DRAFT: not yet in force.
This privacy notice is a draft pending Declan McGrath’s sign-off and legal review. Text in highlighted brackets still needs filling in. Version draft.
How Neatwell Ireland uses your personal data when you join the customer waitlist, apply to join the marketplace as an independent cleaner, or are named as a referee.
Neatwell (trading name of D McGrath Ltd), company number [A: Declan to confirm CRO number], registered office 206 Riverpoint, Bishop's Quay, Limerick, Ireland. We are the controller of your personal data. For anything about your data, email privacy@neatwell.ie or write to us at the address above.
Data Protection Officer. We’re a small business and we don’t think the law requires us to appoint a Data Protection Officer: we don’t monitor people on a large scale and we don’t process sensitive data on a large scale. [A: lawyer to confirm a DPO isn’t required under GDPR Art 37, and to review this when bookings, ratings or location features are added] Declan McGrath is responsible for data protection at Neatwell and reads every message sent to the address above.
| What we hold | Why | Lawful basis |
|---|---|---|
| Your email address and sign-in details (a password if you choose one, and when you signed in) | To give you an account so you can see and change your details | Steps you asked us to take before a contract (GDPR Art 6(1)(b)) |
| Your name, mobile number, county, area, Eircode, number of bedrooms and bathrooms, and how often you’d like a clean | To email you once when Neatwell opens in your area | Steps you asked us to take before a contract (Art 6(1)(b)) |
| Your county, area, Eircode routing key (the first 3 characters, e.g. D06), home size and frequency, counted together with everyone else’s | To decide where to launch next | Our legitimate interest in planning where to launch (Art 6(1)(f)). We only look at totals per area for this |
| Whether you ticked “news and offers”, the exact wording you saw, and when | To send you news and offers by email, only if you ticked the box | Your consent (Art 6(1)(a)). You can withdraw it at any time (see “Saying no, objecting and withdrawing consent” below) |
| That you confirmed you’re 18 or over, and the version of this notice you saw | Our service is for adults; record keeping | Art 6(1)(b) and our legitimate interest in keeping accurate records (Art 6(1)(f)) |
What you have to give us. You don’t have to give us anything: joining is your choice and nothing in the law requires it. To put you on the waitlist we need your email, name, mobile number, county, area, Eircode, home size, how often you’d like a clean and your confirmation that you’re 18 or over. If you leave any of these out we can’t add you to the waitlist, but nothing else happens. The news-and-offers box is optional: if you leave it unticked you’ll still be on the waitlist and get the one “we’re open” email.
| What we hold | Why | Lawful basis |
|---|---|---|
| Your name, email, mobile number, areas, years of experience, rates, and your answers about how you run your business (own clients, other platforms, own insurance, own supplies, Revenue self-assessment registration) | To assess your application against our published criteria and set up your profile if approved | Steps you asked us to take before a contract (Art 6(1)(b)) |
| A copy of your photo ID and, if relevant, your Irish Residence Permit card and stamp | To check who you are, that you’re 18 or over and that you may work in Ireland on a self-employed basis | Art 6(1)(b), and our legitimate interests in keeping customers safe and preventing fraud (Art 6(1)(f)) [A: right-to-work basis to be confirmed by our lawyer] |
| Your two referees’ names, contact details and how you know them, any reference letters you upload, and what referees tell us | To check your references | Our legitimate interests (Art 6(1)(f)), as set out in our legitimate-interests assessment |
| Our check record: who checked, when, document type, issuing country, expiry date, last 4 characters of the document number, right-to-work basis and expiry, and the references outcome | To show the checks were done, and to re-check before a permission expires | Art 6(1)(b) and (f) |
| Your confirmations that you’re 18 or over, that your referees agreed to be contacted and that your information is true, with the date and notice version | To show what you confirmed when you applied | Art 6(1)(b), and our legitimate interest in keeping accurate records (Art 6(1)(f)) |
| Our decision: approved or not, the date, who decided, and the note we wrote (for a “not approved”, the criterion you didn’t meet) | To tell you the outcome and the reason, and to deal with any request to look again | Art 6(1)(b) and our legitimate interest in being able to explain and review our decisions (Art 6(1)(f)) |
| Whether you ticked “news and offers” | News and offers by email, only if you ticked | Your consent (Art 6(1)(a)) |
What you have to give us. Applying is your choice and no law requires you to give us this information. To consider your application we need everything the form marks as required: your name, mobile number, areas, experience, rates, the answers about your business, your ID (and IRP card and stamp if relevant), two referees and the three confirmations. If you leave any of it out you can save your application as a draft, but you can’t submit it and we can’t approve you. Your usual rate, reference letters and the news-and-offers box are optional; leaving them out doesn’t affect the decision. We do not ask for your PPS number, and we never ask about criminal convictions. A person compares your photo with your ID by eye; we don’t use automated face matching. If you’re approved, we’ll ask for the tax details platforms must report to Revenue (DAC7) at that point, not now.
No automated decisions or profiling. Declan, a person, looks at every application, checks your ID and references by eye, and decides against our published criteria. Our system only stops an approval being recorded if the check record Declan entered doesn’t meet those criteria (for example an expired document); it never approves or rejects anyone by itself. We don’t score, rank or profile customers or cleaners, and nothing about you is decided by software within the meaning of GDPR Art 22. If we can’t approve you, we tell you which criterion wasn’t met, and you can ask a person to look again.
An applicant gave us your name, phone number, email and how you know them. We use these, and your reply, only to decide their application (our legitimate interest, Art 6(1)(f)). Only Neatwell’s founder reads your reply. The applicant may see what you wrote if they ask for a copy of their data. We delete your details and reply 30 days after we decide. We’ll also give you this information when we first contact you. You can object at any time by emailing us; we’ll then stop using your details and delete them, and tell the applicant we couldn’t take your reference.
To keep your data safe and to show we follow our own rules, we keep three kinds of record:
We use these records only for security, to check our own work, and to answer your questions or complaints: our legitimate interest in keeping your documents safe and being able to show how we made a decision (Art 6(1)(f)). We keep them for 2 years [A: lawyer to confirm the 2-year period]. When your account is deleted, we remove your identity and the decision note from them.
We have data processing agreements with our processors. We don’t sell your data, we don’t share it for advertising, and we don’t send ID images or reference text by email or messaging apps.
Our database, sign-in and file storage are in Supabase’s West EU (Ireland) region. Some of our providers use sub-processors or support engineers outside the European Economic Area. Netlify, Inc. (USA) hosts this website, so visitors’ IP addresses and server logs go to the United States. Brevo (Sendinblue SAS) is based in France, in the EU, so our main email service is not a transfer outside the EEA, although some of its sub-processors may be. Where data does leave the EEA, it’s protected by the European Commission’s standard contractual clauses (GDPR Art 46(2)(c)) or, for US companies certified under it, the EU-US Data Privacy Framework (Art 45). Transfers to Netlify rely on the EU-US Data Privacy Framework, with the EU standard contractual clauses as a backup. Email us for a copy of these safeguards.
| Data | How long |
|---|---|
| Waitlist details | Until 12 months after we launch in your area (24 months after you sign up if we never get there), or until you ask us to delete them |
| Unfinished applications | 6 months after you last worked on it. We then delete the application, any files you uploaded and your login |
| Submitted applications we haven’t decided | 12 months after you last updated it [A: lawyer to confirm] |
| Not approved: ID, IRP card, reference letters and referees’ details | Deleted 30 days after the decision (time to ask us to look again) |
| Not approved: name, email, date and reason | 12 months [A: lawyer to confirm] |
| Approved: ID and IRP images, reference letters and referees’ details | Deleted 30 days after approval. We keep the check record described above while you use Neatwell and for [A: lawyer to confirm the number of] years after you stop |
| Records of what you ticked (18+, news and offers) and the notice version | As long as we hold your account, to show what you agreed to |
| Decision notes, activity log and document view log | 2 years [A: lawyer to confirm]. When your account is deleted, your identity and the decision note are removed from these logs |
| Your login (email address and sign-in details) | Deleted with the records above. If you create a login but never join the waitlist or start an application, 6 months after you last signed in |
| Backups | We don’t currently keep backups of our database that we can restore from, so data we delete isn’t kept in any backup we control. If we turn backups on, we’ll update this notice to say how long they’re kept |
We don’t use cookies for tracking, analytics or advertising. The site stores a sign-in token in your browser’s local storage so you stay logged in; that’s strictly necessary for the service. If we ever add analytics, we’ll ask first.
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time; this doesn’t affect what we did before. Email privacy@neatwell.ie. We’ll reply within one month.
Object. Where we use your data because of our legitimate interests (launch planning, reference checks, our records and logs), you can object at any time, for reasons to do with your situation. Email us and say what you object to. We’ll stop unless we have compelling reasons that outweigh your interests, or we need the data to deal with a legal claim, and we’ll tell you which.
Withdraw consent. Our only consent is the news-and-offers box. You can withdraw it at any time, and it’s as easy as giving it: log in, untick “news and offers” on your details or application page and save, or email us. We’ll act on your request and stop sending news and offers within two working days. Withdrawing doesn’t affect your place on the waitlist or your application, and doesn’t make anything we did before unlawful. Every news-and-offers email we send will also have an unsubscribe link. You can object to direct marketing at any time and we will always stop.
Leave the waitlist. Customers can tap “Leave the waitlist” on their details page at any time; we won’t email you about launching. To have your details deleted as well, email us.
You can complain to the Data Protection Commission: dataprotection.ie, 6 Pembroke Row, Dublin 2, D02 X963. We’d appreciate the chance to sort it out first.
Data is encrypted in transit. ID documents are kept in a private store that only the applicant (for their own files) and the founder can reach, the admin account uses two-step sign-in, and every document view is logged. If a breach is likely to put you at high risk, we’ll tell you and the Data Protection Commission.
We’ll update this notice if anything changes and show the new version here. This is version draft.