Tree Story at Nine Oaks Wood

Tree Story at Nine Oaks Wood (“we”, “us”, “our”) is committed to protecting your personal data. This Privacy Policy explains what information we collect, how we use it, and your rights under the General Data Protection Regulation (GDPR) (EU) 2016/679 and the Data Protection Acts 1988–2018 (as amended).

1. Who we are

The data controller is:
Tree Story at Nine Oaks Wood
Nine Oaks Wood, Ballymartin, Co. Carlow, Ireland
Email: info@treestory.ie

2. What personal data we collect

Contact enquiries

When you submit the contact form we collect your name, email address, subject, and message. This information is used solely to respond to your enquiry.

Account registration

If you create an account (currently available to administrators only) we collect your name, email address, and a hashed password. Passwords are never stored in plain text.

Technical data

When you visit our website, our hosting and infrastructure providers may automatically collect standard server log data, including your IP address, browser type, and pages visited. We do not use this data to identify you personally.

3. Legal basis for processing

We process your personal data on the following lawful bases:

Legitimate interests (Article 6(1)(f) GDPR) — to respond to contact form enquiries and to maintain website security.
Contract (Article 6(1)(b) GDPR) — to provide you with access to your account.
Legal obligation (Article 6(1)(c) GDPR) — where required by Irish or EU law.

4. How we use your data

To respond to enquiries submitted through our contact form
To manage user accounts and authentication sessions
To improve and maintain the security of the website
To comply with legal obligations

We will never sell, rent, or share your personal data with third parties for marketing purposes.

5. Third-party service providers

We share personal data only with trusted service providers who process it on our behalf and are bound by data processing agreements:

Resend (resend.com) — email delivery service used to forward contact form submissions to us. Your name and email address are transmitted to Resend for this purpose.
UploadThing (uploadthing.com) — file hosting service used to store images published on the website. No personal data is uploaded through this service.
Database hosting provider — our PostgreSQL database is hosted by a third-party provider. All data is encrypted at rest and in transit.
Hosting provider — our website is hosted on a third-party infrastructure platform. Standard access logs may be retained by them.

Where any service provider is located outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission.

6. How long we keep your data

Contact form enquiries — retained for up to 2 years from the date of receipt, after which they are securely deleted.
Account data — retained for as long as your account is active. You may request deletion at any time.
Session data — authentication session tokens expire automatically and are cleared on sign-out.

7. Your rights

Under GDPR you have the following rights:

Right of access — to request a copy of the personal data we hold about you.
Right to rectification — to request correction of inaccurate data.
Right to erasure (“right to be forgotten”) — to request deletion of your personal data, subject to legal retention obligations.
Right to restriction of processing — to ask us to temporarily halt processing of your data.
Right to data portability — to receive your data in a structured, machine-readable format.
Right to object — to object to processing based on legitimate interests.

To exercise any of these rights, please contact us at info@treestory.ie. We will respond within one month as required by law.

8. Cookies

We use essential cookies to operate the website (e.g. to keep you signed in). We do not use advertising or analytics cookies. For full details, please see our Cookie Policy.

9. Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Irish supervisory authority:

Data Protection Commission (DPC)
21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
Website: www.dataprotection.ie
Phone: +353 (0)1 765 0100

10. Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised “last updated” date. For significant changes, we will notify account holders by email.

11. Contact us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at info@treestory.ie.

This policy should be reviewed by a qualified solicitor before relying on it for compliance purposes. It is intended as a practical starting point.