Privacy
Short version: if you fill in the form I get your name, your email and what you're interested in, I reply, and I delete it when it's no longer any use. I don't track you, I don't profile you and there's nobody to sell you to.
Last updated 30 August 2026
The Once Over is a sole trader business run by Croí, providing strategy, brand and content services to small businesses in Ireland. I am the data controller for the information described on this page.
None. There is no analytics, no tracking pixel, no advertising tag, no social media embed and no video player. The typefaces are built into the pages themselves rather than loaded from anybody else's server, so visiting this site doesn't tell a third party you were here.
That means there's no cookie banner, because there is nothing to consent to. If that ever changes — if I add analytics of any kind — a consent banner will appear before it does, and this page will say so.
| What | Why | Legal basis | Kept for |
|---|---|---|---|
| Your name, email, what you're interested in, and anything you write in the message box | So I can reply to your enquiry and, if it goes further, quote for the work | Legitimate interest — you contacted me and expect an answer. If we go on to work together it becomes necessary for the contract between us. | 12 months from your last contact, unless we start working together |
| Emails you send me directly | Same — to answer them | Legitimate interest, then contract | 12 months, or the length of our working relationship plus 7 years where the email forms part of a record I'm required to keep for tax |
| Information about your business you give me during a job — sales figures, till exports, account access | To do the work you've paid for | Contract | The length of the job, then returned or deleted on request. Financial records are kept as long as Revenue requires. |
| If I contacted you first: your business name, the business email address you publish yourself, your town, and my own notes from looking at your website and public profiles | To write to you once about your own business, with something specific I noticed, and to keep a record of who I've approached so I don't approach anyone twice or approach anyone who has asked me not to | Legitimate interest — offering a relevant service, business to business, to a business at the address it publishes for that purpose | 12 months from my last contact with you, or immediately if you ask |
I don't collect anything else. There's no newsletter to be signed up to without asking, no profiling, and no automated decision-making of any kind.
Sometimes I write to a business first. When I do, three things are always true.
I only ever use the address you publish yourself — on your own website, your Google listing or the email button on your social profile. I don't buy lists, I don't use scrapers, and I don't guess at anyone's personal address. The email is only ever about your business, and it contains something specific I noticed by looking at it, because otherwise there is no reason to send it. Every email I send has a way to stop it — reply with the word stop, or just say so in your own words.
If you tell me to stop, I keep your business name and email address on a suppression list and nothing else. That list exists purely so I can check it before I write to anyone, and being on it means I will not contact you again. It's the one thing I keep indefinitely, because deleting it would defeat its purpose — but if you'd rather I deleted that too, ask and I will.
You can also ask me where I got your address. I'll tell you exactly: I keep a note of the source for every business I write to.
This site is hosted by Netlify, and the contact form is handled by Netlify Forms. That means a form submission is stored on Netlify's systems, which are located in the United States, before it reaches my inbox.
That transfer outside the European Economic Area is covered by Netlify's own data processing agreement, which applies the European Commission's Standard Contractual Clauses (Decision 2021/914) and, separately, the EU–US Data Privacy Framework. I export and delete form submissions from Netlify on a regular schedule rather than leaving them sitting there.
Beyond that: my email provider, and — if we work together — my accountant, and Revenue where the law requires it. Nobody else. I don't share, sell or rent anything to anyone, and there are no advertising or data partners because I don't run advertising.
Under the General Data Protection Regulation you have the right to:
Email hello@theonceover.ie and I'll deal with it inside a month, usually a good deal faster. It costs nothing.
Tell me first — it's one person and it's fixable. But you have the right to complain to the Irish supervisory authority regardless, and you don't need to go through me to do it:
Data Protection Commission
6 Pembroke Row, Dublin 2, D02 X963
www.dataprotection.ie
On some jobs — writing a newsletter, for instance — I handle a client's own customer list on their instructions. In those cases the client is the controller and I'm the processor, and there's a written data processing agreement in place covering exactly what I may do with it. I don't use anybody's customer list for my own purposes, ever.
If this page changes materially I'll change the date at the top and, where it affects you, say so directly rather than quietly editing it.
Questions about any of this go to hello@theonceover.ie. A plain question gets a plain answer.