Privacy Notice
This notice explains how personal data is processed when you visit appointdpo.com or make an enquiry through this website. We have tried to write it the way we would advise our clients to write theirs: plainly, completely, and without padding.
1. Who we are
Sovy Trust Solutions Limited, a company registered in Ireland (CRO no. 610835) with its registered office at St Gall's House, St Gall Gardens South, Milltown, Dublin 14, D14 Y882, is the data controller for personal data processed through this website.
Contact: contact@appointdpo.com
2. When we act as your Data Protection Officer
Most of this notice covers data we process to run this website and respond to enquiries, where Sovy Trust Solutions Limited is the controller. When an organisation appoints us as its Data Protection Officer, matters are different: data subjects of that organisation may contact us directly under Article 38(4) GDPR. When they do, we act in the DPO role for that organisation — we log the contact, treat it with the confidentiality Article 38(5) requires, and handle it under our engagement with that organisation, whose own privacy notice governs its processing.
If you are contacting us as the DPO of an organisation, write to dpo@appointdpo.com so your message enters our logged DPO channel rather than general correspondence.
3. What we collect and why
Enquiry form
When you submit the contact form, we process the information you provide: your name, email address, organisation name, the jurisdiction you selected, and anything you write in the message field.
| Purpose | Legal basis |
|---|---|
| Responding to your enquiry and preparing a proposal | Steps at your request prior to entering into a contract — Article 6(1)(b) GDPR |
| Recording the enquiry in our client relationship system and following up | Legitimate interests — Article 6(1)(f) GDPR: operating and developing our professional practice |
Providing this information is not a statutory or contractual requirement, but we cannot respond to an enquiry we have not received.
Technical data
Our hosting provider processes standard server logs (IP address, browser type, pages requested, timestamps) for the purposes of operating, securing, and debugging the website. Legal basis: legitimate interests — Article 6(1)(f) GDPR.
4. Where your data goes
We use a small number of service providers (processors) to operate this website and handle enquiries. We describe them by category rather than by name, so that this notice stays accurate when a supplier changes:
| Category | What they do for us | Where data is processed |
|---|---|---|
| Website hosting & serverless functions | Hosts this site and processes form submissions | EU/USA (SCCs) |
| Transactional email | Delivers enquiry confirmations and our replies | EU region (Ireland) |
| Customer relationship management | Holds enquiry records so we can respond and follow up, reached via our own Sovy platform | EU (Ireland) |
| Business productivity & mailbox | Our email and document systems | EU |
A current list of the specific providers in each category is available on request at contact@appointdpo.com.
We do not sell personal data, and we do not share it with third parties for their own marketing purposes.
5. How long we keep your information
| Type | How long | Why |
|---|---|---|
| General enquiries that do not become an engagement | 24 months from last contact | To respond if you come back to us |
| DPO engagement records, including the log of data-subject contacts received in the DPO role | Duration of the engagement, then 7 years | Evidence the DPO function was performed |
| Invoices and payment records | 6 years from end of accounting period | Irish tax and company law |
| Server and security logs | Retained by our hosting provider for up to 12 months | Security and abuse investigation |
When a period expires we delete or anonymise. Records under legal hold are kept until the matter resolves, and no longer.
6. How we protect your information
We implement ISO 27001 and GDPR programmes for a living and hold ourselves to the same controls: access on a need-to-know basis with multi-factor authentication, encryption in transit and at rest, supplier due diligence, and a documented incident procedure. If a breach affecting your data meets the threshold, we notify the Data Protection Commission within 72 hours of becoming aware and tell affected people where the risk to them is high.
7. Children
Our services are provided to organisations, and this website is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
8. Automated decision-making
We make no decisions about you by automated means that produce legal or similarly significant effects. A person reads every enquiry.
9. Your rights
Under the GDPR you have the right to access your personal data, to rectification, to erasure, to restriction of processing, to data portability, and to object to processing based on legitimate interests. To exercise any of these rights, email contact@appointdpo.com. We respond within one month.
You also have the right to lodge a complaint with a supervisory authority. Our lead authority is the Data Protection Commission (Ireland) — dataprotection.ie — but you may complain to the authority in your own member state.
10. International visitors
If you contact us from outside the EU/EEA, your data is processed in the EU as described above. If you are in the UK, the equivalent rights under the UK GDPR apply, and the Information Commissioner's Office is your supervisory authority.
11. Changes to this notice
We version this notice and show the date at the top. When a change affects your rights or how we use your data, we say what changed rather than quietly reissuing the page. Previous versions are available on request.
Version 2.0 — 20 August 2026. Added DPO-role, children, automated decision-making, security, retention and contact sections; sub-processors moved to categories; fonts self-hosted.
12. Contact
| If… | Contact |
|---|---|
| You are a data subject contacting the DPO of an organisation we serve | dpo@appointdpo.com |
| You have a privacy question about this website, or want to exercise your rights | contact@appointdpo.com |
| You would rather write to us | Sovy Trust Solutions Limited, St Gall's House, St Gall Gardens South, Milltown, Dublin 14, D14 Y882, Ireland |