Legal
Your GDPR rights
Eight rights, what each one actually means at BuyerIQ, and the single email address that exercises any of them. Free, acknowledged within 48 hours, answered within 30 days.
01
The eight rights
These are yours by law, they cost nothing to exercise, and using one has no effect on your account or on anything you have paid for.
| Right | Article | What it means here |
|---|---|---|
| Access | Art. 15 | A copy of every piece of personal data we hold about you, with an explanation of where it came from and who has received it. |
| Rectification | Art. 16 | Correction of anything inaccurate or incomplete. If we have your email wrong, or a saved search is not yours, we fix it. |
| Erasure | Art. 17 | Deletion of your personal data, subject only to records we are legally required to keep. In practice that means payment records. |
| Portability | Art. 20 | Your data in a structured, machine-readable format, as JSON or CSV, so you can take it elsewhere. |
| Restriction | Art. 18 | A pause on processing while something is resolved, for instance while we verify data you have told us is wrong. |
| Objection | Art. 21 | An objection to anything we process under legitimate interests. We stop unless we can show compelling grounds that override your rights. |
| Withdraw consent | Art. 7(3) | Withdrawal of any consent you have given, at any time, without affecting the lawfulness of what happened before. |
| Complain | Art. 77 | A complaint to the Data Protection Commission, which you may make directly and without going through us first. |
02
How to exercise one
One message does it. Use the contact form, or email privacy@buyeriq.ie, naming the right you are exercising, and send it from the address your BuyerIQ account uses. That is how we verify it is you, and it is usually the only verification needed.
What happens next
We acknowledge within 48 hours and answer substantively within 30 days, which is the deadline Article 12 sets. A genuinely complex request can extend by up to 60 further days, and if that happens we will tell you why before the first 30 are up rather than after.
There is no charge. We may ask for more information if we cannot confirm your identity from the email alone, but we will not use that as a way of slowing the request down.
03
The lawful basis for each thing we do
Article 6 requires a specific basis for each purpose. Ours are set out in full, purpose by purpose, in the privacy policy. In summary:
- Contract, Art. 6(1)(b). Your account, your searches and your payments, all of which are necessary to provide the service you signed up for.
- Legitimate interests, Art. 6(1)(f). Rate limiting, fraud prevention, security monitoring and aggregate statistics. We have carried out a balancing test and concluded these do not override your rights. You can object at any time.
- Consent, Art. 6(1)(a). Marketing email, and the analytics and advertising scripts described in the cookie policy. Withdrawable at any time.
- Legal obligation, Art. 6(1)(c). Payment records, kept for seven years under the Taxes Consolidation Act 1997.
04
What we keep, and for how long
- Account data. While the account is active, then erased within 30 days of deletion.
- Search history. 12 months, then permanently anonymised.
- Payment records. Seven years, as Irish tax law requires.
- Measurement data. Our cookieless analytics holds no personal data and sets no cookie. Google Analytics, Microsoft Clarity and the Reddit pixel each retain under their own schedules, which we do not control. Refusing those scripts stops the collection entirely.
The one right we cannot fully grant
Erasure does not reach payment records. Irish tax law requires us to keep them for seven years, and a legal obligation overrides a deletion request. Everything else goes. We would rather state that plainly here than discover it with you at the point of asking.
05
Where your data physically sits
We prefer European processors and use them wherever we have the choice. The database holding your account is in the EU, as are our error monitoring and our cookieless website analytics.
Payment processing, website hosting and API hosting may process outside the European Economic Area under Standard Contractual Clauses approved by the European Commission. Google, Microsoft and Reddit receive data in the United States through the scripts described in the cookie policy; declining those scripts prevents that transfer.
06
Data Protection Officer
Article 37 requires a Data Protection Officer for large-scale or systematic monitoring, and neither describes BuyerIQ, so we have not appointed one. That is a statement about our scale, not a gap in accountability: every privacy matter reaches the contact form and privacy@buyeriq.ie, both read by the people who run the service.
07
Complaining to the regulator
If you believe your rights have been infringed you may complain to a supervisory authority. For BuyerIQ that is the Irish Data Protection Commission.
Data Protection Commission
21 Fitzwilliam Square South, Dublin 2, D02 RD28
+353 (0)1 765 0100 · 1800 437 737
dataprotection.ie
You are entitled to go to them first. We would appreciate the chance to resolve it directly, but that is a preference and not a condition.