Privacy Policy

This Privacy Policy explains how FirstOnSite collects, uses, discloses and protects personal data, and sets out your rights under the General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018. It applies to personal data we process in connection with the FirstOnSite service.

1. Data controller

FirstOnSite is a construction lead-alert service operating as a sole trader and trading as “FirstOnSite” (firstonsite.ie). For the purposes of the GDPR, FirstOnSite is the data controller for the personal data described in this Policy and can be contacted at info@firstonsite.ie.

2. Personal data we collect from subscribers

• Email address, in order to deliver the alerts you have subscribed to.
• Approximate location (a town or county you provide), used to indicate the distance of each opportunity. We do not request or store your precise address.
• Preferences, being the counties, project types and trades you select.
• Feedback, where you indicate that a lead is “not for me” or “already won”, recorded against your subscription to improve the relevance of your alerts.
• Subscription and payment status, being a record that your subscription is active and paid. We do not receive or store your payment card details, which are handled by our payment processor (see section 6).
• IP address, retained briefly (approximately 24 hours) solely for rate-limiting and abuse prevention on our public web forms.

3. Legal bases for processing

We process personal data on the following legal bases under Article 6 of the GDPR:

• Performance of a contract (Article 6(1)(b)) - to provide the Service, manage your subscription and take payment.
• Legitimate interests (Article 6(1)(f)) - to keep the Service secure and prevent abuse, and to include the published business contact details of professional agents drawn from the public record (see section 5). We have assessed these interests against the rights and freedoms of the individuals concerned.

We do not sell personal data and we do not use it for third-party advertising.

4. Sources of data

We collect personal data directly from you when you subscribe or interact with the Service. We also process information contained in publicly available records, as described in section 5.

5. Public records and professional agent contact details

The Alerts are compiled from publicly available Irish records, including planning applications published by local authorities, commencement notices published by the National Building Control Office, public procurement notices, and the register of the Companies Registration Office.

Where a planning application identifies a professional agent (such as an architect, engineer or planning consultant acting in a professional capacity), we process the business contact details published in the public record, including name, firm, and, where published, business telephone number or email address. Where the public record provides only a name, we may supplement it with the practice's publicly listed office contact obtained from professional or business directories. We rely on our legitimate interest in connecting construction professionals in relation to live projects, processing only business contact information that is already in the public domain.

We do not collect or store the names or details of private individuals who apply for planning permission. Applicant names are retained only where they exactly match a registered, active company on the public CRO register; in all other cases they are discarded and are not stored.

If you are a professional agent named in the Alerts and wish to object to this processing, please contact info@firstonsite.ie and we will remove your details promptly.

6. Payments

Paid subscriptions are handled by a third-party payment processor. You provide your payment card details directly to that processor; those details do not pass through or reside on our systems. We receive only confirmation that a payment has been made and that your subscription is active. The payment processor handles your payment data as an independent controller in accordance with its own privacy policy.

7. Data processors

We engage a limited number of reputable third-party service providers to operate the Service, including for database and website hosting, email delivery, cookieless analytics and payment processing. Each such provider processes personal data only on our documented instructions and under appropriate data-processing terms, and is permitted to use it solely to provide services to us. We do not sell or otherwise share your personal data with third parties for their own purposes.

8. International transfers

Certain of our service providers process data outside the European Economic Area (EEA), including in the United States. Where personal data is transferred outside the EEA, that transfer is subject to appropriate safeguards as required by the GDPR, such as the European Commission's Standard Contractual Clauses.

9. Cookies and analytics

We do not use tracking or advertising cookies. Our analytics are cookieless and do not identify you individually. We use only essential technical measures necessary for the operation of certain features, such as the secure signed links contained in our emails that allow you to update your preferences or unsubscribe.

10. Data security

We implement appropriate technical and organisational measures to protect personal data, including access restrictions and encryption in transit provided by our hosting providers. Payment card details are never processed by or stored on our systems. We retain only the minimum personal data necessary to provide the Service.

11. Data retention

• Subscriber data is retained for the duration of your subscription. If you unsubscribe, we cease sending you emails immediately and delete your subscriber record within 30 days, except where we are required to retain limited records (for example, basic payment records) to comply with a legal or accounting obligation.
• Rate-limiting records are deleted daily.

12. Your rights

Under the GDPR you have the right to request access to your personal data; to request rectification or erasure; to restrict or object to processing; to data portability in respect of data you have provided to us; and to withdraw consent where processing is based on consent. You may exercise these rights by contacting info@firstonsite.ie or by using the unsubscribe link in any email. We will respond within one month. You also have the right to lodge a complaint with the Data Protection Commission at dataprotection.ie.

13. Changes to this Policy

We may update this Policy from time to time. Any changes will be reflected by the date shown above, and we will notify subscribers by email of any significant change.