Effective date: 21 September 2026 | Last reviewed: 21 September 2026
This Privacy Policy explains how Crannraí Forest Certification Ltd (referred to as “Crannraí”, “we”, “us” or “our”) collects, uses, shares and protects personal data in connection with the website https://crannraiforestcertification.ie/, the Crannraí Group Certification Scheme, forest management planning, stakeholder consultation, certification and related communications.
It applies to website visitors, forest owners and scheme applicants or members, landowners, neighbours, stakeholders, contractors, consultants, auditors, representatives of public bodies and other people who interact with Crannraí. It should be read together with our Cookie Policy and GDPR & Data Protection Rights page.
Crannraí Forest Certification Ltd is the controller of personal data processed for the purposes described in this policy, except where another organisation determines its own purposes and means of processing as an independent controller.
Registered office: [INSERT REGISTERED OFFICE ADDRESS]
Company registration number: [INSERT CRO NUMBER]
Privacy contact: certification@crannraiforestcertification.ie
Data Protection Officer (if appointed): [INSERT NAME/CONTACT OR STATE “NOT APPLICABLE”]
| Category | Examples relevant to Crannraí |
| Identity and contact data | Name, organisation, role, postal address, email address, telephone number and preferred contact method. |
| Forest and land-related data | Ownership or authorised-representative status, forest/property name, county, forest management unit ID, maps, boundaries, access information, licence references and information connected with a forest management plan. Some land information may identify or be linked to an individual owner. |
| Scheme and certification records | Applications, consents, group membership records, declarations, management objectives, inspection findings, corrective actions, audit evidence, certification status and communications relating to FSC and PEFC requirements. |
| Stakeholder consultation data | Comments, concerns, objections, observations about forest operations or High Conservation Values, the location concerned, supporting material and records of Crannraí’s response or follow-up. |
| Contractor and supplier data | Contact details, qualifications, insurance or compliance information, contracts, invoices, payment administration and work records. |
| Communications | Emails, letters, call notes, meeting notes, requests, complaints and correspondence. |
| Technical and usage data | IP address, browser/device information, approximate location, pages viewed, referral source, timestamps, interaction data and cookie or similar identifiers, subject to consent where required. |
| Special category or sensitive information | Crannraí does not normally require special category personal data. If a submission contains health, disability, political, religious, trade union or other sensitive information, we will process it only where necessary and a valid Article 9 GDPR condition applies. |
| Purpose | Lawful basis under Article 6 GDPR |
| Respond to enquiries and provide requested information | Legitimate interests in communicating about our services; steps at your request before entering a contract. |
| Assess applications, administer group membership and deliver certification-related services | Performance of a contract or steps before a contract; legitimate interests in operating the scheme. |
| Prepare, implement and review forest management plans | Performance of a contract; legitimate interests in sustainable forest management, operational planning and scheme integrity; legal obligation where applicable. |
| Conduct stakeholder consultation and manage comments, concerns or complaints | Legitimate interests in transparent, responsible forest management, identifying impacts and meeting certification requirements; legal obligation where applicable. |
| Carry out inspections, audits, certification and corrective-action processes | Performance of a contract; legitimate interests in demonstrating compliance and maintaining certification; legal obligation where applicable. |
| Publish appropriate forest, certification and consultation information | Legitimate interests in transparency, stakeholder engagement and meeting certification requirements, balanced against the rights of affected individuals. |
| Manage suppliers, contractors, professional advisers, administration and accounts | Performance of a contract; legal obligations; legitimate interests in running and protecting the business. |
| Protect systems, detect misuse and maintain website security | Legitimate interests in network, information and business security; legal obligation where applicable. |
| Use non-essential analytics, session-recording or similar technologies | Consent. These technologies must not be activated before consent where Irish ePrivacy rules require consent. |
| Establish, exercise or defend legal claims | Legitimate interests; legal obligation; and, for special category data where relevant, Article 9(2)(f) GDPR. |
Where we rely on legitimate interests, we consider the necessity and proportionality of the processing, the reasonable expectations of individuals and the potential effect on their rights. You may object to processing based on legitimate interests as explained in Part II.
Stakeholder engagement is an important part of forest management planning and certification. If you make a submission, Crannraí may use your contact details and the substance of your comments to assess the relevant forest management issue, communicate with you, keep an audit trail and demonstrate consultation to certification or audit bodies.
We may need to share a submission, or a fair summary of it, with the relevant forest owner, scheme member, forest manager, contractor, professional adviser, public authority or certification body. We will limit personal details where reasonably possible. We will not publish your name or contact details on the website unless there is a lawful basis and publication is necessary and proportionate, or you have clearly agreed.
Do not include unnecessary personal data about yourself or another person. If confidentiality is requested, we will take it into account, but cannot guarantee absolute confidentiality where disclosure is required by law, certification rules, due process or the proper investigation of the matter.
We may share personal data, only to the extent necessary, with:
Some recipients act as processors on our instructions; others act as independent controllers under their own legal duties. We do not sell personal data.
Some technology providers may process personal data outside Ireland or the European Economic Area. Where this occurs, Crannraí will use a lawful transfer mechanism, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, together with supplementary safeguards where required. Information about relevant safeguards may be requested using the contact details above.
We retain personal data only for as long as necessary for the purpose collected, including certification, contractual, legal, accounting, audit, dispute and security requirements. Retention is determined by the nature of the record, the certification cycle, limitation periods, regulatory or scheme requirements and the risk associated with deletion.
| Record type | Proposed retention rule — confirm before publication |
| General enquiries | Up to 24 months after the enquiry is closed, unless it develops into a scheme, contract, complaint or legal record. |
| Scheme membership, forest management and certification files | For the membership/contract period and for [CONFIRM PERIOD] afterwards, taking account of FSC/PEFC audit and certification requirements. |
| Stakeholder consultation, complaint and corrective-action records | For [CONFIRM PERIOD] after closure or for the relevant certification/management cycle, whichever is longer, and longer where needed for a dispute or audit. |
| Contracts, invoices and financial records | Normally 6 years after the relevant financial year or longer where Irish tax/company law requires. |
| Consent and cookie preference records | For the life of the consent plus an appropriate evidence period, proposed 2 years after withdrawal or expiry. |
| Security and server logs | Typically 30–180 days unless a security event requires longer retention. |
| Analytics data | According to the configured provider retention period, subject to consent and periodic review: [CONFIRM GOOGLE AND CLARITY SETTINGS]. |
We use appropriate technical and organisational measures designed to protect personal data, including access controls, secure hosting and communications, backups, provider due diligence, confidentiality obligations and incident-management procedures. No internet transmission or storage system is completely secure; therefore absolute security cannot be guaranteed.
Depending on the circumstances, you may have rights of access, rectification, erasure, restriction, data portability, objection and withdrawal of consent, as well as the right not to be subject to a solely automated decision that produces legal or similarly significant effects. These rights and how to exercise them are explained in Part II.
The website and Crannraí’s services are directed to forest owners, professionals and stakeholders and are not intended for children. We do not knowingly collect children’s personal data through the website. If you believe a child has provided personal data, contact us so that we can assess and take appropriate action.
Crannraí does not currently make decisions about individuals using solely automated processing that produces legal or similarly significant effects. If this changes, we will provide the information and safeguards required by GDPR.
The website may link to external services such as the DAFM Forestry Licence Viewer, Google Maps, FSC, PEFC or certification bodies. Those organisations operate their own websites and privacy practices. A link does not make Crannraí responsible for their processing. Please review the external provider’s privacy information before submitting personal data.
We may update this policy to reflect changes in law, certification requirements, our services or website technologies. We will post the updated version on the website and change the effective date. Material changes may be communicated by additional means where appropriate.
Questions, requests or complaints may be sent to certification@crannraiforestcertification.ie or to the registered office listed above. You also have the right to complain to the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland; www.dataprotection.ie.