Who we are
AuditGlass is operated by Excytech Limited trading as AuditGlass, a company registered in Ireland, Unit 2, Church Street, Kilcock, Co. Kildare, W23 HW89. We are the controller for the personal data described in this notice.
Our Data Protection Officer is Kathy Horgan. Questions about this notice or your data go to privacy@auditglass.ie or 01 504 7000.
What we collect
- Account details: your name, work email, organisation, role and, if you choose one, a password (stored only as a one-way hash).
- Audit content: your answers, notes, evidence files, registers and documents. These belong to your organisation.
- Payments: billing name, address, VAT number and the last four digits of your card. Card numbers are handled by our payment provider, not by us.
- Expert help: the messages and files you exchange with a panel expert.
- Usage and device data: pages visited, sign-in times, IP address and browser, used to keep the service secure.
- Security records: whether two-step sign-in is on, trusted devices and an audit log of security-relevant actions.
- Your choices: marketing and cookie consents, with the date and the wording you agreed to.
- Certificate checks: when anyone checks a course certificate (by scanning its QR code or typing its code), we note the date, the result and a coarse code for their network that changes every day. We never store the IP address, so checks can’t be traced to a person or linked across days.
Why we use it, and our lawful basis
| Purpose | Lawful basis (GDPR Art. 6) |
|---|---|
| Providing your account, audits, passports and expert help | Contract |
| Billing, VAT records and accounts | Legal obligation |
| Security, fraud prevention and audit logs | Legitimate interests |
| AI drafting and guidance (redacted text only) | Contract; legitimate interests |
| Reminders about expiring passports and deadlines you set | Contract |
| Product news and marketing emails | Consent (you can withdraw it at any time) |
| Analytics cookies | Consent (see the cookie policy) |
When your organisation stores personal data about other people in AuditGlass (for example members in a register), your organisation is the controller and we act as its processor under our data processing terms.
Transfers outside the EEA
Your data is stored in the EU: the app and database run in Dublin, and encrypted backups are kept in Frankfurt. Some providers process limited data outside the EEA (for example email delivery, payments, SMS and AI drafting in the United States). For each, we rely on the EU-US Data Privacy Framework, an adequacy decision or the EU Standard Contractual Clauses, with a transfer assessment. The sub-processors page lists the safeguard for each provider.
How long we keep it
| Data | How long |
|---|---|
| Account and audit content (answers, evidence, registers, documents) | While your organisation has an account, then 30 days |
| Closed accounts | 30 days after closing, then pseudonymised |
| Database backups | 35 days, rolling |
| Invoices, payments and VAT records | 6 years after the financial year, as Irish tax law requires |
| Audit log of security-relevant actions | 13 months online, then archived for 6 years |
| Application logs | 30 days |
| Expired sign-in sessions | Removed after 7 days |
| Ask the Lens conversations; AI prompt logs (off by default) | 30 days |
| Enquiries that did not become customers | 24 months after last contact |
| Marketing and cookie consent records | While the consent lasts, plus 3 years |
| Privacy request records | 3 years after the request closes |
| Certificate checks (date, result and a daily-changing network code) | 12 months |
Passports and verification records stay available for 6 years after they expire, because third parties rely on them.
Your rights
You can ask for a copy of your data, ask us to correct or delete it, restrict or object to how we use it, and ask for it in a portable format. You can withdraw consent at any time, as easily as you gave it.
- With an account: download your data, change your consents or delete your account yourself in Privacy & data.
- Without an account: use the privacy request form, or email privacy@auditglass.ie.
We reply within one month, and first confirm it is you. If your data is held by a club or business that uses AuditGlass, that organisation decides; we pass your request to them and help them answer.
Complaints
If you are unhappy with how we handle your data, please tell us first. You can also complain to the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28 (dataprotection.ie). In the UK, contact the Information Commissioner’s Office (ico.org.uk).
Questions about this page? Email hello@auditglass.ie.
