Privacy Notice

CirPact respects your privacy and is committed to handling personal information responsibly. This Privacy Notice explains what personal data may be collected when you visit the CirPact website, contact CirPact, subscribe to updates or engage with CirPact professionally, and how that information is used and protected.

This notice is provided in accordance with the EU General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

1. Who we are

CirPact is a founder-led advisory practice established and operated by Pauline Gannon.

Website: www.cirpact.com
Email: pauline@cirpact.com

For the purposes of data protection law, Pauline Gannon, operating CirPact, is the Data Controller of personal data processed by CirPact.

2. Personal data we may collect

Depending on how you interact with CirPact, we may process:

• contact information, such as your name and email address;
• professional information, such as your organisation, role or sector where you provide it;
• communications, including emails, enquiries and other correspondence you send to CirPact;
• professional and client information required to discuss, establish or deliver an engagement;
• subscription information where you choose to subscribe to CirPact writing or updates through Substack; and
• technical information generated when you visit the website, such as IP address, browser/device information and basic server-log information required to operate and secure the website.

CirPact does not ask visitors to provide special-category or sensitive personal data through this website.

3. How we collect personal data

Personal data may be collected when you:

• contact CirPact by email;
• communicate with CirPact about potential or existing work;
• subscribe to CirPact publications or updates through Substack;
• interact with CirPact professionally; or
• visit the website, where limited technical information may be processed by the website hosting infrastructure.

The CirPact website does not currently operate a contact form or user account system.

4. How we use personal data

CirPact may use personal data to:

• respond to enquiries and correspondence;
• discuss, establish and deliver professional engagements;
• maintain appropriate professional and client relationships;
• send publications or updates you have chosen to receive;
• administer and secure the CirPact website;
• maintain appropriate business, contractual and financial records; and
• comply with legal, regulatory and tax obligations.

CirPact does not sell or rent personal data.

5. Legal bases for processing

The legal basis used depends on the purpose for which the information is processed. CirPact may rely on:

Legitimate interests — for example, to respond to professional enquiries, maintain appropriate business relationships and operate the practice.

Contract or steps before entering a contract — where information is needed to discuss, arrange or provide professional services.

Consent — where you have actively chosen to subscribe to publications or other communications and consent is the appropriate basis.

Legal obligation — where information must be retained or processed to meet legal, tax, accounting or regulatory requirements.

6. Cookies and website technologies

At launch, CirPact does not use advertising, behavioural tracking or analytics cookies on this website.

The website may use technologies that are strictly necessary for its operation, security and delivery.

If CirPact introduces analytics or other non-essential tracking technologies in future, this notice and the website's consent arrangements will be updated before those technologies are used.

7. Substack and external websites

CirPact publishes writing through Substack. If you follow a link from this website to Substack or choose to subscribe there, information will also be processed through the Substack platform under its own privacy arrangements.

The website may also link to other external services, including LinkedIn. CirPact is not responsible for the privacy practices of external websites.

Where CirPact receives subscriber information through Substack, it will only be used in connection with the publications or communications you have chosen to receive.

8. Service providers and data sharing

CirPact may use reputable third-party service providers where reasonably necessary to operate the practice, including providers of:

• website hosting;
• email;
• publication/subscription services;
• accounting or professional services; and
• other essential business technology.

Personal data is shared only where necessary for a legitimate purpose or legal requirement.

Some service providers may process information outside the European Economic Area. Where this occurs, CirPact will rely on the safeguards required by applicable data protection law.

9. How long we retain personal data

CirPact does not keep personal information indefinitely.

As a general approach:

• routine enquiries and correspondence will normally be retained for up to two years after the last meaningful contact, unless there is a reason to retain them longer;
• information relating to an ongoing professional relationship will be retained for the duration of that relationship and for an appropriate period afterwards;
• financial, accounting and business records will be retained for the period required by law; and
• subscription information will normally be retained until you unsubscribe or otherwise withdraw your consent.

Personal data will be deleted or securely disposed of when it is no longer required.

10. Your data protection rights

Subject to the circumstances and applicable law, you may have the right to:

• access personal data held about you;
• ask for inaccurate information to be corrected;
• ask for personal information to be erased;
• restrict certain processing;
• object to certain processing;
• request data portability where applicable; and
• withdraw consent at any time where processing is based on consent.

To exercise a data protection right or ask a question about how CirPact handles personal data, contact pauline@cirpact.com.

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

11. Complaints

If you have a concern about how CirPact handles your personal data, you are welcome to contact CirPact first so that the issue can be addressed.

You also have the right to raise a concern with the Irish Data Protection Commission:

Website: www.dataprotection.ie

12. Changes to this Privacy Notice

This Privacy Notice may be updated from time to time to reflect changes in CirPact's activities, website or legal obligations.

Any updated version will be published on this page with a revised Last updated date.