Legal
Privacy policy
We collect only what we need to answer you, work with your dealership and run this website. We never sell personal data. You can ask what we hold, and have it corrected or deleted, at any time.
1. Who we are
Z2GROWTH is a marketing business built for car dealerships in Ireland. It is a registered business name of Denis Mc Carthy, a sole trader. Denis is the data controller for the personal data in this policy, which means he decides how and why it's used.
- Location: Limerick, Ireland
- Email: denis@z2growth.com
- Phone: 083 846 3856
A business our size doesn't need a Data Protection Officer. For anything about your data, email us and Denis will reply personally, normally within a few working days.
This policy covers our website, z2growth.com, our social media pages, how we contact dealerships, and the photos and video we produce.
2. What we collect and where it comes from
We don't collect sensitive data such as health information.
| Who you are | What we collect | Where it comes from |
|---|---|---|
| Website visitor | Device and browser type, pages viewed, how you found the site, approximate location (country or city, from your IP address) | Your browser, through Squarespace. Anything non-essential only with your consent |
| Someone who contacts us | Name, dealership, job title, phone, email and whatever you write in your message | You, through the booking form, email, phone, WhatsApp, social media messages or in person |
| Dealership contact we'd like to work with | Name, job title, dealership, business email and phone, and notes of our conversations | Public sources such as the dealership's website, DoneDeal dealer page, LinkedIn and Google Business Profile; introductions from people who know you; and you, when we meet |
| Client contact | Name, job title, business contact details, agreements, invoices, payment records and our correspondence | You and your dealership |
| Dealership staff in our photos or video | Your image, voice, and your name if it's used on screen | Filming at the dealership, with your agreement (see section 8) |
| Follower or commenter on our social media | Your public profile name, comments, messages and the statistics the platform gives us | You and the platform (Instagram, Facebook, TikTok, LinkedIn) |
Registration plates can appear in photos of a dealer's stock. These belong to the dealership's stock, not a private person, and we don't use them to identify anyone.
3. Why we use it and our legal basis
Every use has a legal basis under the GDPR. Where that basis is our legitimate interests, we've weighed them against your privacy, and you can object (see section 7).
| What we do | Legal basis |
|---|---|
| Reply to your enquiry and arrange a call or meeting | Legitimate interests in answering people who contact us, and steps you've asked for before a contract |
| Contact dealerships about our services by visit, phone, email or LinkedIn, and keep notes of those conversations | Legitimate interests in offering a relevant business service to dealerships, using business contact details only. Every email includes a way to opt out, and we stop as soon as you ask |
| Provide our services, manage the agreement, invoice and get paid | Performance of a contract with your dealership, and legitimate interests in dealing with its staff |
| Keep accounting and tax records | Legal obligation (Revenue record-keeping rules) |
| Film and photograph dealership staff, and publish that content for the dealership | Consent of the staff member, collected with the dealership and recorded by us (see section 8) |
| Show our work in our portfolio, case studies and social media | Written consent of the dealership, and consent of any staff member shown |
| Set analytics cookies and measure website visits | Consent, through our cookie banner |
| Protect the booking form from spam | Legitimate interests in keeping the site secure |
| Send a newsletter, if we start one | Consent, which you can withdraw at any time |
| Reply to comments and messages on our social media | Legitimate interests in engaging with people who contact us there |
| Protect our legal rights, for example in a dispute about an agreement | Legitimate interests, and legal obligation where it applies |
We don't use automated decision-making or profiling that has legal or similarly significant effects on you.
6. How long we keep it
We keep personal data only as long as we need it, then delete it or make it anonymous.
| Data | How long |
|---|---|
| Enquiries that don't lead to work | 12 months from our last contact |
| Notes on dealerships we've contacted but don't work with | 24 months from our last contact, or straight away if you ask us to stop contacting you. We keep a short do-not-contact note so we don't contact you again |
| Agreements, invoices and accounting records | 6 years after the end of the tax year they relate to, as Revenue requires |
| Client correspondence and project files | 6 years after our work ends, in case of a dispute |
| Raw footage and photos for a client | 12 months after delivery, unless the client asks us to keep or delete them sooner |
| Portfolio and case study content | Until the dealership or the staff member withdraws consent. We then remove it from our website and accounts within 30 days |
| Website analytics | Up to 2 years, as set by Squarespace |
| Your cookie choice | 30 days, then the banner asks again |
7. Your rights
Email denis@z2growth.com to use any of these rights. We'll reply within one month and won't charge you. We may need to confirm who you are first.
- Access: get a copy of the personal data we hold about you.
- Correction: have anything inaccurate or incomplete fixed.
- Erasure: have your data deleted where we no longer have a good reason to keep it.
- Restriction: ask us to pause using your data while a question about it is sorted out.
- Objection: object to any use based on our legitimate interests. If you object to marketing, including our emails to dealerships, we'll stop straight away.
- Portability: get data you gave us in a common electronic format, where we use it on the basis of consent or a contract.
- Withdraw consent: where we rely on your consent, withdraw it at any time. This doesn't affect what we did before.
Complaints
We'd like the chance to fix any concern first. You also have the right to complain to the Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, online at forms.dataprotection.ie/contact or through dataprotection.ie.
8. Client work: photos, video and staff
When we film or photograph for a dealership, the dealership decides how its content is used, and nobody appears on camera without agreeing to it.
- Staff on camera. Before we film a staff member, the dealership confirms that person has agreed, and we keep a simple signed record. Anyone can change their mind. We'll stop using new footage of them, and the dealership decides what happens to content already published, including when someone leaves.
- Customers. We don't film a dealership's customers, for example at a handover, unless the customer has agreed first.
- Who controls what. For content we make for a dealership's own listings and social accounts, the dealership is the controller and we act as its processor under our agreement. The dealership's own privacy notice applies to that content.
- Our portfolio. We show client work on our website and social media only with the dealership's written permission and the agreement of any staff member who appears.
- Dealership customer data. If a dealership asks us to handle its customers' details, for example to send review requests, we'll only do it under a written data processing agreement and only on the dealership's instructions.
9. Security, children and changes
Security. We use two-step verification on our email, website and social media accounts, keep files in password-protected cloud storage, and encrypt portable drives. Only Denis, and freelancers working on a specific job, can access client files. If a data breach puts your rights at risk, we'll tell the Data Protection Commission within 72 hours and tell you without undue delay where the law requires it.
Children. Our services are for businesses. We don't knowingly collect data from anyone under 18.
Other websites. Our site links to other sites, such as DoneDeal and WhatsApp. Their own privacy policies apply there.
Changes. We'll update this policy when the way we use data changes, and show the new date at the top. If a change is significant, we'll tell clients directly.