Effective date: 21 September 2026 | Applies to personal data controlled by Crannraí
Crannraí is committed to processing personal data lawfully, fairly and transparently in accordance with the EU General Data Protection Regulation (GDPR), the Data Protection Act 2018 and applicable Irish ePrivacy rules. This page explains the principles we follow and the rights available to individuals.
| Principle | How it applies |
| Lawfulness, fairness and transparency | We identify a lawful basis, consider effects on individuals and provide clear privacy information. |
| Purpose limitation | We collect data for specified purposes and do not use it incompatibly without a lawful basis and appropriate notice. |
| Data minimisation | We seek only information that is adequate, relevant and necessary for the purpose. |
| Accuracy | We take reasonable steps to keep personal data accurate and correct or delete inaccurate data. |
| Storage limitation | We apply retention rules and securely delete or anonymise data when no longer required. |
| Integrity and confidentiality | We apply proportionate security, access and confidentiality measures. |
| Accountability | We maintain policies, records, contracts, risk assessments and evidence of compliance appropriate to our processing. |
| Right | What it means |
| Information | To receive clear information about how your personal data is used. |
| Access | To obtain confirmation of processing and a copy of your personal data, with related information. |
| Rectification | To have inaccurate data corrected and incomplete data completed. |
| Erasure | To request deletion where a legal ground applies. This is not absolute, for example where data is needed for a legal obligation or claim. |
| Restriction | To request that use of data is limited in specified circumstances. |
| Data portability | To receive certain data you provided in a structured, commonly used, machine-readable format and, where technically feasible, transmit it to another controller. This applies only in defined consent/contract and automated-processing cases. |
| Object | To object to processing based on legitimate interests or a public task. We will stop unless compelling legitimate grounds override your interests or processing is needed for legal claims. |
| Withdraw consent | To withdraw consent at any time, without affecting processing that was lawful before withdrawal. |
| Automated decisions | Not to be subject to certain solely automated decisions with legal or similarly significant effects, and to receive safeguards where an exception applies. |
| Complain | To complain to the Irish Data Protection Commission or another competent EEA supervisory authority. |
Send your request to certification@crannraiforestcertification.ie with the subject line “Data Protection Request”, or write to the registered office. Please describe the right you wish to exercise and the information or activity concerned.
We may ask for information reasonably necessary to confirm identity and protect personal data from unauthorised disclosure. We will not request excessive identification. If a representative acts for you, we may request evidence of authority.
We normally respond without undue delay and within one month after receiving a valid request. GDPR allows the period to be extended by up to two further months where a request is complex or numerous; if so, we will explain the extension within the first month. Requests are normally free of charge, although GDPR permits a reasonable fee or refusal for manifestly unfounded or excessive requests.
Rights are subject to conditions and exemptions in applicable law. For example, access may be limited to protect another person’s rights, legal privilege or confidential information. We may retain information despite an erasure request where required for a legal obligation, public-interest function, freedom of expression, research/statistics under applicable safeguards or legal claims.
Where a request covers records containing another person’s data, we will balance the rights of everyone involved and may redact information rather than disclose or delete the entire record.
Crannraí relies on legitimate interests for activities such as operating and protecting the scheme, responsible forest management, stakeholder consultation, certification transparency, responding to enquiries, preventing misuse and establishing legal claims. We document the purpose, necessity and balancing assessment where appropriate. To object, identify the processing and explain your particular circumstances; we will reassess whether it may continue.
Where consent is the lawful basis, it must be freely given, specific, informed and unambiguous. You can withdraw it as easily as it was given. In particular, non-essential analytics and session-recording technologies should be disabled until website consent has been obtained. Cookie choices must not affect access to core website content except where a requested feature genuinely depends on the relevant technology.
For new or changed systems and forest-management processes, Crannraí should identify privacy risks early, minimise the personal data used, limit access and publication, set retention periods and select privacy-protective defaults. A Data Protection Impact Assessment will be completed where processing is likely to result in a high risk to individuals, including systematic monitoring or large-scale sensitive processing where applicable.
Processors handling data for Crannraí must be selected with due care and bound by Article 28 GDPR terms covering instructions, confidentiality, security, sub-processors, rights requests, breaches, deletion/return and audits. Where Crannraí and another party jointly determine purposes and means, responsibilities will be addressed under Article 26. Independent controllers remain responsible for their own processing.
Crannraí will assess suspected personal data breaches promptly, contain and document them, and notify the Data Protection Commission without undue delay and, where feasible, within 72 hours of awareness where the breach is likely to create a risk to individuals. Where a breach is likely to create a high risk, affected individuals will also be informed without undue delay unless an exception applies.
We encourage you to contact Crannraí first so that we can try to resolve a concern. This does not affect your right to contact the Data Protection Commission: www.dataprotection.ie; 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland. You may also seek a judicial remedy where available.