Legal

Privacy Policy

Effective Date: 1 January 2026 Version 1.0 Last Updated: 6 May 2026

This Privacy Policy explains how Celtic Penitentiary Tours Ltd ("Celtic Penitentiary", "we") collects, uses, and protects personal information you provide when using celticpenitentiary.com (the "Site") or booking a walk. We respect your privacy and we collect only what we need to answer your enquiry, run a walk, and meet our legal obligations.

1. Data Controller

Celtic Penitentiary Tours Ltd
22 Reginald Street, Dublin 8, D08 V860, Ireland
Email: privacy@celticpenitentiary.com
Phone: +353 1 416 5821

We do not currently have a designated Data Protection Officer (DPO). All privacy enquiries go to the email above and are answered within 30 days.

2. Categories of Data We Collect

Identity data — name you provide on enquiry or booking
Contact data — email address, optional phone number
Booking data — chosen walk, group size, preferred dates, accessibility notes you choose to share
Payment data — card-payment details are never stored by us; they are handled directly by our payment processor (Stripe Payments Europe Ltd)
Technical data — IP address, browser type, pages visited, anonymised device data (when you accept analytics cookies)
Geolocation — we do not request precise geolocation; coarse country-level data is inferred from IP address only with analytics consent

We do not intentionally collect special-category personal data (race, religion, health, sexual orientation, etc.), and we ask you not to include such data in enquiries.

3. Purposes of Processing & Legal Basis

Answering your enquiry and running your walk — Contractual necessity
Sending the booking confirmation, pre-walk reading list, and post-walk follow-up — Contractual necessity
Site analytics (only if you accept analytics cookies) — Consent
Tax and accounting records — Legal obligation (Irish Revenue retention rules)
Marketing or news emails — Consent; we do not send marketing emails unless you explicitly opt in

4. Third-Party Sharing

We share personal data only with the following processors, each under a written data-processing agreement:

Stripe Payments Europe Ltd — payment processing
Fastmail Pty Ltd — email hosting (bookings@celticpenitentiary.com)
Plausible Insights OÜ — cookie-less, EU-hosted website analytics (only when you accept analytics cookies)
Hetzner Online GmbH — web hosting (Helsinki, Finland)

We do not sell or share personal data with advertisers, brokers, or any other third party for monetary or non-monetary consideration.

5. International Data Transfers

Our hosting and email providers operate within the European Economic Area. Stripe operates internationally and may transfer payment data outside the EEA under Standard Contractual Clauses approved by the European Commission. Plausible operates entirely within the EU.

6. Retention Periods

Enquiry emails not converted to a booking: deleted within 12 months
Booking records: retained for 6 years from the walk date (Irish accounting/Revenue rules)
Site analytics: aggregate, retained for 24 months
Marketing list: retained until you unsubscribe; we re-confirm consent every 24 months

7. Your Rights (CCPA & equivalent)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA/CPRA):

Right to Know — what personal data we hold about you
Right to Delete — subject to legal-retention exceptions
Right to Correct — inaccurate or incomplete data
Right to Opt-Out of Sale or Sharing — we do not sell or share, but you may still file the request
Right to Limit Use of Sensitive Personal Information — we do not knowingly collect sensitive PI
Right to Non-Discrimination — we will not refuse service or change pricing because you exercised these rights

To exercise any right, email privacy@celticpenitentiary.com with the subject line "CCPA request" and a brief description. We respond within 30 days. We may ask for verification (a reply from the email on file is usually enough).

Do Not Sell or Share My Personal Information: we do not sell or share data; if a future change required it, an opt-out link would appear in this section and in the footer of every page.

8. Children's Data

The Site is not directed at children under 13. We do not knowingly collect personal data from children under 13. If a parent or guardian discovers their child has submitted data, contact us at privacy@celticpenitentiary.com and we will delete it.

9. Security Measures

We use HTTPS site-wide, store enquiry email under encrypted-at-rest hosting, restrict access to booking data to the four named guides and the two directors, and review our security posture annually. No system is perfectly secure; we will notify you of any data breach affecting your information within 72 hours of becoming aware of it.

10. Changes to This Policy

We may update this Policy. The Effective Date and Version above will change. Material changes will be announced on the Site for at least 14 days; if you have an active booking we will email you directly.

11. Contact

For any privacy question, write to privacy@celticpenitentiary.com or by post to Celtic Penitentiary Tours Ltd, 22 Reginald Street, Dublin 8, D08 V860, Ireland.