Privacy Notice
Data Controller:
New Ballagh Centre
Tullyskearney
Rossinver
County Leitrim
F91 H2HY
Ireland
Telephone: 071 985 4030
Email: manager@rcdc.ie
Who we are
New Ballagh Centre is the Data Controller responsible for determining how and why personal data is processed through the RCDC/New Ballagh Centre website and member platform. Technology suppliers process information only to provide their services under their own contractual and legal responsibilities; they do not become owners of member data.
Information we collect
- Accounts and profiles: name, email address, Firebase user identifier, profile photo and details you choose to add, including contact preferences, interests, accessibility, dietary, transport, support and emergency-contact information.
- Services: event, course and training bookings; payment-status fields; attendance, progress and certificate records; reminders and account history.
- Community activity: group memberships, posts, comments, likes, invitations, marketplace listings, images, enquiries, private marketplace conversations and messages.
- Contact and safety: enquiries, rights requests, reports or complaints, moderation decisions and supporting information supplied to us.
- Technical information: authentication/session data, device and browser information, IP address and security or diagnostic logs generated by Firebase, hosting and network services.
- Browser storage: cookie choice, authentication state, accessibility preferences and dashboard-tour preference. See our Cookie Policy.
Do not include unnecessary sensitive information in profiles, messages, posts, listings or reports. Information in community posts and public marketplace listings can be seen by other users; private messages can be read by their recipients.
Why we use information and our lawful bases
| Processing activity | Data used | Purpose | Lawful basis |
|---|---|---|---|
| Account registration | Name, email, identifier and authentication data | Create an account and provide secure access | Contract; steps requested before entering a contract |
| Account management | Profile details, preferences, account history and profile image | Maintain the member service and user choices | Contract; legitimate interests in maintaining a reliable member service |
| Event and course bookings | Contact details, bookings and payment-status fields | Reserve and administer places | Contract; legitimate interests in delivering community services |
| Attendance and training records | Attendance, progress and certificate records | Deliver activities and maintain necessary service records | Contract; legitimate interests in service administration; legal obligation where applicable |
| Contact enquiries and rights requests | Contact details, request and correspondence | Respond to enquiries and meet data-protection duties | Legitimate interests in responding to enquiries; legal obligation for rights requests |
| Community participation | Group membership, posts, comments, likes, images and identifiers | Provide requested community features | Contract; legitimate interests in maintaining useful community participation |
| Messaging | Sender and recipient identifiers, message content and timestamps | Deliver private member communications | Contract; legitimate interests in providing and maintaining messaging |
| Marketplace use | Listings, images, seller details, enquiries and marketplace conversations | Publish listings and connect users | Contract; legitimate interests in providing a useful local marketplace |
| Moderation, reports and safeguarding | Content, messages relevant to a report, reports, account and moderation records | Investigate concerns, prevent abuse and maintain community safety | Legitimate interests in safety, moderation and preventing harm; legal obligation or vital interests where genuinely applicable |
| Security and maintenance | Identifiers, IP/device information, logs and activity | Protect accounts, diagnose faults and prevent fraud or abuse | Legitimate interests in platform security and reliable operation; legal obligation where applicable |
| Optional analytics or marketing | Google Analytics cookie and usage information; contact details if a future marketing opt-in is offered | Measure website use or provide communications chosen by you | Consent |
Where we rely on legitimate interests, we consider necessity, benefit and the effect on individuals, and apply access controls and data minimisation. Google Analytics loads only after Analytics consent. No marketing service is currently configured.
Consent
Consent is used only for genuinely optional processing, such as optional cookies or future marketing choices. It is separate from accepting the Terms, is not pre-ticked, and can be withdrawn through or by contacting us. Withdrawal does not affect processing already carried out lawfully. Acknowledging this notice during registration is not blanket GDPR consent.
Service providers and recipients
Authorised New Ballagh Centre staff or administrators receive information where their role requires it. Other users receive information you publish or send to them. The code confirms the following services; none owns New Ballagh Centre user data merely because it supplies technology.
| Provider/service | Use on the platform |
|---|---|
| Google Firebase Authentication | Account registration, login, password reset, identity tokens and session protection. |
| Google Cloud Firestore | Accounts, bookings, attendance, community content, messages, marketplace data, reports and administration records. |
| Google Firebase Storage | Profile, marketplace, activity, course and other authorised image uploads. |
| Google Cloud Functions for Firebase | Protected server-side administration, booking, ticket and check-in operations. |
| Google reCAPTCHA through Firebase App Check, when configured | Helps protect Firebase requests against automated abuse. |
| Google Analytics 4 | Measures website visits and use under measurement ID G-3QYR9N413M, only after Analytics consent. |
| OpenStreetMap/Leaflet and Nominatim; Esri imagery in administration tools | Maps, location display and administrator address search. These services receive ordinary request information when used. |
| Google Fonts and public content-delivery networks | Fonts and front-end libraries required to render the interface. |
| Tiny Cloud | Rich-text editing in authenticated administration screens. |
| Website server mail facility | Delivers Contact Us messages. The underlying email/hosting provider is not identified in the repository. |
| Copper Fox Digital | Identified as the design and technical provider; precise processor responsibilities require contractual confirmation. |
Google Analytics is initialised only when the visitor grants Analytics consent. No payment gateway code is currently implemented; event records contain price and payment-status fields for administration.
Messages are not represented as end-to-end encrypted. Authorised administrators may access relevant messages where reasonably necessary for moderation, safeguarding, security, an investigation or a legal obligation.
International transfers
Some technology providers may process information outside Ireland or the European Economic Area. Where data-protection law requires safeguards, we expect the relevant provider arrangement to use a recognised safeguard such as an adequacy decision, Standard Contractual Clauses or another legally valid mechanism. The exact hosting region and contractual transfer arrangements remain subject to organisational confirmation.
How long we keep your information
Approved fixed retention periods have not yet been confirmed. We retain information only for as long as required to provide the service, resolve disputes, meet legal obligations, protect users or maintain security. For each category we consider whether an account or service remains active, whether a booking, complaint or investigation is complete, whether a legal, funding or accounting record must be preserved, and when backups are scheduled to expire. New Ballagh Centre must approve fixed periods before they are published or automated.
| Category | Retention approach |
|---|---|
| Account and profile data | While the account is active, then deleted or anonymised subject to necessary retained records. |
| Deleted accounts | Removed from live account systems when deletion is completed, except information that must be retained, restricted or anonymised for a lawful reason. |
| Bookings | Until the booking and related service are complete, then only for applicable dispute, legal, funding, audit or accounting needs. |
| Attendance and training records | While required for service delivery, certification and any applicable legal, funding or audit need. |
| Enquiries and rights requests | Until resolved and for a proportionate period needed to evidence the response. |
| Community content | While needed for the community feature, its context, moderation or a dispute; deleted or anonymised when no longer necessary where practical. |
| Messages | While needed to provide messaging, address a report or dispute, or meet a legal or safeguarding need. |
| Marketplace listings | While a listing is active and for a proportionate period afterwards where needed for enquiries, disputes, moderation or fraud prevention. |
| Reports and moderation records | According to the seriousness of the report, investigation status, ongoing risk, dispute needs and legal duties. |
| Safeguarding records | According to ongoing risk, the need to protect individuals and applicable legal or safeguarding duties. |
| Security and diagnostic logs | For a limited period proportionate to security, investigation and operational needs. |
| Uploads | While required by the associated profile, listing, activity or course, then removed when no longer necessary unless connected to a report, dispute or legal duty. |
| Optional analytics | Google Analytics data is retained according to the approved property setting; collection stops when consent is withdrawn. The exact property retention setting requires organisational confirmation. |
| Cookie choices | Until the choice is reset, withdrawn or replaced by a later choice. |
| Backups | Residual copies remain only until they expire through the documented backup cycle, unless preservation is required for security or legal reasons. |
Account deletion
Signed-in members can use the confirmed deletion control in Account Settings. It requires a recent login, typed confirmation and a checkbox. It removes the Firebase login and attempts to remove the profile, stored profile image, reminders, bookings, owned chat areas and marketplace data. Shared content, attendance, payment, moderation, safeguarding or other records may need to be retained, restricted or anonymised where there is a lawful reason. Because deletion currently runs from the browser, contact us if it reports an error so remaining data can be reviewed.
Your Data Protection Rights
Subject to GDPR conditions and legal exceptions, you may ask for access to your personal information, correction, erasure, restriction, objection, and data portability where applicable. You may withdraw consent at any time. You also have rights relating to decisions based solely on automated processing that produce legal or similarly significant effects; the current platform does not document such decision-making.
Use “Request My Data” in Account Settings or email manager@rcdc.ie. Tell us which right you wish to exercise. We may request proportionate information to verify identity. Rights may be limited where GDPR or another law permits or requires continued processing; if so, we will explain where legally permitted.
Complaints
Please contact us first so we can try to resolve the issue. You may also complain to the Data Protection Commission (Ireland) (opens in a new tab) if you believe your information has been handled unlawfully.
Security and changes
We use role-based Firebase rules, authentication, validation, security headers and upload restrictions. No internet service can promise absolute security. We may update this notice when services or legal requirements change; the date and version will be updated.