Authaeon Limited respects your privacy and is committed to protecting your personal data. This Privacy Notice explains what personal data we collect, why we use it, who we may share it with, how long we keep it, and the rights you have under the General Data Protection Regulation (“GDPR”) and applicable Irish data protection law.
1. Who we are
Authaeon Limited is the controller of the personal data described in this Privacy Notice.
Authaeon Limited
CRO No. 813659
Apartment 26, House 3
Linden Court
Grove Avenue
Blackrock
Dublin A94 CD54
Ireland
Email: william.osullivan@authaeon.com
As controller, Authaeon Limited determines why and how the personal data covered by this notice is processed.
We have not appointed a Data Protection Officer. Questions concerning privacy or data protection should be sent to the contact address above.
2. Who this notice applies to
This notice applies to individuals whose personal data we process in connection with Authaeon’s business, including:
- people who make an enquiry about our services;
- people who request a quotation;
- people who submit an enquiry through an Authaeon advertisement or lead form on Facebook or Instagram;
- customers who contract with us personally;
- directors, employees, shareholders, representatives or other contacts of companies and organisations that deal with us;
- prospective customers and business contacts; and
- individuals whose personal data we need to process in order to provide an agreed service.
GDPR protects information relating to natural persons. Information relating solely to a limited company or other legal person is not itself personal data, although information identifying an individual associated with that organisation may be personal data.
3. Personal data we collect
The personal data we collect depends on how you interact with us.
Enquiries and quotation requests
When you contact us through www.authaeon.com, by email, telephone, or another communication channel, we may collect:
- your full name;
- email address;
- telephone number;
- the company or organisation you represent, where applicable;
- the service you are interested in;
- the contents of your enquiry or message; and
- subsequent correspondence with you.
Facebook and Instagram enquiries
Authaeon advertises through services provided by Meta, including Facebook and Instagram.
If you submit an enquiry through a Meta lead form, we may receive:
- your full name;
- email address;
- telephone number;
- answers or information you provide in the lead form; and
- information associated with the enquiry or form that Meta makes available to us.
The information is submitted through Meta’s platform and made available to Authaeon so that we can respond to your enquiry.
Meta Platforms Ireland Limited operates Facebook and Instagram for users in the European region and separately processes information about your use of its platforms in accordance with Meta’s own privacy information.
Submitting an Authaeon lead form through Facebook or Instagram does not give Authaeon unrestricted permission to use your contact details for unrelated marketing.
Customers and service delivery
If you become a customer, we may also process personal data reasonably necessary to:
- establish and manage our relationship with you;
- provide the services you have requested;
- communicate with you about those services;
- prepare quotations, invoices and other business records;
- manage payments;
- comply with legal, accounting and tax obligations; and
- deal with questions, complaints or disputes.
The exact information required depends on the service being provided. We aim to collect only personal data reasonably necessary for that service.
Payments
Payments may be processed through Stripe.
Stripe may collect payment-card and payment-account information directly from you. Authaeon does not store full payment-card details.
We may retain information relating to a payment, such as the amount, payment status, invoice, date and transaction reference, where required for business, accounting or legal purposes.
4. Where we obtain personal data
We obtain personal data primarily:
- directly from you when you contact us;
- from information you submit through our website;
- from information you submit through an Authaeon Facebook or Instagram lead form;
- through correspondence with you during an enquiry or customer relationship; and
- where relevant to providing a service, from another person acting on your behalf or at your request.
Where you submit an enquiry through Facebook or Instagram, Meta acts as the platform through which the information is provided to us.
5. Why we use personal data and our lawful bases
GDPR requires us to have a lawful basis for processing personal data.
Responding to an enquiry or providing a quotation
We use your information to understand your enquiry, communicate with you and, where requested, prepare a quotation.
Where you are personally considering entering into a contract with Authaeon, our lawful basis is Article 6(1)(b) GDPR: taking steps at your request before entering into a contract.
Where you are contacting us on behalf of a company or other organisation, our lawful basis is generally Article 6(1)(f) GDPR: our legitimate interests.
Our legitimate interests are:
- responding to genuine business enquiries;
- communicating with prospective customers and their representatives;
- assessing whether and how we can provide our services; and
- operating and developing our business.
Meta lead enquiries
When you submit an Authaeon lead form through Facebook or Instagram, we use the information you provide to contact you about the service in which you expressed an interest and to respond to your enquiry.
Where you are personally taking steps towards entering into a contract with us, we rely on Article 6(1)(b) GDPR.
Where you are acting for, establishing, or representing a business or organisation and Article 6(1)(b) does not apply to you personally, we rely on Article 6(1)(f) GDPR, based on our legitimate interest in responding to requested business enquiries and offering our services.
We do not rely on a person’s submission of a Meta lead form as blanket consent for unrelated electronic marketing.
Providing our services
Where you personally enter into a contract with Authaeon, processing necessary to provide the agreed service is based on Article 6(1)(b) GDPR.
Where our customer is a company or another legal person and we process the personal data of its directors, employees, representatives or other contacts, we generally rely on Article 6(1)(f) GDPR.
Our legitimate interest is administering the customer relationship and providing the services the organisation has asked us to provide.
Invoicing, accounting and tax compliance
We process information where necessary to issue invoices, maintain business and accounting records and comply with applicable legal and tax requirements.
Depending on the processing involved, our lawful basis is:
- Article 6(1)(c) GDPR — compliance with a legal obligation; and/or
- Article 6(1)(b) GDPR — performance of a contract.
Legal claims and protection of our business
We may retain or use relevant information where reasonably necessary to establish, exercise or defend legal claims, prevent misuse of our services, respond to disputes, or protect our legal rights.
Where no specific legal obligation applies, our lawful basis is Article 6(1)(f) GDPR, based on our legitimate interest in protecting and administering our business and legal rights.
Legal and regulatory requirements
Where legislation, a court order or another binding legal requirement requires us to process or disclose personal data, we rely on Article 6(1)(c) GDPR.
6. Legitimate interests
Where we rely on legitimate interests under Article 6(1)(f) GDPR, we consider whether:
- there is a genuine business purpose for the processing;
- processing the personal data is necessary for that purpose; and
- our interests are overridden by your rights, interests or freedoms.
You have the right to object to processing based on legitimate interests in certain circumstances. See section 14 below.
7. Meta advertising
We use Meta’s advertising services to promote Authaeon’s services on platforms including Facebook and Instagram.
Meta independently determines aspects of how its platforms operate, including how advertisements are selected, displayed and measured. Meta may use automated systems and profiling in connection with advertising on its platforms under its own privacy terms and applicable law.
Where you submit an Authaeon lead form, Meta makes the information you submit available to us so that we can respond.
Once Authaeon receives your lead information, our use of it is governed by this Privacy Notice.
We do not sell lead information received through Meta.
We do not use information received through a Meta lead form to make decisions about you based solely on automated processing that produce legal effects or similarly significant effects.
8. Direct marketing
Responding to an enquiry that you have made is not treated by us as consent to receive unrelated promotional communications.
If we use personal data for electronic direct marketing, we will do so only where permitted by applicable data protection and electronic-communications law.
Where consent is required, we will seek that consent separately.
Where you receive direct marketing from us, you may object to it at any time. Where applicable, electronic marketing communications will provide a straightforward means of opting out.
If you object to processing for direct-marketing purposes, we will stop using your personal data for that purpose.
9. Who we share personal data with
We disclose personal data only where reasonably necessary for the purposes described in this notice.
Recipients or categories of recipients may include the following.
Google Workspace
We use Google Workspace for business email and associated business communications and productivity services.
Personal data contained in emails or related business communications may therefore be processed through Google services on our behalf.
Meta
We use services provided by Meta Platforms Ireland Limited and associated Meta companies to advertise our services and receive enquiries through Facebook and Instagram.
Meta separately processes information about people using its platforms in accordance with its own privacy terms.
Stripe
We use Stripe for payment processing.
Stripe processes payment information required to provide its payment services. Depending on the particular processing activity, Stripe may act as a processor on our behalf or as a separate controller for certain activities required to operate its payment platform and comply with financial-services obligations.
Authaeon does not store full payment-card details.
Other service providers
We may use suppliers that provide services necessary for the secure and effective operation of our business, such as:
- website and IT infrastructure providers;
- communications providers;
- cloud or data-storage providers;
- accounting or professional-services providers; and
- technical support providers.
Such providers receive personal data only to the extent reasonably necessary for their role and are subject to appropriate contractual or legal obligations where required.
Professional advisers and authorities
We may disclose information where reasonably necessary to:
- accountants, solicitors, insurers or other professional advisers;
- courts or parties involved in legal proceedings;
- government departments;
- regulators;
- tax authorities;
- law-enforcement bodies; or
- other public authorities,
where required by law or reasonably necessary to establish, exercise or defend legal rights.
At your request
We may also provide information to another person or organisation where you instruct or authorise us to do so, including where this is necessary to deliver a particular service you have requested.
We do not sell your personal data.
10. International transfers
Some companies we use to operate our business form part of international groups or use infrastructure and subprocessors located outside the European Economic Area (“EEA”).
This means personal data may, in some circumstances, be processed in countries outside the EEA.
Where GDPR requires safeguards for such a transfer, the transfer will be made using an applicable lawful transfer mechanism. Depending on the destination and provider, this may include:
- a European Commission adequacy decision;
- an applicable adequacy framework;
- the European Commission’s Standard Contractual Clauses; or
- another safeguard permitted by Chapter V GDPR.
Google’s data-processing terms provide mechanisms including Standard Contractual Clauses for restricted international transfers where required.
Stripe’s applicable transfer terms provide for recognised transfer mechanisms, including an applicable adequacy framework and Standard Contractual Clauses where required.
Meta is responsible for explaining the safeguards applicable to Meta’s independent processing and international transfers under its own privacy information.
You may contact us using the details in section 1 if you would like further information about a transfer safeguard relevant to personal data that Authaeon controls, including information about how to obtain a copy of applicable safeguards where available.
11. How long we keep personal data
We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, taking account of legal, accounting, contractual and dispute-resolution requirements.
Enquiries that do not become customers
If an enquiry does not proceed to a customer relationship, we will ordinarily delete the enquiry and associated correspondence within 12 months of the last substantive contact.
We may retain particular information for longer where reasonably necessary to deal with a complaint, dispute, legal claim, fraud or other legal requirement.
Customers
Personal data relating to a customer relationship is retained only for as long as necessary for:
- delivery of the service;
- administration of the relationship;
- accounting and tax obligations;
- compliance with applicable law; and
- establishment, exercise or defence of legal claims.
Business, transaction and accounting records that must be retained for Irish tax purposes will generally be retained for six years, subject to any longer period required in a particular case.
Information that does not need to be retained for that period may be deleted earlier.
Payment data
Authaeon does not retain full payment-card details.
Stripe retains information processed through its services in accordance with its own legal and operational retention requirements.
Meta
Copies of Meta lead information held by Authaeon are subject to Authaeon’s retention periods above.
Information retained independently by Meta on Facebook, Instagram or other Meta systems is subject to Meta’s own retention practices.
12. Is providing your personal data mandatory?
Providing personal data when making an initial enquiry is generally voluntary.
However, we need enough information to identify the nature of your enquiry and contact you. If you do not provide sufficient contact information, we may be unable to respond or provide a quotation.
If you decide to purchase a service, certain information may be necessary:
- to enter into or perform the contract;
- to provide the requested service;
- to process payment; or
- to comply with legal requirements.
If required information is not provided, we may be unable to enter into the contract or provide all or part of the service.
13. Special categories of personal data
We do not ordinarily request special-category personal data, such as information concerning health, religious or philosophical beliefs, political opinions, trade-union membership, genetic or biometric information, or sexual orientation, through a general enquiry.
Please avoid including such information in an enquiry unless it is genuinely necessary.
If particular sensitive personal data becomes necessary for a service, we will process it only where an appropriate lawful basis and, where required, an Article 9 GDPR condition applies.
14. Your data-protection rights
Depending on the circumstances and the lawful basis for processing, GDPR may give you the following rights.
Right of access
You may ask whether we process your personal data and request a copy of personal data we hold about you.
Right to rectification
You may ask us to correct inaccurate personal data or complete information that is incomplete.
Right to erasure
You may ask us to delete personal data in circumstances where GDPR gives you a right to erasure.
This right is not absolute. For example, we may need to retain information where required by law or for the establishment, exercise or defence of legal claims.
Right to restriction
You may ask us to restrict processing in circumstances specified by GDPR.
Right to data portability
Where processing is carried out by automated means and is based on consent or a contract, you may have the right to receive personal data you provided to us in a structured, commonly used and machine-readable format and, where technically feasible, have it transmitted to another controller.
Right to object
Where we process personal data on the basis of legitimate interests, you may object on grounds relating to your particular situation.
We will stop the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or processing is necessary for legal claims.
Direct-marketing objection
You have the right to object at any time to processing of your personal data for direct-marketing purposes.
If you do so, we will stop processing your personal data for that purpose.
Withdrawal of consent
Where we specifically rely on your consent for a processing activity, you may withdraw that consent at any time.
Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
Most processing described in this notice does not depend on consent.
15. Exercising your rights
To exercise a data-protection right, contact: william.osullivan@authaeon.com
We may need to request sufficient information to verify your identity before acting on a request.
We will respond without undue delay and normally within one month.
Where permitted by GDPR, that period may be extended by up to two further months where necessary because of the complexity or number of requests. If an extension is required, we will inform you within the initial one-month period and explain the reason.
Data-protection requests are normally dealt with free of charge. GDPR permits a reasonable fee or refusal in limited circumstances where requests are manifestly unfounded or excessive.
16. Automated decision-making and profiling
Authaeon does not make decisions about customers or prospective customers based solely on automated processing, including profiling, where those decisions produce legal effects or similarly significantly affect the individual.
Meta may separately use automated processing and profiling to operate its advertising platform, personalise content or determine advertisement delivery. That processing is undertaken by Meta under its own privacy arrangements and is not an automated decision made by Authaeon about whether to provide you with our services.
17. Security
We take appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental or unlawful loss, destruction, alteration, disclosure and other unlawful processing.
We seek to limit access to personal data to persons and service providers that reasonably need access for legitimate business purposes.
No method of electronic transmission or storage can guarantee absolute security, but we review our practices and the services we use with the aim of maintaining protection appropriate to the nature of the information involved.
18. Cookies and similar technologies
Cookies and similar tracking technologies are subject to separate rules under Irish electronic-communications law.
Where www.authaeon.com uses a cookie or similar technology that is not strictly necessary for a service requested by the user, we will provide appropriate information and obtain consent where required.
The fact that you have encountered Authaeon through an advertisement on Facebook or Instagram does not itself mean that you have consented to tracking technologies on www.authaeon.com.
19. Third-party platforms
Our website or communications may link to third-party websites or platforms, including Facebook, Instagram, Google or Stripe.
Those organisations may process personal data independently under their own privacy notices. Authaeon is not responsible for processing undertaken independently by a third party outside Authaeon’s control.
You should review the privacy information provided by the relevant third party if you wish to understand its separate processing practices.
20. Complaints
If you have a concern about how we process your personal data, we encourage you to contact us first so that we can investigate it.
You also have the right to lodge a complaint with the Irish supervisory authority:
Data Protection Commission
www.dataprotection.ie
You may also have the right to complain to another competent supervisory authority where applicable under GDPR.
21. Changes to this Privacy Notice
We may update this Privacy Notice where our services, suppliers, processing activities or legal obligations change.
The current version will be published on www.authaeon.com and will show the date on which it was last updated.
Where a change materially affects how we use personal data, we will take appropriate steps to bring the change to the attention of affected individuals where required.
If we intend to use personal data for a new purpose that is materially different from the purpose for which it was originally collected, we will provide the information required by GDPR before beginning that further processing.
22. Contact
Questions about this Privacy Notice, our processing of personal data, or your data-protection rights can be sent to:
Authaeon Limited
CRO No. 813659
Apartment 26, House 3
Linden Court
Grove Avenue
Blackrock
Dublin A94 CD54
Ireland