1. Controller and contact details
Built by Winters, a sole trader established in Co. Wicklow, Ireland, is the controller of the personal data described in this policy.
Ciarán Winters, Built by Winters
Co. Wicklow, Ireland
086 164 1680
ciaran@builtbywinters.ie
Contact form
No Data Protection Officer has been appointed, as the criteria in Article 37 GDPR do not apply. Data protection queries should be sent to the address above. Objections to marketing contact are dealt with in section 5.
2. Visitors to this website
This website counts page views, using Vercel Web Analytics, provided by Vercel Inc. The counting happens only if you accept it in the notice at the foot of the page. If you decline, or if you have not yet answered, nothing is counted and nothing is sent.
The counting sets no cookie and writes nothing into your browser’s local or session storage, so nothing is left on your device by it and nothing on your device is read by it. What is sent is the address of the page you are on and the address of the page you came from. Your IP address and browser type are processed in transit by the provider to produce a hash that changes every day, which is what separates one visitor from another for that day. That hash is not stored as an identifier, is not linked to anything else held about you, and cannot be used to recognise you the following day. The result is a count of pages and visits, not a record of individuals.
Everything after the question mark in a page address is removed before the address is sent, apart from three tags — utm_source, utm_medium and utm_campaign— which identify the campaign or link that brought a visitor to the site and contain nothing about the visitor.
The legal basis is consent under Article 6(1)(a) GDPR. Consent can be withdrawn at any time, and withdrawing it is as easy as giving it — the Cookie Policy sets out how. Withdrawal does not affect counting already carried out.
If you accept the notice, two further services also run: Google Analytics and Google Ads conversion measurement, both provided by Google Ireland Limited. These do set cookies, and they are the only cookies this site is responsible for. Google Analytics records which pages are read and in what order. Conversion measurement records that an enquiry followed a particular advertisement, so that money is not spent on advertising that brings nobody. The cookie names, what each is for and how long each lasts are listed in the Cookie Policy.
The legal basis for both is consent under Article 6(1)(a) GDPR, and neither runs before it is given. Advertising personalisation is switched off, and no advertising audience is built from visitors to this site. Google Ireland Limited acts as a controller in its own right for these services, so what it does with the data is governed by its own terms as well as this policy.
No session-replay or heat-map tooling is used. Any change will be reflected here and in the Cookie Policy before it takes effect.
Apart from the measurement cookies described above, which are set by the provider and only with consent, this site sets no cookies of its own. Information is instead stored in the browser’s own local and session storage for two purposes: to record the choice made on the site notice, and to retain the contents of a chat conversation for the duration of the browser session. Session storage is cleared by the browser when the tab is closed.
Storing or accessing information on a device is governed by Regulation 5 of S.I. No. 336 of 2011 whether or not a cookie is used. Both entries above are exempt from the consent requirement because each is strictly necessary to provide a service explicitly requested by the user: to honour the dismissal of the notice, and to maintain the chat conversation the user has opened. Neither is used to identify or measure visitors.
The hosting provider records standard server logs, including the page requested, IP address and approximate location, for network security and service availability. The legal basis is legitimate interests under Article 6(1)(f) GDPR. Those logs are held by the provider and their retention is determined by the provider.
The Cookie Policy sets out the individual storage entries and how to clear them.
3. Enquiries and forms
Contact and enquiry forms, on this website and on client websites built by Built by Winters, collect the data entered into them, typically a name, email address, telephone number and message.
- On this website, enquiries are received and used to respond to the enquiry. The legal basis is Article 6(1)(b) GDPR, steps taken at the request of the data subject prior to entering into a contract.
- On a client’s website, the enquiry is delivered to that business, which is the controller of it and determines its retention.
Form submissions are transmitted through a third-party form delivery service, which processes the message in order to deliver it, and are then carried by an email service provider.
If you reach an enquiry form by clicking an advertisement, the link you arrived on carries a reference identifying that click, placed there by the advertising service. That reference is sent with your enquiry so that it is possible to tell which advertisement led to it, and it may be sent back to the advertising provider for the same purpose. It is read from the address of the page you are on and is not stored on your device, so it happens whether or not measurement has been accepted. It says nothing about you beyond which advertisement you clicked, it is not used to build a profile, and it is kept for the same period as the enquiry it arrived with. The legal basis is legitimate interests under Article 6(1)(f) GDPR — knowing which advertising works, so that money is not spent on advertising that brings nobody. You can object to it at any time using the contact details in section 1.
Enquiries are not used for marketing and are not added to any marketing list. Enquiries are retained for 12 months from the last exchange, unless the sender becomes a client, in which case section 4 applies.
Chat window
A chat window on this website, and on some client websites, answers visitor questions using information supplied by the business about itself.
- Messages entered into the chat window are transmitted to a third-party artificial intelligence service, acting as a processor, in order to generate a reply.
- Conversations are not retained on the website’s server after a reply is generated. The transcript is held only in the browser’s session storage and is cleared when the tab is closed.
- The provider’s terms in force at the date of this policy state that conversation content is not used to train its models.
- Where contact details are provided through the chat window, they are transmitted in the same way as a form submission, as described above.
4. Clients
For clients, the following are held: business and contact details, content supplied for the website, and billing records. The legal basis is Article 6(1)(b) GDPR for performance of the contract, and Article 6(1)(c) GDPR for records required to be kept by law.
Billing records are retained for six years from the end of the tax year to which they relate, as required by Irish tax law. Where a Revenue enquiry or appeal is open, the records concerned are retained until it is concluded. Other client data is retained for the duration of the engagement and for 24 months afterwards.
5. Marketing contact with businesses
Categories of personal data
Where a business or organisation is contacted about website services, the following categories of data are held:
- Business, firm or club name
- A business contact email address
- A business telephone number, where publicly listed
- Publicly listed business details: address, opening hours, website address and social media page
- Observations and technical measurements recorded from the organisation’s own public website, together with the resulting priority rating and a suggested opening point for the message
- A record of correspondence sent, the date sent, and any reply
No payment data is held. Publicly available information about an organisation’s website — including automated technical measurements of its loading speed, its display on a mobile device, whether it offers contact facilities, whether it is served securely, and the publishing platform it is built on — is evaluated automatically to rate how likely website services are to be relevant to that organisation, to rank it against others, and to suggest an opening point for the message. It is used only to decide whether and how to make contact. It does not produce legal or similarly significant effects, and Article 22 GDPR does not apply.
Source of the data
This data is not obtained from the data subject. It is obtained from publicly accessible sources, namely:
- The organisation’s own website and public social media pages
- Governing-body and association directories, for example the Irish Taekwon-Do Association club directory
- Publicly available professional registers, for example the Law Society of Ireland’s register of practising solicitors and firms
- Publicly available business and map listings
The specific source from which a given organisation’s details were obtained is identified in the first message sent to it.
Purpose and legal basis
The purpose is to make businesses that may require website design services aware of those services, and to keep a record sufficient to avoid contacting the same organisation twice.
The legal basis is legitimate interests under Article 6(1)(f) GDPR. The legitimate interest pursued is the promotion of the controller’s business services to other businesses. A legitimate interests assessment has been carried out and recorded, and a copy is available on request to the address in section 1.
Electronic marketing is carried out in accordance with Regulation 13 of the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336 of 2011).
Right to object and to opt out
There is an absolute right to object to the processing of personal data for direct marketing purposes under Article 21(2) GDPR. On objection, the processing for that purpose stops. No reason need be given.
To object, reply to any message received, or write to ciaran@builtbywinters.ie. No form or account is required.
Suppression records
On objection, the email address and an identifier derived from the business name and telephone number are added to a do-not-contact record. That record is checked before any marketing message is sent. It is retained indefinitely, on the basis of legitimate interests, for the sole purpose of ensuring the objection continues to be honoured, and is used for no other purpose. Erasure of a suppression record can be requested, but would remove the safeguard preventing further contact.
Retention
- Where no reply is received: retained for no longer than 24 months from the last message sent, and deleted at the end of that period.
- Where a reply is received: retained for the duration of the correspondence and for 12 months following the last exchange.
- Where the organisation becomes a client: see section 4.
- Suppression records: retained indefinitely, as set out above.
6. Recipients and transfers
Personal data is disclosed only to the service providers required to operate the business, in the following categories: website hosting, website analytics, email delivery, form handling, artificial intelligence chat services, and invoicing and accounting. Each processes data only on instructions and only for its own part of the service.
Website hosting and website analytics are separate purposes, although both are provided by the same company, Vercel Inc. Analytics and advertising measurement are named here rather than described by category, because they are carried out on the basis of consent, and consent is only informed where the recipient is identified. The named recipients are Vercel Inc. for page-view counting and Google Ireland Limited for Google Analytics and Google Ads conversion measurement. What each receives, and what it does not, is set out in section 2.
Personal data is not sold, rented or disclosed to other marketers.
Some of these providers are established outside the European Economic Area, principally in the United States. Those transfers are made on the basis of an adequacy decision, where one applies, or otherwise under the European Commission’s Standard Contractual Clauses. Data handled by Google Ireland Limited may be transferred to the United States under the EU–US Data Privacy Framework. Details of the safeguard relied on for a given provider are available on request.
Service providers are described by category rather than by name. The current list of named providers is available on request, free of charge, to the address in section 1.
7. Rights
The following rights apply under the GDPR:
- Access to the personal data held, and a copy of it (Article 15)
- Rectification of inaccurate or incomplete data (Article 16)
- Erasure (Article 17)
- Restriction of processing (Article 18)
- Data portability (Article 20)
- Objection to processing, including the absolute right to object to direct marketing (Article 21)
Requests should be sent to either contact route in section 1. A response will issue within one month of receipt, free of charge. Where a request is complex or where a number of requests are received, that period may be extended by up to two further months, and notice of any extension will be given within the first month.
Verification of identity may be required before a request is actioned, where there is reasonable doubt as to the identity of the requester.
8. Complaints
Complaints may be made directly to the contact in section 1, and there is a right to lodge a complaint with the supervisory authority:
Data Protection Commission
6 Pembroke Row, Dublin 2, D02 X963
dataprotection.ie
01 765 0100
9. Changes to this policy
This policy is updated when the processing it describes changes, and the date at the top is amended accordingly. The version applicable is the version published at the time of the contact or the visit concerned.