Your information

Privacy policy

Draft for client approval — 14 October 2026. Before publication, confirm the controller’s full legal name, postal address, privacy contact, retention schedule and the providers’ contractual and international-transfer arrangements. This version describes the proposed WordPress deployment.

1. Who we are

Defence & Security Ireland is operated by Paul Allen & Associates. For the personal information described in this policy, the data controller is [confirm full legal entity name], at [insert postal address].

To ask about your information or exercise your data protection rights, contact info@paapr.com or call +353 1 676 9575. [Confirm these are the appropriate privacy contact details before publication.]

2. Information we collect

When you request access, we collect your name, email address, organisation (if provided) and reason for requesting access. We also record when you apply, the decision on your request and relevant administrative actions.

When you sign in, WordPress processes your email address, password and session cookies. Passwords are stored as hashes, not readable passwords. Activation and password-reset links are time-limited and single-use. Administrator authentication may also involve an authenticator app; confirm the final plugin and recovery process before launch.

Our hosting and email providers may process technical information such as IP addresses, browser information, request times, delivery status and security logs. Our application uses a keyed, non-readable representation of an IP address or email address to limit repeated form and login attempts.

The request form uses Google reCAPTCHA v3, a hidden bot field and request limits to reduce automated abuse. The check runs when you submit the form, independently of optional analytics-cookie preferences. Google receives technical data for risk analysis, including IP address, browser information and interactions, and may use security cookies.

Please do not put classified, operationally sensitive, confidential or special-category personal information in the access-request form. An access request is not a secure channel for discussing such matters.

3. Why we use information

• Reviewing access requests: to understand who is requesting access and decide whether access is appropriate. We rely on our legitimate interests in managing a private professional website and protecting its content.
• Sign-in and access management: to verify control of an approved email address, maintain a secure session and remove access where necessary. We rely on our legitimate interests in preventing unauthorised access.
• Service emails: to acknowledge requests, communicate approval or other access decisions and send activation and password-reset links. These are operational messages, not marketing subscriptions.
• Security and troubleshooting: to limit abuse, investigate faults and maintain the website, based on our legitimate interests in providing a secure service.
• Legal requirements: where necessary, to comply with a legal obligation or establish, exercise or defend legal claims.

Providing access-request details is voluntary, but we cannot review a request without a name, email address and explanation. If you need assistance with the form, contact us by email. Access decisions are made by an administrator; the security check does not decide whether to approve your application.

4. Who receives information

Authorised staff and website administrators can review access requests. During development, IDEA’s authorised website team assists with setup and testing. We use LetsHost to host the website and database, Twilio SendGrid to deliver operational emails, and Google reCAPTCHA for form security. Providers receive the information required to perform their respective services.

We may also disclose information to professional advisers or competent authorities where required by law or necessary for a legal claim. We do not sell personal information or use this site to build advertising profiles.

5. International processing

Some provider operations may involve processing outside the European Economic Area. Before launch, we will confirm the locations and applicable safeguards for the configured services, such as an adequacy decision or the European Commission’s Standard Contractual Clauses where required. You can contact us for information about the safeguards relevant to your data.

[Launch check: confirm the applicable SendGrid, Google and hosting agreements and transfer mechanisms. Do not publish this section as a completed assurance until those checks are documented.]

6. How long we keep information

Pending and declined requests are scheduled for deletion after 90 days, subject to the WordPress maintenance task running. Approved and revoked account records remain until reviewed and deleted by an administrator. WordPress session and password-reset records follow its configured expiry rules. Hosting logs, backups and SendGrid records follow provider settings. Confirm and document all retention periods before launch.

7. Your rights

Subject to the applicable conditions, you may request access to your personal information, correction, erasure, restriction of processing or data portability. You may object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting processing carried out before withdrawal.

Contact us using the details above. We may need to verify your identity before acting on a request. You can also complain to Ireland’s Data Protection Commission, or your local supervisory authority where applicable.

8. Cookies and changes to this policy

See our cookie policy for details of session cookies, saved preferences and security checks. We may update this notice when the service or its processing changes. The date at the top identifies the latest version.