Privacy Notice

1. Who is responsible for your information?

Analu Nua is operated by Fiachra Keogh, a sole trader, based in Drumcarraig, Drumalee, Cavan, Ireland (Eircode H12 KV60). This operator is the data controller for the activities described in this notice.

For privacy questions or requests, contact [email protected].

2. Information we collect

When you contact us, we receive the information you provide, such as your name, email address, telephone number, the service you are interested in and your message.

If you arrange a visit, we may also need appointment details and records of communications about your booking. Where payments are taken, relevant transaction information is handled as described in the provider details below.

Website operation may involve technical information such as your IP address, browser information, access times and security logs. The actual information collected and providers involved are:

• Website hosting. Cloudflare serves the pages of this website. Like any web server, it receives your IP address, your browser’s details and the address of the page you ask for, so that it can deliver the page and protect the website from attack.
• The enquiry form. What you enter in the form goes to Supabase, which stores it in our booking system in Ireland: your name, your email address or telephone number, how you would like us to reply, the service you are interested in, a preferred date and time of day, and your message. We also keep the date of your enquiry and the version of this notice in force when you sent it. Like the hosting, Supabase receives your IP address and browser details with the request.
• Our email about your enquiry. When your enquiry arrives, our booking system emails its details to our own address so that we see it promptly: your name, your email address or telephone number, how you would like us to reply, the service you are interested in, a preferred date and time of day, and your message. Resend delivers that email to our mailbox at Register 365. It is sent to us, not to you.
• The form’s security check. Cloudflare Turnstile checks that the form is being used by a person rather than an automated program. It loads when you start to use the form and reads technical signals from your browser and device, such as your IP address and browser details. Our booking system asks Cloudflare whether the check was passed and records only that it was.
• Bookings and payments. If you become a customer, your contact details, your appointments, the sessions and packages you buy and the payments you make are recorded in the same booking system. This website does not take payments: when you pay us, we record the amount, the date and how you paid.
• The map. Google Maps in the Contact section loads only if you accept the cookie choice or press “Show the map”. Google then receives your IP address and information about your device (section 8).
• Nothing else. The website uses no analytics or advertising service, and neither the website nor our booking system sends you automatic emails or text messages. We reply to you ourselves.

Please keep website enquiries general and avoid including medical records or detailed health information in the message box.

3. Why we use information and our legal bases

The following describes how we use information for this website, and the legal basis for each use:

We do not treat a consultation enquiry as consent to receive promotional messages. If we introduce optional marketing, we will explain the relevant choices and how to unsubscribe.

4. Health information

Information about health receives additional protection under data protection law. If health information is needed to assess suitability or deliver a session, we will explain what is required, how it will be used, who can access it and how long it will be retained before collecting it.

5. Who receives information?

Access is limited to people and service providers who need information for the purposes explained in this notice. Depending on the service, recipients may include authorised business personnel, website and email providers, booking or payment providers, and professional advisers. Information may also need to be disclosed where required by law.

The service providers that receive information through this website are:

• Supabase (opens in a new tab), which stores our enquiry and booking records and runs the functions that receive the enquiry form. It acts on our instructions, as our processor.
• Cloudflare (opens in a new tab), which hosts this website and runs the form’s security check (Turnstile (opens in a new tab)). It acts as our processor. It also decides for itself how it uses the security-check signals to improve Turnstile.
• Google (opens in a new tab), only if you load the map in the Contact section. Google decides for itself how it uses that information, under its own privacy policy.
• Resend (opens in a new tab), which delivers the email our booking system sends us about each new enquiry. It acts as our processor.
• Register 365 (opens in a new tab) (Namesco Ireland Limited, part of team.blue), which hosts our email address and holds the messages we exchange with you. It acts as our processor.
• The developer who builds and maintains this website and our booking system, and who may access the records to keep them working and to fix problems. The developer acts on our instructions, as our processor, from within the EEA.

6. International transfers

Our booking system is stored in Ireland. Our providers, or their own service providers, may still access personal data from outside the European Economic Area (EEA), mainly from the United States. Each one protects those transfers as follows:

• Supabase. Supabase Pte. Ltd., in Singapore, provides the service, and it and its own service providers (opens in a new tab), most of them in the United States, may access the data to run and support it. These transfers are covered by the European Commission’s standard contractual clauses, in Supabase’s data processing agreement (opens in a new tab).
• Cloudflare. Cloudflare, Inc. is based in the United States and serves the website from its data centres around the world. It is certified under the EU-U.S. Data Privacy Framework (opens in a new tab), and its data processing agreement (opens in a new tab) applies the standard contractual clauses to any transfer the Framework does not cover.
• Google. If you load the map, Google Ireland Limited provides it, and Google may process the information on servers around the world. Google LLC, in the United States, is certified under the EU-U.S. Data Privacy Framework, and Google uses the standard contractual clauses where they are required (Google’s data transfer frameworks (opens in a new tab)).
• Resend. Resend, Inc. is based in the United States. It sends our email from Ireland and stores it in the United States. It is certified under the EU-U.S. Data Privacy Framework (opens in a new tab), and its data processing agreement (opens in a new tab) includes the standard contractual clauses.
• Register 365. Namesco Ireland Limited is an Irish company. Its data processing agreement (opens in a new tab) allows its own service providers to be based outside the country where the data is stored, and requires transfer protections for any such transfer.

The agreements and the Framework’s list of certified companies are public at the links above. You can also ask us for a copy of these safeguards at [email protected].

7. How long we keep information

We retain information only for as long as it is needed for its purpose or to meet applicable legal requirements. Relevant information may need to be retained longer where necessary for a dispute or legal claim.

Our retention periods or criteria are:

• General enquiries that do not result in a booking: deleted 90 days after we receive them.
• Our email about an enquiry: Resend keeps its copy for 30 days; the copy in our mailbox is deleted with the enquiry, as above.
• Booking and service administration: kept while you are our customer and for six years after your last appointment. We then erase your personal details and notes, and keep the bookings and payments without them.
• Financial records: six years, the period for which Revenue requires business records to be kept.
• Website security logs: we keep none of our own. Supabase keeps its request logs, which include IP addresses, for a short time (currently one day); Cloudflare keeps its own as its privacy policy (opens in a new tab) describes.
• Health-related records, if collected: as set out in the health-data notice.

8. Cookies and similar technologies

This website does not set cookies of its own, and it does not use analytics or advertising cookies. What it does use in your browser is listed here.

• Your cookie choice. We keep your choice (accepted or declined) in your browser’s local storage so that we do not ask you again. It stays on your device and is not sent to us.
• The opening animation. A note in your browser’s session storage records that the animation has played. It is removed when you close the tab.
• Google Maps. The map in the Contact section is provided by Google. It loads only if you accept the cookie choice or press “Show the map”. Google may then set cookies and receive information such as your IP address and your device; see Google’s own privacy policy. If you decline, nothing is sent to Google unless you open the place in Google Maps yourself.
• The enquiry form’s security check. To protect the form from automated abuse, it uses a security check supplied by Cloudflare. It loads when you start to use the form.

Counting page views. When a page of this website is shown, your browser tells our booking system which page it is and the name of the website you came from, if any. We add one to that day’s count for the page, the kind of website (none, a search engine, a social network, another website or this one) and the kind of device (phone, tablet or computer), and keep only those counts. The count keeps no IP address, no address of the page you came from and nothing else that could identify you or your device, and nothing is stored in your browser for it.

You can change or withdraw your cookie choice at any time, as easily as you made it, with “Cookie settings” at the foot of every page.

9. Your rights

Depending on the circumstances, you may ask to access or correct your personal information, have it erased, restrict its use, object to certain processing, or receive eligible information in a portable format. These rights are subject to legal conditions and exceptions.

Where processing relies on consent, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it was withdrawn.

Contact [email protected] to make a request. We may need proportionate information to confirm your identity. We normally respond within one month; if a permitted extension is needed, we will explain why within that first month.

You can also complain to Ireland’s Data Protection Commission at dataprotection.ie (opens in a new tab), or to another competent supervisory authority where applicable.

10. Providing information and automated decisions

Providing information through the enquiry form is voluntary. We need sufficient contact information to reply. If information necessary to arrange a service is not provided, we may be unable to complete the booking.

A person reads each enquiry and replies to it. We do not use solely automated decision-making or profiling that has legal or similarly significant effects on you.

11. Changes to this notice

We may update this notice when our services or data-handling practices change. The current version will be available on this page with its last-updated date. Where required, we will notify you of significant changes.