Legal
Privacy Policy.
Effective date: on publication
| Purpose | Typical lawful basis under GDPR |
|---|---|
| Answer enquiries and prepare individual quotations | Steps requested before a contract, or legitimate interests in responding to business enquiries |
| Design, deliver and support websites | Performance of contract where applicable; otherwise legitimate interests or client-controller instructions under a data-processing agreement |
| Administer Stripe deposits, one-time payments, invoices and care-plan subscriptions | Contract, legal accounting/tax obligations and legitimate interests in payment administration and fraud prevention |
| Maintain CRM and client communications | Legitimate interests, subject to balancing and applicable opt-outs |
| Send electronic or telephone marketing | Consent or another permission only where the applicable Irish ePrivacy rules allow it; objections and unsubscribe requests are honoured |
| Keep systems secure, prevent abuse and manage incidents | Legitimate interests and legal obligations where applicable |
| Use Lovable AI and supporting development tools | Contract or legitimate interests as applicable, with additional safeguards or consent where law requires |
| Keep records and respond to legal claims | Legal obligations and legitimate interests in establishing, exercising or defending claims |
We do not sell personal data. Publicly available business contact details are not a general permission to send marketing. Individuals can object to direct marketing at any time. Consent for optional cookies is separate from marketing consent and agreement to our Terms & Conditions.
4. Stripe payments, billing and subscriptions
We use Stripe to process agreed website deposits where applicable, one-time project payments, customer invoices, receipts and recurring website-care subscriptions. Stripe may handle card authentication, payment security, fraud prevention and payment recovery. We maintain the billing records needed to identify the correct customer, agreed invoice, subscription plan, initial free period where applicable, billing schedule, payments, refunds and disputes.
Stripe processes certain information for its own security, regulatory and payment-platform purposes and provides other processing services to us. Customers may see Stripe's own privacy information on Stripe-hosted checkout and billing pages. We do not use payment authorisation as consent to unrelated tracking or marketing.
Subscription duration, charges, refund rights and cancellation conditions are contractual matters explained in our Terms & Conditions and the customer's order confirmation, not determined by this Privacy Policy.
5. Data handled on clients' websites
For our own business records we are normally an independent controller. For personal data belonging to visitors, customers or users of a website we develop or maintain for a client, the client will ordinarily decide the purposes and means of processing, and we will generally act as processor.
Where required, an Article 28 GDPR data-processing agreement will address instructions, confidentiality, approved subprocessors, safeguards, transfers and return/deletion of data. Each client remains responsible for its own website's legally required notices and consent settings, subject to our agreed responsibilities.
6. Employees, sales representatives and contractors
Approved employees, sales representatives, technical contractors and advisers may access only information reasonably needed for their assigned work. Appropriate confidentiality, access permissions and contractual controls are applied. Authorised personnel may see invoice and subscription status to assist clients; they do not need full card credentials. We restrict and revoke access when it is no longer needed.
7. Lovable AI and other AI-assisted development tools
Lovable AI is a principal platform we use to design, build, modify and test client websites. We may also use other approved coding, testing and AI-assisted tools. Depending on the project, prompts, website specifications, content, code and related files may be processed by Lovable and its infrastructure providers.
We seek to minimise personal data sent to these systems; sensitive details and credentials should not be uploaded through ordinary prompts. We review AI-assisted outputs as appropriate to our contractual obligations. Where an interactive AI chatbot is deployed, we will provide any applicable disclosures and privacy information. We do not currently describe our ordinary enquiry or client-management process as involving solely automated decisions with legal or similarly significant effects. If that changes, this notice and the relevant safeguards will be updated.
8. Sharing and international transfers
Where necessary, data may be shared with Stripe, Lovable AI and associated infrastructure, hosting/domain providers, business email and CRM providers, payment and security suppliers, authorised personnel, accountants, legal advisers or public authorities where legally required. These are recipient categories; not every supplier or tracking service is necessarily installed on our public website.
Some providers may process data outside the European Economic Area. Where the GDPR's international-transfer rules apply, we assess lawful mechanisms such as an adequacy decision, Standard Contractual Clauses and, where necessary, supplementary safeguards. You may request further information through our privacy email.
9. How long we keep information
We keep information only as long as reasonably necessary for its purpose, taking account of law, security and potential disputes.
| Record | General retention approach |
|---|---|
| Unsuccessful enquiries | Normally up to 24 months after meaningful contact, subject to periodic review and earlier deletion when appropriate |
| CRM contacts and opt-outs | Reviewed periodically; limited suppression records may be retained to prevent renewed unwanted contact |
| Contracts, invoices and core tax records | Normally at least six years where applicable to Irish recordkeeping, or longer where a lawful need applies |
| Project files and backups | For the agreed project/support period and a documented post-project or backup-rotation period |
| Security logs | Generally short-lived, typically not exceeding 12 months unless a security, fraud or legal need justifies longer |
| Cookie choices | Preference state ordinarily refreshed within six months; separate minimal accountability records may be retained where justified |
Retention periods are subject to verification against the systems actually used and applicable legal obligations.
10. Security and incidents
We apply proportionate safeguards, which may include access controls, multi-factor authentication, encrypted connections, secure credentials, updates, backups and appropriate contractor controls.
No internet-based system is completely risk-free. We assess incidents and, where required, notify the Irish Data Protection Commission and affected individuals in accordance with the GDPR. When acting as a processor, we notify the relevant client controller without undue delay as required by our data-processing agreement and law.
11. Your data-protection rights
Depending on your circumstances and applicable exceptions, you may request access, correction, erasure, restriction, portability, object to certain processing, object to direct marketing, withdraw consent for future consent-based processing, and exercise applicable rights concerning automated decision-making. Email judson@jfwebdev.com. We may request proportionate proof of identity.
Withdrawal of consent does not invalidate earlier lawful processing, and legal retention requirements may limit some requests.
12. Cookies, children and business continuity
Our Cookie Policy explains cookies and similar tracking, including the choices available through Cookie Settings. We do not treat acceptance of our service Terms as cookie consent. Our services are aimed at businesses rather than children. Any legally authorised closure, succession or handover of the business will require proportionate protection, lawful transfers and appropriate return or deletion of personal data.
13. Complaints, changes and related policies
For privacy questions or complaints contact judson@jfwebdev.com. You may also complain to the Irish Data Protection Commission at https://www.dataprotection.ie. We may update this notice when our processing, vendors or legal duties change; the publication date on the website will identify the current version.
Our Terms & Conditions govern service descriptions, personalised project quotations and contractual subscription obligations. This Privacy Policy explains only the associated handling of personal data.