Privacy policy

1. Who we are

dodgybox.ie is an independent Irish website. For the purposes of the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, we are the data controller for the personal data described below. Contact: hello@dodgybox.ie.

2. What we collect and why

2.1 Installer quote requests

When you ask for quotes we collect your name, phone number, email address, county, Eircode (optional), job type, property type, timeframe and any notes you add. We also record the date and time, the page you submitted from, the version and exact wording of the consent you gave, and a shortened, one-way hash of your IP address used only to limit spam.

Purpose: to pass your request to up to three local installers so they can contact you with a quote, and to follow up if none of them does.

Legal basis: your consent (Article 6(1)(a) GDPR), given by ticking the box that reads: "I agree to dodgybox.ie passing my name, phone number, email address, location and job details to up to three local installers so they can contact me with a quote. I understand I can ask for my details to be deleted at any time."

2.2 Installer sign-ups

If you sign up as an installer we collect your business name, contact name, phone, email, website, counties covered, services offered, your confirmation that you hold public liability insurance, and any notes. Same time, page and IP-hash details as above.

Purpose: to vet you, contact you about leads, and send you leads if you are approved.

Legal basis: consent to the sign-up wording, and thereafter the performance of an agreement with you (Article 6(1)(b)).

2.3 Analytics

We use Google Analytics 4 to understand which pages help people. It sets cookies and sends usage data to Google, so it only runs if you accept it in the cookie banner. Your choice is remembered in your browser's local storage. See the cookie policy. Legal basis: consent (Regulation 5 of the ePrivacy Regulations 2011 and Article 6(1)(a) GDPR). Google Analytics 4 does not log or store full IP addresses. Google's data retention help (official source, opens in a new tab)

2.4 Email you send us

If you email us, we keep the email for as long as needed to deal with it. Legal basis: our legitimate interest in answering you (Article 6(1)(f)).

2.5 Affiliate links

When you click a link marked as an affiliate link, the merchant or its affiliate network may set cookies on their own site to attribute a purchase to us. We receive aggregated commission reports, not your personal data. Their own privacy policies apply once you leave our site.

3. Who we share it with

• Installers: up to three vetted installers covering your county receive your quote request. They become independent controllers of that data once they have it and must handle it under their own obligations. We keep a record of which installers received each request.
• Email delivery: form submissions are delivered to us by EmailJS, which acts as our processor. EmailJS says its servers are in the United States, run on Amazon Web Services. See EmailJS's privacy policy and data protection agreement.
• Hosting: the site is hosted on Cloudflare. Every request for a page, and every form submission, passes through Cloudflare's network, which handles your IP address in order to deliver the site and keep it secure. See Cloudflare's data processing addendum.
• Analytics: Google, only if you consent. Google Analytics then records page views and a small set of interactions, such as following a link to a service or building a plan. We never send Google anything you type into a form. The cookie policy has the detail.

We do not sell personal data. We do not share it with anyone else unless the law requires it.

4. International transfers

Some of our processors store data outside the European Economic Area, in the United States. EmailJS and Cloudflare rely on the European Commission's standard contractual clauses, as their own terms linked above set out. Google, only if you accept analytics, applies the safeguards set out in the data processing terms that come with Google Analytics.

5. How long we keep it

• Quote requests: 12 months from submission, then deleted.
• Installer sign-ups: 12 months if not approved; for approved installers, for as long as we work together plus 12 months.
• Analytics: per the retention setting on our Google Analytics property.
• Emails: as long as needed to deal with your query, normally no more than 12 months.

6. Your rights

You can ask us to: access the data we hold about you; correct it; delete it; restrict or object to how we use it; give it to you in a portable form; and withdraw consent at any time (which doesn't affect processing that already happened). To do any of these, email hello@dodgybox.ie from the address you used. We aim to respond within one month.

If you want your quote request deleted before an installer has contacted you, tell us as soon as possible. We will delete our copy and ask the installers to delete theirs, but once they have your details they are responsible for their own copy.

You can complain to the Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, using its online contact form. More at dataprotection.ie.

7. Security

Forms are submitted over HTTPS. We store as little as possible: in version one of the site there is no database; requests exist as emails in our mailbox and in the installers' mailboxes. We hash IP addresses rather than storing them.

8. Children

The site is not aimed at children and we do not knowingly collect data from anyone under 16.

9. Changes

We will update this page when anything changes and show the date at the top. Consent wording is versioned; the version you agreed to is stored with your request.