LEGAL DOCUMENTATION
DATAFIREFLY LIMITED
15A Main Street, Blackrock, Dublin, Ireland, A94T8P8
This document contains:
-
- Privacy Policy (GDPR)
-
- Cookies / ePrivacy Policy
-
- Electronic Marketing Policy
Compliant with GDPR (EU) 2016/679 · Data Protection Act 2018 · ePrivacy Regulations (Ireland)
Competent supervisory authority: Data Protection Commission, Dublin, Ireland
Version 1.0: March 2026
Privacy contact: [email protected]
1. PRIVACY POLICY
Last updated: March 2026, DATAFIREFLY LIMITED
1.1 Controller
This website and its associated services are operated by DATAFIREFLY LIMITED, an Irish company registered under number 810100, acting as data controller within the meaning of the GDPR.
| Field | Value |
|---|---|
| Company name | DATAFIREFLY LIMITED |
| Registration number (CRO) | 810100 |
| Address | 15A Main Street, Blackrock, Dublin, Ireland, A94T8P8 |
| Privacy email | [email protected] |
| Hosting provider | O2switch, France (EEA) |
1.2 Scope
This policy applies to any person who:
- visits our website
- contacts us by form, email or any other means
- requests a quote, demonstration or information about our services
- subscribes to our services, modules, consulting, training or SaaS subscriptions
- uses our technical support or customer service
- signs up for our newsletter or consents to receive our commercial communications
- is in a professional (B2B) relationship with Datafirefly
1.3 Data collected
1.3.1 Identification and contact data
- Last name, first name
- Company name and role
- Email address and phone number
- Postal address and country
1.3.2 Commercial and contractual data
- Content of your requests, quotes, orders and invoices
- Commercial relationship history
- Information relating to your subscriptions, licenses or subscribed services
1.3.3 Technical and connection data
- IP address, technical logs, date and time of access
- Browser, device type, operating system
1.3.4 Usage data
- Site journey, pages viewed, interactions with our content
- Audience measurement data (via Google Analytics, subject to consent)
1.3.5 Support data
- Content of messages, attachments, screenshots and exchange histories
1.3.6 Payment data
Payment data (card number, expiry date, CVV) are collected and processed directly by our payment provider Stripe Technology Europe Limited. Datafirefly never stores full card details on its servers.
1.4 Purposes and legal bases
In accordance with Articles 13 and 14 of the GDPR, each processing activity is based on an identified legal basis.
| Purpose | Legal basis |
|---|---|
| Responding to your contact, quote or demonstration requests | Pre-contractual measures / Legitimate interest |
| Creation and management of client account | Contract performance |
| Provision of SaaS services, modules, consulting, training | Contract performance |
| Billing, accounting, tax obligations | Legal obligation |
| Customer support and technical maintenance | Contract performance |
| Security, fraud and abuse prevention | Legitimate interest |
| Service improvement and internal statistics | Legitimate interest / Consent |
| Sending newsletters and commercial communications | Consent / ePrivacy rules |
| Lead scoring and customer segmentation (AI) | Legitimate interest: see section 1.9 |
| Defence in court and dispute management | Legitimate interest / Legal obligation |
1.5 Data recipients
Your data are accessible to authorised persons within Datafirefly. They may be transmitted, strictly as necessary, to the following categories of recipients:
- Hosting provider: O2switch (France, EEA)
- Communication and emailing tools: own email infrastructure, hosted in the EU
- Analytics tools: Google Analytics (see section on transfers outside EEA)
- Advertising networks: Meta Platforms (see section on transfers outside EEA)
- Payment provider: Stripe Technology Europe Limited, direct processing of banking data (see section 1.6)
- Accounting, legal or administrative advisors, under professional secrecy
- Public or judicial authorities, where required by law
1.6 Transfers outside the European Economic Area
Some of our tools involve data transfers to countries outside the EEA, in particular:
| Provider | Country | Legal safeguard |
|---|---|---|
| Google Analytics | United States | Standard Contractual Clauses (SCC): EU-US adequacy decision applicable |
| Meta Platforms (Pixel) | United States | Standard Contractual Clauses (SCC) |
| Stripe Technology Europe Ltd | Ireland (EEA) / partial US | SCC for residual transfers: Stripe GDPR policy |
| OpenAI / Anthropic / Ollama (if processing) | United States | Standard Contractual Clauses (SCC) |
For further information on these safeguards or a copy of applicable mechanisms, please write to [email protected].
1.7 Retention periods
Retention periods correspond to the legal maximums allowed for each purpose, in accordance with the storage limitation principle (Art. 5(1)(e) GDPR) and applicable Irish obligations.
| Type of data | Retention period | Legal reference |
|---|---|---|
| Events held during a quota overage | 7 days maximum, encrypted at rest | Performance of the contract (Art. 6(1)(b) GDPR): deferred transmission to the destination platforms |
| Proof of acceptance of the Terms (version, date, IP, language) | Contract duration + 6 years | Legitimate interest (Art. 6(1)(f) GDPR): evidencing contractual consent; Statute of Limitations Act 1957 |
| Contact requests without commercial follow-up | 3 years after last contact | Irish Statute of Limitations |
| Unconverted prospect data | 3 years after last meaningful contact | Irish Statute of Limitations |
| Client and contractual data | Contract duration + 6 years (archive) | Statute of Limitations Act 1957 (Ireland) |
| Invoices and accounting data | 6 years from end of financial year | Companies Act 2014 & Taxes Consolidation Act 1997 |
| Tax and intra-EU VAT documents | 6 years minimum | Revenue Commissioners Ireland: VAT Act 2010 |
| Technical and security logs | 12 months | GDPR minimisation: security use only |
| Support data / tickets | 3 years after ticket closure | Irish Statute of Limitations |
| Newsletter / marketing consent | 3 years after withdrawal or last interaction | DPC Guidance: ePrivacy Regulations |
| Payment data (transaction reference) | 6 years | Companies Act 2014: accounting obligations |
| Non-essential cookies and trackers | 13 months maximum | EDPB & DPC guidance on cookies |
| Strictly necessary cookies | Session or 12 months max | ePrivacy Regulations (Ireland) |
| GDPR consent evidence | 3 years after end of relationship | Art. 5(2) GDPR: accountability principle |
1.8 Your rights
In accordance with the GDPR, you have the following rights:
| Right | Description |
|---|---|
| Access | Obtain a copy of data concerning you |
| Rectification | Correct inaccurate or incomplete data |
| Erasure | Request deletion of your data, under conditions |
| Restriction | Request temporary suspension of processing |
| Objection | Object to processing based on legitimate interest |
| Portability | Receive your data in a structured, machine-readable format |
| Withdrawal of consent | Withdraw your consent at any time, without prejudice |
To exercise your rights, contact us at: [email protected]. We may ask you to verify your identity. Any request is processed free of charge within one month, extendable by two months for complex requests.
Right to lodge a complaint with the supervisory authority
You have the right to lodge a complaint with the Data Protection Commission (DPC) of Ireland.
Website: www.dataprotection.ie, Email: [email protected]
1.9 Customer scoring and automated processing
Datafirefly uses artificial intelligence tools for lead scoring and customer segmentation. The purpose of such processing is to tailor our commercial offers and prioritise our marketing actions.
Such processing does not constitute automated decisions producing significant legal effects within the meaning of Article 22 GDPR. Scoring is used as an aid to human decision-making and does not automatically determine a contractual decision.
Legal basis: legitimate interest, balanced against your fundamental rights and freedoms.
You may object at any time by writing to [email protected].
1.9 bis AI features in the service (Signal Analyst and "Ask your data")
The service includes two features that rely on an artificial intelligence model, disclosed as such in the console in accordance with article 50 of the EU Artificial Intelligence Act:
- Anomaly explanations (Signal Analyst): when statistical detection raises an anomaly on your tracking, the wording of the explanation may be produced by an AI model from the aggregated figures of that anomaly. Any explanation produced this way carries an "Explanation generated by AI" notice in the console and in the weekly report; explanations we write ourselves do not.
- "Ask your data": your natural-language questions about your own aggregated statistics are interpreted by an AI model.
What is sent to our processor Anthropic (model provider, United States, standard contractual clauses) is limited to aggregated, non-personal data: event counts, rates, thresholds, destination names. No personal data belonging to your own customers is ever sent to an AI model: no email address, no identifier, no hash, no IP address.
| What the AI does not do. Anomaly detection is purely statistical: no model is involved, and the figures shown are measurements, never a model's estimates. Fix recipes are hand-written and versioned. No action on your configuration or on your advertising accounts is ever triggered by a model: every write requires an explicit human approval. No automated decision within the meaning of article 22 GDPR is taken. |
|---|
1.10 Data security
Datafirefly implements appropriate technical and organisational measures, including:
- Access control and authentication
- Logging of access to sensitive data
- Regular backups and business continuity plan
- Secure hosting on O2switch infrastructure (France)
- Access restricted to authorised personnel only
- Revocation of access at the end of a service
1.11 Data of minors
Datafirefly services are intended for professional or adult audiences. We do not knowingly collect personal data concerning persons under 18.
1.12 Policy update
This policy may be updated to reflect legal, regulatory or operational developments. The version in force is the one published on the site on the date indicated at the top of the document. In case of substantial modification, we will inform you by email or via a notice on the site.
2. COOKIES / ePRIVACY POLICY
Last updated: March 2026, DATAFIREFLY LIMITED
Legal basis: GDPR (EU) 2016/679 · Data Protection Act 2018 (Ireland) · ePrivacy Regulations (Ireland)
Competent authority: Data Protection Commission (DPC), Dublin.
In Ireland, the ePrivacy rules cover any storage of, or access to, information on the user's terminal equipment.
2.1 What is a cookie?
A cookie is a small text file, or any similar technology, placed on or read from your terminal (computer, smartphone, tablet) when browsing a site. Irish ePrivacy rules more broadly apply to any technology allowing information to be stored on, or accessed from, a user's terminal equipment (pixels, tags, local storage, SDK, etc.).
2.2 Categories of cookies used
Strictly necessary cookies
Essential to the operation of the site. They enable security, authentication, session stability and storage of your technical choices. They do not require prior consent but must be explained.
| Name | Provider | Purpose | Duration | EEA Transfer |
|---|---|---|---|---|
| session_id | Datafirefly / O2switch | Secure session maintenance | Session | No |
| cookie_consent | Datafirefly (CMP) | Storage of consent preferences | 12 months | No |
| csrf_token | Datafirefly | Protection against CSRF attacks | Session | No |
Audience measurement cookies: Google Analytics
These cookies measure site traffic, pages viewed and browsing behaviour, to improve our content and performance.
| Name | Provider | Purpose | Max duration (EDPB) | EEA Transfer |
|---|---|---|---|---|
| _ga | Google Analytics | Unique visitor identification | 13 months | Yes: US (SCC) |
| ga* | Google Analytics | Google Analytics session state | 13 months | Yes: US (SCC) |
| _gid | Google Analytics | User distinction | 24 hours | Yes: US (SCC) |
Marketing cookies: Meta Pixel (Facebook)
These cookies are set by Meta Platforms and allow us to measure the effectiveness of our advertising campaigns, create custom audiences and limit ad repetition.
| Name | Provider | Purpose | Max duration (EDPB) | EEA Transfer |
|---|---|---|---|---|
| _fbp | Meta Platforms | Conversion and advertising audience tracking | 13 months | Yes: US (SCC) |
| _fbc | Meta Platforms | Facebook ad click tracking | 13 months | Yes: US (SCC) |
2.3 Legal basis of cookies
| Category | Legal basis | Consent required |
|---|---|---|
| Strictly necessary | Legitimate interest / Service operation | No |
| Audience measurement (Google Analytics) | Prior consent | Yes |
| Marketing / Meta Pixel | Prior consent | Yes |
In accordance with the Irish DPC requirements, no non-essential cookie is set or read before obtaining your prior, free, specific, informed and unambiguous consent.
Refusing non-essential cookies is as easy as accepting them.
2.4 Consent management
On your first visit, a consent management banner (CMP) allows you to accept, refuse or configure cookies by category.
You can modify your preferences at any time:
- Via the "Manage my cookies" link available at the bottom of each page of the site
- Via your browser settings (blocking or deleting cookies)
Blocking certain strictly necessary cookies may affect the proper functioning of the site.
2.5 Transfers outside EEA
Google Analytics and Meta Pixel cookies involve data transfers to the United States. These transfers are based on Standard Contractual Clauses (SCC) approved by the European Commission. For more information, see our Privacy Policy: section 1.6.
2.6 Chat assistant (AI assistant)
The site offers an automated chat assistant, expressly labelled as an "AI assistant" in line with the transparency obligations of the EU Artificial Intelligence Act: you are not talking to a human unless our team explicitly takes over. The messages you type are transmitted to our processor Anthropic (the AI model provider) to generate the reply, and retained by Datafirefly Limited for support and service-improvement purposes. Do not enter sensitive data in the chat. No decision producing legal effects concerning you is taken in an automated way. You can request a human at any time (the "Talk to a human" button or [email protected]). Any email address you leave in the chat is used only to get back to you (pre-contractual measures, Art. 6(1)(b) GDPR).
2.7 Contact
For any question regarding our use of cookies and trackers, please write to: [email protected]
3. ELECTRONIC MARKETING POLICY
Newsletter · Commercial emails · Email tracking: DATAFIREFLY LIMITED
Legal basis: GDPR (EU) 2016/679 · ePrivacy Regulations (Ireland) · DPC Guidance on direct electronic marketing
Sending tool: own email infrastructure, hosted in the EU
Contact: [email protected]
3.1 Types of communications sent
Datafirefly may send you the following electronic communications:
- Editorial newsletter: news, articles, resources and advice on digital marketing and AI
- Commercial communications: presentation of our services, modules, offers and training
- Invitations to webinars, demonstrations or events
- Follow-ups within an ongoing commercial relationship or initial request
- Transactional emails: order confirmation, delivery, invoicing, support
- Product notifications: module updates, maintenance alerts, SaaS changes
3.2 Legal basis and consent
Communications subject to prior consent
In accordance with the Irish ePrivacy Regulations and the guidance of the Data Protection Commission, sending commercial emails to natural persons (B2C) requires prior, free, specific, informed and unambiguous consent.
This consent is collected via a sign-up form with an un-pre-ticked checkbox, accompanied by a clear statement on the nature of the communications and the possibility to unsubscribe at any time.
B2B communications: applicable framework
Within professional (B2B) relationships, certain communications may be sent on the basis of legitimate interest or existing customer relationship, strictly within the limits provided by the ePrivacy regulations applicable in Ireland and DPC guidance.
In all cases, the right to object is systematically respected.
Datafirefly does not sell, lease or share any contact list with third parties for prospecting purposes.
3.3 Sending tool
DataFirefly's transactional emails are sent from its own email infrastructure, hosted within the European Union. DataFirefly uses no third-party email SaaS (nor any equivalent). Relevant technical sub-processors are listed in the sub-processor list.
3.4 Email tracking
Our emails may include measurement technologies to collect the following data:
- Open rate (open tracking pixel)
- Clicks on links within the email
- Bounce and unsubscribe rates
This data is used for internal statistical purposes and to improve our communications. It also contributes to our lead scoring system described in the Privacy Policy: section 1.9.
You can disable email tracking by configuring your email client to block loading of remote images.
This deactivation does not affect your ability to read and unsubscribe from our emails.
3.5 Proof of consent
Datafirefly keeps proof of consent for each subscriber to its newsletter or commercial communications, including:
- Date and time of registration
- Source of the form (page of origin)
- Exact wording accepted at the time of registration
- Registration IP address (subject to applicable ePrivacy rules)
- Double opt-in confirmation where applicable
3.6 Right of objection and unsubscription
You may unsubscribe at any time from our commercial communications:
- By clicking the unsubscribe link included in each commercial email
- By writing to: [email protected]
Your request is processed as soon as possible and at the latest within 10 business days. Unsubscription does not affect the receipt of transactional emails related to an ongoing contractual relationship (order confirmations, invoices, support).
3.7 Retention period for marketing data
| Type of data | Duration | Legal basis |
|---|---|---|
| Active newsletter subscriber data | Until withdrawal of consent | Art. 7(3) GDPR |
| Inactive subscriber data (no open/click) | 3 years after last active engagement | DPC Guidance: ePrivacy |
| Proof of marketing consent | 3 years after end of commercial relationship | Art. 5(2) GDPR: accountability |
| Sending history and aggregated statistics | 3 years | Irish civil statute of limitations |
| Email tracking logs (opens/clicks) | 13 months rolling | EDPB guidance on cookies & trackers |
3.8 Contact and complaint
For any question relating to our electronic marketing practices or to exercise your rights:
Privacy email: [email protected]
Address: DATAFIREFLY LIMITED, 15A Main Street, Blackrock, Dublin, Ireland, A94T8P8
Competent supervisory authority: Data Protection Commission (DPC), www.dataprotection.ie
Terms of service
The terms governing the DataFirefly Server-Side service are set out in a separate document: Terms of Service. Those terms alone govern this service.