Accurate
Country-specific legal content
Drafted with legal expertise for each jurisdiction, far more thorough than AI-generated drafts that copy generic clauses across borders.
LegalIE
Privacy Policy (GDPR) Template (Ireland)
A privacy policy tells users how you collect, use and protect their personal data. Our free Irish template is built around the GDPR transparency requirements (Articles 13–14), the Data Protection Act 2018, and the expectations of the Data Protection Commission.
Free to useInstant PDFNo account required
PDF (free) + editable Word (.docx) with Expert
PRIVACY POLICY
GDPR And Data Protection Act 2018 · Emerald Digital Solutions Ltd.
Effective: 15 April 2026
Last Updated: 15 April 2026
Emerald Digital Solutions Ltd. ("we", "us", "our") is committed to protecting your privacy and handling your personal data in a transparent manner. This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you visit https://www.emeralddigital.ie or use our services, in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), the Data Protection Act 2018 (DPA 2018), and the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336/2011). Please read this policy carefully before using our services.
1.
WHO WE ARE — DATA CONTROLLER
Emerald Digital Solutions Ltd. is the Data Controller of your personal data within the meaning of Article 4(7) GDPR and section 2 of the Data Protection Act 2018.
Registered Address: 14 Fitzwilliam Square, Dublin 2, D02 N964
Privacy Contact Email: privacy@emeralddigital.ie
Telephone: +353 1 234 5678
Website: https://www.emeralddigital.ie
If you have any queries about this Privacy Policy or our data protection practices, please contact us at the email address above.
Registered Address: 14 Fitzwilliam Square, Dublin 2, D02 N964
Privacy Contact Email: privacy@emeralddigital.ie
Telephone: +353 1 234 5678
Website: https://www.emeralddigital.ie
If you have any queries about this Privacy Policy or our data protection practices, please contact us at the email address above.
2.
WHAT PERSONAL DATA WE COLLECT
We collect and process the following categories of personal data within the meaning of Article 4(1) GDPR:
(a) Identity and Contact Data: Name, email address, postal address, telephone number, and company name where applicable.
(b) Usage and Technical Data: IP address, browser type and version, time zone setting, browser plug-in types and versions, operating system, pages visited, referring URLs, and clickstream data.
(c) Cookie Data: Preferences, session identifiers, and tracking information collected via cookies and similar technologies — see Section 7 below.
(d) Financial Data: Payment card details (processed directly by our payment processor and not stored by us), billing address, and transaction history.
(e) Communications Data: Content of messages you send us, customer support enquiries, and feedback.
(f) Analytics Data: Aggregated and/or anonymised data about how you interact with our website, collected via third-party analytics services.
(a) Identity and Contact Data: Name, email address, postal address, telephone number, and company name where applicable.
(b) Usage and Technical Data: IP address, browser type and version, time zone setting, browser plug-in types and versions, operating system, pages visited, referring URLs, and clickstream data.
(c) Cookie Data: Preferences, session identifiers, and tracking information collected via cookies and similar technologies — see Section 7 below.
(d) Financial Data: Payment card details (processed directly by our payment processor and not stored by us), billing address, and transaction history.
(e) Communications Data: Content of messages you send us, customer support enquiries, and feedback.
(f) Analytics Data: Aggregated and/or anonymised data about how you interact with our website, collected via third-party analytics services.
3.
HOW WE COLLECT PERSONAL DATA
We collect personal data through the following means:
(a) Directly from you: When you register an account, complete a form, place an order, contact us via email or telephone, subscribe to our newsletter, or otherwise interact with our services.
(b) Automatically: Through cookies, server logs, and similar technologies when you visit our website — see Section 7 for details.
(c) Third parties: From analytics providers (such as Google Analytics), payment processors, and social media platforms, subject to their own privacy policies. Where we receive data from third parties, we ensure appropriate legal bases and contractual safeguards are in place.
(a) Directly from you: When you register an account, complete a form, place an order, contact us via email or telephone, subscribe to our newsletter, or otherwise interact with our services.
(b) Automatically: Through cookies, server logs, and similar technologies when you visit our website — see Section 7 for details.
(c) Third parties: From analytics providers (such as Google Analytics), payment processors, and social media platforms, subject to their own privacy policies. Where we receive data from third parties, we ensure appropriate legal bases and contractual safeguards are in place.
4.
LEGAL BASIS FOR PROCESSING
We process your personal data on one or more of the following lawful bases under Article 6 GDPR:
(a) Consent (Art. 6(1)(a)): Where you have given clear, freely given, specific, informed and unambiguous consent. You may withdraw consent at any time by contacting us — withdrawal does not affect the lawfulness of processing before withdrawal.
(b) Contractual Necessity (Art. 6(1)(b)): Where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract.
(c) Legal Obligation (Art. 6(1)(c)): Where processing is necessary to comply with a legal obligation under Irish or EU law, including obligations under the Companies Act 2014, Taxes Consolidation Act 1997, or applicable regulatory requirements.
(d) Legitimate Interests (Art. 6(1)(f)): Where processing is necessary for our legitimate business interests (such as fraud prevention, IT security, and service improvement), provided such interests are not overridden by your fundamental rights and freedoms — we carry out legitimate interests assessments where this basis applies.
Where we process special categories of personal data (Art. 9 GDPR), we rely on an explicit legal basis under Article 9(2) and any applicable provision of the Data Protection Act 2018.
(a) Consent (Art. 6(1)(a)): Where you have given clear, freely given, specific, informed and unambiguous consent. You may withdraw consent at any time by contacting us — withdrawal does not affect the lawfulness of processing before withdrawal.
(b) Contractual Necessity (Art. 6(1)(b)): Where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract.
(c) Legal Obligation (Art. 6(1)(c)): Where processing is necessary to comply with a legal obligation under Irish or EU law, including obligations under the Companies Act 2014, Taxes Consolidation Act 1997, or applicable regulatory requirements.
(d) Legitimate Interests (Art. 6(1)(f)): Where processing is necessary for our legitimate business interests (such as fraud prevention, IT security, and service improvement), provided such interests are not overridden by your fundamental rights and freedoms — we carry out legitimate interests assessments where this basis applies.
Where we process special categories of personal data (Art. 9 GDPR), we rely on an explicit legal basis under Article 9(2) and any applicable provision of the Data Protection Act 2018.
5.
HOW WE USE YOUR PERSONAL DATA
We use your personal data for the following purposes:
(a) To provide, operate, and maintain our services and website;
(b) To process and fulfil transactions and send related information including purchase confirmations and invoices;
(c) To manage your account, preferences, and communications;
(d) To respond to your enquiries, comments, and requests;
(e) To send marketing communications where you have provided consent under Art. 6(1)(a) GDPR — you may unsubscribe at any time by clicking the unsubscribe link or contacting us;
(f) To comply with legal obligations, including Irish Revenue, the Companies Registration Office (CRO), and regulatory requirements;
(g) To prevent fraud and ensure the security of our systems; and
(h) To improve and personalise our services based on how users interact with our website.
(a) To provide, operate, and maintain our services and website;
(b) To process and fulfil transactions and send related information including purchase confirmations and invoices;
(c) To manage your account, preferences, and communications;
(d) To respond to your enquiries, comments, and requests;
(e) To send marketing communications where you have provided consent under Art. 6(1)(a) GDPR — you may unsubscribe at any time by clicking the unsubscribe link or contacting us;
(f) To comply with legal obligations, including Irish Revenue, the Companies Registration Office (CRO), and regulatory requirements;
(g) To prevent fraud and ensure the security of our systems; and
(h) To improve and personalise our services based on how users interact with our website.
6.
SHARING YOUR PERSONAL DATA
We do not sell your personal data. We may share your personal data with the following categories of recipients in the circumstances described:
(a) Data Processors (Art. 28 GDPR): Third-party service providers who process personal data on our behalf under written data processing agreements, including hosting providers, IT support, payment processors, analytics providers, and email service providers. Each processor is required to implement appropriate technical and organisational measures and to process data only on our documented instructions.
(b) Payment Processors: When you make a payment, your payment card data is processed directly by our PCI DSS-compliant payment processor (e.g. Stripe Ireland Ltd, a data processor regulated in Ireland). We do not store full card details on our systems.
(c) Professional Advisers: Solicitors, accountants, and auditors bound by professional duties of confidentiality, where necessary for legal or financial compliance.
(d) Public Authorities: Where we are legally required to disclose data, for example to the Revenue Commissioners, An Garda Síochána, the Data Protection Commission (DPC), or a court of competent jurisdiction.
International Transfers (GDPR Chapter V): Some of our service providers are located outside the EU/EEA. In such cases, we ensure that transfers are subject to appropriate safeguards, primarily Standard Contractual Clauses (SCCs) approved by the European Commission, or an EU adequacy decision. You may request a copy of the relevant transfer mechanisms by contacting us.
(a) Data Processors (Art. 28 GDPR): Third-party service providers who process personal data on our behalf under written data processing agreements, including hosting providers, IT support, payment processors, analytics providers, and email service providers. Each processor is required to implement appropriate technical and organisational measures and to process data only on our documented instructions.
(b) Payment Processors: When you make a payment, your payment card data is processed directly by our PCI DSS-compliant payment processor (e.g. Stripe Ireland Ltd, a data processor regulated in Ireland). We do not store full card details on our systems.
(c) Professional Advisers: Solicitors, accountants, and auditors bound by professional duties of confidentiality, where necessary for legal or financial compliance.
(d) Public Authorities: Where we are legally required to disclose data, for example to the Revenue Commissioners, An Garda Síochána, the Data Protection Commission (DPC), or a court of competent jurisdiction.
International Transfers (GDPR Chapter V): Some of our service providers are located outside the EU/EEA. In such cases, we ensure that transfers are subject to appropriate safeguards, primarily Standard Contractual Clauses (SCCs) approved by the European Commission, or an EU adequacy decision. You may request a copy of the relevant transfer mechanisms by contacting us.
7.
COOKIES
Our website uses cookies and similar technologies. Under the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336/2011), non-essential cookies require your prior informed consent before being placed on your device.
We use the following categories of cookies:
(a) Strictly Necessary Cookies: Essential for the website to function — these do not require consent and cannot be disabled without affecting core functionality (e.g. session cookies, security cookies).
(b) Analytics and Performance Cookies: Help us understand how visitors interact with our website (e.g. Google Analytics, Hotjar). These are only placed with your consent.
(c) Functional Cookies: Allow the website to remember choices you make to provide a more personalised experience — placed with consent.
(d) Marketing / Targeting Cookies: Used to deliver advertising relevant to your interests — placed only with your prior consent under S.I. No. 336/2011.
You can manage your cookie preferences at any time through our cookie consent banner or your browser settings. Withdrawing consent for non-essential cookies will not affect the lawfulness of prior processing.
We use the following categories of cookies:
(a) Strictly Necessary Cookies: Essential for the website to function — these do not require consent and cannot be disabled without affecting core functionality (e.g. session cookies, security cookies).
(b) Analytics and Performance Cookies: Help us understand how visitors interact with our website (e.g. Google Analytics, Hotjar). These are only placed with your consent.
(c) Functional Cookies: Allow the website to remember choices you make to provide a more personalised experience — placed with consent.
(d) Marketing / Targeting Cookies: Used to deliver advertising relevant to your interests — placed only with your prior consent under S.I. No. 336/2011.
You can manage your cookie preferences at any time through our cookie consent banner or your browser settings. Withdrawing consent for non-essential cookies will not affect the lawfulness of prior processing.
8.
DATA RETENTION
In accordance with the storage limitation principle under Article 5(1)(e) GDPR, we retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by Irish or EU law.
Our general retention schedule is: 3 years from last interaction, or as required by Irish law. Specific retention periods vary by data category:
(a) Customer transaction records — 7 years from the date of the transaction, in accordance with the Taxes Consolidation Act 1997 and Revenue guidance;
(b) Employee records — duration of employment plus 7 years;
(c) Marketing data — until consent is withdrawn or 2 years from last interaction, whichever is earlier;
(d) Technical/usage data — up to 26 months unless anonymised sooner.
Where personal data is no longer required, we will securely delete, destroy, or anonymise it in compliance with our data retention procedures.
Our general retention schedule is: 3 years from last interaction, or as required by Irish law. Specific retention periods vary by data category:
(a) Customer transaction records — 7 years from the date of the transaction, in accordance with the Taxes Consolidation Act 1997 and Revenue guidance;
(b) Employee records — duration of employment plus 7 years;
(c) Marketing data — until consent is withdrawn or 2 years from last interaction, whichever is earlier;
(d) Technical/usage data — up to 26 months unless anonymised sooner.
Where personal data is no longer required, we will securely delete, destroy, or anonymise it in compliance with our data retention procedures.
9.
YOUR RIGHTS UNDER GDPR
Under Articles 15-22 of the GDPR and the Data Protection Act 2018, you have the following rights regarding your personal data:
(a) Right of Access (Art. 15): To obtain a copy of the personal data we hold about you, and information about how it is processed (Subject Access Request — SAR).
(b) Right to Rectification (Art. 16): To have inaccurate or incomplete personal data corrected without undue delay.
(c) Right to Erasure / 'Right to be Forgotten' (Art. 17): To request deletion of your personal data in certain circumstances (e.g. withdrawal of consent, data no longer necessary).
(d) Right to Restriction of Processing (Art. 18): To restrict how we process your data in certain circumstances.
(e) Right to Data Portability (Art. 20): To receive personal data you provided to us in a structured, commonly used and machine-readable format, and to transmit it to another controller.
(f) Right to Object (Art. 21): To object to processing based on legitimate interests or for direct marketing purposes — where you object to direct marketing, we will cease processing immediately.
(g) Rights in Relation to Automated Decision-Making (Art. 22): Not to be subject solely to automated decision-making, including profiling, which produces legal or similarly significant effects.
To exercise any of these rights, please contact us at privacy@emeralddigital.ie. We will respond within one calendar month of receiving your request (extendable by two months for complex requests — we will inform you). We may need to verify your identity before processing your request. We do not charge a fee unless a request is manifestly unfounded or excessive.
Right to Lodge a Complaint with the DPC: If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Commission (DPC), Ireland's supervisory authority under Article 51 GDPR: Data Protection Commission, 21-25 Canal Road, Dublin 6, D06 YK07. Website: www.dataprotection.ie. Telephone: +353 57 868 4757.
(a) Right of Access (Art. 15): To obtain a copy of the personal data we hold about you, and information about how it is processed (Subject Access Request — SAR).
(b) Right to Rectification (Art. 16): To have inaccurate or incomplete personal data corrected without undue delay.
(c) Right to Erasure / 'Right to be Forgotten' (Art. 17): To request deletion of your personal data in certain circumstances (e.g. withdrawal of consent, data no longer necessary).
(d) Right to Restriction of Processing (Art. 18): To restrict how we process your data in certain circumstances.
(e) Right to Data Portability (Art. 20): To receive personal data you provided to us in a structured, commonly used and machine-readable format, and to transmit it to another controller.
(f) Right to Object (Art. 21): To object to processing based on legitimate interests or for direct marketing purposes — where you object to direct marketing, we will cease processing immediately.
(g) Rights in Relation to Automated Decision-Making (Art. 22): Not to be subject solely to automated decision-making, including profiling, which produces legal or similarly significant effects.
To exercise any of these rights, please contact us at privacy@emeralddigital.ie. We will respond within one calendar month of receiving your request (extendable by two months for complex requests — we will inform you). We may need to verify your identity before processing your request. We do not charge a fee unless a request is manifestly unfounded or excessive.
Right to Lodge a Complaint with the DPC: If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Commission (DPC), Ireland's supervisory authority under Article 51 GDPR: Data Protection Commission, 21-25 Canal Road, Dublin 6, D06 YK07. Website: www.dataprotection.ie. Telephone: +353 57 868 4757.
10.
DATA SECURITY
In accordance with Article 32 GDPR, we implement appropriate technical and organisational security measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:
(a) Encryption of personal data in transit (TLS/SSL) and at rest where appropriate;
(b) Access controls and authentication — data is accessible only to authorised personnel on a need-to-know basis;
(c) Regular security testing, vulnerability assessments, and staff training;
(d) Business continuity and data recovery procedures.
In the event of a personal data breach, we will notify the Data Protection Commission within 72 hours of becoming aware in accordance with Article 33 GDPR, and will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Article 34 GDPR).
(a) Encryption of personal data in transit (TLS/SSL) and at rest where appropriate;
(b) Access controls and authentication — data is accessible only to authorised personnel on a need-to-know basis;
(c) Regular security testing, vulnerability assessments, and staff training;
(d) Business continuity and data recovery procedures.
In the event of a personal data breach, we will notify the Data Protection Commission within 72 hours of becoming aware in accordance with Article 33 GDPR, and will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Article 34 GDPR).
11.
CHILDREN
Our services are not directed at children. Under Article 8 GDPR and section 29 of the Data Protection Act 2018, Ireland has set the digital consent age at 16 years. We do not knowingly collect personal data from children under 16 years of age without verifiable parental or guardian consent. If we become aware that we have collected personal data from a child under 16 without appropriate consent, we will take prompt steps to delete that data. Parents or guardians who believe their child's data has been collected may contact us at privacy@emeralddigital.ie.
12.
CONTACT US AND DPC COMPLAINTS
For any questions, requests, or concerns regarding this Privacy Policy or our data protection practices, please contact us:
Emerald Digital Solutions Ltd.
14 Fitzwilliam Square, Dublin 2, D02 N964
Email: privacy@emeralddigital.ie
Tel: +353 1 234 5678
You have the right at any time to complain to the Data Protection Commission (DPC), the Irish supervisory authority for data protection matters:
Data Protection Commission, 21-25 Canal Road, Dublin 6, D06 YK07
Website: www.dataprotection.ie | Email: info@dataprotection.ie | Tel: +353 57 868 4757
We would, however, appreciate the opportunity to address your concerns directly before you approach the DPC, and encourage you to contact us in the first instance.
Emerald Digital Solutions Ltd.
14 Fitzwilliam Square, Dublin 2, D02 N964
Email: privacy@emeralddigital.ie
Tel: +353 1 234 5678
You have the right at any time to complain to the Data Protection Commission (DPC), the Irish supervisory authority for data protection matters:
Data Protection Commission, 21-25 Canal Road, Dublin 6, D06 YK07
Website: www.dataprotection.ie | Email: info@dataprotection.ie | Tel: +353 57 868 4757
We would, however, appreciate the opportunity to address your concerns directly before you approach the DPC, and encourage you to contact us in the first instance.
13.
CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time to reflect changes in our data processing practices, technology, legal requirements, or other factors. When we make material changes, we will post the updated policy on our website with a revised effective date and, where appropriate, notify you by email. The current version of this policy is dated 15 April 2026. We encourage you to review this policy periodically. Your continued use of our website or services after any changes constitutes acceptance of the updated policy.
This Privacy Policy is governed by the laws of Ireland, the GDPR (EU 2016/679) as applicable in Ireland, and the Data Protection Act 2018.
This Privacy Policy is governed by the laws of Ireland, the GDPR (EU 2016/679) as applicable in Ireland, and the Data Protection Act 2018.
Available as a print-ready PDF or an editable Microsoft Word (.docx) file.
What Is a Privacy Policy?
A privacy policy (sometimes called a privacy notice or privacy statement) is a public-facing document through which an organisation tells data subjects how it processes their personal data. It is the primary way an organisation complies with the transparency obligations in Articles 13 and 14 of the GDPR.
In Ireland, organisations that process personal data must comply with the General Data Protection Regulation (EU) 2016/679 (GDPR) as given further effect by the Data Protection Act 2018. The Data Protection Commission (DPC) is the national supervisory authority and enforces compliance through audits, investigations and fines. The Irish DPC is also the lead supervisory authority for many of the world’s largest tech companies headquartered in Dublin.
A well-drafted privacy policy identifies the data controller, the categories of personal data processed, the lawful bases under Article 6 GDPR, retention periods, recipients and international transfers, data-subject rights, and how to complain to the DPC. It must be written in clear, plain language and be easily accessible.
What's Covered in This Template
The template includes every clause expected of an Irish GDPR-compliant privacy policy.
Controller Identity
Name, address with Eircode, and contact details of the data controller.
DPO Contact (if appointed)
Data Protection Officer contact details where one is required.
Categories of Personal Data
Identity, contact, technical, usage, and any special-category data.
Sources of Data
Collected directly, from third parties, or from public sources.
Purposes and Lawful Bases
Each processing purpose mapped to an Article 6 lawful basis.
Legitimate Interests Assessment
Brief summary where Article 6(1)(f) is relied on.
Special-Category Data
Article 9 conditions where applicable (health, biometric, racial).
Recipients of Data
Processors, service providers and group companies receiving data.
International Transfers
Transfers outside the EEA and safeguards (SCCs, adequacy).
Retention Periods
How long data is kept and the criteria for deletion.
Data Subject Rights
Access, rectification, erasure, restriction, portability, objection, and DPC complaint.
Cookies and Analytics
Signposting to a cookie policy under the ePrivacy Regulations.
How to Create a Privacy Policy
Publish a GDPR-compliant Irish privacy policy in minutes.
- 1
Enter Controller Details
Provide the data controller’s legal name, address with Eircode, and DPO contact if one is appointed.
- 2
Map Data Categories and Purposes
List each category of personal data you process and the purpose for which you use it.
- 3
Identify Lawful Bases
Map each purpose to an Article 6 lawful basis (consent, contract, legal obligation, legitimate interests).
- 4
Describe Recipients and Transfers
State which processors and third parties receive data, and any transfers outside the EEA.
- 5
Review and Publish
Review retention periods, data-subject rights and cookie signposting, and publish the policy on your website.
Why Doxuno documents are different
Four things that make our templates more thorough than AI-generated drafts and more current than static template libraries.
Always current
Always current with the law
Templates carrying statute references are continuously updated as the law changes. Your document always reflects the current legal framework.
Free PDF
Print-ready PDF
Free to download. Vector text, embedded fonts, statute citations baked in. Print, sign, file. Ready for any signing flow including electronic signature.
Word · .docx
Editable Word (.docx)
Continue editing in Word after download. Add custom clauses, reuse the template for similar agreements, or share with a colleague for collaborative review.
Requires Expert one-time unlock or any paid Doxuno subscription.
Legal Considerations in Ireland
Privacy compliance in Ireland is driven by GDPR, the Data Protection Act 2018 and sector-specific rules.
This template is for information only and is not legal advice. Consult an Irish data-protection solicitor for complex processing, international transfers, or high-risk activities.
Drafted for Irish data-protection law
GDPR Transparency (Articles 13–14)
Articles 13 and 14 of the GDPR require controllers to provide specific information to data subjects, including identity, lawful basis, purposes, recipients, retention, rights and how to complain. Information must be concise, transparent, intelligible and in clear plain language.
Data Protection Act 2018
The Data Protection Act 2018 gives further effect to the GDPR in Ireland and establishes the Data Protection Commission. It deals with matters including children’s data (digital age of consent: 16), special-category data, and freedom of expression.
Lawful Bases under Article 6
Every processing activity must have a lawful basis: consent, contract, legal obligation, vital interests, public task, or legitimate interests. For special-category data under Article 9, an additional condition must also be satisfied.
International Transfers
Transfers outside the EEA require a valid transfer mechanism under Chapter V of the GDPR: adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or derogations. Post-Schrems II, a transfer impact assessment may also be required.
Frequently Asked Questions
Create Your Privacy Policy Now
Publish a clear, GDPR-compliant privacy policy in minutes. Download the PDF and upload to your website.
Free PDF · Editable Word with Expert · No account required