Privacy Policy
Last updated: 20 March 2026
1. Who We Are
Obscurity Ltd is an analytics governance consultancy based in Dublin, Ireland. We help regulated organisations govern analytics and marketing tracking so measurement stays reliable and audit-ready. Obscurity Ltd is not required to designate a Data Protection Officer under Article 37 GDPR. For data protection queries, contact contact@obscurity.ie.
- Company Registration No: 622475
- Email: contact@obscurity.ie
2. What Data We Collect
We collect minimal data on this website. Visitors who decline consent experience no analytics tracking. Strictly necessary cookies (such as the CookieConsent preference cookie) may be set without consent as permitted under the ePrivacy Directive, as they are required for the website to function.
When consent is granted:
Consent is managed via Cookiebot CMP (Cybot, Denmark), which is IAB TCF 2.2 certified. When a visitor grants consent:
- Google Tag Manager (GTM) loads in the browser and activates analytics tags.
- Page views and navigation data are collected by Google Analytics 4 (GA4) via client-side JavaScript.
- GA4 applies automatic IP anonymisation. No raw IP addresses are stored by Google Analytics.
- GTM loads with all consent signals denied by default. Analytics tags within GTM only activate after consent is granted via Cookiebot.
Google Calendar:
If you book an appointment, your name and email are processed by Google Workspace. Google Ireland Ltd is the data controller for EEA users.
Free Governance Scanner:
If you use our free governance scanner, we collect your email address to deliver the scan results. If you opt in to marketing communications via the scanner form, we may also send analytics governance insights and service updates. This data is processed on the basis of consent (you submit the form voluntarily; marketing communications require separate opt-in). Email addresses collected via the scanner are retained for 12 months and then deleted. Scanner infrastructure is hosted on Fly.io (Dublin, EU).
3. How We Use Your Data
- To understand how visitors use our website (aggregated analytics only)
- To respond to enquiries via email
- To schedule appointments
- To deliver governance scan results to the email address you provide
4. Legal Basis (GDPR Article 6)
- Analytics: consent (Article 6(1)(a))
- Enquiries: legitimate interest (Article 6(1)(f))
- Appointments: contract performance (Article 6(1)(b))
- Governance scanner: consent (Article 6(1)(a)) - scan results delivery and, where separately opted in, marketing communications
5. Third-Party Processors
| Processor | Purpose | HQ | Data Location |
|---|---|---|---|
| AWS Amplify (Amazon) | Website hosting / CDN | US (eu-west-1 region) | EU |
| Cookiebot (Cybot) | Consent management | Denmark (EU) | EU |
| Google Tag Manager | Tag management (consented) | US (Google Ireland Ltd for EEA) | US infrastructure |
| Google Analytics 4 | Website analytics (consented) | US (Google Ireland Ltd for EEA) | US infrastructure |
| Google Workspace | Email, calendar scheduling | US (Google Ireland Ltd for EEA) | EEA |
| Fly.io | Scanner API hosting infrastructure | US | EU (Dublin) |
| Brevo (Sendinblue) | Scanner lead capture email delivery and CRM | France (EU) | EU |
6. Data Transfers
GA4 data is processed by Google LLC, which is certified under the EU-US Data Privacy Framework (DPF). We acknowledge that transfer mechanisms may change and will update this policy accordingly. GA4 event data is retained for 2 months and user data is retained for 14 months. We minimise data collection by gating all analytics behind Cookiebot consent - no tracking occurs without explicit visitor approval. GA4 applies automatic IP anonymisation so no raw IP addresses are stored.
7. Your Rights
Under the General Data Protection Regulation (GDPR), you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate personal data
- Request erasure of your personal data
- Restrict processing of your personal data
- Data portability
- Object to processing of your personal data
- Withdraw consent at any time via the Cookiebot banner
You also have the right to lodge a complaint with the Data Protection Commission (Ireland).
8. Cookies
We use Cookiebot to manage cookie consent. Strictly necessary cookies (CookieConsent preference storage) are set without consent as permitted under the ePrivacy Directive. Without consent, no analytics or marketing cookies are set and no tracking occurs. With consent, analytics cookies are set by Google Tag Manager and Google Analytics.
Cookie Categories
| Category | Cookie Name | Provider | Purpose | Expiry | Type |
|---|---|---|---|---|---|
| Necessary | CookieConsent | Cookiebot (Cybot) | Stores the visitor's consent state for cookie categories | 1 year | HTTP cookie |
| Necessary | CookieConsentBulkSetting-# | Cookiebot (Cybot) | Enables cookie consent state across multiple websites | Persistent | HTTP cookie |
| Analytics | _ga | Google Analytics 4 | Registers a unique ID used to generate statistical data on site usage | 2 years | HTTP cookie |
| Analytics | _ga_* | Google Analytics 4 | Used by GA4 to maintain session state | 2 years | HTTP cookie |
9. Changes to This Policy
We may update this policy from time to time. The "last updated" date at the top of this page reflects the most recent revision.
10. Contact
If you have questions about this privacy policy or how we handle your data, please contact us:
- Email: contact@obscurity.ie
- For data protection enquiries: contact@obscurity.ie
- Address: Obscurity Ltd, Dublin, Ireland