1. Who we are
Optimal Assurance Limited is the data controller responsible for the personal data described in this policy.
| Company | Optimal Assurance Limited |
|---|---|
| Registered in | Ireland, company number 656903 |
| frank@optimalassurance.ie | |
| Telephone | 085 879 2311 |
We are not required to appoint a Data Protection Officer. Any question about this policy or about how we handle personal data should be sent to the email address above.
2. What this policy covers
This policy applies to personal data we handle as a data controller: enquiries made through this website, by email or by telephone, and information relating to our clients, their staff and our suppliers.
Where we process personal data on behalf of a client as part of a consultancy engagement — for example while carrying out an audit, reviewing documentation or supporting an investigation — we act as a data processor. That processing is governed by the terms of the individual engagement and, where required, a separate data processing agreement, rather than by this policy.
3. Information we collect
Enquiries and correspondence
If you contact us by email or telephone, we receive your name, your contact details, the organisation you represent and whatever information you choose to include in your message.
Client and supplier records
Where an engagement proceeds, we hold contact details for the individuals we deal with, together with correspondence, proposals, agreements, records of work carried out and information required for invoicing and accounting.
Website visitors
This website does not use cookies, analytics or tracking of any kind. We do not build profiles of visitors and we do not share visitor information with advertising networks.
Our hosting provider automatically records standard server log information, including IP addresses, dates and times of requests and browser type. These logs are generated and retained by the hosting provider for security and operational purposes. We do not use them to identify individuals.
Sensitive information
Some of our work — particularly event medical planning, incident review and certain assurance activities — may involve information relating to health or to workplace incidents. We ask that such information is only provided where it is genuinely necessary, and that it is anonymised or minimised wherever possible. Where sensitive information must be handled, arrangements are agreed with the client in advance and set out in writing.
4. Why we use personal data, and our legal basis
| Purpose | Legal basis |
|---|---|
| Responding to enquiries and providing information about our services | Legitimate interests — responding to a request you have made to us |
| Preparing proposals and quotations | Steps taken at your request prior to entering a contract |
| Delivering agreed consultancy work and managing the engagement | Performance of a contract |
| Invoicing, accounting and tax records | Legal obligation |
| Maintaining records to defend our professional position, including insurance matters | Legitimate interests — establishing, exercising or defending legal claims |
| Occasional updates about our services to existing contacts | Consent, which you may withdraw at any time |
5. Who we share information with
We do not sell personal data, and we do not share it for marketing purposes.
We share personal data only where it is necessary, and only with:
- our hosting and email providers, who store data on our behalf;
- our accountant and, where relevant, our professional advisers and insurers;
- public authorities, where we are legally required to disclose information.
Where a service provider processes personal data on our behalf, they are bound by contract to act only on our instructions and to keep the information secure.
6. Transfers outside the European Economic Area
We aim to use service providers that store data within the European Economic Area. Where a provider processes data outside the EEA, we rely on the safeguards permitted under the General Data Protection Regulation, such as an adequacy decision or standard contractual clauses.
7. How long we keep information
| Category | Retention |
|---|---|
| Enquiries that do not lead to an engagement | Up to 12 months |
| Client engagement records, reports and correspondence | 7 years from the end of the engagement |
| Accounting and tax records | 6 years, in line with Irish company and tax law |
| Records relevant to a potential claim | Retained until the relevant limitation period has passed |
Information is deleted or securely destroyed once it is no longer required.
8. Keeping information secure
We apply measures appropriate to the size of the business and the sensitivity of the information held, including access controls, encrypted storage and transmission where available, restricted use of portable devices and secure disposal of paper records. No system can be guaranteed completely secure, but we take our obligations here seriously and review our arrangements as the business develops.
9. Your rights
Under the General Data Protection Regulation and the Data Protection Act 2018 you have the right to:
- request access to the personal data we hold about you;
- have inaccurate data corrected;
- request erasure of your data in certain circumstances;
- request that we restrict how we use your data;
- object to processing carried out on the basis of legitimate interests;
- receive your data in a portable format where it was provided by you and is processed by automated means;
- withdraw consent at any time, where consent is the basis for processing.
To exercise any of these rights, email frank@optimalassurance.ie. We will respond within one month. We may need to verify your identity before acting on a request.
Where we hold your data on behalf of a client, your request should normally be directed to that organisation. We will assist them in responding.
10. Complaints
If you are unhappy with how we have handled your personal data, please contact us first so we have the opportunity to put it right. You also have the right to complain to the supervisory authority:
Data Protection Commission
6 Pembroke Row, Dublin 2, D02 X963, Ireland
Telephone: (01) 765 0100 or 1800 437 737
www.dataprotection.ie
11. Other websites
This website may link to other organisations' websites. We are not responsible for their content or their privacy practices, and we would encourage you to read their own privacy policies.
12. Changes to this policy
We may update this policy from time to time to reflect changes in how we work or in the law. The current version is always the one published on this page.