Privacy Policy

Last updated: 30 June 2026

This Privacy Policy explains how County Kildare Community Network Company CLG, trading as MERITS ("we", "us", "our"), handles information when you visit merits.ie (the "Site"). We are the data controller for the processing described below.

We have written this policy to be as plain as possible. If anything is unclear, contact us using the details at the end.

1. The short version

• We collect personal data in two situations: automatically (limited technical data when you browse) and when you contact us through a form on the Site.
• Our website analytics is privacy-respecting and cookieless, and we do not use tracking cookies, build advertising profiles, or sell or share your data.
• If you fill in one of our forms, we use your details to respond to your enquiry — nothing more.
• You have rights under the GDPR. Section 9 explains them.

2. What we collect and why

2.1 Server and access logs

When you visit the Site, our hosting provider automatically generates technical logs. These may include your IP address, browser type and version (user agent), the pages you request, referring URL, and the date and time of the request.

• Purpose: security, abuse and fraud prevention, troubleshooting, and keeping the Site running.
• Legal basis: our legitimate interests (Article 6(1)(f) GDPR) in operating and securing the Site.

2.2 Anonymous analytics (Fathom)

We use Fathom Analytics to understand, in aggregate, how the Site is used. Fathom is configured for anonymous tracking: it does not use cookies, does not track you across other websites, and does not store data that personally identifies you. Where your IP address is processed, it is used only transiently to derive approximate location and de-duplicate visits, and is not retained in an identifiable form.

• Purpose: measuring and improving the Site's content and performance.
• Legal basis: our legitimate interests (Article 6(1)(f) GDPR) in understanding and improving the Site.

2.3 Information you send us through our forms

The Site has two enquiry forms — a general "Get In Touch" contact form and a "Tell Us About Your Business" form. When you choose to submit one, we collect the details you provide, which may include your name, email address, mobile number, job title, company name, the subject and content of your message, how you heard about us, and any selection you make from the enquiry drop-down.

• Purpose: to receive and respond to your enquiry and to follow up where appropriate.
• Legal basis: our legitimate interests (Article 6(1)(f) GDPR) in responding to people who contact us. You are not required to consent to anything to use the form; submitting it is a deliberate act on your part, and the acknowledgement checkbox simply confirms you have seen this policy.
• Your submission is delivered to us by email and stored in the Site's database. To protect the forms from spam and abuse, we use Cloudflare Turnstile, which performs a background check when you submit; this is designed to operate without cookies.

We do not use the information you send us for marketing, and we do not share it with third parties for their own purposes.

We do not collect special category data, and the Site is not directed at children (see Section 10).

3. Who processes your data (third parties)

We rely on a small number of service providers ("processors") to run the Site. They act on our instructions under contract.

We do not sell, rent, or trade your information, and we do not share it for third-party marketing.

4. Cookies and consent

The core Site sets no tracking cookies. Our analytics (Fathom) is cookieless, our web fonts are served from our own server, our Instagram feed is served from our own server, and our form spam-protection (Cloudflare Turnstile) is designed to run without cookies. As a result, browsing the Site does not require a cookie consent banner.

For full details of the cookies used, please see our Cookie Policy at https://www.merits.ie/cookie-policy-eu/.

5. Embedded content

Our Instagram feed is displayed using images stored on our own server, so viewing it does not share your data with Instagram or Meta. Our promotional video is hosted on our own server, so playing it does not contact any third-party video platform.

Where we link to our social media profiles (Instagram, LinkedIn, X/Twitter), these are ordinary links that open in a new tab; no content from those platforms loads on our Site. Once you follow such a link, that platform's own privacy policy applies.

6. International transfers

Our analytics processor (Fathom) is based in Canada, which the European Commission recognises as providing an adequate level of data protection.

Our spam-protection provider (Cloudflare) is based in the United States. Where personal data is transferred to the US, it is protected by an appropriate safeguard — the EU–US Data Privacy Framework and/or Standard Contractual Clauses — relied upon by the provider.

7. How long we keep data

• Server/access logs: retained for up to 12 months, in line with our hosting provider's policy, then deleted or overwritten.
• Form submissions: retained for up to 12 months from the date of your enquiry, then deleted, unless your enquiry leads to an ongoing relationship that requires us to keep it longer.
• Analytics: retained only as anonymous, aggregated statistics, which cannot be linked back to an individual.

8. Automated decision-making

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

9. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you;
• Request rectification of inaccurate data;
• Request erasure ("right to be forgotten");
• Request restriction of processing;
• Object to processing carried out on the basis of legitimate interests;
• Data portability.

If you have sent us an enquiry through one of our forms, these rights apply to the information in that submission. If you have only browsed the Site, we generally hold no information that identifies you (our analytics is anonymous and our logs are kept only briefly for security), so we may be unable to locate any data relating to you, and the GDPR does not require us to acquire additional information solely to identify you (Article 11).

To exercise any right, contact us using the details in Section 12.

10. Children

The Site is intended for a general audience and is not directed at children under 16. We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top shows the most recent version. Material changes will be reflected on this page.

12. Contact and complaints

For any privacy question or to exercise your rights, contact:

County Kildare Community Network Company CLG (t/a MERITS) Áras Chill Dara, Devoy Park, Naas, Co. Kildare, W91 X77F Ireland Email: joinus@merits.ie Phone: +353 45 818 960

You also have the right to lodge a complaint with the Irish supervisory authority:

Data Protection Commission 21 Fitzwilliam Square South, Dublin 2, D02 RD28 Website: www.dataprotection.ie