Privacy policy

1. Who controls your data

The data controller is The Boat Yard Sauna, operating at Wicklow Harbour, Wicklow Town, and North Quay, Arklow Harbour, Ireland.

Privacy enquiries and data-rights requests can be sent to theboatyardsauna@gmail.com.

2. Information we collect

• Your email address when you subscribe to updates.
• Voucher purchase details, including the buyer’s name and email, payment confirmation, and any recipient name, recipient email, or gift message you provide.
• Information you include when contacting us directly.
• Technical security information normally created when a website is accessed, such as an IP address, browser type, request time, and server logs.
• Booking information collected on an external booking service when you follow a booking link. That service will also provide its own privacy notice.

Please only provide another person’s details for a voucher if you have their permission to do so.

3. Why we use it and our legal basis

• To process purchases, issue vouchers, answer booking enquiries, and provide requested services. Our basis is performance of a contract or steps requested before a contract.
• To send mailing-list updates. Our basis is your consent, which you can withdraw at any time by using the unsubscribe link or contacting us.
• To keep financial and transaction records where required by law. Our basis is compliance with a legal obligation.
• To protect the website, prevent fraud, resolve problems, and respond to claims. Our basis is our legitimate interests in operating a secure and accountable service.

We do not sell your personal data.

4. Services that receive data

We share only the information needed with service providers that help us operate:

• Stripe, for secure voucher payments.
• Resend, for delivery of voucher emails.
• Buttondown, for mailing-list subscriptions and emails.
• Our external booking provider, when you choose to make a booking.
• Vercel, which hosts this website and may process technical request logs.
• Sanity, which provides the website’s content-management service.

We may also disclose information where the law requires it or where necessary to protect legal rights. Some providers may process data outside the European Economic Area. Where that happens, the provider must use a lawful transfer mechanism and appropriate safeguards, such as an adequacy decision or standard contractual clauses.

5. How long we keep it

• Mailing-list details are kept until you unsubscribe or withdraw consent.
• Transaction and accounting records are kept for the period required by Irish law, generally six years.
• Voucher delivery details and correspondence are kept only as long as needed to provide the voucher, handle queries, and establish or defend legal claims.
• Security logs are retained for a limited period appropriate to website security and troubleshooting.

We securely delete or anonymise personal data when it is no longer needed.

6. Cookies and browser storage

This website does not currently use advertising or analytics cookies. It uses essential browser storage only to remember your cookie preference. This does not track you between websites and is not used for advertising. Optional analytics cookies are currently switched off and will not load unless we add them in the future and you actively choose to accept them.

External services opened from this website, including booking and payment services, may use their own necessary or optional cookies under their own policies and consent controls. If we add analytics, advertising, or other optional tracking to this website, it will remain disabled until you make an informed choice.

7. Your GDPR rights

Depending on the circumstances, you may ask us for access to your personal data, to correct it, erase it, restrict its use, object to its use, or provide it in a portable format. Where processing relies on consent, you may withdraw that consent at any time without affecting earlier lawful processing.

Email your request to theboatyardsauna@gmail.com. We may need to verify your identity before acting. You also have the right to complain to Ireland’s Data Protection Commission .

8. Security, children, and changes

We use appropriate technical and organisational measures to protect personal data, but no internet service can guarantee absolute security. This website and its purchasing tools are not directed at children acting independently. A parent or guardian should make any booking or purchase involving a child.

We may update this notice when our services or legal obligations change. The date at the top shows the latest revision.