Privacy

Which hat

We are the controller for the data of the people who run shops on FreshTrim: your name, your email, your login, your billing records, our support conversations and our server logs. This page is about that.

We are a processor for the personal data of the customers who book appointments with you. You decide what happens to that data; we act on your instructions. Those obligations live in the Data Processing Agreement.

What we hold, and why

• Your account. Name, email address, role and shop membership. Needed to give you an account at all. Lawful basis: performance of a contract.
• Billing. Your subscription status, invoices and the last four digits of a card. Full card details are held by Stripe and never reach us. Lawful basis: contract, and legal obligation for tax records.
• Service messages. The emails we send you about your account, your trial and failed payments. Lawful basis: contract.
• Logs and error reports. Technical records that let us find out why something broke. Lawful basis: our legitimate interest in a working product.

What we do not do

We do not sell personal data. We do not run advertising. We do not run behavioural analytics or a tracking pixel on this site, which is also why you are not looking at a cookie banner. See cookies.

Where it lives

In the European Union. Our database is hosted in Ireland (AWS eu-west-1), and the services we rely on are listed, with their regions, on the subprocessors page.

How long we keep it

Account and shop data for as long as you have an account, and for 30 days after you close it. Billing records for six years, because Irish tax law requires it. Server logs for 30 days. Backups roll on a 30-day cycle, so deleted data can persist there for up to 30 days before ageing out; it is never restored to live systems.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, object to processing based on legitimate interests, or ask for it in a portable format. Email fresh@dv.ie and we will respond within one month.

If you are unhappy with how we have handled it you can complain to the Irish Data Protection Commission at dataprotection.ie.

Breaches

If personal data we control is breached in a way that presents a risk to you, we will notify the Data Protection Commission within 72 hours and tell you without undue delay where the risk is high. Where the breach affects data we process on your behalf, we tell you. The DPA sets out the timescale we commit to.

Contact

Darragh Verschoyle, 2 Elmbrook, Eighter, Virginia, Co. Cavan. Email fresh@dv.ie.

We have assessed whether we are required to appoint a Data Protection Officer and concluded that we are not: our core activity is not large-scale systematic monitoring, and we do not process special category data. We review that annually.