1. Controller and contact details
Built by Winters, a sole trader established in Co. Wicklow, Ireland, is the controller of the personal data described in this policy.
Ciarán Winters, Built by Winters
Co. Wicklow, Ireland
086 164 1680
ciaran@builtbywinters.ie
Contact form
No Data Protection Officer has been appointed, as the criteria in Article 37 GDPR do not apply. Data protection queries should be sent to the address above. Objections to marketing contact are dealt with in section 5.
2. Visitors to this website
As at the date at the top of this policy, this website does not use analytics, visitor statistics, advertising pixels or tag management, and does not track visitors across other websites. Any change will be reflected here and in the Cookie Policy before it takes effect.
This site sets no cookies of its own. Information is instead stored in the browser’s own local and session storage for two purposes: to record that the site notice has been dismissed, and to retain the contents of a chat conversation for the duration of the browser session. Session storage is cleared by the browser when the tab is closed.
Storing or accessing information on a device is governed by Regulation 5 of S.I. No. 336 of 2011 whether or not a cookie is used. Both entries above are exempt from the consent requirement because each is strictly necessary to provide a service explicitly requested by the user: to honour the dismissal of the notice, and to maintain the chat conversation the user has opened. Neither is used to identify or measure visitors.
The hosting provider records standard server logs, including the page requested, IP address and approximate location, for network security and service availability. The legal basis is legitimate interests under Article 6(1)(f) GDPR. Those logs are held by the provider and their retention is determined by the provider.
The Cookie Policy sets out the individual storage entries and how to clear them.
3. Enquiries and forms
Contact and enquiry forms, on this website and on client websites built by Built by Winters, collect the data entered into them, typically a name, email address, telephone number and message.
- On this website, enquiries are received and used to respond to the enquiry. The legal basis is Article 6(1)(b) GDPR, steps taken at the request of the data subject prior to entering into a contract.
- On a client’s website, the enquiry is delivered to that business, which is the controller of it and determines its retention.
Form submissions are transmitted through a third-party form delivery service, which processes the message in order to deliver it, and are then carried by an email service provider.
Enquiries are not used for marketing and are not added to any marketing list. Enquiries are retained for 12 months from the last exchange, unless the sender becomes a client, in which case section 4 applies.
Chat window
A chat window on this website, and on some client websites, answers visitor questions using information supplied by the business about itself.
- Messages entered into the chat window are transmitted to a third-party artificial intelligence service, acting as a processor, in order to generate a reply.
- Conversations are not retained on the website’s server after a reply is generated. The transcript is held only in the browser’s session storage and is cleared when the tab is closed.
- The provider’s terms in force at the date of this policy state that conversation content is not used to train its models.
- Where contact details are provided through the chat window, they are transmitted in the same way as a form submission, as described above.
4. Clients
For clients, the following are held: business and contact details, content supplied for the website, and billing records. The legal basis is Article 6(1)(b) GDPR for performance of the contract, and Article 6(1)(c) GDPR for records required to be kept by law.
Billing records are retained for six years from the end of the tax year to which they relate, as required by Irish tax law. Where a Revenue enquiry or appeal is open, the records concerned are retained until it is concluded. Other client data is retained for the duration of the engagement and for 24 months afterwards.
5. Marketing contact with businesses
Categories of personal data
Where a business or organisation is contacted about website services, the following categories of data are held:
- Business, firm or club name
- A business contact email address
- A business telephone number, where publicly listed
- Publicly listed business details: address, opening hours, website address and social media page
- Observations and technical measurements recorded from the organisation’s own public website, together with the resulting priority rating and a suggested opening point for the message
- A record of correspondence sent, the date sent, and any reply
No payment data is held. Publicly available information about an organisation’s website — including automated technical measurements of its loading speed, its display on a mobile device, whether it offers contact facilities, whether it is served securely, and the publishing platform it is built on — is evaluated automatically to rate how likely website services are to be relevant to that organisation, to rank it against others, and to suggest an opening point for the message. It is used only to decide whether and how to make contact. It does not produce legal or similarly significant effects, and Article 22 GDPR does not apply.
Source of the data
This data is not obtained from the data subject. It is obtained from publicly accessible sources, namely:
- The organisation’s own website and public social media pages
- Governing-body and association directories, for example the Irish Taekwon-Do Association club directory
- Publicly available professional registers, for example the Law Society of Ireland’s register of practising solicitors and firms
- Publicly available business and map listings
The specific source from which a given organisation’s details were obtained is identified in the first message sent to it.
Purpose and legal basis
The purpose is to make businesses that may require website design services aware of those services, and to keep a record sufficient to avoid contacting the same organisation twice.
The legal basis is legitimate interests under Article 6(1)(f) GDPR. The legitimate interest pursued is the promotion of the controller’s business services to other businesses. A legitimate interests assessment has been carried out and recorded, and a copy is available on request to the address in section 1.
Electronic marketing is carried out in accordance with Regulation 13 of the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336 of 2011).
Right to object and to opt out
There is an absolute right to object to the processing of personal data for direct marketing purposes under Article 21(2) GDPR. On objection, the processing for that purpose stops. No reason need be given.
To object, reply to any message received, or write to ciaran@builtbywinters.ie. No form or account is required.
Suppression records
On objection, the email address and an identifier derived from the business name and telephone number are added to a do-not-contact record. That record is checked before any marketing message is sent. It is retained indefinitely, on the basis of legitimate interests, for the sole purpose of ensuring the objection continues to be honoured, and is used for no other purpose. Erasure of a suppression record can be requested, but would remove the safeguard preventing further contact.
Retention
- Where no reply is received: retained for no longer than 24 months from the last message sent, and deleted at the end of that period.
- Where a reply is received: retained for the duration of the correspondence and for 12 months following the last exchange.
- Where the organisation becomes a client: see section 4.
- Suppression records: retained indefinitely, as set out above.
6. Recipients and transfers
Personal data is disclosed only to the service providers required to operate the business, in the following categories: website hosting, email delivery, form handling, artificial intelligence chat services, and invoicing and accounting. Each processes data only on instructions and only for its own part of the service.
Personal data is not sold, rented or disclosed to other marketers.
Some of these providers are established outside the European Economic Area, principally in the United States. Those transfers are made on the basis of an adequacy decision, where one applies, or otherwise under the European Commission’s Standard Contractual Clauses. Details of the safeguard relied on for a given provider are available on request.
Service providers are described by category rather than by name. The current list of named providers is available on request, free of charge, to the address in section 1.
7. Rights
The following rights apply under the GDPR:
- Access to the personal data held, and a copy of it (Article 15)
- Rectification of inaccurate or incomplete data (Article 16)
- Erasure (Article 17)
- Restriction of processing (Article 18)
- Data portability (Article 20)
- Objection to processing, including the absolute right to object to direct marketing (Article 21)
Requests should be sent to either contact route in section 1. A response will issue within one month of receipt, free of charge. Where a request is complex or where a number of requests are received, that period may be extended by up to two further months, and notice of any extension will be given within the first month.
Verification of identity may be required before a request is actioned, where there is reasonable doubt as to the identity of the requester.
8. Complaints
Complaints may be made directly to the contact in section 1, and there is a right to lodge a complaint with the supervisory authority:
Data Protection Commission
6 Pembroke Row, Dublin 2, D02 X963
dataprotection.ie
01 765 0100
9. Changes to this policy
This policy is updated when the processing it describes changes, and the date at the top is amended accordingly. The version applicable is the version published at the time of the contact or the visit concerned.