Privacy Policy – The Boutique at Cashel Palace Hotel

Effective date: 9 September 2025
Who we are: The Boutique at Cashel Palace Hotel ("The Boutique", "we", "us", "our") is the retail arm of Cashel Palace Hotel.

Plain‑English summary: We collect just enough information to process your orders, deliver your purchases, and keep in touch (if you choose). We respect your privacy, do not sell your data, and give you control over your information.

1) Controller & Contact

Controller: Cashel Palace Hotel (The Boutique), Main Street, Cashel, Co. Tipperary, Ireland.
Email: info@cashelpalacehotel.ie
Telephone: [+353 (0)62 62 002.
DPO: Seamus Redmond sredmond@cashelpalacehotel.ie.

2) What data we collect

  • Identity data: first name, last name, title.

  • Contact data: email address, telephone number, billing and delivery addresses, country.

  • Order & transaction data: products purchased, order value, gift messages, returns.

  • Payment data: processed securely by our payment providers (e.g., Stripe/PayPal/Apple Pay/Google Pay). We do not store full card numbers.

  • Marketing preferences: your newsletter sign‑up, consent status, and related preferences.

  • Technical data: IP address, device identifiers, browser type, cookies, and analytics events (e.g., page views, conversions).

  • Support correspondence: emails, webforms, social messages.

  • Optional profile data: date of birth, interests (when you choose to share them).

3) How we collect data

  • Directly from you (online checkout, newsletter forms, customer service).

  • Automatically via cookies and similar technologies.

  • From hotel systems if you interact with the wider Cashel Palace Hotel (e.g., when you opt‑in to receive Boutique updates via Revinate).

4) Purposes & legal bases (GDPR)

We process your data only when a legal basis applies:

  • Purchases & fulfilment (create account, process orders, deliver items, customer service, returns): Performance of a contract (Art. 6(1)(b)); legal obligation for tax/records (Art. 6(1)(c)).

  • Payments & fraud prevention: Legitimate interests (Art. 6(1)(f)) and provider’s legal obligations.

  • Marketing communications (email/SMS/ads) when you consent: Consent (Art. 6(1)(a)); you can withdraw anytime.

  • Personalisation & analytics (to improve our website and understand what guests find helpful): Legitimate interests (Art. 6(1)(f)), or consent where required for cookies.

  • Security & compliance: Legitimate interests and legal obligation.

5) Cookies & similar technologies

We use cookies to operate the site, remember your basket, and measure performance.

  • Strictly necessary cookies: always on (site operation, checkout).

  • Analytics & performance: e.g., Google Analytics 4 (GA4).

  • Advertising/retargeting: e.g., Meta Pixel, Google Ads (if enabled).
    You can manage cookie preferences via our cookie banner and most browser settings. See Cookie Policy for details.

6) Sharing your data

We share data with trusted providers who help run The Boutique:

  • Website & hosting: Squarespace (and connected integrations).

  • Payments: Stripe and/or PayPal (plus Apple Pay/Google Pay via Stripe).

  • Email marketing & CRM: Revinate (newsletter and guest profile management).

  • Delivery & logistics: An Post and selected couriers for shipping and returns.

  • Analytics & advertising: Google, Meta, and similar platforms where enabled.

  • IT/security & support: cloud storage, customer support tools, and auditors.
    All providers are bound by contracts and process data only on our instructions.

7) International transfers

Where data is transferred outside the EEA/UK (e.g., to the US by some processors), we use appropriate safeguards such as EU Standard Contractual Clauses (SCCs) and supplementary measures as required. Copies of relevant safeguards are available on request.

8) Data retention

  • Orders & invoices: retained for 7 years (Irish tax/accounting).

  • Customer accounts: active while you use them; deleted or anonymised after 24 months of inactivity, unless we need to retain for legal reasons.

  • Marketing data: retained while consent remains and for 24 months after last engagement, then deleted or anonymised.

  • Support records: up to 24 months after resolution unless longer is required.

9) Your rights (EEA/UK)

You have the right to access, rectify, erase, restrict, object, and port your personal data, and to withdraw consent at any time without affecting lawfulness of prior processing. You also have the right to lodge a complaint with the Data Protection Commission (Ireland) at www.dataprotection.ie.

10) Children’s data

Our site is intended for adults. We do not knowingly collect data from children under 16 in Ireland for marketing purposes. If you believe a child has provided personal data, please contact us to delete it.

11) Security

We use technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS), access controls, least‑privilege administration, and regular reviews of our third‑party processors.

12) Boutique‑specific details

  • Squarespace Commerce: We use Squarespace for storefront, checkout, and order management. Squarespace may act as a processor for website analytics and commerce functions.

  • Revinate newsletter: If you subscribe, we record your consent, the signup timestamp, and source (e.g., “Boutique – Newsletter”). You can unsubscribe at any time via the link in each email.

  • Click & Collect: If offered, we may share your order details with the Hotel’s concierge team for collection coordination.

13) Third‑party links

Our website may contain links to third‑party sites. We are not responsible for their privacy practices. Please review their policies.

14) Changes to this notice

We may update this policy from time to time. We will post changes here and update the Effective date. For significant changes, we may notify you by email or on‑site banner.

15) Contact us

For privacy enquiries or to exercise your rights, please contact info@cashelpalacehotel.ie or write to: Cashel Palace Hotel (The Boutique), Main Street, Cashel, Co. Tipperary, Ireland.

Annex – Lawful bases matrix (reference)

Purpose Data categories Lawful basis Process orders & deliver purchases Identity, Contact, Order, Payment (tokenised), Support Contract; Legal obligation Customer service & returns Identity, Contact, Order, Support Contract; Legitimate interests Payments & fraud prevention Payment (tokenised), Technical Legitimate interests; Legal obligation Marketing communications Identity, Contact, Preferences Consent (withdraw anytime) Personalisation & analytics Technical, Behavioural Legitimate interests and/or Consent (cookies) Security & compliance Technical, Logs Legitimate interests; Legal obligation

Version: 1.0
Brand owner: The Boutique at Cashel Palace Hotel