Privacy Policy

1. Data Controller

Ataraxium Limited, Dublin, Ireland. Contact: privacy@ataraxium.ai

2. Data We Collect

• Website analytics (anonymous, via Plausible/self-hosted)
• Contact form submissions (name, email, message)
• Audit order data (website URL, business details, billing info)
• Payment data (processed by Stripe/Revolut - we don't store card details)

3. Legal Basis (GDPR Art. 6)

• Contract performance (Art. 6(1)(b)) - delivering audits
• Legitimate interest (Art. 6(1)(f)) - analytics, security
• Consent (Art. 6(1)(a)) - marketing emails (opt-in only)
• Legal obligation (Art. 6(1)(c)) - tax records

4. Data Sharing

We share data only with:

• Stripe/Revolut (payment processing)
• Email provider (Transactional emails only)
• Legal authorities when required by law

We do NOT sell data. No third-party advertisers.

5. Retention

• Audit data: 2 years (contractual)
• Billing records: 6 years (Irish tax law)
• Analytics: 13 months (anonymized)
• Contact forms: 30 days

6. Your Rights (GDPR)

• Access, rectification, erasure, restriction, portability
• Object to processing
• Withdraw consent anytime
• Complain to DPC (Irish Data Protection Commission)

Exercise rights: privacy@ataraxium.ai

7. International Transfers

Data processed in EU (Ireland). Stripe/Revolut use Standard Contractual Clauses for any US subprocessors.

8. Security

TLS 1.3, encrypted at rest, least-privilege access, regular audits.