Privacy policy

Who is responsible for your data

The data controller for anything collected through this website, eolaswebdesign.ie (formerly eolaswebdesign.com), is [CONFIRM: registered business name — the limited company name, or the sole trader's own legal name], trading as Eolas Web Design, of [CONFIRM: registered business address], Dublin, Ireland. [CONFIRM: CRO company number, if the business is registered with the Companies Registration Office — delete this sentence if it is not].

You can reach us about anything on this page at hello@eolaswebdesign.ie, or by phone on [CONFIRM: phone].

A business of this size is not required to appoint a Data Protection Officer, so requests come straight to us and are handled by us.

What we collect, and when

We only collect personal data that you type into a form yourself. There is no analytics script, no advertising tag and no tracking pixel anywhere on this site — see the cookies section below.

Free demo request. The form at /free-demo asks for your name, your business name, your email address, and a description of the project in your own words. Only the email address is required, because it is the only way we can send the finished demo back to you.

Contact form. The form at /contact asks for your name, your email address, your business name and your message. Again, only the email address is strictly needed.

Website quote tool. The older /calculator page collects your name, your email address and the answers you select about the project so it can send you an indicative figure.

Technical data. Our server sees the IP address your request arrives from. We use it for exactly two things: counting recent submissions from the same address so one client cannot flood the form, and passing it to Cloudflare's Turnstile check so a solved security challenge can be tied to the network that submitted the form. The rate-limit counter holds an address in memory for ten minutes and then discards it. It is never written to a database, never attached to your enquiry, and never used to build a profile of you. [CONFIRM: whether Cloudflare request logging or Web Analytics is switched on for this Worker in the Cloudflare dashboard — if it is, say so here and state how long those logs are kept].

Why we use it, and our lawful basis

Under Article 6 of the GDPR every use of personal data needs a lawful basis. Ours are:

• Replying to you and building your demo — Article 6(1)(b), taking steps at your request before entering into a contract. If you are only asking a general question rather than asking us to build anything, we rely instead on Article 6(1)(f), our legitimate interest in answering people who get in touch.
• Keeping the forms usable — Article 6(1)(f), our legitimate interest in stopping automated abuse. This covers the hidden honeypot field, the submission rate limit and the Cloudflare Turnstile check on the demo form.
• Keeping records once you become a client — Article 6(1)(f) for project correspondence, and Article 6(1)(c) where Irish tax law requires us to retain invoices and related records.

We do not use your details for marketing. We will never sell them, never share them for advertising, and never add you to a mailing list you did not ask to join. If we ever want to email you something you did not request, we will ask for your consent first and you will be able to withdraw it at any time.

Who else sees it

The list of companies that touch your enquiry is deliberately short. Each of them is a processor acting on our instructions:

• Cloudflare — hosts this website and runs the Turnstile security check on the demo form. Your request passes through their network to reach us at all. Their privacy policy is at cloudflare.com/privacypolicy.
• Resend — delivers the notification email carrying your enquiry to our inbox. Their privacy policy is at resend.com/legal/privacy-policy.
• Google (Google Workspace) hosts the hello@eolaswebdesign.ie mailbox and stores the enquiry once it arrives, in the same way any email you send us is stored. Their privacy policy is at policies.google.com/privacy.

Some of these process data outside the European Economic Area. Where they do, the transfer relies on the European Commission's Standard Contractual Clauses together with the provider's own supplementary safeguards. You can ask us for details of the safeguards in place for any specific provider.

Nobody else receives your personal data, unless we are legally required to hand it over.

How long we keep it

• Enquiries that do not become projects — [CONFIRM: retention period; 24 months from your last message is a reasonable default], after which the correspondence is deleted.
• Client project correspondence — kept for the life of the project and then [CONFIRM: retention period after a project ends; note that Revenue's record-keeping rules mean invoices and related records generally need to be held for six years].
• Demos we build but you decide not to launch — [CONFIRM: how long an unaccepted demo and the details behind it are kept before deletion; 90 days is a reasonable default].
• Rate-limit counters — ten minutes, then discarded automatically.

You can ask us to delete anything sooner. See your rights, below.

Your rights

Under the GDPR you can ask us to:

• Tell you what we hold about you, and give you a copy of it.
• Correct anything that is wrong or incomplete.
• Delete it, where we have no continuing reason to hold it.
• Restrict what we do with it while a dispute about it is resolved.
• Send it to you, or to someone else, in a portable format.
• Stop using it where we are relying on legitimate interests, unless we have compelling grounds that override your objection.
• Withdraw consent, in the cases where consent is what we relied on. Withdrawing it does not undo anything done before you withdrew.

Email hello@eolaswebdesign.ie and say which of these you want. We will respond within one month, free of charge. If a request is unusually complex we may take longer, but we will tell you why inside that first month. We may ask you to confirm who you are before we act on a request, so that we are not handing your data to somebody else.

Complaints

If you think we have handled your data badly, tell us first — most things are a misunderstanding and we would rather fix it directly. If you are still unhappy, you have the right to complain to the Irish supervisory authority:

Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28. Their complaints process is at dataprotection.ie.

Cookies and tracking

This site sets no analytics, advertising or profiling cookies, which is why there is no consent banner to dismiss. We do not use Google Analytics or any equivalent, and nothing here follows you to another website.

The only client-side storage in play is whatever Cloudflare Turnstile needs to run the security check on the demo form. That is strictly necessary to provide a service you have explicitly asked for — a form that is not swamped by bots — and storage of that kind falls outside the consent requirement in Regulation 5 of S.I. 336/2011, the Irish ePrivacy Regulations.

If we ever add analytics, this page changes first and a consent notice goes up at the same time.

Security

Every form on this site posts over HTTPS. We never ask for payment card details, passwords or financial information through this website, and you should not send them to us in a message. [CONFIRM: how client credentials and project files are stored once a project starts — for example a named password manager and an encrypted drive].

No transmission over the internet is completely secure. If a breach ever put your rights at risk we would notify the Data Protection Commission within 72 hours and tell you directly where the law requires it.

Children

This site is aimed at businesses and is not directed at children under 16. We do not knowingly collect their personal data. If you believe a child has sent us something, email us and we will delete it.

Changes to this policy

If we change how we handle personal data, we update this page and change the date at the top of it. Where a change materially affects you, we will say so plainly rather than leaving you to spot the difference.

This is a plain-language notice, not legal advice, and it has not been reviewed by a solicitor.