1. Controller and contact
For the purposes of the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Irish Data Protection Act 2018, the data controller is:
Alaviro Limited 1 Grand Canal Square, Dublin 2, D02 P820, Ireland Phone: +353 1 561 2345 General enquiries: [email protected] Privacy enquiries: [email protected]
This website provides information about our Irish truffle farm, seasonal availability, and culinary guidance, and it allows visitors to contact us. If you contact us by phone or email outside of the website, this policy still applies to the personal data we process in connection with your enquiry.
2. Data we collect
We collect personal data in two main ways: (a) data you provide directly to us, and (b) technical and usage data collected automatically when you use the website. We do not intentionally collect special category data (for example, health information, political opinions, or biometric data). Please do not include sensitive information in messages to us.
Data you provide
- Full name (when submitted in our contact form).
- Email address (for replies and record-keeping).
- Phone number (optional, only if you choose to provide it).
- Message content (details you choose to share about your enquiry).
Data collected automatically
- IP address (typically in server logs and security events).
- Browser and device information (user agent, device type, operating system).
- Approximate location derived from IP (city/region level).
- Website usage data (pages viewed, clicks, referrer, session duration).
- Cookie and similar identifier data (depending on your consent choices).
We do not require you to create an account to use our website. We also do not request payment card details through the website contact form. If we ever introduce online ordering, we will update this policy and provide separate payment and checkout notices.
3. How we collect data
We collect personal data using the following methods:
Web forms and direct messages
When you use our Contact form, you provide the details we ask for and any content you include in your message. If you email us directly, we process the personal data included in that email.
Cookies, analytics tools, and logs
Our servers log basic request data to keep the site reliable and secure. We may also use analytics tools such as Google Analytics 4 to understand aggregated site usage, and we may use Meta Pixel for advertising measurement if implemented. Where these tools rely on non-essential cookies, they are controlled through the cookie banner and your consent choices.
We do not use pop-ups that block content, and we do not use cloaking or show different content to users and crawlers. The same website content is presented to all visitors.
4. Legal bases for processing (GDPR Art. 6)
We process personal data only when we have a lawful basis under Article 6 of the GDPR. Depending on the context, we rely on one or more of the following bases:
Data / activity
Legal basis
Why
Contact form submissions (name, email, message, optional phone)
Art. 6(1)(b) contract steps; Art. 6(1)(f) legitimate interests
To respond to your enquiry and provide requested information; to keep records for customer support and operational continuity.
Basic server logs (IP, timestamp, requested page, errors)
Art. 6(1)(f) legitimate interests
To operate the website securely, diagnose issues, prevent abuse, and maintain service reliability.
Analytics cookies and usage measurement (GA4)
Art. 6(1)(a) consent
To understand how the site is used and improve content and navigation in aggregate.
Marketing measurement (Meta Pixel), if enabled
Art. 6(1)(a) consent
To measure ad performance and improve relevance for visitors who choose to accept marketing cookies.
Legal compliance requests
Art. 6(1)(c) legal obligation
To comply with applicable laws, lawful requests, and regulatory obligations.
When we rely on consent, you may withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
5. Purposes of processing
We use personal data for the following purposes, in line with the legal bases described above:
Service delivery and support
Responding to enquiries about truffle availability, culinary uses, and farm information; providing requested guidance; and following up on operational questions such as delivery coordination where relevant.
Website operations and security
Maintaining site reliability, preventing fraud and abuse, monitoring error rates, and keeping the website secure. This includes the use of server logs and basic security monitoring.
Analytics and improvement
Understanding which pages are useful, how visitors navigate the site, and where content can be made clearer. We use analytics in aggregated form where possible and limit its use through cookie choices.
Marketing (consent-based)
If we run advertising campaigns, we may use measurement and retargeting tools that rely on marketing cookies. These are optional and are used only if you accept marketing cookies via the banner.
We do not use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects for you.
6. Retention periods
We keep personal data only as long as necessary for the purposes described in this policy, unless a longer retention period is required or permitted by law. Our typical retention periods are:
- Form submissions and enquiry emails: 2 years from last correspondence, to maintain customer support context and handle repeat enquiries.
- Server logs: up to 90 days, unless needed longer to investigate security incidents.
- Analytics data (GA4): 14 months (configured retention), then aggregated or deleted depending on tool settings.
- Cookie consent preference: stored in your browser local storage until you clear site data or change device/browser.
- Email list (if you subscribe in future): until you unsubscribe, then deleted within 30 days (we may keep a minimal suppression record to respect your opt-out).
If you request deletion, we will delete data where we can, subject to any legal obligations or legitimate reasons to retain specific records (for example, security logs related to an incident).
8. International transfers
We are based in Ireland and primarily process data in the European Economic Area (EEA). However, some service providers (for example, analytics or advertising platforms) may process data outside the EEA, including in the United States, depending on their infrastructure.
Where personal data is transferred outside the EEA, we rely on one or more of the following safeguards, as appropriate:
- Adequacy decisions adopted by the European Commission where applicable.
- Standard Contractual Clauses (SCCs) approved by the European Commission, together with supplementary measures where required.
You may request more information about international transfers and the safeguards used by contacting us at [email protected].
9. Your rights under GDPR
If you are in the EEA (including Ireland), you have rights under the GDPR, subject to conditions and exemptions. We will respond to verified requests without undue delay and generally within one month. To make a request, email [email protected] with sufficient detail so we can identify the relevant data.
Access, rectification, portability
- Right to access your personal data and receive a copy.
- Right to rectify inaccurate or incomplete data.
- Right to data portability where processing is based on consent or contract and carried out by automated means.
Erasure, restriction, objection
- Right to erasure (delete) in certain circumstances.
- Right to restrict processing in certain circumstances.
- Right to object to processing based on legitimate interests, and to object to direct marketing at any time.
Withdraw consent
Where we rely on consent (for example, analytics or marketing cookies), you can withdraw consent by changing your cookie preferences. On this website, cookie choices are stored in your browser. You can clear site data in your browser settings to reset the banner and make a fresh choice. You can also contact us for assistance if needed.
Right to complain
You have the right to lodge a complaint with a supervisory authority. In Ireland, the supervisory authority is the Data Protection Commission (DPC). You can find information on how to make a complaint at the DPC’s website. You can also contact us first so we can try to address your concern directly.
11. Children’s privacy
Our website is not directed to children under 16, and we do not knowingly collect personal data from children under 16. If you believe that a child has provided personal data to us, please contact [email protected] and we will take reasonable steps to delete that data from our records.
12. Policy updates
We may update this Privacy Policy to reflect changes to our practices, technology, legal requirements, or the services we offer. When we make changes, we will update the “Last Updated” date at the top of this page. For significant changes, we may also provide a notice on the website.
If you have previously contacted us and a change affects how we use your data for that enquiry, we may also notify you by email where appropriate and where we have a valid reason to do so.
13. Contact / DPO
Alaviro Limited does not appoint a Data Protection Officer (DPO) as a matter of course. However, we provide a dedicated privacy contact for any questions, requests, or complaints relating to personal data:
Privacy contact
Email: [email protected]
Mailing address: Alaviro Limited, 1 Grand Canal Square, Dublin 2, D02 P820, Ireland
Phone: +353 1 561 2345
If you want to request deletion or access, please include the email address you used to contact us and a description of the interaction. We may ask for additional information to verify your identity before fulfilling a request, to protect your data from unauthorised access.
Related links
For information about using the website, please review our Terms. If you would like to contact us about a privacy question, use the details above or visit our Contact page.