Privacy Policy
LAST UPDATED: 19 FEBRUARY 2026
1. DATA CONTROLLER
Smart Sustainability Lab (“we,” “our,” or “us”) is the data controller responsible for the processing of personal data collected through the website smartsustainabilitylab.com (the “Site”). We are based in Ireland and subject to the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Irish Data Protection Act 2018, and the ePrivacy Directive 2002/58/EC as transposed into Irish law.
For all data protection inquiries, you may contact us at: info@smartsustainabilitylab.com
2. PERSONAL DATA WE COLLECT
2.1 Data Collected Automatically
When you visit the Site, we may collect certain data automatically through cookies and similar technologies, but only after you have provided explicit consent through our cookie consent mechanism. No non-essential storage or access occurs on your device until you actively click “Accept.” This data may include:
- IP address (anonymised by default in GA4)
- Browser type and version
- Operating system
- Referring URL and pages visited
- Date and time of access
- Approximate geographic location (country/region level)
2.2 Data You Provide Directly
If you contact us by email, we will process your email address and the content of your correspondence for the purpose of responding to your inquiry.
2.3 Data We Do Not Collect
We do not request or intentionally collect financial data, government identifiers, health data, biometric data, or special categories of personal data as defined under Article 9 of the GDPR. We do not require account registration. We do not operate contact forms, comment systems, or user-generated content features. If you voluntarily provide special category data in email correspondence, we will process it solely for the purpose of responding to your inquiry and will delete it when no longer necessary.
3. LAWFUL BASIS FOR PROCESSING
We process personal data on the following lawful bases under Article 6(1) of the GDPR:
- Consent (Article 6(1)(a)): Analytics cookies are loaded only after you provide explicit consent through our cookie banner. You may withdraw consent at any time by clearing your browser storage for this domain and revisiting the Site.
- Legitimate Interest (Article 6(1)(f)): We process server-level access logs for the purpose of maintaining the security, availability, and integrity of the Site. This processing is strictly necessary to protect against unauthorised access, denial-of-service attacks, and other threats.
4. COOKIES AND TRACKING TECHNOLOGIES
4.1 Consent Mechanism
On your first visit to the Site, a cookie consent banner is presented. The option to decline is given equal prominence to the option to accept, in accordance with EDPB guidelines on consent. No analytics cookies or non-essential device storage occurs until you explicitly click “Accept.” If you click “Decline” or take no action, no analytics tracking occurs. Scrolling or continued browsing does not constitute consent.
4.2 Analytics Cookies
If you consent, we use Google Analytics 4 (operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to understand how visitors use the Site. Our GA4 configuration has the following privacy settings:
- IP anonymisation: enabled (GA4 default)
- Google Signals: disabled (no cross-device tracking)
- Advertising features and ads personalisation: disabled
- User-ID collection: disabled
These settings are enforced at the GA4 property level and are not selectively enabled by user or session.
We do not use Google Analytics data for advertising, remarketing, or any form of cross-context behavioural profiling. We do not sell or share personal information as those terms are defined under applicable US state privacy laws, including the California Consumer Privacy Act as amended by the CPRA.
Google's privacy policy is available at: policies.google.com/privacy
4.3 Consent Preference Storage
We store your consent preference using your browser's local storage (a form of on-device storage under the ePrivacy Directive). This is strictly necessary for the Site to honour your choice and does not track you or transmit data to any third party. No HTTP cookies are set for this purpose.
4.4 Managing Your Preferences
You may withdraw your consent at any time by clearing your browser's cookies and local storage for this domain, then revisiting the Site. You may also configure your browser to reject all cookies. The Site remains fully functional without analytics.
5. PURPOSE AND USE OF DATA
We use the data we collect for the following purposes:
- To understand how visitors interact with the Site and improve its content and structure
- To monitor the security and availability of the Site
- To respond to inquiries sent to our contact email
- To comply with legal obligations
We do not use personal data for profiling, automated decision-making, direct marketing, advertising, or sale to third parties.
6. DATA SHARING AND THIRD-PARTY PROCESSORS
We do not sell, rent, or trade personal data. We share data only with the following categories of processors, under appropriate data processing agreements:
- Google Ireland Limited — Analytics processing (only if you have consented to analytics). We have executed Google's Data Processing Terms (DPT) for this service.
- Google Cloud / Firebase — Website hosting infrastructure, with data processed within the European Union.
7. INTERNATIONAL DATA TRANSFERS
The Site is hosted on Firebase (Google Cloud) with servers in the European Union. Google Ireland Limited acts as the data processor for analytics data. Where Google transfers analytics data outside the EEA, the following safeguards apply:
- Google LLC is certified under the EU–US Data Privacy Framework (DPF), as recognised by the European Commission's adequacy decision of 10 July 2023
- Standard Contractual Clauses (SCCs) approved by Commission Implementing Decision (EU) 2021/914 are incorporated into Google's Data Processing Terms as a supplementary transfer mechanism
We rely on Google's DPF certification as the primary transfer mechanism, supplemented by SCCs. Google Signals, advertising features, and ads personalisation are disabled in our configuration, limiting the scope of data processed to non-advertising, consent-based analytics data.
8. DATA RETENTION
We retain personal data only as long as necessary for the purposes described in this policy:
- Analytics data: retained in Google Analytics for 14 months, then automatically deleted. This period aligns with GA4's default retention setting and provides sufficient data to identify year-over-year trends.
- Email correspondence: retained for the duration of the inquiry plus 12 months, to maintain continuity of support and handle follow-up inquiries.
- Server access logs: retained for a maximum of 90 days, to support incident investigation and security monitoring.
9. YOUR RIGHTS UNDER GDPR
Under the GDPR, you have the following rights in relation to your personal data. To exercise any of these rights, contact us at info@smartsustainabilitylab.com. We may ask you to verify your identity before processing your request. We will respond within 30 days. In certain circumstances, we may be entitled to refuse or limit a request, in which case we will explain our reasons.
- Right of Access (Article 15): You may request a copy of the personal data we hold about you.
- Right to Rectification (Article 16): You may request correction of inaccurate personal data.
- Right to Erasure (Article 17): You may request deletion of your personal data where there is no compelling reason for its continued processing.
- Right to Restriction of Processing (Article 18): You may request that we restrict the processing of your personal data in certain circumstances.
- Right to Data Portability (Article 20): You may request that we provide your personal data in a structured, commonly used, machine-readable format.
- Right to Object (Article 21): You may object to our processing of your personal data where we rely on legitimate interest as our lawful basis.
- Right to Withdraw Consent (Article 7(3)): Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
10. RIGHT TO LODGE A COMPLAINT
If you believe your data protection rights have been violated, you have the right to lodge a complaint with any supervisory authority in the European Economic Area. Our lead supervisory authority is the Irish Data Protection Commission:
21 Fitzwilliam Square South
Dublin 2, D02 RD28, Ireland
www.dataprotection.ie
If you are located in the United Kingdom, you may also contact the Information Commissioner's Office (ICO) at ico.org.uk.
11. CHILDREN'S PRIVACY
The Site is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us and we will take steps to delete such data.
12. THIRD-PARTY LINKS
The Site may contain links to third-party websites, including regulatory bodies, standard-setting organisations, and our LinkedIn company page. We are not responsible for the privacy practices or content of external sites. We encourage you to read the privacy policy of any site you visit.
13. CHANGES TO THIS POLICY
We may update this Privacy Policy to reflect changes in our practices, legal requirements, or the services we provide. Changes will be posted on this page with an updated “Last Updated” date. Where changes are material, we will take reasonable steps to bring them to your attention. Continued use of the Site after changes constitutes acceptance of the revised policy.
14. CONTACT
For questions about this Privacy Policy, to exercise your data protection rights, or to raise a concern about how we handle personal data, contact us at: