Privacy policy

PRIVACY POLICY
TempleHill Agency

Website: https://www.templehillagency.com

Business name: TempleHill Agency

 
1. INTRODUCTION
TempleHill Agency (“TempleHill Agency”, “we”, “us” or “our”) is committed to respecting your privacy, protecting personal data and complying with applicable data protection legislation.

This Privacy Policy explains how we collect, use, access, store, disclose, transfer and otherwise process personal data when you:

Visit or interact with our website at https://www.templehillagency.com.
Contact us by email, telephone, website form or other communication channel.
Request information, a consultation, a quotation or a proposal for our services.
Purchase or receive digital marketing services from us.
Receive business communications or marketing communications from us.
Interact with our social media profiles, advertisements or other online channels that we operate.
Act as an employee, representative, contractor or other contact of one of our clients, suppliers or business partners.
Have your personal data processed by us when we deliver digital marketing services on behalf of a client.
This policy is intended to explain what personal data we process, why we process it, the legal bases we rely on, who may receive it, how long we retain it and the rights available to you.

We aim to process personal data lawfully, fairly and transparently, collect only information that is relevant to our stated purposes, maintain appropriate security and retain information only for as long as necessary.

This policy should be read alongside any relevant service agreement, data processing agreement, cookie notice or additional privacy notice that we provide in connection with a particular service.

Where a separate notice applies to a specific activity, that notice should be read together with this policy.

2. LEGAL AND REGULATORY FRAMEWORK
Our personal data processing activities are subject, where applicable, to:

Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”).
The Irish Data Protection Act 2018, as amended.
The European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011, as amended, commonly referred to as the Irish ePrivacy Regulations.
Other applicable Irish and European Union laws relating to privacy, electronic communications, marketing, confidentiality, cybersecurity, tax and business record-keeping.
The laws that apply depend on the nature of the processing, the people concerned and the countries involved.

References in this policy to the GDPR include applicable national implementing and supplementary laws where relevant.

3. WHO IS RESPONSIBLE FOR YOUR PERSONAL DATA?
3.1 Data controller
For personal data processed for our own business purposes, the controller is:

Trading name: TempleHill Agency
Full legal name of controller: Philip Moriarty
Business structure: SOLE TRADER
Registered or principal business address: TempleHill 
Email: [email protected]
Website: https://www.templehillagency.com

A data controller determines the purposes and means of processing personal data.

3.2 Data processor
When we process personal data solely on documented instructions from a client as part of providing digital marketing services, we generally act as a data processor.

In those circumstances, our client will generally act as the data controller and determine why the data is processed and how it is used.

The client is generally responsible for ensuring that it has a valid legal basis for the processing, has provided required privacy information and can lawfully instruct us to carry out the processing.

We will process such data in accordance with the applicable client agreement, data processing agreement and legal requirements.

3.3 Situations where our role may differ
Our role depends on the specific processing activity, rather than simply on whether we have a contract with a client.

For example, we may act as:

A controller when managing our own prospective customer contacts, invoicing records or website analytics.
A processor when managing a client's mailing list or advertising campaign solely on that client's documented instructions.
An independent controller when we determine our own lawful purposes for using particular contact or administrative information.
A joint controller if we and another organisation jointly determine the purposes and essential means of a particular processing activity.
Where joint controllership applies, the parties must make appropriate arrangements to allocate their responsibilities and provide the information required by law.

We will not assume that all personal data accessed while delivering a service automatically belongs to the same category or is governed by the same legal basis.

4. WHAT IS PERSONAL DATA?
Personal data is information relating to an identified or identifiable natural person.

It can include information that identifies someone directly, such as a person's name or email address, as well as information that identifies them indirectly, such as an online identifier or a combination of other details.

Depending on the circumstances, personal data may include:

Names and business contact details.
Professional roles and employment information.
Email addresses and telephone numbers.
Online identifiers, IP addresses and cookie identifiers.
Website interaction and analytics information.
Advertising and campaign interaction data.
Customer enquiries and communication records.
Contractual, billing and transaction information.
Records of consent, preferences and objections.
Information supplied by a client about its customers or prospective customers.
Not every piece of technical or commercial information is personal data. Information genuinely anonymised so that individuals cannot be identified is not personal data under the GDPR. Pseudonymised information may still constitute personal data.

5. CATEGORIES OF PERSONAL DATA WE MAY COLLECT
The precise information collected will depend on the service, communication channel and relationship involved.

5.1 Website visitors
When you visit our website, information may be collected about your device, browser, network connection and use of the website.

Depending on our website configuration and your consent choices, this may include:

IP address and technical connection data.
Browser type and version.
Device type and operating system.
Pages visited and navigation events.
Referral source and referring website.
Approximate location derived from an IP address.
Date, time and duration of a visit.
Website errors and performance information.
Security logs and information relating to suspicious activity.
Cookie identifiers and similar tracking information.
Analytics and advertising interaction data, where applicable.
We do not assume that every category above is collected on every visit. The actual categories depend on the technologies installed and enabled on our website.

5.2 Enquiries and prospective clients
If you contact us or enquire about our services, we may collect:

Your name.
Your business name.
Your job title or professional role.
Your work email address.
Your telephone number, if provided.
Your business location or postal address, where relevant.
Details of the services you are interested in.
Your budget, objectives and project requirements, if you provide them.
The content of your messages, correspondence and call notes.
The source of your enquiry.
Information needed to prepare a quotation or proposal.
Records of follow-up communications and decisions.
We will use this information only for appropriate and lawful purposes connected with handling the enquiry, managing the business relationship or another purpose properly disclosed to you.

5.3 Existing clients and business contacts
Where you engage our services or act as a contact for a client, supplier or business partner, we may process:

Contact and identification details.
Company and professional information.
Contract and proposal information.
Service specifications and project instructions.
Communications, approvals and feedback.
Project status, deliverables and support requests.
Billing, payment and invoice records.
Records of access permissions or account administration, where necessary.
Information required to manage contractual obligations.
Records relevant to complaints, disputes or legal claims.
Where you are an employee or representative of a business client, we may process your business contact details because they are needed to communicate with the organisation and administer the relationship.

5.4 Client campaign and customer data
Depending on our agreed services, a client may instruct us to process personal data relating to its customers, leads, subscribers or website visitors.

Such information may include:

Names and contact details.
Form submissions and enquiry information.
Mailing list and subscription records.
Lead source and campaign attribution.
Advertising or website interaction events.
Customer relationship management records.
Social media engagement information.
Online identifiers and campaign measurement data.
Preferences or segmentation information supplied by the client.
Other data expressly identified in the applicable service agreement.
The nature and scope of such data must be documented in the relevant client arrangements.

We will not collect additional categories of client personal data merely because they could be useful for marketing. Any processing must be relevant, appropriately authorised and supported by the applicable lawful basis and contractual instructions.

5.5 Supplier and professional contact information
We may process business contact details, correspondence, contract records and invoicing information relating to suppliers, contractors, advisers and other business partners.

This processing is generally carried out to manage procurement, payments, professional relationships, legal obligations and business administration.

5.6 Information from publicly available or third-party sources
Where lawful and relevant, we may obtain professional contact information from sources such as:

Company websites.
Public professional directories.
Professional networking platforms.
Business referrals.
Publicly available business registers.
Other reputable business information services.
Public availability does not automatically make personal data free to use for any purpose.

We will assess whether the collection and intended use are lawful, relevant and proportionate. We will comply with applicable transparency obligations, including providing privacy information when required for data obtained indirectly.

We will not treat publication of contact information online as blanket consent to receive direct marketing.

5.7 Sensitive or special-category information
Our services are not ordinarily intended to require special-category personal data, such as information revealing health, racial or ethnic origin, religious beliefs, political opinions, trade union membership, genetic data, biometric identification data, sex life or sexual orientation.

We ask that you do not supply such information through ordinary website forms, email or project briefs unless it is genuinely necessary and appropriate.

If a particular service requires processing special-category data, the processing must be assessed separately and must have both an appropriate GDPR lawful basis and a valid condition under Article 9, together with any additional safeguards required by law.

Information concerning criminal convictions and offences is subject to separate legal restrictions.

We will not assume that a general service contract or a standard privacy notice alone authorises such processing.

6. HOW WE COLLECT PERSONAL DATA
We may collect personal data through the following channels.

6.1 Direct collection
You may provide information directly when you:

Complete a contact or enquiry form.
Email or telephone us.
Request a quotation or consultation.
Enter into a service agreement.
Pay an invoice or provide billing information.
Participate in a meeting, call or project discussion.
Respond to a survey or provide feedback.
Communicate with us through social media or another business channel.
6.2 Automatic collection
Our website, hosting provider, security tools and other enabled technologies may automatically collect technical or usage information.

Where collection involves cookies or similar technologies requiring consent, those technologies will be activated only in accordance with the applicable consent requirements.

6.3 Collection from clients
Clients may provide us with personal data so that we can deliver contracted services.

The client is responsible for ensuring that it can lawfully provide the relevant data to us. We will process the data in accordance with the applicable instructions and agreement.

6.4 Collection from third parties
We may receive information through referrals, business partners, public sources, professional networks and relevant service providers.

Where the GDPR requires us to provide information about personal data obtained indirectly, we will provide the required details within the applicable timeframe and subject to any lawful exception.

6.5 Information you are required to provide
Some information is necessary to respond to an enquiry, prepare a proposal, enter into a contract, deliver a service or satisfy a legal obligation.

If you do not provide required information, we may be unable to respond adequately, enter into the requested arrangement, provide part of the service or comply with a legal requirement.

Where information is optional, we will not treat your failure to provide it as consent to another form of processing.

7. PURPOSES OF PROCESSING AND LEGAL BASES
We will process personal data only where an applicable legal basis permits us to do so.

The relevant legal basis depends on the actual purpose and circumstances. A business relationship does not automatically mean that every form of processing is necessary for a contract.

7.1 Responding to enquiries and preparing proposals
We process relevant enquiry details to respond to you, understand your needs, prepare proposals and take requested steps before entering into a contract.

The legal basis may be pre-contractual steps at your request where you are the prospective contracting party. Where you are contacting us on behalf of another business, our legitimate interests in responding to and managing the business enquiry may be the more appropriate basis.

7.2 Providing our services
We process relevant information to deliver digital marketing services, manage projects, communicate with clients, provide support and meet our contractual obligations.

Where the processing is necessary to perform a contract with you personally, the legal basis may be Article 6(1)(b) GDPR. Where a client is the contracting party and you are its employee or representative, legitimate interests or another applicable basis may be more appropriate for your contact details.

Where we act as a processor, the client's lawful basis for its own processing must be established by the client, while we must comply with the obligations applicable to processors.

7.3 Invoicing, payments and business administration
We may process necessary records to issue invoices, receive payments, manage accounts, maintain business records and comply with tax or other legal obligations.

The legal basis may be compliance with a legal obligation or, where appropriate, performance of a contract or our legitimate interests in managing the business.

7.4 Website operations and security
We may process technical information to operate the website, diagnose errors, prevent misuse, detect security incidents, manage access and protect our systems.

Depending on the processing, the legal basis may be our legitimate interests in maintaining secure and reliable services, a legal obligation or another applicable basis.

This does not remove the separate requirement to obtain consent for cookies or similar technologies where the Irish ePrivacy rules require it.

7.5 Website analytics and advertising measurement
Where permitted, we may use analytics and campaign measurement information to understand website performance, improve content and evaluate marketing effectiveness.

Where this processing requires consent under applicable cookie and tracking rules, we will obtain valid consent before activating the relevant technology.

Where personal data is processed, we will also identify and document an appropriate GDPR lawful basis.

7.6 Business development and direct marketing
We may process relevant business contact information for business development and marketing where permitted by law.

The lawful basis under the GDPR and the rules governing the particular communication channel must both be considered. A GDPR legitimate-interest assessment does not override a separate requirement for consent under electronic marketing law.

7.7 Legal obligations and disputes
We may retain or process relevant information where necessary to comply with applicable legal requirements, cooperate with competent authorities, establish or defend legal claims, or protect our legal rights.

The legal basis will depend on the circumstances and the particular information concerned.

7.8 Consent-based activities
Where we rely on consent, we will explain what is being consented to, the purpose of the processing and any relevant information required by law.

Consent must be a freely given, specific, informed and unambiguous indication of agreement. Where required, we will maintain evidence of consent.

You may withdraw consent at any time. Withdrawal will not affect the lawfulness of processing carried out before withdrawal.

We will not treat silence, inactivity or a pre-selected checkbox as valid consent where an affirmative choice is required.

8. LEGITIMATE INTERESTS
Where we rely on legitimate interests under Article 6(1)(f) GDPR, those interests may include:

Responding to relevant business enquiries.
Managing business-to-business relationships.
Maintaining accurate client and supplier records.
Ensuring the security and reliability of our systems.
Preventing fraud, abuse and unauthorised access.
Defending or pursuing legal claims.
Managing service quality and business operations.
We will consider whether the processing is necessary for the identified interest and whether that interest is overridden by your rights, freedoms or reasonable expectations.

Where required, we will document the legitimate interests assessment and provide further information about the relevant interests.

You may object to processing based on legitimate interests on grounds relating to your particular situation. We will assess your objection in accordance with applicable law.

You have an unconditional right to object to the processing of your personal data for direct marketing purposes.

9. DIRECT MARKETING AND BUSINESS DEVELOPMENT
9.1 Our own marketing
We may use appropriate business contact channels to communicate information about TempleHill Agency's services, subject to applicable law.

The channels may include email, telephone, professional networking platforms, social media or other communications where legally permitted.

The fact that a person has a business email address does not automatically make every marketing communication lawful.

We will consider the individual's status, the type of communication, the source of the contact details, the purpose of the message and the applicable consent or objection requirements.

9.2 Electronic marketing in Ireland
We will comply with the Irish ePrivacy Regulations governing direct electronic marketing, alongside the GDPR.

In general, unsolicited electronic direct marketing to natural persons requires consent, subject to the limited exceptions provided by law.

The existing-customer exception may apply only where its specific requirements are satisfied, including lawful collection of contact details in the context of a sale, marketing of the sender's own similar products or services, an appropriate opportunity to object when details are collected and in each subsequent message, and compliance with the applicable time limit.

Certain business-to-business communications may be treated differently where the relevant legal requirements are met, including where an address reasonably appears to be used mainly in the context of commercial or official activity and the marketing relates solely to that activity.

We will assess the circumstances rather than assume that a contact is exempt merely because the email address includes a business domain.

Every marketing message we send will identify the sender appropriately and provide a valid means of contacting us, as required by law.

9.3 Opting out
You may object to direct marketing or withdraw marketing consent at any time.

You can normally do this by clicking the unsubscribe link included in a marketing email or by emailing [email protected] with a clear request.

We will act on valid opt-out requests within the time required by law and ensure that the information is not used for further direct marketing in a way that conflicts with your objection.

We may retain a minimal suppression record where necessary to honour your objection and prevent future marketing. Such a record will be limited to what is reasonably necessary for that purpose.

An objection to marketing does not necessarily mean that we must delete all information required for invoicing, legal compliance, contract administration or other independent lawful purposes.

9.4 Client marketing campaigns
When we manage a client's marketing activity, the client will generally determine the marketing purposes and be responsible for ensuring the appropriate legal basis, notices, permissions and opt-out arrangements are in place.

We will follow documented instructions and the relevant agreement. We will not independently assume that a client's mailing list or advertising audience is lawfully available for every intended use.

10. COOKIES, PIXELS AND SIMILAR TECHNOLOGIES
10.1 What these technologies do
Cookies are small files stored on a device. Similar technologies may include pixels, tags, scripts, local storage and tracking identifiers.

Depending on what is installed on our website, these technologies may support essential functionality, security, user preferences, traffic analysis, advertising measurement or targeted advertising.

10.2 Essential technologies
Certain technologies may be used without consent where a legal exemption applies, such as where they are strictly necessary to provide a service explicitly requested by you or fall within another applicable statutory exemption.

We will not classify a technology as strictly necessary simply because it is useful to us.

10.3 Analytics, advertising and other non-essential technologies
Where required by Irish law, we will obtain valid consent before storing or accessing information on your device through non-essential cookies or similar technologies.

This may include analytics cookies, advertising pixels, conversion tracking or technologies used to build or measure advertising audiences.

The actual classification depends on the purpose and function of each technology.

10.4 Managing consent
Where a consent management mechanism is required, it should provide a clear choice about non-essential categories and allow you to change or withdraw your consent as easily as you gave it.

Rejecting non-essential technologies should be a genuine option. Non-essential technologies must not be activated before the required consent has been obtained.

You may also adjust your browser settings, although browser-level controls do not replace the website's obligation to obtain consent where required.

10.5 Information about individual cookies
The exact cookies and similar technologies used by TempleHill Agency must be identified through an audit of the live website.

A separate cookie notice or consent interface should specify, as applicable, the name of each technology, its purpose, its provider, its duration and whether information is shared with third parties.

The technologies used on this website have not been verified for this draft. Do not publish an invented cookie list or state that a consent mechanism exists unless it has been implemented and tested.

11. SHARING AND DISCLOSURE OF PERSONAL DATA
We may share personal data where necessary for an identified and lawful purpose.

Depending on our actual operations, recipients may include the following categories.

11.1 Website and technology providers
Providers may supply hosting, domain services, website maintenance, email, cloud storage, security, backup and technical support.

They may process information needed to provide those services. Where they act as our processors, appropriate processing contracts and safeguards must be in place.

11.2 Business and marketing software providers
Where used, these may include customer relationship management platforms, analytics services, advertising platforms, email marketing tools, scheduling services, project management software and marketing automation tools.

The information disclosed must be relevant to the service and limited to what is necessary.

Where a provider determines its own purposes for particular processing, its role and our responsibilities must be assessed accordingly.

11.3 Payment and accounting providers
Relevant information may be shared with payment services, banks, accountants and accounting software providers to administer transactions and meet financial record-keeping obligations.

11.4 Clients and authorised recipients
Where necessary to perform a service, we may share relevant project information with the client, its authorised employees, its advisers or another provider authorised to assist with the project.

Where we act as processor, any further disclosure of client personal data must be consistent with the applicable instructions and agreement.

11.5 Professional advisers, insurers and authorities
We may disclose relevant information to legal advisers, accountants, insurers, courts, regulators or public authorities where necessary and lawful.

11.6 Business transactions
If the business is involved in a sale, merger, restructuring or transfer of assets, relevant information may be disclosed as part of the transaction, subject to appropriate confidentiality and data protection safeguards.

11.7 No general sale of personal data
We do not sell personal data to third parties for their own independent commercial mailing lists as a routine business practice.

If an activity would involve a different type of disclosure, such as sharing data for another organisation's advertising purposes, it must be assessed separately and disclosed accurately before it takes place where required.

12. THIRD-PARTY SERVICES AND SOCIAL MEDIA
Our website or marketing materials may link to, embed or interact with third-party services.

These may include social media platforms, video or map services, advertising services, analytics tools or other external websites, depending on our configuration.

When you follow an external link, the third party's own privacy notice and terms may apply.

Embedded content and social media integrations can sometimes transmit information to a third party, including information about a visit, before you actively interact with the content. Where such technologies are subject to consent requirements, they must be configured accordingly.

We do not control the independent privacy practices of third parties acting for their own purposes. Their processing is governed by their own legal obligations and notices.

We will take reasonable steps to understand the providers we use and the data flows involved in our own website and service delivery.

13. INTERNATIONAL TRANSFERS
Some technology, analytics, advertising, cloud or communications providers may store or access personal data outside the European Economic Area (“EEA”).

Where personal data is transferred to a third country or international organisation, we will ensure that the transfer complies with Chapter V of the GDPR.

Depending on the circumstances, a transfer may rely on:

An applicable European Commission adequacy decision.
Appropriate safeguards, such as the relevant European Commission Standard Contractual Clauses.
Another transfer mechanism expressly permitted by applicable law.
Where required, we will assess the circumstances of the transfer and implement supplementary safeguards where appropriate.

A provider's use of servers or support personnel outside the EEA must be considered when assessing the transfer. A statement that a provider is based in Europe does not, by itself, establish that all processing takes place within the EEA.

You may contact us to request further information about international transfers and the safeguards applicable to your personal data, subject to legal restrictions.

The specific providers, destinations and transfer mechanisms used by TempleHill Agency must be confirmed before this section is finalised.

14. HOW LONG WE RETAIN PERSONAL DATA
We keep personal data only for as long as necessary for the purposes for which it was collected, taking into account legal requirements, contractual obligations, legitimate business needs and the need to establish or defend legal claims.

Retention periods vary according to the type of information and the context.

The following schedule is a proposed retention framework that TempleHill Agency must check against its actual systems and requirements before publication.

Category
Proposed retention approach
Unsuccessful enquiries and prospective client records
Normally up to 12 months after the last meaningful interaction, unless a longer period is justified
Client and project correspondence
For the duration of the relationship and for an appropriate period afterwards where needed for contract administration, disputes or legal claims
Contracts, invoices and accounting records
For the applicable statutory retention period and any additional period genuinely necessary for legal claims
Marketing subscriptions and preferences
While relevant to the marketing activity and until consent is withdrawn or an objection is received, subject to necessary suppression records
Marketing suppression records
For as long as reasonably necessary to ensure that valid objections and opt-outs are respected
Website security logs
For a documented period appropriate to security needs, unless an incident requires longer preservation
Analytics data
According to the configured analytics retention period and applicable consent and legal requirements
Client personal data processed on instructions
In accordance with the client agreement, documented instructions and applicable law, followed by return or deletion as agreed
Legal claims, complaints or investigations
For as long as necessary to handle the matter and meet applicable legal requirements
The periods above are not a claim that the live systems are already configured in this way. TempleHill Agency must adopt a documented retention schedule and ensure that the policy agrees with the actual practice.

14.1 Deletion and anonymisation
When personal data is no longer necessary, we will take appropriate steps to delete it securely or anonymise it irreversibly.

Where deletion is not immediately possible because data is held in protected backups, we will apply suitable access restrictions and ensure that the data is removed through the applicable backup lifecycle, subject to legal obligations.

14.2 Exceptions to deletion
We may retain certain information after a relationship ends where retention is required by law or reasonably necessary for legal claims, fraud prevention, regulatory compliance or another permitted purpose.

Such retention does not authorise unrestricted use of the data for unrelated purposes.

15. DATA SECURITY AND CONFIDENTIALITY
We will implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, unlawful processing, accidental loss, destruction, damage or disclosure.

Measures will be selected according to the sensitivity of the information, the nature of the processing, the likelihood and severity of risks, the available technology and implementation costs.

Depending on our actual systems and risks, security measures may include:

Appropriate access controls and least-privilege permissions.
Strong authentication and multifactor authentication where appropriate.
Secure configuration and software updates.
Encryption where appropriate to the risk.
Secure transfer and storage procedures.
Backup and recovery arrangements.
Access review and account-removal procedures.
Confidentiality obligations for authorised personnel.
Vetting and review of relevant service providers.
Incident detection, reporting and response procedures.
Secure deletion and disposal of information.
Staff or contractor guidance on handling personal data.
This list describes potential controls and does not mean that each control is already implemented. We will maintain measures appropriate to our actual operations.

No electronic communication or storage system is completely risk-free. We cannot guarantee absolute security, but we will take appropriate steps to protect personal data and respond to suspected incidents.

15.1 Access to client systems
Where we access a client's advertising accounts, website, mailing list, analytics platform or customer relationship management system, access should be limited to authorised individuals and the permissions needed for the assigned work.

We encourage clients to use named accounts, appropriate permission levels and secure access-sharing arrangements instead of sending passwords through ordinary email.

Where a service ends, access should be revoked or adjusted as appropriate.

16. PERSONAL DATA BREACHES
A personal data breach may include accidental disclosure, unauthorised access, loss, alteration, destruction or unavailability of personal data.

We will maintain appropriate procedures to identify, assess, document and respond to suspected personal data breaches.

Where TempleHill Agency acts as a controller, we will assess whether notification to the Data Protection Commission is required. Where a breach is likely to result in a risk to individuals' rights and freedoms, the GDPR generally requires notification to the relevant supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of the breach.

If a breach is likely to result in a high risk to individuals, affected individuals must also be informed without undue delay unless a lawful exception applies.

Where we act as a processor, we will notify the relevant client controller without undue delay after becoming aware of a personal data breach affecting data processed on its behalf, provide available relevant information and reasonably assist with the client's response.

We will document breaches as required by law, including the facts, effects and remedial action taken.

17. YOUR DATA PROTECTION RIGHTS
Under the GDPR, you may have the following rights, subject to applicable conditions and exceptions.

17.1 Right of access
You may request confirmation of whether we process your personal data and, where applicable, obtain a copy of that data and the related information required by law.

17.2 Right to rectification
You may request correction of inaccurate personal data and completion of incomplete information.

17.3 Right to erasure
You may request deletion of your personal data where one of the legal grounds for erasure applies.

This right is not absolute. We may be entitled or required to retain certain information, for example to comply with a legal obligation or establish, exercise or defend legal claims.

17.4 Right to restriction of processing
You may request restriction of processing in circumstances provided for by law, such as while certain accuracy or objection issues are being assessed.

Where processing is restricted, we will generally store the information and otherwise process it only as permitted by applicable law.

17.5 Right to data portability
Where the legal requirements are met, you may request personal data that you have provided to us in a structured, commonly used and machine-readable format, and have it transmitted to another controller where technically feasible.

This right generally concerns processing based on consent or contract and carried out by automated means. It does not apply to every category of information.

17.6 Right to object
You may object to processing based on legitimate interests or a public task on grounds relating to your particular situation, where the right applies.

We will assess the objection in accordance with the GDPR.

You have an absolute right to object to processing of your personal data for direct marketing, including related profiling. Once you object, your personal data must no longer be processed for that purpose.

17.7 Right to withdraw consent
Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal. It also does not automatically require deletion of information that we must retain for another lawful purpose.

17.8 Rights concerning automated decisions
Where a decision is based solely on automated processing, including profiling, and produces legal effects or similarly significantly affects you, you may have additional rights and safeguards under the GDPR.

These rights are subject to specific legal conditions and exceptions.

17.9 Right to complain
You have the right to lodge a complaint with a competent supervisory authority, particularly in the EU Member State where you habitually reside, work or where an alleged infringement occurred.

For Ireland, details of the Data Protection Commission are provided in Section 19.

18. HOW TO EXERCISE YOUR RIGHTS
To make a privacy request, contact:

Email: [email protected]
Subject line: Privacy Request

Please describe the request and provide enough information for us to understand which processing activity or relationship it concerns.

We may ask for additional information to confirm your identity where we have reasonable doubts. Any verification will be proportionate to the request and the risk of disclosing information to the wrong person.

You should not send unnecessary identity documents or sensitive personal information unless we explain why it is needed and provide an appropriate means of submitting it.

We will generally respond within one month of receiving the request. Where legally permitted because of the complexity or number of requests, the response period may be extended by up to two further months. We will inform you of an extension, and the reasons for it, within the initial month.

Requests will ordinarily be handled free of charge. A reasonable fee or refusal is permitted only in the circumstances allowed by law, such as where a request is manifestly unfounded or excessive.

We will explain the reasons if we cannot act on a request, subject to applicable law, and inform you of any available complaint or judicial remedy where required.

18.1 Requests relating to client data
If your personal data is processed by TempleHill Agency on behalf of a client, the client will generally be responsible for deciding how a rights request should be handled.

We may refer you to the relevant client or notify that client of the request, as appropriate. We will reasonably assist the controller in meeting its obligations under the applicable agreement and law.

You may still contact us if you are unsure which organisation controls the relevant data.

19. COMPLAINTS AND THE IRISH DATA PROTECTION COMMISSION
We encourage you to contact us first if you have a concern about how we process your personal data. We will consider the matter and seek to address it appropriately.

You do not need to contact us before exercising your right to complain to a supervisory authority.

The supervisory authority in Ireland is:

Data Protection Commission
Website: https://www.dataprotection.ie/

The Commission's website provides information about data protection rights and how to make a complaint.

If you are located elsewhere in the European Economic Area, you may also be entitled to complain to the supervisory authority in your country of habitual residence, place of work or the place of the alleged infringement, subject to applicable law.

20. INTERNATIONAL USERS
Our business is intended primarily to provide digital marketing services to businesses. Our website may nevertheless be visited by people located in different countries.

The law applicable to a particular processing activity may depend on the establishment of the relevant organisation, the services provided and the individuals concerned.

Where the GDPR applies, we will comply with the obligations relevant to that processing.

If you are located outside the EEA, local privacy laws may provide additional rights or impose additional requirements. This policy does not remove any rights that cannot lawfully be excluded.

21. CHILDREN'S PRIVACY
Our services and website are directed primarily towards businesses and individuals acting in a professional capacity.

We do not intend to knowingly collect personal data directly from children through our general business enquiry processes.

If we become aware that personal data has been collected in circumstances where doing so was not appropriate or lawful, we will assess the issue and take appropriate steps under applicable law.

If a marketing project involves children's data or services directed towards children, the processing must be separately assessed before it begins, including any applicable consent, transparency, safeguarding and age-related requirements.

22. AUTOMATED PROCESSING, PROFILING AND ARTIFICIAL INTELLIGENCE
Digital marketing tools may use automated processes to measure campaign performance, categorise audiences, recommend content, attribute conversions or optimise advertising delivery.

The tools and the role of TempleHill Agency may vary by project.

Where automated processing involves personal data, we will assess the purpose, legal basis, transparency requirements, consent requirements and relevant safeguards.

We will not assume that using an advertising or analytics platform automatically authorises every possible form of profiling.

Where a processing activity falls within Article 22 GDPR, including solely automated decisions producing legal or similarly significant effects, the applicable restrictions and safeguards must be met.

We may also use software tools, including AI-assisted tools, to support routine business or marketing tasks where appropriate. Before personal data is entered into such a tool, we will consider whether the data is necessary, whether the tool is appropriately authorised, its applicable terms and security arrangements, and whether disclosure is consistent with our legal obligations and client instructions.

Before publication: Confirm whether TempleHill Agency uses AI services that receive personal data, automated lead-scoring tools, audience profiling or other forms of automated decision-making. Add the actual purposes and safeguards where required, and remove any statements that do not reflect your operations.

23. CONFIDENTIALITY AND CLIENT INFORMATION
We recognise that digital marketing projects may involve confidential commercial information, campaign strategies, customer records, unpublished content, account credentials and other sensitive business material.

We will handle such information in accordance with applicable contractual confidentiality obligations and, where personal data is involved, applicable data protection law.

Information supplied for one project will not automatically be treated as available for an unrelated project or used for a purpose inconsistent with the applicable agreement.

Clients should ensure that they are authorised to share the relevant information and should avoid sending unnecessary personal data or sensitive credentials.

Where client data must be shared with another service provider, we will assess the relevant authorisation, contractual terms and legal safeguards before permitting access, as required by law.

24. THIRD-PARTY PRIVACY NOTICES
This policy covers the processing activities for which TempleHill Agency is responsible under its own data protection obligations.

It does not replace the privacy policies of third-party services, client websites, social media networks, advertising platforms or external websites that we do not control.

Where a client independently determines the purposes and means of processing, the client's privacy notice will generally govern that processing. Our agreement with the client will define our respective responsibilities.

Where we operate as a processor, we will support the client as required by our agreement and applicable law.

25. CHANGES TO THIS PRIVACY POLICY
We may amend this Privacy Policy to reflect changes in our business, the services we provide, website technologies, data processing activities or applicable legislation.

The revised version will be published at:

https://www.templehillagency.com

We will update the “Last reviewed” date when appropriate.

If a change materially affects how personal data is processed, we will provide additional information or seek consent where required by law.

We will not rely on a general policy update to retrospectively authorise processing that requires a separate lawful basis or consent.

We encourage you to review this policy periodically.

26. CONTACT TEMPLEHILL AGENCY
For general privacy questions, data protection requests or complaints about our handling of personal data, contact:

TempleHill Agency

Address: TempleHill Agency
Email: [email protected]
Website: https://www.templehillagency.com

Please include “Privacy Request” or “Data Protection Enquiry” in the email subject line where appropriate.

Privacy contact:

Philip Moriarty

[email protected]
Business address: TempleHill Agency Cuan Dor 3 Churchyard Lane Ballintemple Cork

Effective date: 17 October 2026
Last reviewed: 17 October 2026