Privacy Notice

1. Who we are

Cycological Marketing Agency ("we", "our", "us") is the data controller for the personal data described in this notice.

Controller: Cycological Marketing Agency
Registered address: 6 Ashgrove, Kill Avenue, Dún Laoghaire, Co. Dublin, Ireland
Privacy contact: info@cycological.ie

We process personal data in line with the EU General Data Protection Regulation (Regulation (EU) 2016/679), the Irish Data Protection Act 2018, the Irish ePrivacy Regulations 2011, and — for visitors and clients in the United Kingdom — the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

2. What we collect

Information you give us

Enquiry and audit details: name, work email, phone number, company, website, sector, size, objectives, timeline and anything else you tell us.
Newsletter: your email address, if you subscribe.
Privacy requests: your name, email and the substance of your request.
Consent records: which cookie categories you allowed, the time, and the version of this notice you were shown.

Information collected automatically

Technical data: IP address, browser and device type, and server logs needed to deliver and secure the site.
Campaign context: the referring site and any campaign parameters in the link you arrived on. Before you allow analytics cookies this is held in memory for the current visit only and is never written to your device.
Cookies and similar storage: see our cookie policy. Nothing beyond strictly necessary storage is set until you consent.

3. Why we process it, and on what lawful basis

Responding to your enquiry or growth audit — necessary for the steps leading to a contract, or our legitimate interest in replying to a business enquiry you initiated.
Delivering services to clients — performance of our contract with you.
Marketing email and the insights newsletter — your consent, which you may withdraw at any time using the unsubscribe link in any email or by contacting us.
Analytics and advertising cookies — your consent, given through the cookie banner and changeable at any time.
Site security, fraud prevention and record keeping — our legitimate interests, balanced against your rights.
Meeting legal obligations — compliance with a legal obligation, including keeping proof of consent.

We do not carry out automated decision-making that has a legal or similarly significant effect on you. The growth audit produces an indicative score to help us prepare for a human conversation; it does not decide anything about you on its own.

4. Who we share it with

We share personal data only with service providers who process it on our instructions under a written data processing agreement. Our current processors are listed on the subprocessors page, which names each provider, what it is used for, and whether it only loads after you consent. We do not sell personal data.

Lovable Cloud (hosting, database, authentication) — Hosts the website and stores enquiry, audit, newsletter and consent records.
Email delivery provider (notify.cycological.ie) — Delivers transactional and notification email you have asked for.
Google Ireland Ltd — Google Analytics and Tag Manager — Aggregated website measurement and tag delivery. Loads only if you allow the relevant cookie category.
Meta Platforms Ireland Ltd — Meta Pixel — Advertising measurement and audience building. Loads only if you allow the relevant cookie category.
LinkedIn Ireland Unlimited Company — Insight Tag — Advertising measurement and audience building. Loads only if you allow the relevant cookie category.
CRM and email marketing platform — Manages enquiry follow-up and sends the insights newsletter to people who opted in.

We may also disclose data where required by law, or to professional advisers where necessary to protect our legal rights.

5. International transfers

Some providers process data outside the European Economic Area or the United Kingdom, principally in the United States. Where that happens we rely on the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, an applicable adequacy decision, or the provider's certification under an approved transfer framework, plus supplementary measures where needed.

6. How long we keep it

Enquiries: 24 months from our last contact with you.
Growth audit submissions: 24 months from our last contact with you.
Newsletter subscriptions: Until you unsubscribe, then a suppression record only.
Consent records: Retained as proof of consent, then reviewed annually.
Client records: for the duration of the engagement, then for as long as required for tax, accounting and legal purposes.

When a retention period ends we delete the data or irreversibly anonymise it for aggregate reporting.

7. Cookies and tracking

Analytics and marketing storage stay switched off until you opt in. You can change or withdraw your choice at any time — or use the "Cookie settings" link in the footer. Withdrawing is as easy as consenting, and it takes effect immediately. Full detail is in the cookie policy.

8. Your rights

Under the EU and UK GDPR you have the right to access your data; to have inaccurate data corrected; to erasure; to restriction of processing; to data portability; to object to processing based on legitimate interests or to direct marketing at any time; and to withdraw consent where consent is the basis we rely on.

To exercise any of these, use our data request form or email info@cycological.ie. We respond within one month, and will tell you if we need to extend that period as the legislation allows. Exercising your rights is free of charge.

9. Complaints

We would rather hear from you first, but you have the right to lodge a complaint with a supervisory authority:

Data Protection Commission (Ireland) — 21 Fitzwilliam Square South, Dublin 2, D02 RD28 — make a complaint
Information Commissioner's Office (United Kingdom) — Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF — make a complaint

10. Security

We use encrypted connections, access controls and database-level access rules so that form submissions cannot be read from the browser, and we limit access to personal data to those who need it. No transmission over the internet can be guaranteed as absolutely secure. If a personal data breach is likely to result in a risk to your rights, we notify the relevant supervisory authority within 72 hours and inform you where required.

11. Children

Our services are aimed at businesses. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided data, contact us and we will delete it.

12. Changes to this notice

If we change how we use personal data we will update this notice and, where the change affects cookies or consent, we will ask for your choice again. Material changes will be highlighted on this page.