Legal

Privacy Policy

Last updated: 26 September 2026

This Privacy Policy explains how Andalusia Dynamics Limited ("Andalusia Dynamics," "we," "our," or "us") collects, uses, shares, and protects personal data when you visit andalusiadynamics.com (the "Site"), contact us, work with us, or are a business contact whom we approach about our services. It is written to meet our obligations under the EU General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR"), the Data Protection Act 2018, and the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336 of 2011, the "ePrivacy Regulations").

1. Who We Are

The data controller is Andalusia Dynamics Limited, a private company limited by shares registered in Ireland under company number [to be confirmed], with its registered office at [to be confirmed]. We are a software development and IT consulting business.

We have not appointed a Data Protection Officer, as we are not required to do so. All data protection enquiries, and all requests to exercise your rights, may be sent to hello@andalusiadynamics.com.

2. Whose Personal Data This Policy Covers

This Policy applies to four groups of people: (a) visitors to the Site; (b) people who contact us; (c) our clients, prospective clients, suppliers, and their staff; and (d) individuals whose business contact details we obtain from public sources in order to tell their business about our services (see Section 6).

3. What Personal Data We Process, Why, and For How Long

The table below sets out each purpose for which we process personal data, the categories of data involved, the lawful basis under Article 6 GDPR, and how long we keep the data.

Purpose	Personal data	Lawful basis	Retention
Operating and securing the Site; aggregate traffic statistics	IP address, browser and device type, pages requested, and timing data, processed by our hosting and analytics provider	Legitimate interests: keeping the Site available, secure, and fast (Art. 6(1)(f))	Aggregated statistics only; raw technical logs are held by the provider for a short period under its own settings
Responding to enquiries	Name, email address, organisation, and the content of your message	Legitimate interests in answering enquiries you initiate (Art. 6(1)(f)); steps at your request before a contract (Art. 6(1)(b))	Up to 24 months after our last contact, unless a client relationship follows
Providing and administering our services to clients	Contact details of client staff, project correspondence, and invoicing and payment records	Performance of a contract (Art. 6(1)(b)); compliance with legal obligations (Art. 6(1)(c))	Duration of the engagement; accounting and tax records are then kept for at least 6 years from the end of the financial year to which they relate, as Irish company and tax law require
Telling businesses about our services (outreach), including free website reviews	Business name, business address and phone number, website address, and business email address (which may include an individual's name); results of automated checks on the business's public website, including a screenshot of its homepage	Legitimate interests in promoting our services to relevant businesses (Art. 6(1)(f)); see Section 6	Deleted 24 months after collection unless the business becomes a client or asks us to stay in touch; if you object, we keep only your email address (or domain), the date, and the reason, indefinitely, so that we never contact you again
Legal compliance, and establishing, exercising, or defending legal claims	Any of the above, to the extent necessary	Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f))	For as long as the obligation or claim requires

We do not process special categories of personal data (such as health or biometric data) or data relating to criminal convictions, and we do not seek it. Please do not include it in messages to us.

4. Where We Get Personal Data

From you: when you email us, engage us, or otherwise correspond with us.
Automatically: technical data generated when your browser requests pages from the Site.
From public sources: business names, addresses, phone numbers, and website addresses from public mapping and place databases and from the public register of the Companies Registration Office; and business email addresses, which we take only from the business's own website. We use this information only for the business outreach described in Section 6.

5. The Site, Cookies, and Similar Technologies

The Site does not set advertising, tracking, or analytics cookies, and it does not read or write other information on your device for those purposes. We use a privacy-preserving analytics service that does not use cookies or persistent identifiers and does not follow you across other sites. Our infrastructure provider may set strictly necessary security cookies to protect the Site from automated abuse; where it does, these are exempt from consent under Regulation 5 of the ePrivacy Regulations because they are necessary to provide the Site securely.

The Site's typefaces are served from our own hosting, so viewing the Site does not send requests to any font or advertising service. The mailto: link in our contact section opens your own email client; nothing is sent to us until you send the message yourself.

6. Business Outreach: How We Contact Businesses and Why

We approach small and medium-sized businesses, mainly in Ireland, whose websites we believe we could help improve. Where we do so, we may carry out automated checks of the business's publicly visible website (for example, its loading speed, display on phones, secure connection, broken links, and the email-security settings of its domain) and send an email to a business address, with a short summary of what we found and an offer to help.

Lawful basis. Our legitimate interest in promoting our services to businesses that may benefit from them (Art. 6(1)(f) GDPR). We have weighed this against the interests and rights of the individuals concerned and limit the data to business contact details and public website information. A summary of this assessment is available on request.
Who we email. We send outreach only to email addresses published on the business's own website that appear to be used for its commercial activity, and only about that activity. In line with Regulation 13 of the ePrivacy Regulations, we do not send marketing email to free webmail or internet-provider mailboxes (such as Gmail, Outlook, or Eircom addresses), because these are often an individual's personal address.
How to opt out. You may object at any time, and free of charge, to our use of your data for direct marketing (Art. 21(2) and (3) GDPR). Reply to any of our emails saying you would rather not hear from us, or write to hello@andalusiadynamics.com. We will not contact you again, and we add your address (or, if you ask, your whole business domain) to a do-not-contact list that we check before every email.
What each email tells you. Every outreach email states that we found the address on your website, identifies Andalusia Dynamics Limited with its company particulars, links to this Policy, and explains how to opt out. This Section, together with the rest of this Policy, forms the fuller information required by Article 14 GDPR.
What we do not do. We do not sell, rent, or trade the contact details we collect, and we do not use them for any purpose other than the outreach described here.

7. Automated Tools and Artificial Intelligence

The findings in our outreach emails come from fixed, rule-based software checks of a business's public website (for example, whether it loads over a secure connection or displays properly on phones). We have also used an artificial-intelligence service to help sort businesses by whether their website appears outdated. For that, we gave the service each website's address, page title and description, and a short excerpt of its public homepage text. We did not give it the email addresses or other contact details we hold, although a homepage excerpt may incidentally include names or contact details that the business itself published.

These tools assess businesses' websites, not individuals. We do not make decisions that produce legal effects on, or similarly significantly affect, any individual based solely on automated processing. Every email is reviewed by us before it is sent.

8. Who We Share Personal Data With

We share personal data only with the following categories of recipients, and only where necessary:

Service providers (processors) that act on our instructions and are bound by confidentiality, security, and data protection terms: cloud hosting and content delivery; web analytics; business email and file storage; and, once we have clients, accounting and payment services.
Other technical services that receive only website addresses, not personal data, such as the page-speed testing service we use for website checks.
The artificial-intelligence service described in Section 7, which processes the website excerpts it receives under its own terms.
Professional advisers such as our accountants, insurers, and legal advisers, under duties of confidentiality.
Public authorities, such as the Revenue Commissioners, the Companies Registration Office, the courts, and the Data Protection Commission, where the law requires or permits it.
A successor to our business, if we are ever involved in a merger, acquisition, or sale of assets, subject to this Policy continuing to protect your data.

We do not permit our processors to use personal data for their own purposes. We do not sell personal data.

9. International Data Transfers

Some of our service providers process data on infrastructure outside the European Economic Area (EEA), including in the United States. Where a transfer takes place, we rely on a safeguard recognised by Chapter V of the GDPR: an adequacy decision of the European Commission (including, for United States recipients certified under it, the EU–US Data Privacy Framework), or the Commission's Standard Contractual Clauses together with supplementary measures where needed. You may ask us for further information, or a copy of the relevant safeguards, using the details in Section 13.

10. Security

We apply technical and organisational measures appropriate to the risk, including encrypted connections to the Site, access controls, limiting access to personal data to those who need it, and using reputable providers. No system is completely secure. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours and, where the risk is high, tell you without undue delay.

11. Your Rights

Under the GDPR you have the right to:

be informed about, and request access to, the personal data we hold about you;
have inaccurate data corrected and incomplete data completed;
have your data erased in the circumstances set out in Article 17;
restrict our processing in the circumstances set out in Article 18;
receive data you provided to us in a portable format, where processing is based on contract and carried out by automated means;
object to processing based on our legitimate interests and, absolutely, to direct marketing; and
withdraw any consent you have given, at any time, without affecting the lawfulness of earlier processing.

To exercise a right, email hello@andalusiadynamics.com. We will respond within one month, which we may extend by up to two further months for complex or numerous requests, and we will tell you if we do. There is no fee unless a request is manifestly unfounded or excessive. We may ask you to verify your identity before acting on a request. Some rights are subject to legal exceptions.

12. Complaints

We would like the chance to resolve any concern first, so please contact us. You also have the right to lodge a complaint with the Irish supervisory authority: the Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland (dataprotection.ie), or with the supervisory authority in your own EU Member State.

13. Contact

Andalusia Dynamics Limited, [to be confirmed]. Email: hello@andalusiadynamics.com.

14. Changes to This Policy

We may update this Policy to reflect changes in our practices or in the law. The "Last updated" date above shows the current version. Where a change is material, we will take reasonable steps to bring it to your attention.