Privacy Policy (GDPR) Template (Ireland)
A privacy policy tells users how you collect, use and protect their personal data. Our free Irish template is built around the GDPR transparency requirements (Articles 13–14), the Data Protection Act 2018, and the expectations of the Data Protection Commission.
Registered Address: 14 Fitzwilliam Square, Dublin 2, D02 N964
Privacy Contact Email: privacy@emeralddigital.ie
Telephone: +353 1 234 5678
Website: https://www.emeralddigital.ie
If you have any queries about this Privacy Policy or our data protection practices, please contact us at the email address above.
(a) Identity and Contact Data: Name, email address, postal address, telephone number, and company name where applicable.
(b) Usage and Technical Data: IP address, browser type and version, time zone setting, browser plug-in types and versions, operating system, pages visited, referring URLs, and clickstream data.
(c) Cookie Data: Preferences, session identifiers, and tracking information collected via cookies and similar technologies — see Section 7 below.
(d) Financial Data: Payment card details (processed directly by our payment processor and not stored by us), billing address, and transaction history.
(e) Communications Data: Content of messages you send us, customer support enquiries, and feedback.
(f) Analytics Data: Aggregated and/or anonymised data about how you interact with our website, collected via third-party analytics services.
(a) Directly from you: When you register an account, complete a form, place an order, contact us via email or telephone, subscribe to our newsletter, or otherwise interact with our services.
(b) Automatically: Through cookies, server logs, and similar technologies when you visit our website — see Section 7 for details.
(c) Third parties: From analytics providers (such as Google Analytics), payment processors, and social media platforms, subject to their own privacy policies. Where we receive data from third parties, we ensure appropriate legal bases and contractual safeguards are in place.
(a) Consent (Art. 6(1)(a)): Where you have given clear, freely given, specific, informed and unambiguous consent. You may withdraw consent at any time by contacting us — withdrawal does not affect the lawfulness of processing before withdrawal.
(b) Contractual Necessity (Art. 6(1)(b)): Where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract.
(c) Legal Obligation (Art. 6(1)(c)): Where processing is necessary to comply with a legal obligation under Irish or EU law, including obligations under the Companies Act 2014, Taxes Consolidation Act 1997, or applicable regulatory requirements.
(d) Legitimate Interests (Art. 6(1)(f)): Where processing is necessary for our legitimate business interests (such as fraud prevention, IT security, and service improvement), provided such interests are not overridden by your fundamental rights and freedoms — we carry out legitimate interests assessments where this basis applies.
Where we process special categories of personal data (Art. 9 GDPR), we rely on an explicit legal basis under Article 9(2) and any applicable provision of the Data Protection Act 2018.
(a) To provide, operate, and maintain our services and website;
(b) To process and fulfil transactions and send related information including purchase confirmations and invoices;
(c) To manage your account, preferences, and communications;
(d) To respond to your enquiries, comments, and requests;
(e) To send marketing communications where you have provided consent under Art. 6(1)(a) GDPR — you may unsubscribe at any time by clicking the unsubscribe link or contacting us;
(f) To comply with legal obligations, including Irish Revenue, the Companies Registration Office (CRO), and regulatory requirements;
(g) To prevent fraud and ensure the security of our systems; and
(h) To improve and personalise our services based on how users interact with our website.
(a) Data Processors (Art. 28 GDPR): Third-party service providers who process personal data on our behalf under written data processing agreements, including hosting providers, IT support, payment processors, analytics providers, and email service providers. Each processor is required to implement appropriate technical and organisational measures and to process data only on our documented instructions.
(b) Payment Processors: When you make a payment, your payment card data is processed directly by our PCI DSS-compliant payment processor (e.g. Stripe Ireland Ltd, a data processor regulated in Ireland). We do not store full card details on our systems.
(c) Professional Advisers: Solicitors, accountants, and auditors bound by professional duties of confidentiality, where necessary for legal or financial compliance.
(d) Public Authorities: Where we are legally required to disclose data, for example to the Revenue Commissioners, An Garda Síochána, the Data Protection Commission (DPC), or a court of competent jurisdiction.
International Transfers (GDPR Chapter V): Some of our service providers are located outside the EU/EEA. In such cases, we ensure that transfers are subject to appropriate safeguards, primarily Standard Contractual Clauses (SCCs) approved by the European Commission, or an EU adequacy decision. You may request a copy of the relevant transfer mechanisms by contacting us.
We use the following categories of cookies:
(a) Strictly Necessary Cookies: Essential for the website to function — these do not require consent and cannot be disabled without affecting core functionality (e.g. session cookies, security cookies).
(b) Analytics and Performance Cookies: Help us understand how visitors interact with our website (e.g. Google Analytics, Hotjar). These are only placed with your consent.
(c) Functional Cookies: Allow the website to remember choices you make to provide a more personalised experience — placed with consent.
(d) Marketing / Targeting Cookies: Used to deliver advertising relevant to your interests — placed only with your prior consent under S.I. No. 336/2011.
You can manage your cookie preferences at any time through our cookie consent banner or your browser settings. Withdrawing consent for non-essential cookies will not affect the lawfulness of prior processing.
Our general retention schedule is: 3 years from last interaction, or as required by Irish law. Specific retention periods vary by data category:
(a) Customer transaction records — 7 years from the date of the transaction, in accordance with the Taxes Consolidation Act 1997 and Revenue guidance;
(b) Employee records — duration of employment plus 7 years;
(c) Marketing data — until consent is withdrawn or 2 years from last interaction, whichever is earlier;
(d) Technical/usage data — up to 26 months unless anonymised sooner.
Where personal data is no longer required, we will securely delete, destroy, or anonymise it in compliance with our data retention procedures.
(a) Right of Access (Art. 15): To obtain a copy of the personal data we hold about you, and information about how it is processed (Subject Access Request — SAR).
(b) Right to Rectification (Art. 16): To have inaccurate or incomplete personal data corrected without undue delay.
(c) Right to Erasure / 'Right to be Forgotten' (Art. 17): To request deletion of your personal data in certain circumstances (e.g. withdrawal of consent, data no longer necessary).
(d) Right to Restriction of Processing (Art. 18): To restrict how we process your data in certain circumstances.
(e) Right to Data Portability (Art. 20): To receive personal data you provided to us in a structured, commonly used and machine-readable format, and to transmit it to another controller.
(f) Right to Object (Art. 21): To object to processing based on legitimate interests or for direct marketing purposes — where you object to direct marketing, we will cease processing immediately.
(g) Rights in Relation to Automated Decision-Making (Art. 22): Not to be subject solely to automated decision-making, including profiling, which produces legal or similarly significant effects.
To exercise any of these rights, please contact us at privacy@emeralddigital.ie. We will respond within one calendar month of receiving your request (extendable by two months for complex requests — we will inform you). We may need to verify your identity before processing your request. We do not charge a fee unless a request is manifestly unfounded or excessive.
Right to Lodge a Complaint with the DPC: If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Commission (DPC), Ireland's supervisory authority under Article 51 GDPR: Data Protection Commission, 21-25 Canal Road, Dublin 6, D06 YK07. Website: www.dataprotection.ie. Telephone: +353 57 868 4757.
(a) Encryption of personal data in transit (TLS/SSL) and at rest where appropriate;
(b) Access controls and authentication — data is accessible only to authorised personnel on a need-to-know basis;
(c) Regular security testing, vulnerability assessments, and staff training;
(d) Business continuity and data recovery procedures.
In the event of a personal data breach, we will notify the Data Protection Commission within 72 hours of becoming aware in accordance with Article 33 GDPR, and will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Article 34 GDPR).
Emerald Digital Solutions Ltd.
14 Fitzwilliam Square, Dublin 2, D02 N964
Email: privacy@emeralddigital.ie
Tel: +353 1 234 5678
You have the right at any time to complain to the Data Protection Commission (DPC), the Irish supervisory authority for data protection matters:
Data Protection Commission, 21-25 Canal Road, Dublin 6, D06 YK07
Website: www.dataprotection.ie | Email: info@dataprotection.ie | Tel: +353 57 868 4757
We would, however, appreciate the opportunity to address your concerns directly before you approach the DPC, and encourage you to contact us in the first instance.
This Privacy Policy is governed by the laws of Ireland, the GDPR (EU 2016/679) as applicable in Ireland, and the Data Protection Act 2018.
What Is a Privacy Policy?
A privacy policy (sometimes called a privacy notice or privacy statement) is a public-facing document through which an organisation tells data subjects how it processes their personal data. It is the primary way an organisation complies with the transparency obligations in Articles 13 and 14 of the GDPR.
In Ireland, organisations that process personal data must comply with the General Data Protection Regulation (EU) 2016/679 (GDPR) as given further effect by the Data Protection Act 2018. The Data Protection Commission (DPC) is the national supervisory authority and enforces compliance through audits, investigations and fines. The Irish DPC is also the lead supervisory authority for many of the world’s largest tech companies headquartered in Dublin.
A well-drafted privacy policy identifies the data controller, the categories of personal data processed, the lawful bases under Article 6 GDPR, retention periods, recipients and international transfers, data-subject rights, and how to complain to the DPC. It must be written in clear, plain language and be easily accessible.
What's Covered in This Template
The template includes every clause expected of an Irish GDPR-compliant privacy policy.
Controller Identity
Name, address with Eircode, and contact details of the data controller.
DPO Contact (if appointed)
Data Protection Officer contact details where one is required.
Categories of Personal Data
Identity, contact, technical, usage, and any special-category data.
Sources of Data
Collected directly, from third parties, or from public sources.
Purposes and Lawful Bases
Each processing purpose mapped to an Article 6 lawful basis.
Legitimate Interests Assessment
Brief summary where Article 6(1)(f) is relied on.
Special-Category Data
Article 9 conditions where applicable (health, biometric, racial).
Recipients of Data
Processors, service providers and group companies receiving data.
International Transfers
Transfers outside the EEA and safeguards (SCCs, adequacy).
Retention Periods
How long data is kept and the criteria for deletion.
Data Subject Rights
Access, rectification, erasure, restriction, portability, objection, and DPC complaint.
Cookies and Analytics
Signposting to a cookie policy under the ePrivacy Regulations.
How to Create a Privacy Policy
Publish a GDPR-compliant Irish privacy policy in minutes.
- 1
Enter Controller Details
Provide the data controller’s legal name, address with Eircode, and DPO contact if one is appointed.
- 2
Map Data Categories and Purposes
List each category of personal data you process and the purpose for which you use it.
- 3
Identify Lawful Bases
Map each purpose to an Article 6 lawful basis (consent, contract, legal obligation, legitimate interests).
- 4
Describe Recipients and Transfers
State which processors and third parties receive data, and any transfers outside the EEA.
- 5
Review and Publish
Review retention periods, data-subject rights and cookie signposting, and publish the policy on your website.
Legal Considerations in Ireland
Privacy compliance in Ireland is driven by GDPR, the Data Protection Act 2018 and sector-specific rules.
This template is for information only and is not legal advice. Consult an Irish data-protection solicitor for complex processing, international transfers, or high-risk activities.
Drafted for Irish data-protection law
GDPR Transparency (Articles 13–14)
Articles 13 and 14 of the GDPR require controllers to provide specific information to data subjects, including identity, lawful basis, purposes, recipients, retention, rights and how to complain. Information must be concise, transparent, intelligible and in clear plain language.
Data Protection Act 2018
The Data Protection Act 2018 gives further effect to the GDPR in Ireland and establishes the Data Protection Commission. It deals with matters including children’s data (digital age of consent: 16), special-category data, and freedom of expression.
Lawful Bases under Article 6
Every processing activity must have a lawful basis: consent, contract, legal obligation, vital interests, public task, or legitimate interests. For special-category data under Article 9, an additional condition must also be satisfied.
International Transfers
Transfers outside the EEA require a valid transfer mechanism under Chapter V of the GDPR: adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or derogations. Post-Schrems II, a transfer impact assessment may also be required.
Frequently Asked Questions
Create Your Privacy Policy Now
Publish a clear, GDPR-compliant privacy policy in minutes. Download the PDF and upload to your website.
Free · Instant PDF · No account required