Privacy & Cookies Policy

Last updated: 19^th May 2025

At The Orchard in Celbridge, we are committed to respecting and protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data, and your rights under the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Irish Data Protection Act 2018.

Who We Are

The Orchard Home & Garden Limited
Registered address: Celbridge, Co. Kildare, Ireland
Company number: 110850
Email: customerservice@theorchard.ie

We are the “data controller” of your personal data for the purposes described in this policy.

How We Use Your Personal Data

Purpose	Data Collected	Legal Basis	Retention	Shared With
To process and deliver your order	Name, address, phone, email, payment details	Contract (Art. 6(1)(b))	7 years (for Revenue compliance)	Payment processors, delivery partners
To manage your online account	Login details, order history	Contract (Art. 6(1)(b))	Until account closed + 1 year	Internal only
To respond to queries	Name, email, query content	Legitimate interest (Art. 6(1)(f))	2 years	Internal only
To send marketing communications (email or SMS) You can opt out at anytime by clicking ‘unsubscribe’ or contacting us.	Name, email, phone, purchase history	Consent (Art. 6(1)(a))	Until withdrawn or 2 years of inactivity	Email/SMS providers
To personalise your experience (e.g. product recommendations)	Browsing behaviour, purchase history	Legitimate interest (Art. 6(1)(f))	2 years	Analytics providers
To maintain security (e.g. CCTV on premises: signage present as per Irish DPC guidelines)	CCTV footage	Legitimate interest (Art. 6(1)(f))	90 days unless required for investigation	Security contractors
To meet our legal obligations	Transaction records, tax info	Legal obligation (Art. 6(1)(c))	7 years	Revenue Commissioners, auditors

Profiling and Automated Decision-Making

We may use profiling (e.g. customer segmentation, purchase scoring) to tailor marketing offers. This does not involve any decisions with legal or similarly significant effects. You have the right to object to profiling at any time.

2. Cookie Policy

What are cookies?
Small text files placed on your device that enable core features, analytics and advertising.

Cookies we use

Category	Why	Examples / Lifespan	Consent?
Strictly necessary	basket, login, security	PHPSESSID – session	no
Performance	site analytics	_ga – 2 yrs	yes
Functionality	remember choices	orchard_pref – 6 mths	yes
Targeting/ads	personalised adverts	_fbp – 3 mths	yes

Managing cookies
A banner on first visit asks for consent to non-essential cookies. Change preferences anytime via “Cookie Settings” in our footer or through your browser (Chrome > Privacy & Security > Cookies, Safari > Preferences > Privacy, etc.).

Third-party cookies
We use services such as Google Analytics and Facebook Pixel; these providers act under contractual safeguards.

Who We Share Your Data With

We share your data only as necessary with:

Payment providers (e.g. Stripe)
Couriers & logistics partners
Marketing tools (e.g. Klaviyo – with EU-approved safeguards)
IT & cloud service providers (e.g. hosting, CRM)
Legal, financial and tax advisers
Regulatory bodies (where legally required)

We do not sell your personal data.

All third-party processors are bound by data processing agreements to safeguard your personal data.

International Data Transfers

Where possible we use providers that host domains in the EEA and where that is not possible and data transfers are necessary, we ensure appropriate safeguards are in place such as Standard Contractual Clauses (SCCs), adequacy decisions, or participation in the Data Privacy Framework.

How We Keep Your Data Safe

We use physical, electronic and managerial safeguards including:

Secure payment encryption
Access controls and password protections
Staff training and data access restrictions
Regular security reviews and backups
SSL encryption for website visitors
Staff access is based on the ‘need to know’ principle

Your Rights

You have the right to:

Access your personal data, We aim to respond to all rights requests within one month, as required by GDPR.
Correct inaccuracies
Erase your data (“right to be forgotten”)
Restrict or object to processing
Withdraw consent at any time (for marketing)
Request data portability
Lodge a complaint

To exercise your rights, email us at info@theorchard.ie

You may also contact the Irish Data Protection Commission:

Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28
www.dataprotection.ie

Lawful Basis Explanation

We rely on:

Consent – for marketing and non-essential cookies
Contract – to provide goods/services
Legal obligation – for taxation and compliance
Legitimate interests – for analytics, customer service, and security (balanced via LIA)
Data Protection Impact Assessment (DPIA’s) are conducted where high-risk processing applies (if relevant)

We have conducted Legitimate Interest Assessments where applicable and found no overriding risks to your rights.

Children’s Data

Our services are not directed to children under 16. Where services may involve children (e.g. family garden events), we obtain parental consent as required by Irish law. If children may appear in marketing/event photography consent is obtained for any image use.

Changes to This Policy

We may update this policy from time to time. The latest version will always be available on our website. If changes are significant, we will notify you via email or website banner.

https://www.theorchard.ie/contact-us/