any time |
| Remembering interface preferences | Preference cookies | Article 6(1)(a) — consent |
| Recruitment | Candidate data | Article 6(1)(b) and Article 6(1)(f) — legitimate interests in assessing suitability |
| Establishing, exercising or defending legal claims | Any of the above, as relevant | Article 6(1)(f) — legitimate interests in protecting our legal position; Article 9(2)(f) where special-category data is unavoidably involved |
| Complying with regulatory and statutory obligations | As required | Article 6(1)(c) — legal obligation |
3.1 Our legitimate interests, in plain terms
Where we rely on Article 6(1)(f), we have carried out a balancing exercise in each case and recorded it. In summary: the interests we pursue are responding to people who contact us, running a professional services business, keeping our website and client information secure, and defending ourselves if a claim is made. The data involved is business-contact and technical data rather than sensitive personal information; the processing is what a person contacting a professional firm would reasonably expect; and we have limited the data, the retention period and the recipients accordingly. You have an absolute right to object, which we describe in section 8. You may request a summary of the relevant balancing assessment.
4. Who we share it with
We do not sell personal data and we do not share it for third-party marketing. We disclose it only in the circumstances below, and only to the extent necessary.
- Service providers acting as our processors: website hosting and content delivery, email and productivity services, document storage, customer relationship management, newsletter distribution and professional accounting software. Each is engaged under Article 28 terms, is permitted to process data only on our documented instructions, and is subject to confidentiality obligations.
- Network specialists: the legal, privacy and technical specialists we engage and pay to deliver part of an engagement, including counsel in a particular jurisdiction. They act on our instructions, are bound by confidentiality and security obligations no less protective than our own and, where they process personal data on a client's behalf, by written processor terms.
- Professional advisers: our own auditors, insurers and lawyers, where they need the information and are bound by professional confidentiality.
- Authorities and courts: where disclosure is required by law, by a court order, or by a competent authority. Where we are legally permitted to do so, we will give you advance notice and disclose only what is required.
- A successor: in the context of a merger, acquisition or reorganisation, subject to equivalent protection and to prior notice where practicable.
A current list of the categories of processor we use, and the countries in which they operate, is available on request through our contact page.
5. International transfers
Our default position is that personal data is stored and processed within the European Economic Area. Some service providers we rely on may nevertheless process limited data outside the EEA — most commonly for support, redundancy or content delivery.
Where such a transfer occurs, we rely on one of the following Chapter V GDPR mechanisms: an adequacy decision of the European Commission under Article 45; the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) under Article 46(2)(c), with the appropriate module selected for the relationship; or, exceptionally and only where no other mechanism is available, a derogation under Article 49.
Where we rely on Standard Contractual Clauses, we also carry out a transfer impact assessment addressing the law and practice of the destination country concerning public-authority access to data, in line with the Schrems II judgment (Case C-311/18) and European Data Protection Board guidance, and we apply supplementary technical and organisational measures where the assessment indicates they are needed. You may request a copy of the relevant safeguards, with commercially confidential terms redacted.
6. How long we keep it
We keep personal data only for as long as it is needed for the purpose it was collected for, and then delete it or anonymise it. The periods below are our standard positions; a longer period applies where a legal obligation, an ongoing engagement or a live or reasonably anticipated legal claim requires it.
| Category | Retention period | Reason |
|---|---|---|
| Enquiries that do not become engagements | 24 months from last contact | Follow-up and continuity of conversation; evidence of what was said |
| Client engagement files and deliverables | 7 years from the end of the engagement | Professional record, limitation periods and insurance requirements |
| Accounting and tax records | 6 years from the end of the financial year | Irish company and tax law |
| Newsletter subscription | Until you withdraw consent, then a suppression record indefinitely | Consent; and to ensure we do not email you again |
| Web server logs | 90 days, save where retained for an active security investigation | Security monitoring and abuse prevention |
| Consent records (cookies) | 12 months, or until you change or clear them | Evidence of consent under Article 7(1) |
| Unsuccessful candidate applications | 12 months, or longer with your consent | Defence of recruitment-related claims; future opportunities |
| Testing evidence and artefacts | As stated in the rules-of-engagement document, typically 90 days after report acceptance | Report support and retest; then secure destruction |
7. How we protect it
We implement technical and organisational measures appropriate to the risk, as Article 32 requires. These include encryption of data in transit and at rest, access restricted on a least-privilege and need-to-know basis, multi-factor authentication on administrative accounts, segregation of client material by engagement, logging and monitoring, vetting and confidentiality undertakings for personnel, role-appropriate training, documented backup and restoration procedures, and an incident-response plan that is tested.
No website, email service or online system can be guaranteed secure. Email in particular is not a confidential channel unless it is encrypted end-to-end. If you need to send us something sensitive, ask us for a secure transfer link rather than attaching it to an email.
If a personal data breach affecting your data occurs and it is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours of becoming aware of it under Article 33, and we will inform you directly without undue delay where the risk is high, as Article 34 requires.
8. Your rights
Subject to the conditions and exemptions in the GDPR and the Irish Data Protection Act 2018, you have the following rights in relation to personal data we hold about you as controller.
- Access (Article 15): confirmation of whether we process your data, a copy of it, and information about the processing.
- Rectification (Article 16): correction of inaccurate data and completion of incomplete data.
- Erasure (Article 17): deletion where the data is no longer necessary, where you withdraw consent and no other basis applies, where you successfully object, or where the processing was unlawful. This right does not apply where we must retain the data to comply with a legal obligation or to establish, exercise or defend legal claims.
- Restriction (Article 18): suspension of processing while a dispute about accuracy or legitimacy is resolved.
- Portability (Article 20): receipt of the data you provided to us, in a structured, commonly used, machine-readable format, where the processing is based on consent or contract and carried out by automated means.
- Objection (Article 21): an absolute right to object to direct marketing at any time; and a right to object to processing based on legitimate interests on grounds relating to your particular situation, which we must honour unless we demonstrate compelling legitimate grounds that override your interests.
- Withdrawal of consent (Article 7(3)): at any time, without affecting the lawfulness of processing carried out before the withdrawal.
- Automated decision-making (Article 22): we do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you, and we do not profile you for such purposes.
8.1 How to make a request
Submit your request through our contact page, marked “Data subject request”, or in writing to the registered office. Tell us which right you are exercising and give us enough detail to locate the data. We will respond within one month of receipt as Article 12(3) requires; where a request is complex or where you have made several requests, we may extend by up to two further months and will tell you within the first month if we do, explaining why.
There is no fee. Where a request is manifestly unfounded or excessive — in particular because it is repetitive — we may charge a reasonable administrative fee or refuse to act, and we will explain our reasoning and your right to complain. Where we have reasonable doubts about your identity we may request additional information to verify it, as Article 12(6) permits; we will ask only for what is proportionate and will not retain identity evidence longer than necessary.
8.2 Complaints
If you are unhappy with how we have handled your personal data or your request, please tell us first so we have the chance to put it right. You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement. Our lead supervisory authority is:
Data Protection Commission
6 Pembroke Row, Dublin 2, D02 X963, Ireland
www.dataprotection.ie
You also have the right to an effective judicial remedy under Articles 78 and 79 GDPR.
9. Cookies and similar technologies
This website stores a small amount of information on your device. Strictly necessary entries are set on the basis of our legitimate interest in operating the site securely; every other category is set only after you give consent through the banner, which you may change or withdraw at any time using the “Cookie preferences” link in the footer. Full details — including each category, its purpose, its duration and its lawful basis — are in the Cookie Policy.
Consent for non-essential storage is required by Regulation 5(3) of the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336/2011), which implements the ePrivacy Directive in Ireland.
10. Children
This website and our services are directed at organisations and business professionals. We do not knowingly collect personal data relating to children, and we do not offer information society services directly to children within the meaning of Article 8 GDPR. If you believe a child has provided us with personal data, contact us and we will delete it.
11. Whether you have to provide data
You are not obliged to provide any personal data. If you choose not to provide the information marked as required on a contact form, we will not be able to respond to your enquiry or prepare a proposal. Where personal data is required by law or by a contract, we will tell you at the point of collection and explain the consequence of not providing it.
12. Where we get data from, if not from you
Most of the data we hold comes directly from you. We may also receive your business-contact details from: your employer or a colleague who introduces you to an engagement; a client who nominates you as a contact; a partner law firm coordinating a matter with your authorisation; and publicly available professional sources such as a company website or a public professional profile, where we are contacting you in a business capacity about services relevant to your role. Where Article 14 applies, we will tell you within a reasonable period and no later than one month, or at the time of first communication with you.
13. Changes to this Notice
We may update this Notice to reflect changes in our services, the law, technology or our operations. The current version and date appear at the top of this page, and the version history is listed in the Legal Centre. Where a change is material — for example a new purpose or a new category of recipient — we will bring it to your attention by a prominent notice on the website and, where we hold your contact details and the change affects you, by direct communication before the change takes effect.
14. Contact us
For any question about this Notice, about how we process personal data, or to exercise a right, use our contact page or write to: DataFort Solutions Ltd., 12 Emerald Square, Dublin 4, Ireland. Please do not include passwords, private keys, payment-card details or unnecessary special-category data in your message.
Related documents: Terms of Service · Cookie Policy · Data Processing Agreement · Legal Centre