Privacy Notice

O'Connor Law takes its responsibilities under applicable data protection law, including the General Data Protection Regulation (EU) 2016/679 and implementing legislation (Data Protection Law) very seriously. The purpose of this notice is to inform you of the data relating to you that we may collect and use and the uses (including disclosures to third parties) we may make of your data, which includes the provision of legal advice. O'Connor Law is the controller in respect of the data we collect and we take all reasonable steps to ensure the safety and privacy of all information and, where appropriate, enter into contracts with any third party processors to protect the privacy of any personal data processed by us.

1. What information do we collect

We collect personal data that you voluntarily provide to us, for example when you communicate with us via email or contact us over the phone or when we meet you on Teams for example. Such data may include:

• your name, job title and name of employer and any personal data you send to us to provide you with legal services;
• your contact details, including your home address (where you have provided this to us), business address, email address and telephone number;
• the name of your spouse or partner (in limited circumstances);
• on occasions where public health concerns warrant it, and you are visiting our offices, information about your exposure to particular diseases and viruses; and
• information relating to particular areas that may be of interest to you.

If we are in regular contact with you we may collect more information about our relationship with you.

2. Purpose of processing and legal bases

Your personal data is used by us and by third party service providers acting on our behalf for the following purposes:

• 2.1 providing you with legal advice;
• 2.2 for administration and billing purposes and for other purposes which are reasonably incidental to the services being provided;
• 2.3 sending or providing you with access to legal and regulatory information, and invitations to events.
• 2.4 maintaining our list of contacts; and
• 2.5 safeguarding the health and safety of our personnel, visitors to our offices and of attendees at events hosted or organised by us.

The legal bases on which we collect, process and transfer your information in the manner described above are:

(a) For 2.1 and 2.2

• your consent (where we have sought it and you have provided it to us), and in which case, you can withdraw your consent at any time;
• where any such processing is necessary for the performance of a contract with us; and
• our legitimate interests in conducting our business in a responsible and commercially prudent manner.

(b) For 2.3 and 2.4

• Our legitimate interest in maintaining a business relationship and communicating with you, as a business contact, about our events and providing you with information about new legal developments.

(c) For 2.5

• your consent to our use of your health data for the purposes described above.

3. Sources of data

As well as collecting information from you or other professional services advisors, in some cases your personal data has been supplemented by information obtained from publicly available sources, including LinkedIn and your employer's website, for the purpose of confirming your current professional position.

4. Sharing your data

We may disclose your personal data to third party recipients acting on your or our behalf, for the purposes of providing legal advice to you and for providing you with information which we believe you may be interested in.

5. Retention

We retain personal data for as long as is necessary to fulfil the purpose for which it was collected and to meet our legal and regulatory obligations. Minimum retention periods by file type are as follows:

Enquiries and contact details submitted through our website (via the contact form or the AI assistant) are held in our online form service for as long as they are needed to deal with your enquiry. If your matter proceeds and the information becomes part of a client file, the retention periods above apply. You can ask us to erase your enquiry at any time — see section 9.

6. Security measures to keep your personal data safe

We employ appropriate technical and organisational security measures to help protect your personal data against loss and to guard against access by unauthorised persons. We carry out risk assessments on all third party service providers to make sure the personal data they hold is secure. We regularly review our security policies and procedures to ensure our systems are secure and protected.

7. Necessity of provision of certain information and consequences

You may be required to provide us with certain information in order for us to verify your identity and carry out anti-money laundering or other checks which are required by law. This information consists of identification and verification documentation for individuals. If you do not provide us with such information, we will be unable to provide you with legal services. Apart from the details mentioned above, you are not under a statutory or contractual duty to provide us with any personal data. However, there are some pieces of information that you must provide to us so that we can provide you with our legal services. We will notify you of any such required information. If you do not provide us with this information, we may not be in a position to provide our legal services to you.

8. Transfers abroad

Where relevant and necessary for the firm's business including our representation of you, we may transfer your personal data outside the European Economic Area, including to a jurisdiction which is not recognised by the European Commission as providing for an equivalent level of protection for personal data as is provided for in the European Union. If and to the extent that we do so, we will ensure that appropriate measures are in place to comply with our obligations under applicable law governing such transfers, which may include (i) entering into a contract governing the transfer which contains the 'standard contractual clauses' approved for this purpose by the European Commission or (ii) seeking and obtaining your explicit consent to the transfer or (iii) where the transfer is necessary for the establishment, exercise or defence of legal claims.

9. Your rights and how to update your information

You have the following rights, in certain circumstances and subject to certain restrictions, in relation to your personal data:

• 9.1 the right to be provided with a copy of your personal data;
• 9.2 the right to request the rectification and/or erasure of your personal data;
• 9.3 the right to restrict the use of your personal data;
• 9.4 the right to object to the processing of your personal data, where we are processing it based on this being necessary for the purposes of our or of a third party's, legitimate interests; and
• 9.5 the right to receive your personal data, which you have provided to us, in a structured, commonly used and machine-readable format or to require us to transmit that data to another controller, where we are processing the data based on your consent or that this is necessary for the performance of a contract with you.

In order to exercise any of the rights set out above, or if you have any questions about how we process your personal data, you can email us at info@oconnorlaw.ie or write to us. Please note that the limitation or deletion of your personal data may mean that we will be unable to provide you with the communications described above.

We are required to keep all personal data accurate and up to date. To assist us in doing so, we ask you to contact your usual business contact at O'Connor Law or email info@oconnorlaw.ie with any relevant changes, such as change of address or contact telephone numbers.

10. Complaints

We take a high level of care in how your personal data is handled to ensure that it is safeguarded and our legal obligations are met. If you are not happy with the way we have used your information or addressed your rights, you may contact us at info@oconnorlaw.ie. You also have the right to make a complaint to the Irish Data Protection Commission by emailing info@dataprotection.ie.

11. Our website and the service providers we use

When you visit our website, our hosting provider automatically collects limited technical data about your visit: your IP address, your browser type and version, your device and operating system, the pages you request, and the date and time of each request. This is used only to deliver the site, keep it secure and diagnose faults, and it is held for a short period. We do not use website analytics, advertising trackers, or profiling of any kind.

Separately, we receive whatever details you choose to send us through our contact form or our AI assistant.

Our legal basis for this. Where you send us details through our contact form or our AI assistant, we process them on the basis of your consent, which you give by ticking the consent box on the form, or by accepting the notice shown before you start a chat. You can withdraw your consent at any time by emailing info@oconnorlaw.ie; withdrawing it does not affect anything we did before you withdrew. The limited technical data described above is processed on the basis of our legitimate interest in keeping this website secure and working correctly.

We use the following service providers to operate this website. Each is engaged under a written data-processing agreement and is permitted to process your data only on our instructions:

• Website hosting — our website is delivered by Vercel Inc., which serves the pages to your browser and runs the server function behind our AI assistant. That function is configured to run in Vercel's Dublin region, and your messages to the AI assistant pass through it. Vercel is a company established in the United States, and under its data-processing agreement it may process data in the United States and in other locations where it operates. It does so under the European Commission's Standard Contractual Clauses.
• Contact form and enquiry details — the details you submit through our contact form, or through the AI assistant's “Leave my details for Donal” option, are sent from your browser to Formspark, the online form service we use to receive website enquiries. Your enquiry itself — your name, your contact details and what you tell us about your matter — is stored on servers in Ireland, inside the European Economic Area, and the email notifying us of your enquiry is also sent from within the European Economic Area. Your IP address is separately processed on servers in Germany, also inside the European Economic Area, for the single purpose of working out an approximate location for the submission. Submissions to this form are not screened by any external spam-filtering service, so the content of your enquiry is not sent to any third country for that purpose. In limited circumstances the service's technical fault reports, which may contain limited information about a failed submission, are handled by an error-monitoring provider in the United States. That provider is certified under the EU–US Data Privacy Framework, which the European Commission has formally recognised as providing an adequate level of protection.
• AI assistant — the messages you send to our AI assistant “Aoife” are passed by our hosting provider to Amazon Web Services and processed within the European Union — see section 12.

What these safeguards mean. Where personal data is sent outside the European Economic Area, European law requires a specific legal safeguard to be in place. Two apply here. The Standard Contractual Clauses are a standard set of data-protection contract terms approved by the European Commission which the provider signs; under them the provider must give your data the standard of protection required by European law, and you have rights you can enforce against that provider directly. The EU–US Data Privacy Framework is a decision by the European Commission that certified United States organisations provide an adequate level of protection, so no further contractual safeguard is needed for a transfer to a certified organisation. You can ask us for more detail about either safeguard, or for a copy of the relevant clauses, by emailing info@oconnorlaw.ie.

12. Our AI assistant (“Aoife”)

Our website offers an AI assistant called “Aoife” that can answer general questions about O'Connor Law and Irish law, and, if you choose, pass your contact details to the firm.

• Aoife is an AI assistant, not a solicitor, and does not provide legal advice. Using it does not make you a client of the firm.
• You are asked to accept a short notice before you use Aoife, and we ask you not to enter personal information or the confidential details of your legal matter into the chat.
• Messages you send are passed to Amazon Web Services and processed by a language model within the European Union, solely to generate a reply. Amazon Web Services does not store your messages, and the company that developed the underlying language model does not receive them. They are not used to train any AI model.
• We do not keep a record of your conversation. It is held only in your own browser while you are on this site, and is cleared when you reload the page or close the tab. The most recent messages are sent with each reply so that the assistant can follow the thread.
• Donal does not see your chat. Only the details you choose to submit through the “Leave my details for Donal” option — which requires your explicit consent — are sent to and retained by the firm.
• Under the EU Artificial Intelligence Act, Aoife is a limited-risk system, and we make clear to you that you are interacting with an AI assistant.