Privacy policy

This policy explains how WIT Software Development Ltd. ("boreen", "we", "us") handles personal data when you visit boreen.io, when your business uses the boreen platform, and when you book or use a tour, course or event offered through boreen.

1. Who is responsible

For the boreen.io website and for the accounts of businesses using boreen, the controller is WIT Software Development Ltd., Ballard, Ballinaclash, Co. Wicklow, A67 WK53, Ireland, company number 562044. You can contact us about privacy at info@boreen.io.

When you book, buy or use a product of a business that sells through boreen (for example a walking tour, an online course or an event), that business is the controller of your personal data, and boreen processes it on its behalf as a processor. For questions about those bookings, or to exercise your rights, please contact the business first. We will help them answer your request.

2. What we collect and why

Visitors of boreen.io

• Our hosting provider keeps technical server logs, such as IP address, browser and the pages requested, to run and secure the website (legitimate interest).
• If you email us, we use your message and contact details to answer you (legitimate interest).
• The website does not use analytics, advertising or tracking cookies.

Businesses using boreen

• Account data: names and email addresses of the people with access to the backoffice, and company details such as name, address and VAT number. We use this to provide the platform and to communicate with you (performance of contract).
• Billing data: invoices and payment details, which we keep to meet our tax and accounting obligations (legal obligation).
• Support emails and messages, to help you (performance of contract).

End customers of those businesses (boreen as processor)

• Booking and order details: name, email address, phone number and, where the business asks for them, address details and answers to its checkout questions.
• Payments: payments are handled by Stripe or Mollie. We receive the payment status and reference, but never your full card or bank details.
• Online courses: your email address for logging in with a one-time code, your progress, and the answers and files you submit, which the course provider can see.
• Digital tours: when you open a tour we record a visit with its time, the tour, the order, your IP address, your browser and an approximate country and city derived from the IP address. The business uses this to see how its tours are used. If you allow location access, your GPS position is used on your device to show where you are and what is nearby; it is not sent to or stored by boreen.
• Favourites, offline content and similar settings in the tour app are stored on your own device.

3. Cookies and local storage

The boreen.io website doesn't set cookies. The platform uses only cookies and local storage that are needed for it to work: to keep you logged in, to remember your cookie choice, and to store tour content and settings on your device for offline use. We don't use them for advertising or tracking.

4. Who we share data with

We don't sell personal data. We share it only with the business you booked with, with authorities where the law requires it, and with the service providers (sub-processors) below, who process it on our instructions:

Where a provider processes data outside the European Economic Area, this happens on the basis of an adequacy decision such as the EU-US Data Privacy Framework, or the European Commission's standard contractual clauses.

5. How long we keep data

• Account and Content data: for as long as the business uses boreen, and up to 30 days after the subscription ends.
• Booking and order data: for as long as the business uses boreen, unless it deletes the data earlier.
• Invoices and accounting records: 6 years, as required by Irish law.
• Emails to us: as long as needed to handle your question, and no longer than 2 years.

6. Security

We protect personal data with encrypted connections (HTTPS), access control, separated customer data and regular backups, and we give access only to people who need it.

7. Your rights

Under the GDPR you have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. To exercise these rights, email info@boreen.io. If your data was collected by a business that sells through boreen, please contact that business; we will support them.

You also have the right to complain to the Irish Data Protection Commission (dataprotection.ie) or to the data protection authority in your own country.

8. Changes to this policy

We may update this policy when our services or the law change. The date at the top shows when it was last updated. Businesses using boreen will be informed of significant changes by email. Our terms and conditions contain the data processing terms that apply between boreen and those businesses.