Árd na Rí | Sheltered Housing & Independent Living in Cork

1. Introduction

Farranree Sheltered Housing Association Limited, operating as Árd na Rí Residential Complex ("Árd na Rí", "we", "us", "our"), is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect personal data when you visit and interact with our website, located at www.ardnari.ie (the "Website"), particularly when you use our contact form.

We are the Data Controller for the personal data processed through this Website. Our registered details are:

Farranree Sheltered Housing Association Limited

Árd na Rí, Closes Green,

Farranree, Cork,

Ireland

This policy is designed to comply with the EU General Data Protection Regulation (GDPR) and applicable Irish data protection legislation.

2. What Personal Data We Collect

We may collect and process the following types of personal data:

Information You Provide Directly:

When you use our contact form, we collect the information you enter, which may include:

Your First Name and Last Name
Your Email Address
Your Phone Number (if provided)
Your preferred method of contact
Information regarding the urgency of your housing need
Any information you include in the body of your message (which might contain details about your situation or needs)
Confirmation of your consent to process this data

Information Collected Automatically:

When you browse our Website, our hosting provider (Vercel) and its analytics service (Vercel Analytics) may automatically collect certain technical information about your device and browsing actions. This is designed to be privacy-preserving and typically includes:

Anonymized IP address components (used for geolocation but full IP address is generally not stored long-term)
Browser type and version
Device type (e.g., desktop, mobile)
Operating system
Referring site
Pages visited on our Website and interaction paths
Time zone setting and general geographic region
Vercel Analytics aims to provide website statistics without using client-side cookies for tracking individuals across sites.

3. How We Use Your Personal Data and Legal Basis

We use your personal data for the following purposes, relying on specific legal bases under GDPR:

Purpose	Data Used	Legal Basis (GDPR Article 6)
To respond to your inquiries submitted via the contact form	Name, Email, Phone, Message Content, Urgency, Contact Preference	Consent (Art. 6(1)(a)) - You actively provide this data and consent via the checkbox for us to contact you.
To operate, maintain, and improve our Website	Technical data (IP address, browser info, usage patterns)	Legitimate Interests (Art. 6(1)(f)) - To ensure the security and proper functioning of our Website.
To analyse Website usage and performance using aggregated/anonymised data via Vercel Analytics	Aggregated technical data (as described in Sec 2), Usage patterns	Legitimate Interests (Art. 6(1)(f)) - To understand website traffic, improve user experience, and ensure functionality, using privacy-preserving analytics that do not track individuals across sites or rely on tracking cookies. We have balanced this interest against your rights and freedoms.
To comply with legal or regulatory obligations	Any relevant data as required	Legal Obligation (Art. 6(1)(c))

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason that is compatible with the original purpose.

4. Data Storage and Retention

Contact Form Submissions:

Data submitted via the contact form is stored securely in our database hosted on **MongoDB Atlas within Ireland (which is in the European Economic Area - EEA)**. We retain this information for as long as necessary to fully address your inquiry and for a reasonable period thereafter for administrative and follow-up purposes. Specifically, we will retain these records for 12 months after the inquiry is considered resolved and closed, unless you request erasure sooner (subject to your rights and our legal obligations) or a longer retention period is required by law or for legitimate operational needs (e.g., ongoing relationship, legal hold).

Technical Data/Logs:

Website server logs and analytics data processed by our hosting provider (Vercel) containing technical data like anonymized IP components are typically retained for shorter periods needed for security, troubleshooting, and generating aggregated statistics.

Cookie Data:

Retention periods for data collected via cookies vary depending on the cookie type. See Section 5 for more details.

5. Cookies and Tracking Technologies

Our Website uses cookies (small text files placed on your device) primarily for essential functionality and security. We also use Vercel Analytics, which is designed **not** to use cookies for tracking visitors.

Strictly Necessary Cookies:

These are essential for the Website to function correctly (e.g., security features provided by our platform, session management if applicable). They do not require your consent under ePrivacy regulations but are active by default. Our legal basis for processing any related personal data (like IP addresses for security) is Legitimate Interest (Art. 6(1)(f) GDPR) or performance of contract (Art. 6(1)(b) GDPR) if providing a service you requested.

Analytical Tools (Cookie-less):

We use Vercel Analytics to help us understand visitor numbers and how users navigate the site, allowing us to improve it. As mentioned, this service is designed to work **without** placing tracking cookies on your device. It provides aggregated, anonymous statistics. The legal basis for processing related data is our Legitimate Interest (Art. 6(1)(f) GDPR) as described in Section 3.

Functionality Cookies:

We may use cookies to remember choices you make (like language preferences) to enhance your experience. We will only use these non-essential cookies if you provide your explicit consent via our cookie consent banner/tool. The legal basis is Consent (Art. 6(1)(a) GDPR).

Since we primarily use necessary cookies and cookie-less analytics, a detailed cookie consent banner for choosing optional cookies may not be required unless we introduce other non-essential tracking technologies in the future. However, you can usually manage general cookie permissions via your browser settings. Blocking strictly necessary cookies may affect Website functionality.

For more information on Vercel‘s approach to privacy and analytics, please refer to Vercel‘s documentation and privacy policy: Vercel Privacy Policy

6. Data Sharing and Recipients

We do not sell your personal data. We may share your data with the following categories of recipients only when necessary:

Internal Staff: Authorised personnel within Árd na Rí (e.g., receptionists, relevant managers) who need access to respond to your inquiries. Access is granted on a need-to-know basis.
IT Service Providers: Companies that provide essential services for our website operation. These include:
- **Vercel, Inc.:** Provides website hosting, content delivery network (CDN), and analytics services. Vercel is based in the USA.
- **MongoDB, Inc.:** Provides the cloud database hosting (MongoDB Atlas) where our contact form data is stored. While MongoDB, Inc. is US-based, our database cluster itself is located in Ireland (EEA).
These providers act as Data Processors on our behalf and are contractually obligated (via Data Processing Agreements - DPAs) to protect your data and process it only according to our instructions and GDPR requirements.
Legal and Professional Advisors: Such as solicitors or auditors, if required for legal or compliance reasons.
Regulatory Authorities: Such as the Data Protection Commission or law enforcement, if required by law or regulation.

We ensure that any third parties acting as Data Processors have appropriate data processing agreements in place that comply with GDPR.

7. Data Security

We have implemented appropriate technical and organisational security measures to protect your personal data from accidental loss, unauthorised access, use, alteration, or disclosure. These measures include:

Using HTTPS encryption for data transmitted to and from our Website.
Secure storage of contact form data in our database with access controls.
Regular review of our security practices.
Procedures to deal with any suspected personal data breach.

While we strive to protect your personal data, no internet transmission or electronic storage is 100% secure.

8. International Data Transfers

Your personal data is primarily processed and stored within the European Economic Area (EEA). Specifically, contact form data is stored on database servers located in Ireland (EEA).

However, we use certain third-party service providers based outside the EEA, notably **Vercel, Inc.** (based in the USA) for website hosting, CDN, and analytics. When your data is processed by or accessed from outside the EEA (e.g., Vercel‘s platform operations), we ensure a similar degree of protection is afforded to it by implementing appropriate safeguards.

These safeguards typically include:

Ensuring the recipient country is deemed to provide an adequate level of protection for personal data by the European Commission (an "Adequacy Decision").
Implementing Standard Contractual Clauses (SCCs) approved by the European Commission between us and the service provider. Vercel‘s Data Processing Addendum (DPA) incorporates these SCCs.
Verifying if the US-based provider participates in the EU-U.S. Data Privacy Framework (DPF), which provides an adequacy basis for transfers to certified companies.

We have verified that our service providers have committed to appropriate data protection standards. For MongoDB Atlas, although the company is US-based, the data storage and processing for our cluster occurs within the EEA (Ireland). Any potential access from outside the EEA by MongoDB staff (e.g., for support) would also be governed by their DPA and SCCs.

9. Your Data Protection Rights

Under GDPR, you have the following rights regarding your personal data:

Right to Access

Request a copy of the personal data we hold about you.

Right to Rectification

Request correction of inaccurate or incomplete data.

Right to Erasure

Request deletion of your personal data where there is no compelling reason for us to keep processing it.

Right to Restrict Processing

Request suspension of the processing of your data in certain circumstances.

Right to Data Portability

Request transfer of your data to you or another service provider in a structured, commonly used, machine-readable format.

Right to Object

Object to processing based on legitimate interests if you believe your fundamental rights and freedoms override our interests.

Right to Withdraw Consent

Withdraw your consent at any time where we rely on consent as the legal basis for processing (this applies to the contact form submissions and non-essential cookies). Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

10. How to Exercise Your Rights

To exercise any of these rights, please contact us using the details below. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights).

Email: [Provide Official Email Address - e.g., privacy@ardnari.ie or admin@ardnari.ie]

Postal Address: Data Protection Inquiry, Árd na Rí, Closes Green, Farranree, Cork, Ireland

We aim to respond to all legitimate requests within one month.

11. Right to Lodge a Complaint

You have the right to lodge a complaint with the Irish Data Protection Commission (DPC) if you believe that our processing of your personal data infringes data protection law.

Website: https://www.dataprotection.ie/

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on this page and updating the "Last Updated" date. We encourage you to review this policy periodically.

13. Contact Us

If you have any questions about this Privacy Policy or our data protection practices, please contact us: