GDPR Compliance

Our Commitment to Data Protection

verdantthorn is committed to protecting the privacy and security of personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Irish data protection legislation. This document outlines how we comply with GDPR requirements and explains your rights as a data subject.

Data Controller Information

verdantthorn Investment Advisory acts as the data controller for personal information collected through our website and business operations.

Contact details:
verdantthorn Investment Advisory
42 Merrion Square East
Dublin 2, D02 XW84
Ireland
Email: [email protected]

Legal Basis for Data Processing

We process personal data only when we have a valid legal basis under GDPR Article 6:

Consent (Article 6(1)(a))

When you submit inquiry forms or accept cookies, you provide explicit consent for us to process your personal information for specified purposes. You may withdraw consent at any time.

Contract Performance (Article 6(1)(b))

Processing is necessary to fulfill advisory service agreements and respond to engagement requests.

Legal Obligations (Article 6(1)(c))

We process data to comply with financial services regulations, tax obligations, and other legal requirements applicable to investment advisory businesses.

Legitimate Interests (Article 6(1)(f))

We process data for legitimate business interests, including website operation, service improvement, fraud prevention, and business development, provided these interests do not override your fundamental rights and freedoms.

Your Rights Under GDPR

As a data subject, you have the following rights:

Right of Access (Article 15)

You have the right to obtain confirmation whether we process your personal data and, if so, to receive a copy of that data along with information about how it is processed.

Right to Rectification (Article 16)

You may request correction of inaccurate personal data and completion of incomplete data.

Right to Erasure (Article 17)

You may request deletion of your personal data when processing is no longer necessary, consent is withdrawn, or data has been unlawfully processed. This right is subject to legal retention requirements applicable to financial services firms.

Right to Restriction of Processing (Article 18)

You may request that we restrict processing of your personal data in specific circumstances, such as when accuracy is contested or processing is unlawful.

Right to Data Portability (Article 20)

You have the right to receive personal data you provided to us in a structured, commonly used, machine-readable format and to transmit that data to another controller.

Right to Object (Article 21)

You may object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision-Making (Article 22)

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects individuals.

Exercising Your Rights

To exercise any of these rights, submit a request to [email protected] with the following information:

• Your full name and contact information
• Description of the right you wish to exercise
• Specific information or action requested
• Verification information to confirm your identity

We will respond to valid requests within one month. If the request is complex or we receive multiple requests, we may extend this period by two months and will inform you of such extension.

Data Protection Measures

We implement appropriate technical and organizational measures to ensure data security, including:

• Encryption of data in transit and at rest
• Access controls and authentication mechanisms
• Regular security audits and vulnerability assessments
• Staff training on data protection principles
• Confidentiality agreements with employees and service providers
• Incident response procedures for data breaches

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours of becoming aware of the breach. If the breach poses a high risk, we will also communicate the breach to affected individuals without undue delay.

International Data Transfers

Our primary operations are based in Ireland within the European Economic Area. If we transfer personal data outside the EEA, we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by the European Commission
• Adequacy decisions recognizing equivalent data protection standards
• Binding corporate rules for transfers within corporate groups

Data Retention

We retain personal data only for as long as necessary to fulfill processing purposes or comply with legal obligations. Our retention periods are:

• Website inquiries: 24 months or until engagement completion
• Client engagement records: 7 years following engagement conclusion
• Financial records: 6 years as required by Irish tax law
• Marketing communications consent: Until withdrawn, reviewed every 3 years

Third-Party Service Providers

We engage third-party processors who may access personal data to provide services on our behalf. These processors are contractually bound to:

• Process data only according to our documented instructions
• Implement appropriate security measures
• Maintain confidentiality
• Assist with fulfilling data subject rights requests
• Delete or return data upon termination of services

Children's Data

Our services are not directed to children under 16 years of age. We do not knowingly process personal data of children. If we become aware of such processing, we will delete the data immediately.

Supervisory Authority

You have the right to lodge a complaint with a supervisory authority if you believe we have not complied with GDPR requirements. The relevant authority for Ireland is:

Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, D02 RD28
Ireland
Website: dataprotection.ie

Updates to This Information

We review and update our GDPR compliance documentation regularly to reflect changes in our practices, services, or legal requirements. Material changes will be communicated through website notice and, where appropriate, direct communication to affected individuals.

Contact for Data Protection Matters

For questions about our GDPR compliance, data protection practices, or to exercise your rights, contact us at [email protected] with "Data Protection Inquiry" in the subject line.