Effective date: 28 August 2026
Who controls personal data
This website is operated by Shane Hatton, who is the data controller for personal data collected directly through the site. Privacy enquiries and rights requests may be sent through the website’s contact page.
Information processed without optional consent
The website and its hosting and security providers may process limited technical information needed to deliver and protect the site, including IP address, requested page, date and time, browser or device information, and security events. The legal basis is Shane’s legitimate interest in operating a secure and reliable portfolio website. Strictly necessary storage may be used where required to provide a service requested by the visitor.
If a visitor submits a contact form or sends a message, Shane processes the supplied contact details and message to respond and take requested pre-contractual steps. Messages are retained only as long as reasonably necessary for the enquiry and any related legal, accounting or record-keeping requirement.
Optional analytics
Google Analytics 4 is used only after a visitor selects Analytics. The legal basis is consent under Article 6(1)(a) GDPR and applicable Irish ePrivacy rules. Analytics remains off before consent and after rejection.
When enabled, Analytics may process page views, session and engagement information, referral source, approximate location, and browser or device characteristics. Shane does not intentionally send names, email addresses or other directly identifying information to Google Analytics. Google states that it does not log or store IP addresses for users in the European Union.
| Cookie | Purpose | Default duration |
|---|---|---|
_ga |
Distinguishes visitors for statistical measurement. | Up to 2 years, subject to browser limits. |
_ga_<container-id> |
Maintains Google Analytics session state. | Up to 2 years, subject to browser limits. |
The GA4 property is configured with Google Signals off, user-provided data collection off, granular location and device collection off, advertising personalisation disallowed in all regions, and optional Google account data-sharing settings off. Event-level data associated with identifiers is retained for 2 months. User data is retained for 14 months and does not reset on new activity. Aggregated standard reports may be retained separately by Google.
Optional external media
Vimeo and YouTube videos, and any Google Maps embeds, are blocked until a visitor separately selects External media. If enabled, the relevant provider may receive the visitor’s IP address, browser or device information, referring page and interaction information, and may set or read cookies under its own policies. The legal basis is consent. The rest of the site remains available without enabling external media.
Consent choices and withdrawal
Analytics and External media are separate optional choices and neither is preselected. Choices are saved in the visitor’s browser using local storage and a first-party preference cookie for up to one year, unless changed sooner or browser data is cleared. Consent may be changed or withdrawn at any time through the persistent Privacy settings button. Withdrawal does not affect processing that lawfully occurred before withdrawal.
Recipients and international transfers
Personal data may be processed by providers supporting hosting, security, website forms and services a visitor chooses to enable. Google Ireland Limited and relevant Google companies provide Google Analytics, YouTube and Google Maps; Vimeo provides embedded video services. Some providers may process information outside Ireland or the EEA. Where required, transfers rely on an adequacy decision, European Commission standard contractual clauses or another lawful safeguard. See Google’s Privacy Policy and Vimeo’s Privacy Policy.
Individual rights
Subject to the GDPR and applicable exceptions, individuals may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. Consent may be withdrawn at any time. Requests may be made through the contact page; identity may need to be verified.
Individuals may complain to the Irish Data Protection Commission. Information and contact details are available at dataprotection.ie.
Automated decisions and sale of data
Shane does not use website information for decisions producing legal or similarly significant effects, does not sell visitors’ personal data, and does not use Google Analytics for personalised advertising.
Changes to this notice
This notice may be updated when the website or its services change. The effective date above identifies the current version.