Tree Story at Nine Oaks Wood

Tree Story at Nine Oaks Wood (“we”, “us”, “our”) is committed to protecting your personal data. This Privacy Policy explains what information we collect, how we use it, and your rights under the General Data Protection Regulation (GDPR) (EU) 2016/679 and the Data Protection Acts 1988–2018 (as amended).

1. Who we are

The data controller is:
Tree Story at Nine Oaks Wood
Nine Oaks Wood, Ballymartin, Co. Carlow, Ireland
Email: info@treestory.ie

2. What personal data we collect

Contact enquiries

When you submit the contact form we collect your name, email address, subject, and message. This information is used solely to respond to your enquiry.

Account registration

If you create an account (currently available to administrators only) we collect your name, email address, and a hashed password. Passwords are never stored in plain text.

Technical data

When you visit our website, our hosting and infrastructure providers may automatically collect standard server log data, including your IP address, browser type, and pages visited. We do not use this data to identify you personally.

Contact form spam protection

We use Vercel BotID Basic to help protect our contact form against spam and automated abuse. It runs a browser challenge and processes browser-generated verification data alongside technical request data to assess whether a submission is automated. Technical data, such as IP addresses and browser information, may constitute personal data.

Submissions identified as automated are rejected before an enquiry email is sent. If you cannot submit the form, you can contact us directly at info@treestory.ie.

3. Legal basis for processing

We process your personal data on the following lawful bases:

Legitimate interests (Article 6(1)(f) GDPR) — to respond to contact form enquiries and to maintain website security, including preventing contact form spam and automated abuse.
Contract (Article 6(1)(b) GDPR) — to provide you with access to your account.
Legal obligation (Article 6(1)(c) GDPR) — where required by Irish or EU law.

4. How we use your data

To respond to enquiries submitted through our contact form
To manage user accounts and authentication sessions
To improve and maintain the security of the website
To comply with legal obligations

We will never sell, rent, or share your personal data with third parties for marketing purposes.

5. Third-party service providers

We use the following service providers to operate the website and handle enquiries. Their processing of personal data is governed by the applicable service terms and data protection arrangements:

Resend (resend.com) — email delivery service used to forward contact form submissions to us. Your name and email address and the subject and message are transmitted to Resend for this purpose.
UploadThing (uploadthing.com) — file hosting service used to store images published on the website. No personal data is uploaded through this service.
Database hosting provider — our PostgreSQL database is hosted by a third-party provider. All data is encrypted at rest and in transit.
Vercel — website hosting and BotID Basic spam protection. Vercel processes technical request and browser verification data to provide these services and may retain security logs. See the Vercel Privacy Notice for information about Vercel's own processing.

Where any service provider is located outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission.

6. How long we keep your data

Contact form enquiries — retained for up to 2 years from the date of receipt, after which they are securely deleted.
Account data — retained for as long as your account is active. You may request deletion at any time.
Session data — authentication session tokens expire automatically and are cleared on sign-out.

7. Your rights

Under GDPR you have the following rights:

Right of access — to request a copy of the personal data we hold about you.
Right to rectification — to request correction of inaccurate data.
Right to erasure (“right to be forgotten”) — to request deletion of your personal data, subject to legal retention obligations.
Right to restriction of processing — to ask us to temporarily halt processing of your data.
Right to data portability — to receive your data in a structured, machine-readable format.
Right to object — to object to processing based on legitimate interests.

To exercise any of these rights, please contact us at info@treestory.ie. We will respond within one month as required by law.

8. Cookies

We use essential cookies to operate the website (e.g. to keep you signed in). We do not use advertising or analytics cookies. For full details, please see our Cookie Policy.

9. Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Irish supervisory authority:

Data Protection Commission (DPC)
21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
Website: www.dataprotection.ie
Phone: +353 (0)1 765 0100

10. Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised “last updated” date. For significant changes, we will notify account holders by email.

11. Contact us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at info@treestory.ie.

This policy should be reviewed by a qualified solicitor before relying on it for compliance purposes. It is intended as a practical starting point.