Legal
Privacy Policy
Last updated 29 October 2026
Nualogic ("we", "us", "our") is committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR), the Data Protection Act 2018, and the ePrivacy Regulations. This policy explains what personal data we collect, why we collect it, how long we keep it, and the rights you have over it.
We are a data controller for the purposes of Irish and EU data protection law. Our details are:
- Nualogic
- 3 Ongar Distributor Road, Ongar Village, Dublin, D15 H34C, Ireland
- Email: info@nualogic.com
- Phone: +353 87 227 4989
If you have a concern about how we handle your personal data, you can contact the Data Protection Commission (DPC), our supervisory authority in Ireland.
1. Data we collect
We collect personal data in two broad ways:
Information you give us directly
- Name, email address, phone number, and company name when you book a consultation, enquire about a course, or submit a contact form.
- For free guide downloads, your name, email, optional company name, requested toolkit, source page, submission reference, timestamp and follow-up email consent are saved in MailerLite. Each toolkit has a dedicated group. The latest request and consent fields are updated when you request another toolkit. Answers you enter in a downloaded workbook stay in that file and are not uploaded to Nualogic.
- Job title and team size when you request a training proposal. For the AI Readiness Scorecard, your business sector, readiness answers, named AI tools and intended data use help prepare your results and tailored policy draft. Your name, email, company, sector, assessment answers, scores and consent record are saved in a dedicated scorecard group in MailerLite for AI follow-up emails. The policy copy is sent to you through MailerSend. You can unsubscribe from follow-up emails at any time. Please do not enter confidential information in tool names.
- Billing details (name, address, VAT number) when you purchase a course or workshop.
- Communications you send us by email, through forms, or during consultations.
Information collected automatically
- Basic technical data: IP address, browser type, device type, and referring URL.
- Usage data: pages visited, time on page, and approximate location derived from IP (city/region level, not precise).
- Cookie consent preferences, stored in accordance with the ePrivacy Regulations.
We do not collect or process special category data (such as health, ethnicity, religious beliefs, or biometric data) and we do not knowingly collect data from anyone under 18.
2. How we use your data
We use your personal data for the following purposes:
- Delivering our services: processing course bookings, scheduling consultations, and providing training.
- Responding to enquiries: answering questions you submit through forms, email, or phone.
- Marketing (with consent): sending our newsletter and occasional updates about courses and events.
- Improving our website and services: using aggregate, privacy-conscious analytics to understand usage patterns.
- Legal compliance: maintaining financial records for tax and accounting purposes as required by Irish law.
- Communication about your bookings: sending confirmation emails, joining instructions, and follow-up materials related to courses or consultations you have booked.
3. Lawful bases for processing
Under the GDPR, we must have a lawful basis for processing your personal data. The table below sets out the bases we rely on and what they cover.
| Lawful basis | What we use it for |
|---|---|
| Consent (Article 6(1)(a)) | Sending you our newsletter and marketing communications. You can withdraw consent at any time. |
| Contract (Article 6(1)(b)) | Processing your booking and delivering training courses and consultations you have signed up for. |
| Legal obligation (Article 6(1)(c)) | Retaining financial records and invoices as required by Irish tax law. |
| Legitimate interests (Article 6(1)(f)) | Using privacy-conscious analytics to understand how our website is used and improving our services, provided your rights and freedoms are not overridden. |
5. Sharing your data
We do not sell your personal data. We share it only with processors who help us deliver our services, under contracts that require GDPR-compliant handling:
- Email and marketing automation: MailerLite for newsletter subscriptions, scorecard records and consented guide follow-up emails. We only subscribe you to follow-up emails with your consent.
- Website enquiry notifications: MailerSend delivers contact and assessment requests to Nualogic. These requests don't subscribe you to our newsletter. Open and click tracking are disabled for these notifications.
- Booking and scheduling: Cal.com for managing consultation appointments.
- Email infrastructure: Our email hosting provider for sending and receiving emails you direct to us.
- Spam protection: Cloudflare Turnstile to protect our forms from automated abuse. Turnstile processes minimal data and is designed to be privacy-preserving.
We may also disclose your data where required by law, for example in response to a lawful request from An Garda Síochána or another competent Irish authority.
6. International data transfers
Some of our processors (for example, MailerLite and Airtable) are based outside the European Economic Area (EEA). Where this is the case, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or on processors whose hosting infrastructure is located within the EU. We assess each transfer to ensure your data receives a level of protection equivalent to that under Irish and EU law.
7. Data retention
We keep your personal data only for as long as is necessary for the purpose it was collected:
- Course bookings and billing records: 6 years, as required by Irish tax law.
- Consultation notes and client communications: up to 3 years after our last interaction, unless you ask us to delete them sooner.
- Newsletter subscribers: until you unsubscribe, after which your data is removed within 30 days.
- Contact form submissions not resulting in a booking: 12 months.
- AI Readiness Scorecard responses: 24 months, unless you request earlier deletion.
- Analytics data: aggregated and anonymised within 14 months of collection.
8. Data security
We take appropriate technical and organisational measures to protect your personal data, including:
- HTTPS encryption (TLS 1.2+) for all data in transit between your browser and our servers.
- Access controls limiting personal data to authorised team members on a need-to-know basis.
- Regular security reviews of our processors and integrations.
- Form spam protection via Cloudflare Turnstile to reduce automated abuse.
Despite these measures, no system can be guaranteed 100% secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours, as required by Article 33 of the GDPR, and will inform you directly where the risk is high.
9. Your rights
Under the GDPR, you have the following rights regarding your personal data. To exercise any of these rights, contact us using the details in section 12 below.
Right of access
You can request a copy of the personal data we hold about you.
Right to rectification
You can ask us to correct inaccurate or incomplete data.
Right to erasure ("right to be forgotten")
In certain circumstances, you can ask us to delete your personal data.
Right to restrict processing
You can ask us to limit how we use your data while a complaint is resolved.
Right to data portability
You can receive your data in a structured, machine-readable format and transfer it to another provider.
Right to object
You can object to processing based on legitimate interests or for direct marketing.
Rights related to automated decision-making
You have the right not to be subject to decisions based solely on automated processing that significantly affect you.
You also have the right to lodge a complaint with the Data Protection Commission if you believe we have not handled your data in accordance with the law. We would welcome the opportunity to address your concerns first, but contacting the DPC does not affect your right to do so.
10. Children's data
Our services are designed for businesses and professionals. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected data from a child, please contact us and we will promptly delete it.
11. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. The date at the top of this page indicates when it was last updated. We encourage you to review this page periodically. If we make material changes, we will notify you through our website or by email where appropriate.
12. Contact us
If you have any questions about this Privacy Policy, want to exercise your data protection rights, or wish to make a complaint about how we handle your data, please contact us:
- Email: info@nualogic.com
- Phone: +353 87 227 4989
- Post: Nualogic, 3 Ongar Distributor Road, Ongar Village, Dublin, D15 H34C, Ireland
We will respond to your request within one month, as required by the GDPR. If your request is complex, we may extend this by a further two months and will inform you of the extension and the reasons for it within the first month.