Privacy Policy

1. Who We Are

This Privacy Policy applies to Paddy Teacher Ltd, an Irish private limited company (“Paddy Teacher”, “we”, “us”, “our”), registered in Ireland. We operate the website www.paddyteacher.com and deliver professional development courses through our Thinkific school (“the School”).

Data Controller: Paddy Teacher Ltd

Registered Jurisdiction: Ireland (subject to GDPR / Data Protection Acts 1988–2018)

Website: www.paddyteacher.com

Email: info@paddyteacher.com

For the purposes of the EU General Data Protection Regulation 2016/679 (“GDPR”) and the Irish Data Protection Acts 1988–2018, Paddy Teacher Ltd is the Data Controller of personal data collected through our website and Thinkific school.

2. Scope of This Policy

This Policy covers personal data collected from:

Visitors to www.paddyteacher.com;
Registered learners in our Thinkific school;
Subscribers to our email marketing list;
Individuals who contact us by email or through any contact form;
School or institution contacts we hold for B2B marketing purposes.

It does not cover third-party websites linked from our site. We encourage you to review the privacy policies of any third-party sites you visit.

3. Personal Data We Collect

3.1 Data You Provide Directly

When you register for a course, purchase access, or contact us, we may collect:

Full name and email address;
School name, role, and county/country (for teacher CPD registration purposes);
Payment card details (processed directly by Stripe — we do not store card data);
Billing address (collected by Thinkific/Stripe for VAT compliance);
Any communications you send us, including support queries.

3.2 Data Collected Automatically

When you visit www.paddyteacher.com or our Thinkific school, we and our service providers may collect:

IP address and approximate geolocation (country/region);
Browser type, device type, operating system;
Pages visited, time spent, referral source;
Cookie identifiers and similar tracking technologies (see Section 9).

3.3 Data from Third Parties

4. Legal Bases for Processing (GDPR)

We process personal data only where we have a lawful basis to do so. The bases we rely on are:

Contract (Art. 6(1)(b) GDPR): Processing necessary to deliver the course you have purchased or registered for, including account creation, course access, and issuing your certificate of completion.

Legal Obligation (Art. 6(1)(c) GDPR): Processing required for VAT compliance (EU OSS scheme, Irish Revenue obligations), financial record-keeping, and responding to regulatory or legal requests.

Legitimate Interests (Art. 6(1)(f) GDPR): Processing for the purposes of fraud prevention, IT security, improving our services, and direct marketing to existing customers in accordance with the ePrivacy Regulations (PECR in Ireland). Our legitimate interests do not override your fundamental rights and freedoms.

Consent (Art. 6(1)(a) GDPR): Where we send marketing emails to new contacts, set non-essential cookies, or process data for purposes beyond those described above, we rely on your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time.

5. How We Use Your Personal Data

We use the personal data we collect for the following purposes:

To create and manage your learner account;
To process payments and issue receipts and VAT invoices;
To provide access to course content, live webinars, and completion certificates;
To send course-related communications (welcome emails, progress reminders, webinar links);
To respond to your support queries;
To send marketing emails about our courses (subject to consent or legitimate interests, as applicable);
To comply with Irish and EU tax and regulatory obligations, including EU VAT OSS reporting;
To maintain the security and integrity of our website and school;
To improve our services through aggregated, anonymised analytics.

6. Who We Share Your Data With

We do not sell, rent, or trade your personal data. We share data only with trusted third-party processors, under written data processing agreements, who act on our instructions:

Thinkific Labs Inc.: Course delivery platform (servers in the USA — transfers covered by SCCs). Privacy Policy: thinkific.com/privacy

Stripe Inc.: Payment processing (servers in the USA — Privacy Shield successor / SCCs). Privacy Policy: stripe.com/privacy

Mailchimp (Intuit Inc.): Email marketing (servers in the USA — SCCs). Privacy Policy: mailchimp.com/legal/privacy

Wix.com Ltd.: Website hosting (servers in the USA and EU — SCCs). Privacy Policy: wix.com/about/privacy

Google (Analytics / Workspace): Website analytics and business email (SCCs). Privacy Policy: policies.google.com/privacy

We may also disclose personal data to competent authorities (including the Data Protection Commission, Revenue Commissioners, or An Garda Síochána) where required by law.

7. International Data Transfers

As an Irish company processing data from EU, UK, US, and Canadian residents, we are careful about cross-border transfers of personal data.

Transfers from the EEA to the USA by our processors (Thinkific, Stripe, Mailchimp, Wix) are governed by Standard Contractual Clauses (SCCs) approved by the European Commission under Article 46(2)(c) GDPR. Where applicable, supplementary technical and organisational measures are applied.

Transfers to the UK are made on the basis of the EU–UK Adequacy Decision adopted by the European Commission in June 2021.

Transfers to Canada benefit from the adequacy finding under GDPR Article 45 in respect of organisations subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) / the new Consumer Privacy Protection Act (CPPA) as applicable.

8. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law:

Learner account data: Duration of enrolment plus 3 years thereafter (for CPD record purposes)

Payment and VAT records: 7 years (Irish Companies Act / Revenue obligations)

Email marketing contacts: Until you unsubscribe or withdraw consent

Website analytics: 26 months (Google Analytics default, subject to cookie consent)

Support correspondence: 2 years from resolution

When data is no longer required, it is securely deleted or anonymised.

9. Cookies and Similar Technologies

Our website and Thinkific school use cookies and similar technologies. We categorise these as follows:

Strictly Necessary Cookies: Essential for the website to function (e.g. session management, login state on Thinkific). These cannot be disabled.

Functional Cookies: Remember your preferences and improve your experience (e.g. language, display settings).

Analytics Cookies: Allow us to understand how visitors use our website (e.g. Google Analytics). Set only with your consent.

Marketing Cookies: Track visits across websites to deliver relevant advertising. We do not currently run retargeting advertising but our third-party tools may set such cookies. Set only with your consent.

You can manage cookie preferences through the cookie banner displayed on your first visit to paddyteacher.com, or at any time by visiting your browser settings. Withdrawing consent to analytics or marketing cookies will not affect the lawfulness of processing before withdrawal.

10. Your Rights Under GDPR (EU / EEA / UK Residents)

If you are located in the EU, EEA, or UK, you have the following rights under GDPR (and the UK GDPR respectively):

Right of Access (Art. 15): to receive a copy of the personal data we hold about you;
Right to Rectification (Art. 16): to have inaccurate data corrected without undue delay;
Right to Erasure (Art. 17): to have data deleted where it is no longer necessary, or you withdraw consent and no other legal basis applies;
Right to Restriction of Processing (Art. 18): to request we limit processing in certain circumstances;
Right to Data Portability (Art. 20): to receive your data in a structured, commonly used, machine-readable format;
Right to Object (Art. 21): to object to processing based on legitimate interests or for direct marketing;
Rights related to Automated Decision-Making (Art. 22): we do not carry out solely automated decision-making with legal or similarly significant effects.

To exercise any of these rights, please contact us at info@paddyteacher.com. We will respond within one calendar month. Where requests are complex or numerous, we may extend this by a further two months with notice.

You also have the right to lodge a complaint with the Data Protection Commission (Ireland), the supervisory authority for Paddy Teacher Ltd:

Data Protection Commission: 21 Fitzwilliam Square South, Dublin 2, D02 RD28

Website: www.dataprotection.ie

Phone: +353 (0)761 104 800

11. Additional Rights for UK Residents

UK residents are protected by the UK GDPR and the Data Protection Act 2018. Your rights mirror those under EU GDPR (Section 10 above). To exercise your rights or make a complaint, you may also contact:

Information Commissioner's Office (ICO): Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Website: www.ico.org.uk

Phone: 0303 123 1113

12. Additional Information for US Residents

We serve US-based teachers and institutions on www.paddyteacher.com and through our Thinkific school. While no single US federal privacy law equivalent to GDPR currently applies to our operations, we are committed to transparency and to providing US residents with equivalent rights where practicable.

12.1 California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act 2018 (CCPA), as amended by the California Privacy Rights Act 2020 (CPRA), may apply to you. You have the right to:

Know what personal information we collect, use, disclose, and sell;
Delete personal information we hold about you (subject to certain exceptions);
Correct inaccurate personal information;
Opt out of the sale or sharing of your personal information — we do not sell personal data;
Non-discrimination for exercising your privacy rights.

To submit a CCPA/CPRA request, contact us at info@paddyteacher.com. We do not sell, share for cross-context behavioural advertising, or otherwise monetise your personal information.

12.2 Other US State Privacy Laws

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas, and other states with comprehensive consumer privacy laws have similar rights to access, correct, delete, and opt out of certain processing. We honour such requests on the same basis as CCPA requests. Please contact us at info@paddyteacher.com.

12.3 COPPA

Our courses are designed for adult primary school teachers. We do not knowingly collect personal information from children under the age of 13. If you believe we have inadvertently collected data from a child, please contact us immediately at info@paddyteacher.com and we will delete it promptly.

13. Additional Information for Canadian Residents

We operate in Canada in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. Canadian residents have the right to:

Be informed of the purposes for which their personal information is collected, used, or disclosed;
Access personal information we hold about them and request corrections;
Withdraw consent to the collection, use, or disclosure of personal information, subject to legal and contractual constraints;
Challenge our compliance with applicable privacy legislation.

If you have a privacy concern as a Canadian resident, please contact us at info@paddyteacher.com. If your concern is not resolved to your satisfaction, you may contact the Office of the Privacy Commissioner of Canada:

Office of the Privacy Commissioner of Canada: 30 Victoria Street, Gatineau, Quebec K1A 1H3

Website: www.priv.gc.ca

Phone: 1-800-282-1376

14. Our Thinkific School — Specific Disclosures

Our courses are hosted on Thinkific, a Canadian-founded, US-operated platform. When you enrol in a course through our Thinkific school:

Thinkific acts as a Data Processor on our behalf and operates under its own Privacy Policy (thinkific.com/privacy);
Your course progress, quiz results, and completion data are stored on Thinkific's servers;
Completion certificates are generated and hosted by Thinkific;
Live webinar sessions may be conducted via Zoom or another provider — participants will be notified of the applicable privacy policy in advance;
We do not share your learner data with any third party for marketing purposes without your explicit consent.

15. Data Security

We implement appropriate technical and organisational measures to protect your personal data against accidental loss, destruction, alteration, disclosure, or unauthorised access. These include:

HTTPS / TLS encryption across our website and Thinkific school;
Access controls limiting staff access to personal data on a need-to-know basis;
Payment processing exclusively through Stripe (PCI-DSS compliant — we never store card data);
Regular review of our data processing activities and third-party processor agreements.

While we take security seriously, no transmission of data over the internet is completely secure. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours and, where required, notify affected individuals without undue delay.

16. Marketing Communications

We may send you marketing emails about our courses and professional development offerings. We do so on the following basis:

Existing customers: on the basis of legitimate interests (soft opt-in), in compliance with the EC ePrivacy Directive (SI 336 of 2011 in Ireland). You can opt out at any time.
New contacts (e.g. from school mailing lists): only where we have obtained valid prior consent under GDPR and ePrivacy rules.

Every marketing email we send includes an unsubscribe link. You can also opt out at any time by emailing info@paddyteacher.com or clicking 'Unsubscribe' in any of our emails. Opting out of marketing will not affect your course access.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify existing learners by email and/or by a prominent notice on our website. The 'Last Updated' date at the top of this Policy will always reflect the most recent version. Continued use of our website or school after the effective date of any update constitutes acceptance of the revised Policy.

18. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact: