Last updated: September 2026
Our Commitment
Sienna Spire is fully committed to complying with the General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018. We recognise that our clients entrust us with sensitive information, and we take our responsibilities as a data controller seriously.
Data Controller Information
Sienna Spire acts as the data controller for personal information collected through this website and in the course of providing our services.
Contact details:
Sienna Spire
42 Fitzwilliam Square
Dublin 2, D02 PX94
Ireland
Lawful Basis for Processing
We process personal data under the following lawful bases as defined by Article 6 of the GDPR:
Consent (Article 6(1)(a))
Where you have given explicit consent for us to process your data for specific purposes, such as receiving marketing communications or allowing us to contact you about our services.
Contract Performance (Article 6(1)(b))
Where processing is necessary to perform a contract with you or to take steps at your request prior to entering into a contract. This includes processing enquiries and delivering our design services.
Legal Obligation (Article 6(1)(c))
Where we are required to process data to comply with legal requirements, such as tax and accounting obligations.
Legitimate Interests (Article 6(1)(f))
Where processing is necessary for our legitimate business interests, such as improving our services, website analytics, and fraud prevention, provided these interests do not override your fundamental rights.
Your Rights Under GDPR
The GDPR provides you with specific rights regarding your personal data:
Right of Access (Article 15)
You have the right to request confirmation of whether we process your personal data and, if so, to access that data along with certain supplementary information.
Right to Rectification (Article 16)
You have the right to have inaccurate personal data corrected and incomplete data completed.
Right to Erasure (Article 17)
Also known as the "right to be forgotten", you may request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for its original purpose.
Right to Restrict Processing (Article 18)
You may request that we limit how we use your data in certain situations, such as when you contest the accuracy of the data or object to our processing.
Right to Data Portability (Article 20)
You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller.
Right to Object (Article 21)
You have the right to object to processing based on legitimate interests or for direct marketing purposes.
Rights Related to Automated Decision-Making (Article 22)
You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently use automated decision-making.
Exercising Your Rights
To exercise any of your rights under GDPR, please contact us using the details above. We will respond to your request within one month, though this period may be extended by two further months for complex requests.
We may need to verify your identity before processing your request. There is no fee for exercising your rights, though we may charge a reasonable fee for manifestly unfounded or excessive requests.
Data Protection Measures
We implement comprehensive technical and organisational measures to protect personal data, including:
- Encryption of personal data during transmission and storage
- Strict access controls based on the principle of least privilege
- Regular security assessments and vulnerability testing
- Staff training on data protection principles and practices
- Incident response procedures for data breaches
- Regular review of data processing activities
Data Breach Notification
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to your rights, we will also notify you directly.
International Data Transfers
We primarily store and process data within the European Economic Area. Any transfer of data outside the EEA will only occur where adequate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.
Data Protection Officer
Given the scale and nature of our processing activities, we have not appointed a Data Protection Officer. However, enquiries regarding data protection can be directed to our management at the contact details provided above.
Complaints
If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Data Protection Commission:
Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, D02 RD28
Ireland
Website: dataprotection.ie
Updates to This Information
We may update this GDPR compliance information from time to time to reflect changes in our practices or legal requirements. Significant changes will be communicated through our website.