Legal
Privacy Notice
This notice explains what personal data Spatialis collects through this website, why we collect it, how long we keep it, and the rights you have over it. We have written it to be read, not to be survived.
1. Who we are
Spatialis Limited (trading as Spatialis) is the data controller responsible for the personal data described in this notice.
- Registered office: 79 Lindsay Road, Glasnevin, Dublin 9, D09 E7V7, Ireland
- Registered in Ireland, company number: 823817
- Contact for data protection queries: privacy@spatialis.ie
We are not required to appoint a Data Protection Officer under Article 37 GDPR, as we do not carry out large-scale monitoring or large-scale processing of special category data. Data protection queries are handled directly by the directors at the address above.
2. What we collect, and why
2.1 Enquiries made through the contact form
When you use the form on our site we collect the name, email address and message you provide. The form delivers this straight to our inbox by email. It is not stored in a database on this website and it is not shared with any third-party form processing service.
Why: to read your enquiry, reply to it, and — if it leads somewhere — to scope and discuss the work.
Legal basis: Article 6(1)(b) GDPR, taking steps at your request prior to entering a contract; and where an enquiry is general rather than pre-contractual, Article 6(1)(f), our legitimate interest in responding to people who contact our business.
Please do not send confidential, commercially sensitive or special category personal data through the form. Use it to start a conversation; we will agree a secure channel before you send anything substantive.
2.2 Email correspondence
If you email us directly, we hold that correspondence and any information in it on the same basis as above.
2.3 Website analytics
We use Google Analytics 4 to understand how the site is used — which pages people read, roughly where visitors come from, and what device they use. This is set up with IP anonymisation enabled and Google Signals and advertising features switched off.
Analytics only run if you consent. No analytics cookies are set, and no data is sent to Google, unless you accept them in the cookie banner. You can change or withdraw that choice at any time from our Cookie Policy page.
Legal basis: your consent — Article 6(1)(a) GDPR, and Regulation 5(3) of S.I. 336/2011 (the ePrivacy Regulations) for the storing of information on your device.
Full detail of each cookie and its lifespan is in our Cookie Policy.
2.4 Server logs
Our hosting provider automatically records standard technical information — IP address, timestamp, page requested, browser user-agent — for security and to keep the site running. These are ordinary server logs, not analytics, and are retained for a short period by the provider.
Legal basis: Article 6(1)(f), our legitimate interest in the security and reliable operation of the website.
3. What we do not do
- We do not sell, rent or trade personal data. Ever, and to anyone.
- We do not use your data for advertising, retargeting or profiling.
- We do not carry out automated decision-making that produces legal or similarly significant effects (Article 22 GDPR).
- We do not add enquirers to a mailing list without a separate, explicit opt-in.
4. Who else sees the data
We keep the supplier list deliberately short. Personal data may be processed on our behalf by:
| Processor | What they handle | Where |
|---|---|---|
| Hostinger, on servers located in the EU | Website hosting and server logs | the EU |
| Microsoft 365, provisioned through Hostinger on EU servers | Delivery and storage of enquiry emails and correspondence | EU, with possible transfers to the United States |
| Google Ireland Limited / Google LLC | Google Analytics 4 — only where you have consented | EU, with transfers to the United States |
Each processor acts on our documented instructions under a written data processing agreement, as required by Article 28 GDPR.
We may also disclose data where we are legally obliged to — for example to a court, a regulator, or the Data Protection Commission — or to our professional advisers where necessary to establish or defend a legal claim.
5. Transfers outside the EEA
Where a processor above transfers personal data to the United States, that transfer relies on the European Commission's adequacy decision of 10 July 2023 for the EU–US Data Privacy Framework, where the recipient is certified under it, and on the Commission's Standard Contractual Clauses together with supplementary technical measures where it is not.
6. How long we keep it
| Data | Retention period |
|---|---|
| Enquiries that do not lead to an engagement | 12 months from last contact, then deleted |
| Client and project correspondence and records | 6 years from the end of the engagement — the period for bringing a contract claim under the Statute of Limitations 1957, and the period accounting records must be retained under section 285 of the Companies Act 2014 |
| Google Analytics data | 14 months, set at account level, then automatically deleted by Google |
| Server logs | Per our hosting provider's standard retention, typically 30 days or less |
7. Your rights
Under the GDPR and the Data Protection Act 2018 you have the right to:
- Access — get a copy of the personal data we hold about you
- Rectification — have inaccurate data corrected or incomplete data completed
- Erasure — have your data deleted, where no overriding legal ground for keeping it applies
- Restriction — have us pause processing while a dispute about accuracy or legitimate interests is resolved
- Portability — receive data you gave us in a structured, machine-readable format
- Object — object to processing we carry out on legitimate interests grounds
- Withdraw consent — for analytics, at any time, without affecting processing already carried out
To exercise any of these, email privacy@spatialis.ie. We will respond within one month, as Article 12(3) requires. There is no charge. We may ask you to confirm your identity where we cannot otherwise be confident who is making the request.
8. Complaints
If you think we have handled your data badly, tell us first — we would rather fix it. You are also entitled to complain to the Irish supervisory authority at any time:
Data Protection Commission
Head office: 21 Fitzwilliam Square South, Dublin 2, D02 RD28
Complaints by post: 6 Pembroke Row, Dublin 2, D02 X963
Web: www.dataprotection.ie
Telephone: +353 (0)1 765 0100 / 1800 437 437
The DPC does not accept complaints by telephone — they must be submitted in writing or through the webform on their site.
9. Security
The site is served over HTTPS. Access to enquiry email is restricted to the directors and protected by multi-factor authentication. We keep the number of systems holding personal data deliberately small, which is itself a security measure.
10. Changes to this notice
If we change how we handle personal data we will update this notice and revise the version number and date at the top. Where a change is material we will say so prominently on the site. Previous versions are available on request.