Privacy Policy
Last updated: January 2026
PennyTrack ("PennyTrack", "we", "us" or "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose and safeguard your personal data when you visit pennytrack.com and use our services, in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Irish Data Protection Act 2018.
1. Data Controller
PennyTrack is the data controller responsible for the processing of your personal data described in this policy. You can contact us at:
- Address: PennyTrack, 23 The Mall, Waterford, X91 K7P2, Ireland
- Email: info@pennytrack.com
- Phone: +353 91 440 7621
2. Categories of Personal Data We Collect
2.1 Data you provide directly
- Contact data: name, email address, phone number and message content when you submit our contact or quote request forms.
- Newsletter data: email address if you subscribe to updates from PennyTrack.
- Correspondence: records of any communication you send to us by email, phone or post.
2.2 Data collected automatically
- Usage data: pages visited, time spent on pages, referring website and interactions with our content.
- Technical data: IP address, browser type and version, device type, operating system and screen resolution.
- Cookie data: information stored via cookies and similar technologies, as described in our Cookies Policy.
3. Purposes and Legal Bases for Processing
| Purpose | Categories of data | Legal basis |
|---|---|---|
| Responding to enquiries and providing quote requests | Contact data, correspondence | Steps prior to entering a contract (Art. 6(1)(b) GDPR) / legitimate interests (Art. 6(1)(f)) |
| Operating, securing and improving the website | Usage data, technical data | Legitimate interests (Art. 6(1)(f)) |
| Analytics to understand how the site is used | Usage data, technical data, cookie data | Consent (Art. 6(1)(a)) |
| Marketing communications and newsletters | Email address, preferences | Consent (Art. 6(1)(a)) |
| Compliance with legal obligations | Any relevant data | Legal obligation (Art. 6(1)(c)) |
4. Cookies and Similar Technologies
We use cookies to operate our website, remember your preferences and, with your consent, analyse traffic and support marketing activities. Essential cookies are always active as they are necessary for the website to function. Analytics and marketing cookies are only set after you give consent through our cookie consent banner. You may change or withdraw your consent at any time by clearing your browser cookies and revisiting the site, where the banner will be presented again. For detailed information, please see our Cookies Policy.
5. Disclosure of Personal Data
We do not sell your personal data. We may share your data only with:
- Service providers (processors): hosting providers, email delivery services and analytics providers who process data on our behalf under data processing agreements in accordance with Article 28 GDPR.
- Professional advisers: accountants, auditors and legal counsel, where necessary.
- Authorities: where disclosure is required by law, court order or to protect our legal rights.
Where service providers are located outside the European Economic Area (EEA), transfers are made only on the basis of appropriate safeguards, such as the European Commission's Standard Contractual Clauses.
6. International Transfers
Our primary hosting and processing operations are located within the EEA. Where personal data is transferred outside the EEA, we ensure an adequate level of protection through adequacy decisions adopted by the European Commission or, in their absence, Standard Contractual Clauses together with supplementary technical and organisational measures.
7. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:
- Contact form enquiries: up to 24 months after the correspondence concludes.
- Newsletter subscriptions: until you withdraw consent or unsubscribe.
- Analytics data: up to 26 months, in aggregated or pseudonymised form where possible.
- Records required by law: for the statutory retention period applicable under Irish law.
8. Your Rights Under GDPR
Under the GDPR, you have the following rights in relation to your personal data:
- Right of access — to obtain confirmation that we process your data and a copy of that data.
- Right to rectification — to have inaccurate or incomplete data corrected.
- Right to erasure — to have your data deleted where there is no overriding legal reason for us to retain it.
- Right to restriction of processing — to request that we suspend processing in certain circumstances.
- Right to data portability — to receive your data in a structured, commonly used, machine-readable format.
- Right to object — to processing based on legitimate interests or for direct marketing purposes.
- Right to withdraw consent — at any time, where processing is based on consent, without affecting the lawfulness of prior processing.
- Rights related to automated decision-making — we do not carry out automated decision-making or profiling that produces legal effects concerning you.
To exercise any of these rights, contact us at info@pennytrack.com or write to PennyTrack, 23 The Mall, Waterford, X91 K7P2, Ireland. We will respond within one month of receiving your request. This period may be extended by two further months where necessary, taking into account the complexity and number of requests.
9. Right to Lodge a Complaint
If you believe that our processing of your personal data infringes data protection law, you have the right to lodge a complaint with the Irish Data Protection Commission:
- Website: www.dataprotection.ie
- Email: info@dataprotection.ie
- Phone: +353 761 104 800
- Address: Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
We would appreciate the opportunity to address your concerns before you contact the supervisory authority, so please contact us first where possible.
10. Security of Personal Data
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse or alteration, including encryption in transit (TLS), access controls, and staff training on data protection. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.
11. Data Breach Notification
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours of becoming aware of the breach, and will inform affected individuals where the breach is likely to result in a high risk, in accordance with Articles 33 and 34 GDPR.
12. Children's Privacy
Our website is not directed at children under the age of 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
13. Links to Other Websites
Our website may reference third-party tools and services in our reviews and guides. This Privacy Policy applies only to pennytrack.com. We encourage you to review the privacy policies of any third-party websites you visit; we are not responsible for their privacy practices.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. The updated version will be posted on this page with a revised "last updated" date. Where changes are significant, we will provide a more prominent notice on our website.
15. Contact Us
For any questions, requests or complaints regarding this Privacy Policy or the processing of your personal data, please contact:
- PennyTrack, 23 The Mall, Waterford, X91 K7P2, Ireland
- Email: info@pennytrack.com
- Phone: +353 91 440 7621