Carmel Rooney Art

Privacy Policy

Last updated: 17 August 2026

Carmel Rooney Art (“we”, “us”) operates the online shop at carmelrooneyart.ie. This policy explains what personal data we collect when you use the site, why, and what rights you have over it under the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.

Data controller

Carmel Rooney Art is the data controller for the personal data described in this policy — we decide why and how it's processed. You can reach us at [email protected] or Athlone, Co. Westmeath for anything data-protection related.

What we collect

  • Orders & checkout: name, email, shipping address, phone, and any details you type into a customizable product.
  • Bookings: name, email, phone, number of guests and any notes you provide when booking a consultation.
  • Accounts & loyalty: if you create an account or join the loyalty programme, we store your name, email, and a record of your orders, points and rewards.
  • Collectors' Club: name, email and subscription/billing status if you join a subscription tier.
  • Newsletter: your email address and whether you've opted out, so we know who to (and who not to) send marketing emails to.
  • Payments: card and payment details are collected and processed directly by Stripe — we never see or store your full card number.
  • Site analytics: if you accept analytics cookies via our cookie banner, we record the pages you visit and links you click, tied to an anonymous session identifier, to understand how the site is used. This is first-party, self-hosted analytics — we don't sell this data or share it with ad networks.

Why we collect it

We use your data to take and fulfil orders, manage bookings, run the Collectors' Club and loyalty programme, send order confirmations and other transactional emails, send marketing newsletters (only if you haven't opted out), and improve the site.

Legal basis for processing

  • Contract: processing your name, contact details and order/booking details is necessary to fulfil the order, booking, Collectors' Club subscription or loyalty reward you've asked for.
  • Legal obligation: keeping order records for accounting/tax purposes.
  • Consent: sending marketing newsletters, and setting analytics cookies — both of which you can withdraw at any time (see “Your rights” and “Cookies” below).
  • Legitimate interest: understanding site usage in aggregate to improve it, and preventing fraud/abuse of the shop and booking system — always balanced against your right to privacy.

Who we share it with

We share the minimum necessary data with the third parties who help us run the site: Stripe (payments), Mailgun (transactional and newsletter email delivery, sent via Mailgun's EU infrastructure), and our hosting provider. These providers only use your data to perform the service we've asked them for, acting as our data processors under their own GDPR-compliant terms. We do not sell your personal data, and we don't use it for automated decision-making or profiling that has a legal or similarly significant effect on you.

International transfers

Where a provider we use (such as Stripe) processes data outside the European Economic Area, they do so under an approved safeguard such as the EU Standard Contractual Clauses, as required by GDPR.

How long we keep it

Order and booking records are kept for as long as needed for accounting, warranty and legal purposes. Newsletter and loyalty data is kept until you unsubscribe or ask us to delete your account. Analytics data is anonymised at the session level and is not used to identify you personally.

Keeping your data secure

We use industry-standard measures to protect your data — encrypted connections (HTTPS) site-wide, payment details handled entirely by Stripe rather than stored by us, and access to admin systems restricted to authorised staff.

Children

Our site and services are not directed at, or intended for, children, and we do not knowingly collect personal data from children.

Your rights

Under GDPR you can ask us to access, correct, delete, or export the personal data we hold about you — on request, we can provide a full export of your orders, bookings, loyalty activity and account details as a PDF — and you can withdraw consent (e.g. unsubscribe from the newsletter, or decline analytics cookies) at any time. To exercise any of these rights, contact us at [email protected]. You also have the right to lodge a complaint with the Data Protection Commission.

Cookies & similar storage

When you first visit, a banner asks whether you're happy for us to use analytics cookies, or only essential ones. Here's exactly what we store and why:

  • Essential (always on): a customer_session cookie, set only if you log into an account, which keeps you signed in; and small amounts of data saved in your browser's local storage — your basket contents and your cookie preference itself. None of these are used for advertising, and they're required for the shop and checkout to work.
  • Analytics (only if you accept): a randomly generated session ID (stored in your browser for the current visit only, not a persistent cookie) which lets us see which pages were viewed and links clicked in that visit, along with the page, how long you spent on it, and a rough traffic source (e.g. search, social, direct). This is self-hosted, first-party analytics — it's never shared with third-party ad networks and isn't linked to your name or account.

You can change your choice at any time by clearing your browser's local storage for carmelrooneyart.ie, which will bring the cookie banner back up on your next visit.

Contact

Questions about this policy or your data can be sent to [email protected] or by post to Athlone, Co. Westmeath.