Privacy Notice

1. Definitions

1.1 In this Notice, “the Controller”, “we”, “us” and “our” mean Zawrick Holdings Teoranta, trading as Docratic; “the Service” means the Docratic website and applications; “you” and “the Data Subject” mean an identified or identifiable natural person to whom Personal Data relates; and “Personal Data”, “Processing”, “Processor” and “Supervisory Authority” bear the meanings given to them in Regulation (EU) 2016/679 (the “GDPR”).

1.2 Headings are for convenience only and do not affect construction. References to any statute or statutory provision include that provision as amended, extended or re-enacted.

2. Identity and contact details of the Controller

2.1 The Controller is Zawrick Holdings Teoranta, 43 The Green, College Road, Galway, H91 D89A.

2.2 All communications concerning this Notice, including the exercise of any right under clause 8, must be addressed to support@docratic.ie.

3. Categories of Personal Data

3.1 The Controller Processes the following categories of Personal Data: (a) account identification and authentication data; (b) educational profile data describing the programme of study to which access is granted; (c) usage, interaction and assessment data generated by your use of the Service; (d) communications and support correspondence; and (e) transaction data relating to any purchase, excluding payment instrument details.

3.2 The Controller does not Process special categories of Personal Data within the meaning of Article 9 GDPR, and does not seek them. You are asked not to submit them through the Service.

4. Purposes of Processing and legal bases

4.1 Performance of a contract (Article 6(1)(b) GDPR): to create and maintain your account, to make available the content and functionality to which you are entitled, to record and present your progress, and to administer any purchase.

4.2 Legitimate interests (Article 6(1)(f) GDPR): to secure the Service and prevent misuse, to maintain and improve the Service, and to communicate with you about the Service in the circumstances described at clause 6. The Controller has assessed these interests as not overridden by your interests or fundamental rights, and you may object under clause 8.1(f).

4.3 Legal obligation (Article 6(1)(c) GDPR): to comply with obligations to which the Controller is subject, including taxation and accounting obligations.

4.4 Consent (Article 6(1)(a) GDPR): where consent is sought for a specific purpose, including any Processing of identifiable Personal Data for research as described at clause 5.2. Consent may be withdrawn at any time without affecting the lawfulness of Processing carried out before withdrawal.

5. Research, analysis and anonymised data

5.1 The Controller analyses usage, interaction and assessment data in aggregated, anonymised or pseudonymised form for the purposes of maintaining and improving the Service, for statistical purposes and for research and publication. Data that has been anonymised such that a Data Subject is no longer identifiable does not constitute Personal Data and this Notice does not apply to it.

5.2 Any Processing of identifiable Personal Data for research purposes is carried out only on the basis of your separate, specific and explicit consent, obtained before that Processing begins.

5.3 Where the Service presents a comparison against other users, it is presented only where the group is of sufficient size that no individual can be identified from the figure.

6. Communications

6.1 Service communications necessary for the performance of the contract, including security, account and transaction messages, are not marketing and cannot be declined while an account subsists.

6.2 Where you have provided your contact details in the course of registering for or purchasing the Service, the Controller may send you communications concerning its own similar products and services in reliance on Regulation 13(11) of S.I. 336/2011. You are given a clear and unambiguous means to refuse such use of your details at the point of collection and in every such communication, at no cost. Refusal does not affect clause 6.1.

6.3 Where you are not a customer, marketing communications are sent only with your prior consent, indicated by an affirmative act.

7. Recipients, transfers and retention

7.1 Categories of recipient. Personal Data is disclosed to the following categories of recipient, each of which acts as a Processor on documented instructions save where stated: hosting, database and infrastructure providers; authentication providers; payment service providers, which act as independent controllers in respect of payment instrument data; communications and email delivery providers; language-model and content-processing providers; and professional advisers. Personal Data is not sold, and is not disclosed to advertising networks or data brokers.

7.2 Transfers. Where a recipient Processes Personal Data outside the European Economic Area, the transfer is made subject to an adequacy decision of the European Commission or to appropriate safeguards within the meaning of Article 46 GDPR, including standard contractual clauses. A copy of the safeguard relied upon may be requested under clause 2.2.

7.3 Retention. Personal Data is retained for as long as necessary for the purpose for which it was collected. In particular: account and profile data is retained for the duration of the account; usage and assessment data is retained for the duration of the account so that your progress remains available to you; transaction records are retained for the period required by applicable taxation and accounting law; and records evidencing a consent or a refusal are retained for as long as necessary to demonstrate compliance. On deletion of your account, Personal Data is erased save where continued retention is required by law or is necessary for the establishment, exercise or defence of legal claims.

8. Rights of the Data Subject

8.1 Subject to the conditions and exceptions in the GDPR, you have the right: (a) of access to your Personal Data under Article 15; (b) to rectification under Article 16; (c) to erasure under Article 17; (d) to restriction of Processing under Article 18; (e) to data portability under Article 20; (f) to object to Processing carried out in reliance on legitimate interests under Article 21, and an unqualified right to object to Processing for direct marketing; and (g) to withdraw consent under Article 7(3).

8.2 You may delete your account, and with it the Personal Data described at clause 3.1(a) to (c), from the settings area of the Service without contacting the Controller.

8.3 Requests under clause 8.1 are addressed to the contact point at clause 2.2 and are answered within the period prescribed by Article 12(3) GDPR.

8.4 You have the right to lodge a complaint with a Supervisory Authority. In Ireland this is the Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963.

9. Automated decision-making; provision of Personal Data

9.1 The Controller does not take decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated Processing within the meaning of Article 22 GDPR.

9.2 The provision of the Personal Data described at clause 3.1(a) and (b) is a requirement necessary to enter into a contract for the Service; without it an account cannot be created and the Service cannot be provided.

10. Amendment

10.1 The Controller may amend this Notice. Where an amendment materially affects the Processing of your Personal Data, notice will be given on this page before the amendment takes effect.

Last reviewed: pending founder review.