1. Who we are
This website is operated by barenox, an Irish organic compost producer providing compost products and related guidance for gardens, farms, and landscaping. For the purposes of data protection law, barenox is the “data controller” for personal data processed through this website.
2. Data we collect
We aim to collect only the data needed to respond to enquiries, operate our website securely, and understand how visitors use our pages. Depending on how you interact with the site, we may collect the following categories of personal data:
- Identity and contact data: full name, email address, and phone number (phone is optional on our contact form).
- Enquiry data: the message content you submit, your compost needs, county/location details you choose to share, and any follow up communications.
- Technical and log data: IP address, approximate location derived from IP (city/region level), date/time of access, pages viewed, referring page, and server log identifiers.
- Device and browser data: browser type and version, operating system, screen size, language, and device identifiers where provided by the browser.
- Cookie and usage data: information stored in cookies or localStorage, including cookie preferences and analytics events when you consent to analytics.
We do not intentionally collect sensitive personal data (such as health information, political opinions, or financial account details) through this site. Please do not include sensitive information in your message.
3. How we collect data
We collect personal data through the following methods. The method depends on the action you take on the site and on your cookie choices.
Web forms
When you submit a form on the Contact page, we collect the fields you enter. Our current form uses a mailto action on your device to draft an email to us. If you contact us directly by email, we process the information you send as part of that email.
Server logs
Like most websites, our hosting provider automatically collects log data to deliver pages and help protect against abuse. This can include your IP address, requested URL, and timestamps.
Cookies and localStorage
We use localStorage to remember your cookie choice (accepted or rejected). We may also use cookies for essential functionality and, if you consent, analytics. Details are provided in the Cookies section below.
Analytics tools (optional)
If enabled with your consent, we may use Google Analytics 4 to understand which pages are visited and how the site performs. We may also use the Meta Pixel to measure ad performance and improve reach. These tools are not required to use the site and should only run when you have accepted analytics/marketing cookies.
4. Legal bases for processing (GDPR Art. 6)
Under the GDPR we must have a lawful basis to process personal data. We rely on the following bases depending on the context:
Consent (Art. 6(1)(a))
We rely on your consent for non-essential cookies and similar technologies, including analytics and marketing tools where used. We also rely on consent if you opt in to receive occasional availability updates and soil tips. You can withdraw your consent at any time by changing your cookie settings (clear localStorage/cookies) or by unsubscribing from emails.
Contract or pre-contract steps (Art. 6(1)(b))
When you ask for a quote, delivery information, or product details, we process your contact and enquiry data to respond and to take steps at your request prior to entering into a contract (for example, confirming availability and providing pricing). If a purchase or supply arrangement follows, we process the data needed to perform that contract.
Legitimate interests (Art. 6(1)(f))
We process certain technical data and basic interaction data to operate our website securely, prevent fraud and abuse, and to understand how the site is used in a way that is proportionate and respects your rights. Where we rely on legitimate interests, we balance our interests against the impact on your privacy, and we provide opt-out controls where appropriate.
Legal obligation (Art. 6(1)(c))
We may need to process and retain certain records to meet legal obligations, such as tax, accounting, or regulatory requirements, and to respond to lawful requests from public authorities.
5. Purposes of processing
We use personal data for the purposes listed below. The specific data used depends on what you do on the site (for example, whether you submit a form) and your cookie preferences.
Responding to enquiries
To reply to your request for pricing, availability, delivery guidance, or advice on compost type and application. This includes follow up emails and any clarifying questions needed to answer accurately.
Security and fraud prevention
To monitor for malicious traffic, protect the site, and investigate suspicious activity. This commonly involves server logs and IP-related data for limited periods.
Operating and improving the site
To keep the site working, improve navigation, and understand which content is useful. Where analytics cookies are used, we only do so with your consent.
Optional updates (consent-based)
If you opt in, we may send occasional emails about compost availability and practical soil tips. You can unsubscribe at any time using the link in the email or by contacting [email protected].
6. Retention periods
We keep personal data only for as long as needed for the purposes described in this policy, unless a longer retention period is required by law. Typical retention periods are:
Server logs are typically retained for short periods needed for security and troubleshooting. The exact period can depend on hosting configuration, but we aim to keep logs no longer than necessary and to restrict access to authorised personnel.
8. International transfers
We are based in Ireland and aim to keep processing within the European Economic Area (EEA) where practical. However, some service providers may store or process data outside the EEA, including in the United States, depending on configuration and support operations.
When personal data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs) under GDPR Art. 46, and where applicable an adequacy decision. We also assess additional measures when necessary, such as encryption in transit and access controls.
9. Your rights under GDPR
If you are in the EEA (including Ireland), you have rights in relation to your personal data. These rights are not absolute and may be limited in certain circumstances, for example where we must keep records for legal obligations.
You can ask for a copy of personal data we hold about you and information about how we process it.
You can ask us to correct inaccurate data or complete data that is incomplete.
You can ask us to delete your personal data in certain situations, such as when it is no longer needed for the original purpose or when you withdraw consent and we have no other legal basis.
You can ask us to restrict processing in certain cases, for example if you contest the accuracy of the data while we verify it.
Where processing is based on consent or contract and carried out by automated means, you can ask to receive your data in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible.
You can object to processing based on legitimate interests in certain circumstances. You also have an unconditional right to object to direct marketing.
If we rely on your consent (for example, analytics cookies or marketing emails), you can withdraw that consent at any time. Withdrawal does not affect processing already carried out before withdrawal.
You have the right to lodge a complaint with the Data Protection Commission (Ireland) if you believe your data protection rights have been infringed.
Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland.
To exercise your rights, email [email protected]. Please provide enough information for us to identify you and your request. We may ask for additional information to verify identity before fulfilling a request.
11. Children’s privacy
Our website and services are not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided personal data to us, please contact [email protected] so we can take appropriate steps to delete the information.
12. Policy updates
We may update this Privacy Policy to reflect changes to the site, legal requirements, or the tools we use. If changes are significant, we will take reasonable steps to inform visitors, such as updating the “Last Updated” date on this page and, where appropriate, posting a notice on the website. If you have subscribed to optional updates and a change affects that processing, we may also notify you by email.
The latest version of this policy will always be available at /privacy/.
13. Contact and Data Protection Officer (DPO)
If you have questions about this Privacy Policy, want to exercise your rights, or want to request deletion of data, you can contact our privacy team:
Include your name and enough detail for us to locate the relevant information. If you are exercising a GDPR right, tell us which right and what outcome you want.
If you prefer, you can send written requests by post. We may contact you by email to confirm details or verify identity where needed.
barenox does not currently appoint a Data Protection Officer as a formal role. We still handle privacy requests promptly via our dedicated email address above and maintain internal responsibility for data protection compliance.