Privacy Policy

1. Data Controller

O'Connor Woodwork Solutions Ltd (trading as TheCutlist.ie), Unit 12, Gillogue Office Park, Clonlara, Co. Clare, Ireland, is the data controller for personal data processed through this website under the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.

Contact for privacy queries: privacy@thecutlist.ie.

2. Personal Data We Collect

• Identity: first name, last name, company name.
• Contact: email, billing address, delivery address, phone number.
• Account: hashed password, account status, linked ERP contact ID (for trade pricing).
• Order data: cutlist specifications, materials, quantities, dimensions, delivery method.
• Payment metadata: Stripe transaction IDs, payment status. We never see or store card numbers.
• Technical: IP address, session cookie, browser type, anti-bot signals (if you enable reCAPTCHA).

3. Lawful Bases & Purposes

• Contract (Art 6(1)(b)): creating your account, calculating quotes, taking payment, manufacturing and delivering orders.
• Legal obligation (Art 6(1)(c)): retaining financial records for 7 years (Irish Revenue), responding to data subject rights requests, EU Deforestation Regulation due diligence.
• Legitimate interest (Art 6(1)(f)): securing the service against fraud and abuse, applying trade pricing via our ERP join, diagnosing errors from server logs.
• Consent (Art 6(1)(a)): non-essential browser storage (draft cutlists, material selection) and Google reCAPTCHA bot protection are activated only if you accept them in the cookie banner.

4. Third-Party Processors & Transfers

We share only the personal data strictly required by each processor. All processors operate under written data-processing agreements. Transfers outside the EEA rely on the EU Commission adequacy decisions (EU–US Data Privacy Framework) or the Standard Contractual Clauses (2021/914) where applicable.

5. Retention

• Account data: kept while your account is active; deleted or anonymised within 90 days of a verified erasure request.
• Order & invoice data: retained for 7 years after the financial year end (Irish Revenue obligation).
• Draft orders: purged automatically after 24 hours.
• Revoked auth tokens: purged automatically once expired.
• Server access logs: 30 days in Cloud Logging.
• Data subject request records: 3 years (evidence of compliance).

6. Your Rights

Under GDPR you have the right to:

• Access (Art 15) and portability (Art 20) of your data.
• Rectification (Art 16) of inaccurate data.
• Erasure (Art 17) where legally possible.
• Restriction (Art 18) or objection (Art 21) to processing.
• Withdraw consent for non-essential storage at any time via the Cookie Settings link in our footer.

To exercise any of these rights, submit a request at /data-requests or email privacy@thecutlist.ie. We will respond within 30 days. You may lodge a complaint with the Irish Data Protection Commission (dataprotection.ie).

While online ordering is paused, the /data-requests form is unavailable — please use privacy@thecutlist.ie, which reaches the same team and carries the same 30-day response commitment.

7. Security & Breach Notification

Data is transmitted over TLS, passwords are hashed with bcrypt, authentication uses HTTP-only cookies with SameSite = Strict, and database access is restricted to the application service account. In the event of a personal data breach likely to result in a risk to your rights, we will notify the Irish DPC within 72 hours and, where the risk is high, notify affected individuals directly.

8. Children

This service is intended for persons aged 18 or over. We do not knowingly collect personal data from minors.