Privacy notice

Ireland Sports Day is the operating identity and controller for personal data handled through this platform. It is run as an independent volunteer initiative.

For privacy questions, email privacy@irelandsportsday.com.

To exercise a data protection right, use the privacy request form.

• Adult account and authentication details, account settings, and security records;
• organisation claims, roles, event submissions, activity history, and audit records;
• stories or other content you choose to submit, together with moderation records; and
• location or address inputs needed for a feature, with public display limited to reviewed, appropriate location detail.

If you choose to provide them, we collect your gender, mobile number, and second and third countries of identity to understand who takes part and to personalise updates. These four fields are optional, never shown publicly and can be seen only by Ireland Sports Day staff. We delete them after 90 days under our existing retention rule.

Accounts are for people aged 18 or over. Youth information is privacy-safe by design and public youth cells are published only when enough young people are counted together. We do not create individual accounts for minors or seek their names, dates of birth, school, contact details, or individual participation records.

Public pages show only privacy-safe release data. We do not publish participant names, contact emails, addresses, or coordinates; participant numbers appear as privacy-safe bands only. Private events and youth rows stay private.

A participation claim stores its event, participation type, adult attestation, accepted disclaimer version and submission timestamp. Separate verification and fraud-control records store the verified email address, hashed verification token, verification status and timestamps, and the verification-request and claim IP addresses. Claim and rights-request actions also create audit and provenance records.

We use this information for participation counting and fraud control. Our provisional legal basis is our legitimate interests in measuring participation and protecting the integrity of campaign reporting.

These terms require claim identity data to be deleted or anonymised at campaign wind-down. Today, verified erasure requests trigger automatic anonymisation; scheduled wind-down enforcement must be in place before campaign closure.

You can ask to access, correct, erase, restrict or object to this processing through the privacy request form.

Exact claim counts are for authorised operations and are not shown on public event cards by default. Ireland Sports Day may publish bands only after the event, at its discretion; it does not publish exact claim counts.

• To create and operate adult accounts, organisation claims, and requested platform services — performance of a contract;
• To secure the platform, prevent misuse, moderate stories, keep audit evidence, and improve reliability — legitimate interests, balanced against your rights;
• To respond to rights requests and meet regulatory, court, tax, or other binding duties — legal obligation; and
• To send optional communications or use data for another clearly explained optional purpose — consent, where consent is requested.

Access is limited to authorised platform operators and service providers that need it for their role. Processors may include Clerk for authentication, the contracted database hosting provider for secure storage and operations, and Google Address Validation for address validation where that feature is enabled. We require appropriate data-protection terms and limit the data sent to what the service needs.

Retention is review-based. We review data at defined intervals and anonymise, aggregate, or delete it when the purpose ends, subject to legal, security, dispute, and audit needs. Exact periods and exceptions remain under DPO review and will be published before this notice becomes final.

When the service ends, the purpose and lawful basis for operating identifiable account, participation, organisation, story, and security data normally end too. We will stop using that data to operate the service and erase or anonymise personal data unless a limited record is still necessary for a legal obligation, a dispute, or the establishment, exercise, or defence of legal claims.

Our closure retention schedule is: operational personal data is erased or anonymised when the service closes; limited audit, security, and legal records are kept only for the period needed for their documented purpose; and anonymised aggregate statistics may be retained indefinitely.

A statistic that has been aggregated so that it does not identify a person, and is published only when at least five people are included (k≥5), is an anonymised aggregate, not personal data. We may retain these aggregates indefinitely to understand participation and report the campaign's overall impact.

We do not store individual minor data. Youth information that remains is an anonymised k≥5 aggregate, not a record about an individual minor, so it may survive service closure or an erasure request precisely because no individual minor is stored within it.

If a closure affects your account, we will tell you through a notice on the service and, where practicable, by email to the email address we hold for the account. The final retention schedule and any material change to it will also be published in this notice before it takes effect.

Account and authentication details marked as required are needed to create and secure an account or deliver a requested service. Optional fields are voluntary, although leaving them blank may limit that feature.

We do not use personal data to make solely automated decisions that produce legal or similarly significant effects. Automated safety or matching signals remain subject to human review where they could materially affect a person or organisation.

• Ask for access to and a copy of your personal data;
• Ask us to correct inaccurate or incomplete data;
• Ask for erasure or restriction where the law provides;
• Object to processing based on legitimate interests;
• Receive applicable data in a portable format; and
• Withdraw consent at any time where consent is the lawful basis, without affecting earlier lawful processing.

To make a request, use the privacy request form.

You may complain to Ireland's Data Protection Commission if you believe your personal data has been handled unlawfully. We would also welcome the opportunity to address the concern through the privacy request form.

We will update this notice when processing changes or the DPO and legal reviews are complete. Material changes will be made clear on the platform.