This notice explains how Irish Steel handles personal data across irishsteel.ie, the Irish Steel member app, member chat, training, events, certification, awards, payments and related services.
1. Who is responsible for your data
The data controller is I.A.S.F. Irish Association of Steel Fabricators Company Limited by Guarantee, company number 657873, trading as Irish Steel.
We process personal data under the General Data Protection Regulation (GDPR), the Data Protection Act 2018 and other applicable Irish and European data-protection and electronic-communications law.
Registered address
Unit 2, Zone 5Clonminam Industrial Estate
Portlaoise, Co. Laois
R32 W2RW
Ireland
Business and postal address
The Certification Hub, Unit 2, Zone 5Clonminam Business Park
Portlaoise, Co. Laois
R32 W2RW
Ireland
Privacy contact: hello@irishsteel.ie · +353 57 867 0629. Irish Steel has not appointed a statutory Data Protection Officer; privacy enquiries are handled through this monitored contact.
2. The information we collect
Depending on how you use Irish Steel services, we may process:
- Identity and account information: name, email address, user ID, authentication records, membership number, role and account status.
- Member and company profile information: employer or company, job title, phone number, business address, county or general location, biography, website, avatar, directory preferences, certifications and membership details.
- Applications and service records: membership applications, insurance or certification documents, bookings, attendance, training and event records, invoices, payments, support enquiries and consent records.
- Community content: direct and group messages, replies, reactions, read state, presence, voice messages, reports, blocks and other moderation information.
- Uploads and submitted content: profile images, photographs, video, audio, files, logos, brochures, nominations, project descriptions, voting records, survey answers and other form submissions.
- Device and technical information: IP address, browser or device type, operating system, security and audit events, app version, push-notification token, notification delivery state and diagnostic information.
- Website usage information: pages and features used, referrer and approximate location derived from IP address where analytics has been enabled through the cookie controls.
We receive information from you, your employer or member company, people who make a nomination or booking involving you, and the service providers described below. If somebody supplies your details to us, we use them only for the relevant Irish Steel purpose and provide notice where required.
3. Why we use it and our lawful bases
| Purpose | Typical information | Lawful basis |
|---|---|---|
| Assess applications and administer membership, accounts and member services | Identity, company, membership, certification and contact information | Contract or steps before a contract; legitimate interests in operating the association |
| Provide the website, app, directory, chat and member community | Account, profile, privacy settings, messages, uploads, reports and technical records | Contract; legitimate interests in delivering secure member communications; consent for optional features where requested |
| Run training, certification, events, awards, bookings and voting | Applications, bookings, attendance, nominations, files, votes and payment records | Contract; legitimate interests; legal obligations; consent where a genuinely optional use depends on it |
| Send service, community and push notifications | Contact details, push token, preferences and notification content | Contract and legitimate interests for service messages; consent for device notifications and direct marketing |
| Process payments, invoices and financial administration | Contact, booking, invoice, transaction and payment-status information | Contract and legal obligations |
| Protect users, investigate misuse and maintain service security | Audit, device, IP, moderation, report and access records | Legitimate interests and, where applicable, legal obligations |
| Understand and improve the public website | Consent-based Google Analytics information | Consent; analytics storage is off until enabled |
| Establish, exercise or defend legal claims and meet regulatory requirements | Relevant account, transaction, certification, communication and audit records | Legal obligation and legitimate interests |
4. Member directory and profile controls
Members choose whether their profile appears in the member directory and whether optional contact details are visible. Irish Steel administrators can see the information needed to administer membership, even where a field is hidden from other members. You can change directory, email, phone, messaging and notification preferences in the app or ask us to do so.
5. Chat, uploads and moderation
Irish Steel member chat is provided using Stream Chat. Stream processes member identifiers, profile details made available to chat, messages, reactions, read state, media, files, voice messages, reports and technical connection information. Chat data is stored in Stream's Ohio, United States region. Messages may be visible to the participants or members of the relevant group, and Irish Steel moderators can act on reported or community-group content where needed to enforce the rules or protect users.
Do not post confidential, unlawful or third-party material unless you are authorised to share it. Members can report content, mute conversations and block other members. Irish Steel may preserve and review relevant records while investigating a report, enforcing membership rules or meeting a legal obligation.
6. Push notifications
If you allow notifications, the app registers a device push token. Irish Steel sends notifications through Expo's push service and the relevant platform provider, such as Apple Push Notification service. The notification service processes the token, delivery information and the notification payload long enough to deliver it. You can change notification categories in the app and disable notifications in the device settings at any time.
7. Face ID and device permissions
The app can use Face ID, Touch ID or the Android device credential as a local privacy lock. The operating system performs that check. Irish Steel does not receive or store your face image, fingerprint or biometric template. Camera, photo-library and microphone access is requested only when you choose a feature that needs it, such as setting an avatar, sharing media or recording a voice message.
8. Payments
Website card payments are handled by Stripe. Irish Steel receives transaction identifiers, status, amount and related booking or account information, but does not receive or store the complete card number or card security code. The mobile app does not currently take payments.
9. Cookies and analytics
Necessary storage supports security, sign-in and saved privacy choices. Google Analytics is disabled until you enable analytics in the cookie controls. Advertising storage and cross-site advertising tracking are not enabled. You can reject analytics or change your choice at any time from Privacy Choices. More detail is available in the Cookie Policy.
The Irish Steel app does not track users across other companies' apps or websites and does not use member data for third-party advertising.
10. Who we share information with
We share only what is needed with:
- Stream.io, Inc. for member chat, media, realtime delivery and moderation tooling.
- Irish Steel's Supabase and Directus services for authentication, profiles, forms, bookings, preferences, app records and content management. These services are hosted for Irish Steel in the EEA.
- Hetzner and Cloudflare for hosting, network delivery, security and bot protection.
- Expo, Apple and Google where needed for mobile builds, updates, device push notifications and app distribution.
- Postmark for transactional and service email.
- Stripe for website payment processing.
- Google for consent-based website analytics, maps, and limited operational services such as authorised spreadsheets or file workflows.
- Sentry where configured for website error diagnosis and service reliability.
- Professional advisers, accreditation or certification bodies, insurers, auditors, regulators, courts or law-enforcement bodies where reasonably necessary or legally required.
We do not sell personal data or member contact lists. Other members see only information allowed by the relevant conversation, group and directory settings.
11. International transfers
Core Irish Steel website, account and content systems are hosted in the European Economic Area. Some providers process information outside the EEA: in particular, Stream chat uses its Ohio, United States storage region, while Expo, Apple, Google, Cloudflare, Postmark, Stripe and Sentry may process information through international infrastructure.
Where an adequacy decision does not apply, Irish Steel relies on appropriate contractual safeguards such as the European Commission's Standard Contractual Clauses, together with supplier data-processing terms and relevant technical and organisational measures. You may ask us for more information about the safeguard used for a particular service.
12. How long we keep information
| Record | Retention approach |
|---|---|
| Account, profile and preferences | For the active membership/account and until deletion or no longer needed for membership administration. |
| Chat content and uploads | While the conversation and account are active, unless deleted sooner. Permanent account deletion prunes the Stream profile and hard-deletes that user's Stream messages; shared channel structures and other members' content remain. |
| Reports, blocks and security records | For as long as needed to protect members, investigate the issue, enforce rules, demonstrate the outcome or meet legal requirements. |
| Bookings, invoices and payments | For the service relationship and the periods required by tax, accounting, company and claims law. |
| Certification and inspection records | For the applicable certification or accreditation period; some records are retained for at least ten years where the relevant scheme requires it. |
| Awards, member, partner and sponsor material | For the relevant programme and, where appropriate, as part of Irish Steel's published archive, subject to the supplied rights, privacy choices and valid removal requests. |
| Unsuccessful applications and general enquiries | Until the process or enquiry is complete and for a reasonable period needed for follow-up, consistency and legal claims. |
| Marketing preferences | Until consent is withdrawn or an objection is recorded; a minimal suppression record may be retained to honour the request. |
We may retain less information, aggregate it, or anonymise it when identifiable data is no longer needed.
13. Account deletion
You can permanently delete your app account from Profile → Account & Privacy → Delete account. The flow verifies the signed-in account before deletion. It removes the authentication account and avatar, prunes the Stream user and hard-deletes that user's Stream messages. Irish Steel also scrubs retired-message previews and disconnects retained business or audit records from the deleted profile where designed to do so.
Records that must remain for accounting, certification, legal claims, fraud prevention or other legal reasons may be retained with access restricted or the account link removed. Deleting the app account does not by itself cancel an organisation's Irish Steel membership, an unpaid invoice, a booking or a certification obligation. Contact us separately if any of those need to change.
14. Your data-protection rights
Subject to the circumstances and applicable law, you may ask us to:
- give you access to your personal data;
- correct inaccurate or incomplete information;
- erase information;
- restrict how information is used;
- provide portable data that you supplied;
- stop direct marketing or object to processing based on legitimate interests; and
- withdraw consent without affecting processing that was lawful before withdrawal.
Email hello@irishsteel.ie. We may need to verify your identity and clarify the request. Rights can be limited where another person's rights, legal privilege, a statutory retention duty or another lawful exemption applies.
You may also complain to Ireland's Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland, telephone 01 765 0100 or 1800 437 737. We would appreciate the opportunity to address the issue first.
15. Children
Irish Steel membership services and the app are intended for approved professional members, not children. We do not knowingly offer app accounts to children. Contact us if you believe a child has supplied personal data outside an appropriate training, event or employment context.
16. Security and changes to this notice
Irish Steel uses access controls, encrypted connections, authentication, rate limits, audit records, backups and supplier safeguards appropriate to the service. No online service can promise absolute security. Please use a strong unique password and report suspected misuse promptly.
We will update this notice when our services or legal obligations change. Material changes will be highlighted on the website or communicated through the service where appropriate. The effective date at the top shows the current version.
