Privacy · controller, bases, retention, rights
1. Who the controller is
The controller for personal data processed through this site is Craft of Reporting Ltd, CRO 698412, 8 South Mall, Cork, T12 R5NP, Ireland. Telephone +353 21 486 2270, email [email protected].
The supervisory authority for data protection in Ireland is the Data Protection Commission. You may lodge a complaint with the Data Protection Commission at any time, and you do not have to contact this desk first, although doing so is usually faster for a straightforward request.
2. What is collected, and what is not
Apart from the contact form on the contact page, which only ever runs when you fill it in and submit it, the site collects no personal data through the pages themselves. There is no registration, no login, no comment system, no newsletter sign-up and no payment. No profile is built, no identifier is assigned to you, and nothing you read is associated with any record about you.
Four categories of processing exist in total. First, two items of local storage on your own device, described in the cookie policy. Second, the server records that any web host keeps in order to serve pages and defend against abuse. Third, the content of any email you choose to send to the desk. Fourth, the five fields you submit through the contact form, which reach the same mailbox and are treated in exactly the same way as an email.
| What | Purpose | Legal basis | Retention |
|---|---|---|---|
| Entry-notice record and storage choice | Remember that the notice was dismissed and which storage option you chose | Necessary for a service you requested; consent for the optional analytics setting | Up to twelve months, or until you clear it |
| Hosting request logs | Deliver pages, keep the site available, investigate abuse | Legitimate interests in operating and securing the site | Short operational period set by the host, then deletion or aggregation |
| Email you send to the desk | Read, answer and, for corrections, record why a page changed | Legitimate interests in answering correspondence; legal obligation where a right is exercised | Twelve months for general enquiries; corrections kept with the correction log |
| Contact form: name, email address, route, message, consent | Read, answer and, for corrections, record why a page changed | Legitimate interests in answering correspondence; legal obligation where a right is exercised | Twelve months for general enquiries; corrections kept with the correction log |
| Data-protection requests | Handle and evidence the handling of a request | Legal obligation | Twenty-four months from closure of the request |
3. The contact form
The contact page carries a form with five fields: your name, your email address, the route the message belongs to, the message itself, and a box confirming that you have read this notice. Those five items are the whole of what is asked and the whole of what is submitted. There is no hidden field, no file upload, no tracking parameter and no attempt to work out who you are from anything other than what you type.
What is submitted is used only to answer the enquiry, on the same legal basis as email: legitimate interests in answering correspondence, and legal obligation where the message exercises one of the rights in section seven. It is retained only as long as needed to resolve the matter and to record what was decided, which in practice means twelve months for a general enquiry and, for a correction, retention alongside the correction log because that log is the record of why a page changed. Nothing submitted is used for marketing, profiling or any purpose other than replying to you, and the desk sends no mailing of any kind.
There are no recipients beyond the hosting provider that serves the pages and receives the submission and the mail provider that carries the resulting message to the desk's mailbox, both acting as processors under contract. No third-party form service, no survey platform and no customer-support tool is involved, and the form is served from this domain like every other file here, so submitting it discloses nothing to any other company. The form is not a secure channel: please do not use it for confidential documents, health data, credentials or anything that could identify a protected source, and see section nine for what happens if such material arrives anyway.
4. Consent Mode v2 on this site
Every page sets Consent Mode v2 default signals inline in the head, before anything else runs. Advertising storage, advertising user data and advertising personalisation are set to denied. Analytics storage is set to denied. Functionality storage and security storage are set to granted, and an update wait of five hundred milliseconds is declared.
If you choose to allow analytics storage in the storage banner, that single signal is updated to granted and your choice is remembered. The three advertising signals remain denied permanently and are never updated to granted by any action on this site. There is a practical consequence worth stating plainly: because no analytics or advertising tag is installed at all, allowing analytics storage currently permits nothing to be collected. The signals are set so that the site behaves correctly if a measurement tool is ever added, and adding one would require this notice to be updated first.
5. No external requests
The pages load nothing from another domain: no fonts, no scripts, no stylesheets, no images, no icon services, no video or audio players, no social embeds, no maps and no tracking pixels. Every file referenced by a page is served from this site, which is why the illustrations are hand-written vector drawings and the type is a system font stack. As a result, no third party learns that you visited a page here.
6. Sharing and transfers
Personal data is not sold, rented, exchanged or used for advertising or profiling. The only routine recipients are the hosting provider that stores and serves the files and receives a form submission, and the mail provider that carries messages to and from the desk's mailbox, both acting as processors under contract. Data may be disclosed where a legal obligation requires it, in which case the disclosure is limited to what is required. No transfer outside the European Economic Area is made for the purpose of running this site.
7. Your rights
- Access: to be told whether personal data about you is held, and to receive a copy.
- Rectification: to have inaccurate data corrected and incomplete data completed.
- Erasure: to have data deleted where one of the grounds in the legislation applies.
- Restriction: to have processing limited while an issue is resolved.
- Portability: to receive data you provided in a structured, commonly used format, where applicable.
- Objection: to object to processing based on legitimate interests.
- Withdrawal of consent: to withdraw a consent at any time, which does not affect processing already carried out.
- Complaint: to complain to the Data Protection Commission as the Irish supervisory authority.
Requests may be sent to the desk email address with Privacy as the first word of the subject line, or through the contact form with Personal-data request chosen as the route. The desk replies within five working days and completes straightforward requests within one month. Because so little data exists, most requests are answered by explaining what is held rather than by producing a file. Proportionate verification may be needed where a request concerns identifiable correspondence.
8. Children
The site is written for adults and is not directed at children. No age is collected and no content is restricted by age, but nothing here is designed for or marketed to children, and the desk does not knowingly hold data about them. If you believe a message sent to the desk contains a child's personal data, say so and it will be deleted unless retention is legally required.
9. Security and retention in practice
Email and form submissions are held in one mailbox with access limited to the desk. Correction correspondence is kept with the correction log because the log is the record of why a page changed; where a correction can be recorded without the sender's details, the details are removed. Retention periods in the table above are maximums, and material is deleted earlier where it is no longer needed.
Please do not send confidential source material, identity documents, health or financial details, credentials, or unpublished work, and please do not name a confidential source. Neither the form nor the mailbox is a secure channel, neither can promise confidentiality for unsolicited material of that kind, and anything of the sort is deleted on recognising it rather than filed or forwarded.
10. Changes to this notice
If the processing described here changes, this page is updated before the change takes effect on the site. Any new field on the contact form, any analytics tool and any external request would be described here first, including the data collected, the legal basis and the retention period. The current version of this notice is the one you are reading.