Privacy Policy

1 Introduction

This Privacy Policy explains how Caladruo Farm ("we", "us", "our") collects, processes, stores, and protects personal data when you visit our website at www.caladruo.com, contact us by phone, email, or post, visit our farm or farm shop in person, or purchase our products at farmers' markets across Munster. Caladruo Farm is the data controller responsible for your personal data under the General Data Protection Regulation (GDPR) and the Irish Data Protection Acts 1988 to 2018.

Our registered business name is Caladruo Farm, operated by Seamus and Deirdre O'Sullivan. Our registered address is Kilbrogan Hill, Bandon, Co. Cork, P72 TY86, Ireland. We are committed to protecting and respecting your privacy. We ask that you read this policy carefully so you understand what data we gather, why we gather it, and what we do with it. If any aspect of this policy is unclear, please reach out to us using the contact details provided in Section 13.

By using our website or providing your personal information to us through any other channel, you acknowledge that you have read and understood this Privacy Policy. We do not require you to provide personal data to browse most areas of our website, but certain features such as our contact form will require limited information from you to function properly.

2 What Data We Collect

We collect and process the following categories of personal data, depending on how you interact with us:

Identity and Contact Data

First name and last name as provided on our contact form or in correspondence
Email address
Telephone number (when voluntarily provided)
Postal address (for delivery or wholesale customers)

Technical and Usage Data

IP address (anonymised where possible)
Browser type and version
Operating system and device information
Pages visited, time spent on pages, and navigation paths
Referring website addresses
Cookie identifiers and similar tracking data

Communication Data

The content of messages you send through our contact form
Email correspondence between you and Caladruo Farm
Subject matter and topic selection from our contact form dropdown

3 How We Collect Data

We collect personal data through several channels. The method of collection depends on the nature of your interaction with Caladruo Farm.

Direct interactions: You provide data directly to us when you fill in our website contact form, send us an email at [email protected], telephone us at +353 23 882 1045, place an order for potatoes (whether online, by phone, or at a farmers' market), or visit our farm shop and provide your details for a delivery or repeat order. All data provided directly is given voluntarily by you.

Automated technologies: When you browse our website, we automatically collect certain technical data about your device, browsing actions, and usage patterns. We collect this data using cookies and server log files. Our web hosting provider records standard server logs that include IP addresses, request timestamps, and pages served. If you have accepted analytics cookies, we use Google Analytics to understand how visitors navigate and use our website. Google Analytics uses first-party cookies to track visitor interactions. The information generated is transmitted to and stored by Google on servers that may be located outside Ireland.

Third parties: We do not currently purchase or obtain personal data from third-party data brokers or list providers. If this changes in the future, we will update this policy and obtain your consent where required before processing any such data.

4 Why We Collect Data (Legal Basis)

Under the General Data Protection Regulation (GDPR), we must have a valid legal basis for processing your personal data. The specific basis depends on the type of processing activity:

Consent (Article 6(1)(a))

When you submit our contact form, you provide consent for us to process your name, email, and message in order to respond to your enquiry. When you accept analytics or marketing cookies, you consent to the collection of browsing data. You may withdraw consent at any time by contacting us or adjusting your browser cookie settings.

Contract Performance (Article 6(1)(b))

When you place an order for potatoes, we process your name, address, phone number, and order details as necessary to fulfil the contract between you and Caladruo Farm. This includes delivering your potatoes and communicating about your order.

Legitimate Interest (Article 6(1)(f))

We have a legitimate interest in understanding how visitors use our website so we can improve its design and content. We also have a legitimate interest in maintaining the security of our website and protecting against misuse. These interests are balanced against your rights and freedoms, and we take steps to minimise the impact on your privacy, including IP anonymisation in analytics.

Legal Obligation (Article 6(1)(c))

We may process certain data to comply with legal requirements, such as tax and accounting obligations under Irish law.

5 How We Use Data

We use the personal data we collect for the following specific purposes:

Responding to enquiries: When you contact us through our website form, email, or phone, we use your name, email address, and the content of your message to provide a timely and helpful response. Typically, we reply within one working day.
Order fulfilment: For wholesale and direct customers, we use contact and delivery details to process, pack, and deliver potato orders. We may also contact you about order status, delivery schedules, or seasonal availability.
Website improvement: We analyse aggregated and anonymised usage data to understand which pages are most visited, how visitors navigate the site, and where improvements can be made. This helps us create a better experience for all visitors.
Security and fraud prevention: Server logs and technical data help us identify and respond to suspicious activity, protect against spam and abuse, and maintain the integrity of our website.
Legal compliance: Where required by Irish or EU law, we process data for tax reporting, accounting records, and responses to lawful requests from regulatory authorities.

We do not use your personal data for automated decision-making or profiling. We do not send unsolicited marketing emails. If we ever introduce an email newsletter, subscription will be entirely voluntary and you will be able to unsubscribe at any time.

6 Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Below are our specific retention periods for each category of data:

Data Type	Retention Period
Contact form submissions	2 years from the date of submission
Email correspondence	2 years from the last communication
Order and delivery records	6 years (Irish tax and accounting requirements)
Analytics data (Google Analytics)	14 months from collection
Server logs	90 days
Cookie consent preferences	13 months from the date of consent

When data reaches the end of its retention period, we securely delete or anonymise it so that it can no longer be associated with you. If you request erasure of your data before the retention period expires, we will comply promptly unless we have a legal obligation to retain it.

7 Data Sharing

We do not sell, rent, or trade your personal data to third parties. We never have and never will. We share data only with the following categories of service providers, and only to the extent necessary for the purposes described in this policy:

Website hosting provider: Our website is hosted on servers within the European Economic Area (EEA). The hosting provider processes technical data (IP addresses, server logs) on our behalf under a data processing agreement.
Google Analytics (Google Ireland Limited): If you accept analytics cookies, anonymised usage data is shared with Google Analytics for the purpose of website performance analysis. Google acts as a data processor under our instructions.
Email service provider: We use a professional email service to manage correspondence. Emails you send to us and our replies are processed through this service under a data processing agreement.
Accountant and tax advisor: Order and financial records may be shared with our accountant for the purpose of tax reporting and compliance with Irish Revenue requirements.

We may also disclose personal data if required to do so by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Caladruo Farm, our customers, or others.

8 International Transfers

Our website is hosted within the European Economic Area (EEA), and the majority of your data remains within Ireland and the EEA. However, some of our service providers, particularly Google (for Google Analytics), may transfer data to servers located in the United States or other countries outside the EEA.

Where personal data is transferred outside the EEA, we ensure that appropriate safeguards are in place. These safeguards include the European Commission's Standard Contractual Clauses (SCCs), which are legally binding contractual obligations on the data recipient to protect your data to the standard required by European law. Google relies on SCCs and the EU-US Data Privacy Framework for transfers to the United States.

If you would like further details about the specific safeguards applied to international transfers of your data, please contact us using the details in Section 13.

9 Your Rights

Under the General Data Protection Regulation (Articles 15 to 22), you have the following rights regarding your personal data. These rights apply to all individuals whose data we process, regardless of where they are located:

Right of Access (Article 15)

You have the right to request a copy of the personal data we hold about you. We will provide this within 30 days of receiving your request, free of charge.

Right to Rectification (Article 16)

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it without undue delay.

Right to Erasure (Article 17)

You have the right to request that we delete your personal data where it is no longer necessary for the purpose it was collected, where you withdraw consent, or where there is no overriding legitimate ground for processing. We will comply unless we have a legal obligation to retain the data.

Right to Restriction (Article 18)

You may request that we restrict the processing of your data in certain circumstances, such as when you contest its accuracy or when you have objected to processing pending verification of our legitimate grounds.

Right to Data Portability (Article 20)

Where processing is based on consent or contract and carried out by automated means, you have the right to receive your data in a structured, commonly used, machine-readable format, and to transmit it to another controller.

Right to Object (Article 21)

You may object to processing based on legitimate interest at any time. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Right to Withdraw Consent (Article 7(3))

Where we rely on consent as the legal basis for processing, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, please contact us at [email protected] or write to us at the postal address listed in Section 13. We will respond to your request within 30 days. We may need to verify your identity before processing certain requests.

If you are not satisfied with how we handle your request, or if you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Irish Data Protection Commission (DPC). The DPC can be contacted at 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland, or through their website at www.dataprotection.ie.

10 Cookies

Cookies are small text files placed on your device when you visit a website. They serve various purposes, from remembering your preferences to helping us understand how visitors interact with our pages. Our website uses the following types of cookies:

Essential Cookies

These cookies are necessary for the website to function properly. They include the cookie consent preference cookie that remembers whether you accepted or rejected non-essential cookies. Essential cookies do not require your consent under EU law.

Cookie name: caladruo_cookies | Duration: 13 months | Purpose: Stores your cookie consent choice

Analytics Cookies

If you accept analytics cookies, we use Google Analytics to collect information about how visitors use our website. This includes pages viewed, time on site, and general geographic region. All IP addresses are anonymised. These cookies are only set after you give consent through our cookie banner.

Cookie names: _ga, _ga_[ID] | Duration: Up to 13 months | Purpose: Distinguishing unique users and sessions

We do not use marketing cookies, retargeting cookies, or third-party advertising cookies on our website.

Managing cookies: You can manage or delete cookies at any time through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, or be notified when a new cookie is set. Please note that if you disable essential cookies, some parts of our website may not function correctly.

You can also change your cookie consent preference on our website at any time by clearing your browser's local storage for our domain, which will cause the cookie consent banner to appear again on your next visit.

11 Children's Privacy

Our website and services are not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe that your child has provided us with personal data without your consent, please contact us immediately at [email protected]. If we become aware that we have collected personal data from a child under 16 without verified parental consent, we will take steps to delete that data from our records as quickly as possible.

Under the Irish Digital Age of Consent, the age at which a child can give their own consent for data processing related to online services is 16 years. For individuals under 16, consent must be given or authorised by the holder of parental responsibility.

12 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. When we make changes, we will update the "Last Updated" date at the top of this page. For significant changes that materially affect how we process your personal data, we will take reasonable steps to notify you, such as displaying a prominent notice on our website homepage.

We encourage you to review this page periodically to stay informed about how we protect your data. Your continued use of our website after any changes are posted constitutes your acknowledgement of the modified policy.

Previous versions of this policy are available upon request. Simply email us at [email protected] and specify which version you require.