Privacy Policy

Irish Organic Farmers & Growers Association CLG Website Privacy PolicyIntroduction

The Irish Organic Association (IOA) is Ireland’s leading organic certification body dedicated to certifying organic produce and products throughout Ireland.  This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit our website or use our services.  We are committed to protecting and respecting your privacy.  In this Privacy Policy, the terms “we”, “our” and “us” are used to refer to IOA (Irish Organic Association).  References in this Privacy Policy to our “Services” include our websites, online platforms, email correspondence, telephone communications, customer support channels, social media accounts, online messaging services, marketing and promotional activities, newsletters, events and any paper or electronic forms through which personal data may be collected or processed.  IOA (Irish Organic Association) are the data controller for the processing of your personal data.

What Personal Data We Collect

As part of our certification, assessment, inspection and related services, we may collect and process personal data relating to individuals acting on behalf of our clients, including employees, contractors, representatives, and other relevant personnel.

We use this information to:

• Deliver certification, assessment, inspection;
• Communicate with clients and participants;
• Maintain certification;
• Manage complaints, appeals, and enquiries;
• Meet our legal, regulatory, and accreditation obligations.

Where necessary, we may share relevant information with accreditation bodies, regulatory authorities, auditors, assessors, technical experts, and service providers involved in the delivery and oversight of our services. Such disclosures will be limited to what is necessary for the relevant purpose and subject to appropriate confidentiality obligations.

We may collect and process the following categories of personal data:

Information You Provide to Us

• Name
• Email address
• Postal address
• Telephone number
• Payment and billing information
• Information submitted through contact forms or enquiries

When you visit our website, we may automatically collect:

• Browser type and version
• Device information
• Operating system
• Website usage information
• Pages visited and time spent on our website
• Cookie and analytics data

Why We Collect Your Data and the Legal Basis for Processing

We process your personal data only where we have a lawful basis under the General Data Protection Regulation (GDPR).

How We Use Your Personal Data

We may use your personal data to:

• Process and manage your licence and account transactions
• Provide services requested by you
• Communicate with you regarding your account or enquiries
• Issue invoices, receipts, and payment confirmations
• Improve our website, products, and services
• Monitor website performance and security
• Send marketing communications where you have consented or where otherwise permitted by law
• Comply with legal and regulatory requirements

You may withdraw your consent to the use of any of your personal information for marketing purposes, at any time by contacting us.

Cookies and Tracking Technologies

Our website uses cookies and similar technologies to ensure the website functions correctly, to improve user experience, to analyse website traffic, and to support our advertising /marketing activities.

Some cookies are necessary for the operation of the website, while others are optional and will only be used with your consent where required by law.

Detailed information about the cookies and similar technologies we use, including their purposes, providers, and retention periods, is available through the Cookie Preferences tool on our website. You can access the Cookie Preferences tool at any time to review and customise your consent preferences regarding the use of these technologies.

Who We Share Your Data With

We do not sell, rent, or trade your personal data.  We may share your personal data with:

• Government departments; statutory agencies; bodies indicated in the organic regulations relating to legislatively required exchange of information.
• TRACES – European Commission’s digital certification and management platform
• Payment service providers
• Website hosting providers
• IT and technical support providers
• Professional advisers (such as accountants, auditors, and legal advisers)
• Regulatory authorities, courts, or law enforcement agencies where required by law

All third-party service providers are required to protect your personal data and process it only in accordance with applicable data protection laws.

International Transfers

Personal data is not currently transferred outside the European Economic Area (EEA). However, should this change in the future, appropriate safeguards and applicable data protection requirements will be implemented, including approved contractual protections where required under GDPR.

How Long We Keep Your Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with legal, contractual, regulatory, and accreditation requirements.

Retention periods may include:

• Client records: For a minimum of 5 years after the end of the business relationship
• Financial and invoicing records for a minimum of 6 years as required by applicable tax and accounting laws
• Marketing records: until consent is withdrawn or the individual opts out
• Website analytics data: retained in accordance with our analytics settings and business requirements
• Where data is no longer required, it will be securely deleted or anonymised.

Your Rights Under GDPR

Under GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request erasure of your personal data (“right to be forgotten”)
• Restrict the processing of your personal data
• Object to the processing of your personal data
• Request the transfer of your personal data to another organisation (data portability)
• Withdraw consent at any time where processing is based on consent
• Lodge a complaint with the Data Protection Commission

We will respond to all valid requests within one month of the receipt of the request, although this one-month time frame can be extended by up to two further months if, for example, the request is complex.  Applicants will be informed if an extension to the applicable timeframe is required.

Security of Your Data

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction.

Sensitive information, including payment details, is transmitted using secure technologies and handled in accordance with recognised security standards.

Third-Party Websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of external websites. We encourage you to review their privacy policies before providing personal information.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be published on this with the revised issue date.

Contact Us

If you have any questions about this Privacy Policy or wish to exercise any of your data protection rights, please contact:
Email: info@irishoa.ie
Telephone: (+353) 90 643 3680
Postal Address: Irish Organic Association, Unit 13 Inish Carraig, Golden Island
Athlone, Co. Westmeath, N37 N1W4, Ireland

If you are dissatisfied with or have concerns regarding IOA’s processing of your personal data, you have the right to lodge a complaint with the Data Protection Commission. Data Protection Commission 21 Fitzwilliam Square South Dublin 2 D02 RD28 Ireland Website: https://www.dataprotection.ie Email: info@dataprotection.ie Telephone: +353 (01) 765 0100