Istantzia Privacy Policy

Last updated: April 2026

1. Introduction

1.1 Purpose of this Privacy Notice

This Privacy Notice aims to provide Users with a clear, transparent, and comprehensive explanation of how Happydemy LTD collects, uses, stores, protects, and shares personal data in the course of delivering its digital services. The notice is drafted in compliance with Regulation (EU) 2016/679 (GDPR), applicable Irish national legislation, and the ePrivacy Directive.

1.2 Scope of Application

This notice applies to all personal data processing activities carried out by Happydemy LTD when the User:

• accesses or browses the Happydemy Platform and its services

• uses official Happydemy mobile applications (including the Android application)

• interacts with the digital, social, or educational services of the Happydemy® ecosystem

• performs transactions or purchases digital products through the Platform

• undergoes identity verification through the Platform

• participates in social features (posts, comments, groups, follows)

• Contact the Company for support, complaints, onboarding, or official communications

The notice applies to both registered Users and unauthenticated visitors, to the extent that personal data is processed.

1.3 Acceptance and Consent

By using any service offered by Happydemy LTD, the User declares to have read, understood, and fully accepted this Privacy Notice. Where processing is based on consent, such consent will be explicitly requested and may be withdrawn at any time, as provided within this notice.

If the User does not intend to accept this notice, they are advised not to use the Platform's services.

1.4 Data Controller and Applicable Jurisdiction

The data controller is:

Happydemy LTD
71 Baggot Street Lower
Dublin D02 P593, Ireland
Company Number: 763825

All processing activities are carried out under Irish jurisdiction and in compliance with the GDPR, the Irish Data Protection Act 2018, and Directive 2002/58/EC (ePrivacy), as amended and implemented by local authorities. The competent supervisory authority is the Data Protection Commission (DPC) based in Ireland.

Happydemy LTD maintains a Record of Processing Activities pursuant to Article 30 GDPR.

Data Protection Officer (DPO): The Company has assessed, in accordance with Article 37 GDPR and Section 36 of the Irish Data Protection Act 2018, that the appointment of a Data Protection Officer is not currently mandatory given the nature and scale of its processing activities. Notwithstanding, the Company has designated an internal privacy point of contact responsible for overseeing compliance. Should the conditions for mandatory appointment arise (particularly large-scale processing of special categories of data or systematic monitoring), a formal DPO appointment will be made and communicated to Users and to the DPC. Users may address any data protection queries via the channels listed in Section 15.

2. Summary of Key Points

This section provides a clear, immediate overview of the fundamental aspects of personal data protection on Happydemy®. For detailed information, please refer to the following sections of this notice.

2.1 Data Processed

We collect and process only the personal data strictly necessary for:

• registering and managing the user account

• using the digital services offered, including social features

• communication and technical support

• processing transactions and purchases

• identity verification and compliance

• security, monitoring, and fraud prevention

2.2 Purpose of Processing

We use personal data to provide, improve, protect, and personalise Happydemy® services, comply with legal obligations, safeguard the ecosystem's security, and ensure a user experience that meets expectations.

2.3 User Rights

Under GDPR, the User has the right to:

• access their data

• request rectification or erasure

• object to or restrict processing

• request portability

• Withdraw consent at any time

• Lodge a complaint with the supervisory authority

2.4 Data Sharing

We share personal data only with:

• authorised contractual partners for service provision (see Section 7.5 for the sub-processor register)

• certified third-party providers, only where necessary

• competent authorities where required by law

We do not sell or monetise the User's personal data.

2.5 Protection and Security

We implement advanced technical and organisational measures to protect data against unauthorised access, loss, alteration, or improper disclosure. We use encryption, backups, audits, and continuous monitoring systems.

2.6 Retention

Data is retained only for as long as strictly necessary for the stated purposes and, thereafter, deleted or anonymised in accordance with applicable EU and Irish regulations.

2.7 GDPR Rights

Happydemy® fully complies with Regulation (EU) 2016/679. All privacy-related requests are handled within the timeframes set by law, through dedicated channels accessible via the Help Centre.

3. Data We Collect

We collect different categories of personal data to ensure the security, quality, and full functionality of Happydemy® Services. Such data is provided directly by the User, collected automatically, or generated during the use of the Platform.

3.1 Data Provided Directly by the User

During registration, use, or customisation of the Services, the User may voluntarily provide:

• First and last name

• Username or alias

• Email address

• Phone number

• Date of birth

• Country of residence

• Preferred language

• Profile picture or avatar

• Personal descriptions and text content entered in the profile

• Password

• Communication preferences

3.2 Identity Verification (KYC)

To ensure the security and integrity of the Platform, identity verification is mandatory within 30 days of registration, as set out in the General Terms.

The User uploads an official identity document via the verification form available on the Platform. Data is processed exclusively by our authorised staff, and no copy is retained: documents are deleted immediately after approval or rejection of the verification.

To enhance security and prevent fraud, submitted documents may be analysed by internal automated systems to detect potentially fraudulent, altered, or counterfeit documents. These systems operate entirely within the Happydemy infrastructure and are not connected to any third-party service. Where the automated system flags a submission, it is escalated for manual review by authorised staff.

Such data is processed as described in the IDU – User Digital Identification Policy↗, a separate but integrated contractual document.

3.3 Payment and Transaction Data

Payment and purchase data are processed in a limited manner:

• Amount, date, currency, payment method

• Product purchased

• Transaction code and reference

• Transaction confirmation and status

• Receipts, invoices, and purchase history

• Payout invoices issued by Creators

Full payment card details are processed only by PCI-DSS certified external providers and are never stored by Happydemy®. Accounting data is managed through certified accounting service providers.

3.4 Technical and Usage Data

When you access the Services, we may automatically collect:

• IP address

• Browser type and version

• Operating system and version

• Screen resolution and language

• Device type, model, and manufacturer

• Network information (provider, connection type)

• Access timestamp, session duration

• URLs visited and pages viewed

• Any crashes or technical errors

These data are used for analysis, security, performance monitoring, and service optimisation.

3.5 Location Data

If you authorise location access, we may collect geolocation data via:

• IP address (approximate)

• GPS or network data (precise)

• Real-time or session-based device location

Access can be revoked or managed through your device settings.

3.6 Application and Device Data

If you use our mobile apps (currently available on Android, with additional Platforms planned) or specific features, we may collect:

• Operating system version

• Granted permissions (microphone, camera, storage, notifications)

• Push notification status and user preferences

• Push notification tokens

3.7 Data Generated from Interactions

We may collect data related to activities performed within the Services, including:

• Comments, reactions, direct messages (if applicable)

• Invitations sent to other users

• Content viewed, saved, or followed

• Frequency of feature usage

This information is used to improve user experience, support the reward system, and prevent abuse.

3.8 Data from Reports, Complaints, and Contacts

If you contact us via ticket or other channels, we collect:

• Content of your communication

• Any attachments

• Identification data (name, email, account ID)

• Interaction history

3.9 Social Interaction Data

When using social features on the Platform, we collect:

• Posts and published content (text, images, videos)

• Comments and reactions on content

• Follow/unfollow actions and social connections

• Group membership and participation

• Profile visibility settings and preferences

• Engagement metrics (views, interactions)

• Content shared or saved by the User

4. How We Use Personal Data

We process the User's personal data exclusively for specific, explicit, and legitimate purposes, in accordance with the principles set out in Regulation (EU) 2016/679 (GDPR) and applicable Irish legislation.

4.1 Account Management

Data is used to:

• create, activate, and configure the User's personal account

• enable authenticated access to the Services via Single Sign-On (SSO)

• manage credentials, preferences, and personal settings

4.2 Service Delivery

Personal data is processed to:

• provide the features offered within the Happydemy® ecosystem, including content, social interactions, publishing tools, groups, profiles, premium access, and thematic sections

• enable the use of paid Services, subscriptions, and digital product purchases

• perform activities requested by the User, such as invitations, connections, notifications, or content creation

4.3 Service Communications

We use data to send:

• technical and operational communications related to the account

• updates on contractual changes or relevant features

• security notifications or mandatory information

• SMS and email notifications via third-party delivery services

These communications cannot be unsubscribed from.

4.4 Personalising the Experience

To improve the quality of the experience, we may use data to:

• adapt content, suggestions, and interfaces based on the User's behaviour or preferences

• display priority items, badges, rankings, or personalised achievements

• support recognition and reward mechanisms provided by the system

This processing is based on the Company's legitimate interest, in accordance with the User's fundamental rights and freedoms.

4.5 Moderation and Abuse Prevention

We process identifying data, published content, access logs, and reports to:

• monitor appropriate behaviour on the Platform

• take action in case of illegal content, abuse, spam, or violations of the Guidelines

• apply progressive sanctions provided for in the General Terms (warning, suspension, ban)

Moderation operations are carried out in compliance with the principles of necessity and proportionality.

4.6 Statistical Purposes and Internal Analysis

We carry out aggregated and anonymous data processing to:

• monitor Service usage

• optimise the infrastructure and features offered

• understand user needs

• support corporate strategic decisions

These activities do not involve individual profiling or automated decisions with legal effects.

4.7 Technical Support

Personal data is processed to provide technical support and responses to requests via:

• tickets opened through the Help Centre

• real-time chat (for subscribed users)

• email communications or internal notifications

Technical logs and any attachments are retained only for the time necessary to manage the request.

4.8 Fraud Prevention and Security

We process technical and behavioural information to:

• detect and prevent unauthorised access or fraudulent activity

• ensure system integrity and data security

• protect users, infrastructure, and the digital environment from internal or external threats

The measures adopted include automated checks, access logs, operational restrictions, and alert systems. Automated systems may temporarily block suspicious transactions or activities pending manual review by authorised staff.

5. Legal Bases for Processing

All personal data processing carried out by Happydemy LTD is based on at least one of the lawful conditions set out in Article 6 of Regulation (EU) 2016/679 (GDPR). In particular, User data is processed exclusively in the following cases:

5.1 Consent

Processing is based on the User's explicit consent in cases where:

• subscription to newsletters or promotional communications is requested

• optional or additional features are activated

• services requiring the processing of non-essential data are requested

Consent may be withdrawn at any time without affecting the lawfulness of processing prior to withdrawal.

5.2 Performance of a Contract

Processing is necessary for the performance of a contract to which the User is a party, or for the implementation of pre-contractual measures taken at the User's request, including:

• registration and account management

• identity verification (KYC)

• use of Happydemy® ecosystem Services, including social features

• purchase of digital products and services

• activation of subscriptions and premium features

• technical support and assistance

5.3 Legal Obligations

Processing is necessary to comply with legal obligations to which Happydemy LTD is subject, including:

• retention of data for tax, accounting, and legal purposes

• compliance with anti-money laundering, identification, and security regulations

• handling of requests from competent authorities

5.4 Legitimate Interest

Processing is based on the Company's legitimate interest, provided that the User's fundamental rights and freedoms do not override it. This includes, for example:

• continuous improvement of Services

• prevention of abuse, fraud, and misuse of the Platform

• maintaining audit trails for internal accountability

• legal defence

• anonymous or aggregated statistical processing

• sending relevant non-promotional communications (e.g., feedback, survey invitations)

6. Cookies and Similar Technologies

Happydemy® uses cookies and similar technologies to ensure the proper functioning of the Platform, improve the User experience, collect statistical data, and provide personalised content.

6.1 Types of Cookies Used

Cookies used within our applications and websites may include:

• Technical cookies (necessary): essential for site operation, navigation, and access to main features (e.g., login, user session, security)

• Functional cookies: allow remembering preferences, language, settings, or experience customisations

• Performance cookies: collect anonymous information on site usage to improve performance

We do not use profiling or targeting cookies, whether internal or third-party.

6.2 Purpose of Use

The main purposes for which we use cookies and similar technologies include:

• authentication and maintaining an active session

• security and prevention of suspicious activity

• traffic measurement and anonymous statistical analysis

• personalisation of the user interface

• improvement of Services through aggregated behavioural analysis

• enabling optional features (e.g., video, chat, push notifications)

We do not perform advertising tracking or use any third-party tracking.

6.3 Managing Preferences

Upon first access, the User can manage preferences via the cookie banner, selecting which cookie categories to accept or refuse. Preferences can be changed at any time:

• via the Cookie Management Centre available on the site

• through the browser settings (with the ability to block or delete all stored cookies)

• by disabling specific features within the mobile application

Disabling technical cookies may impair the proper functioning of the site or apps.

6.4 Link to Cookie Policy

For complete and updated information on the use of cookies, third-party providers involved, and retention periods, please refer to our Cookie Policy↗.

7. Who We Share Your Data With

We share Users' personal data only when strictly necessary and in line with the purposes outlined in this Privacy Notice. Any third party involved is contractually bound to ensure adequate levels of protection, security, and confidentiality.

7.1 Sub-processors and Data Processors

We work with qualified external providers acting as data processors for the provision of technical, infrastructure, and operational services, such as:

• database and server management

• notification and email delivery tools

• payment processing and accounting

• customer support

• system analysis and monitoring

All sub-processors are carefully selected and bound by specific agreements in compliance with Art. 28 GDPR. A complete list of sub-processors is provided in Section 7.5.

7.2 Technical and Infrastructure Providers

Data may be processed by third-party technology providers that offer reliable and certified infrastructure, including:

• cloud and hosting services (located within the European Economic Area)

• payment processing Platforms

Where applicable, such providers act as independent data controllers, with their own privacy notices and legal bases.

7.3 Transfers in the Event of Corporate Transactions

In the context of extraordinary transactions such as mergers, acquisitions, business transfers, or financing operations, Users' data may be transferred to authorised third parties, in compliance with applicable legal safeguards.

The User will be informed if their data is to be processed by a new controller.

7.4 Access by Other Users (Social Interactions)

When the User participates in social features (e.g., posting content, leaving comments, sending messages, joining groups, or creating public profiles), certain information may be visible to other Platform users, depending on the chosen visibility settings.

In particular:

• public content is accessible to other members of the Happydemy® ecosystem

• private messages or direct interactions are visible only to the selected recipients

• the User is responsible for information voluntarily shared in public contexts

We recommend exercising caution when posting personal data in spaces visible to other users.

7.5 Sub-Processor Register

In accordance with Article 13(1)(f) and Article 28 GDPR, we provide the following categories of sub-processors engaged by Happydemy LTD:

Payment and Financial Services:

Sub-Processor

Service Provided

Data Categories

Location

Transfer Mechanism

Revolut Ltd

Primary payment processing, Creator payouts

Payment details, transaction amounts, and bank account details

EU (UK/Lithuania)

DPA incorporated in Revolut Business T&C; UK Adequacy Decision

Stripe, Inc.

Fallback payment processing

Payment details, transaction amounts, customer identifiers

USA

DPA built into Stripe Services Agreement (Section 10); Standard Contractual Clauses (SCC)

Sage Group plc

Accounting and invoicing

Invoice data, transaction summaries, and company financial data

UK

Sage GDPR DPA; UK Adequacy Decision

Communication and Notification Services:

Sub-Processor

Service Provided

Data Categories

Location

Transfer Mechanism

Twilio Inc.

SMS and email notifications

Phone numbers, email addresses, message content

USA

Twilio DPA; Standard Contractual Clauses (SCC)

Vonage (Ericsson)

Backup SMS delivery

Phone numbers, message content

USA

Vonage DPA; Standard Contractual Clauses (SCC)

Infrastructure and Hosting:

Sub-Processor

Service Provided

Data Categories

Location

Transfer Mechanism

European cloud hosting provider

Cloud hosting, Managed database services

All service data (encrypted at rest and in transit)

EU

DPA in place; processing within EEA

This register is updated periodically. The User may request the current version or information about any specific sub-processor by contacting us via the channels listed in Section 15.

8. Where We Process and Transfer Data

We process your data primarily in Ireland, where Happydemy LTD's operational and legal headquarters are located. In all cases, we take measures to ensure that personal data is processed securely and in compliance with applicable laws.

8.1 Servers and Infrastructure (EU and/or EEA)

Our main servers and technology infrastructure are located within the European Economic Area (EEA). This ensures that your data is protected by European data protection laws, particularly the GDPR.

Suppliers provide all hosting and storage services with compliance certifications (e.g., ISO 27001, SOC 2) and high-level security measures.

8.2 International Transfers

In some cases, your data may be transferred outside the EEA, specifically when using sub-processors based in third countries for payment processing, SMS/email delivery, or accounting services.

In all such circumstances, we ensure that:

• the country offers an adequate level of protection according to the European Commission, or

• appropriate safeguards are in place, such as the Standard Contractual Clauses (SCC) approved by the European Commission or other instruments compliant with Art. 46 GDPR.

For details on specific sub-processors and their locations, please refer to Section 7.5.

8.3 Standard Contractual Clauses (SCC)

When we transfer personal data to countries not covered by an adequacy decision, we use updated SCCs to ensure the security and lawfulness of processing. These clauses require the foreign recipient to provide the same level of protection as under the GDPR.

The User may request a copy by contacting us via the Help Centre.

9. How We Protect Your Data

We implement appropriate technical and organisational measures to protect your data from unauthorised access, disclosure, accidental loss, or alteration.

9.1 Technical and Organisational Measures

Our systems are designed according to the principles of privacy by design and by default, aiming to minimise risks and ensure the security of the information processed.

Measures include:

• data separation

• network segmentation

• access controls based on the principle of least privilege

9.2 Encryption

Sensitive data is transmitted using secure encryption protocols (e.g., TLS 1.3) and, where applicable, stored on servers in encrypted form.

Access credentials are protected with secure hashing techniques (e.g., bcrypt or equivalent).

9.3 Communication Security

We continuously monitor communication channels to detect anomalies, intrusions, or unauthorised access attempts. We use firewalls, IDS/IPS systems, and anti-malware controls.

All access to or modification of sensitive data is recorded and logged for security purposes.

9.4 Access and Audits

Access to personal data is restricted to authorised personnel and individuals contractually bound to confidentiality. We have processes in place for:

• periodic audits

• authorisation reviews

• vulnerability assessments

In the unlikely event of a data breach, we will activate the notification procedures required under Articles 33 and 34 of the GDPR.

10. How Long We Retain Data

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected or to comply with applicable legal, tax, and security obligations.

10.1 Retention Criteria

Retention periods vary depending on the nature of the data and the purpose of processing:

• Data linked to an active account: retained until voluntary closure or automatic deactivation after prolonged inactivity

• Payment and billing data: retained for a minimum of 6 years in compliance with Irish tax obligations

• Access and security logs: retained for up to 12 months for auditing and fraud prevention purposes

• Administrative audit records: retained for up to 10 years for compliance and governance purposes

• Data collected based on consent: deleted upon withdrawal of consent, unless legal obligations require otherwise

10.2 Deactivated Accounts, Bans, and Backups

In the case of voluntary account closure, data will be deleted or anonymised within 30 days, unless retention is required by law.

In the event of suspension or permanent ban due to violations of the General Terms, certain personal identifying data (including name, ID, IP address, email, and reason for ban) will be retained indefinitely solely to maintain updated blacklist systems, prevent fraudulent re-entry onto the Platform, and protect the integrity of the ecosystem.

Data retained for blacklist purposes will be subject to periodic review at least every 3 years to assess the continued necessity of retention.

Backups containing personal data are isolated and stored for up to 6 months before being automatically deleted. During this period, access is restricted and protected.

10.3 Anonymisation or Deletion

When data is no longer needed, we will either:

• permanently delete it, or

• irreversibly anonymise it so it can no longer be linked to an identifiable individual

The method applied depends on the residual purpose of processing (e.g., regulatory obligations or aggregated statistics).

10.4 Identity Verification Data

Identity verification data is retained as follows:

• Identity document images: deleted immediately upon completion of the verification decision (approved or rejected) — no copies are retained by Happydemy

• Verification outcome (approved/rejected status): retained for the duration of the account

• Verification audit trail (timestamp, method used, outcome): retained for 7 years for compliance purposes

11. Your Rights

As a data subject, the User has the right to exercise certain rights over their personal data. Happydemy LTD ensures access to these rights in accordance with Regulation (EU) 2016/679 (GDPR) and the Irish Data Protection Act 2018.

11.1 Right of Access

You have the right to obtain confirmation as to whether your personal data is being processed and, if so, to receive a copy of the data processed, along with information on the purposes, categories of data, and recipients.

11.2 Right to Rectification and Erasure

You have the right to request:

• the correction of inaccurate or incomplete data

• the erasure of personal data when it is no longer necessary for the purposes for which it was collected, or if you withdraw consent (in cases where consent is the legal basis for processing)

Please note that some data may be retained for legal obligations or security purposes.

11.3 Right to Restriction and Objection

You have the right to request the restriction of the processing of your personal data in the following cases:

• if you contest the accuracy of the data

• if the processing is unlawful, but you oppose erasure

• if we need the data to establish, exercise, or defend legal claims

You also have the right to object to processing based on legitimate interest, unless the Company has compelling legitimate grounds that override your interests, rights, and freedoms.

11.4 Right to Data Portability

The User has the right to receive the personal data they have directly provided to Happydemy LTD in a structured, commonly used, and machine-readable format, only in the following cases:

• the processing is based on explicit consent or the performance of a contract

• the processing is carried out by automated means

Happydemy LTD will assess each data portability request in good faith, even where there are technical or operational limitations to direct transmission.

11.5 Right to Lodge a Complaint

If you believe that the processing of your personal data violates applicable law, you have the right to lodge a complaint with the competent supervisory authority. In Ireland:

Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, D02 RD28, Ireland
https://www.dataprotection.ie

12. Profiling and Automated Decision-Making

12.1 Automated Processes

Happydemy LTD may use automated systems in the following areas:

• Content personalisation: Automated systems that suggest content, profiles, or connections based on the User's activity and preferences, in order to improve the user experience

• Fraud detection and prevention: Automated monitoring of transaction patterns and identity verification submissions to detect and block potentially fraudulent activity. Blocked transactions and flagged submissions are escalated for manual review by authorised staff

No automated decision produces legally binding effects on the User or significant impacts under Article 22 GDPR without the possibility of human review.

12.2 Human Intervention and Rights

The User has the right to:

• request human intervention in automated decision-making processes

• express their point of view

• contest the automated decision

• request an explanation of the logic involved in automated processing

Such requests can be made through the official channels indicated in Section 13.

13. How to Exercise Your Rights

13.1 Available Channels

To exercise your rights regarding personal data, you may submit a request through one of the following official channels:

• A dedicated form on our official website in the Contact Us section

• Through the channels available within the Happydemy Platform

13.2 Identification

To ensure data security, we may request additional information to verify your identity before processing your request.

13.3 Response Times

We will respond to requests within 30 (thirty) days of receipt. In cases of particular complexity, the response period may be extended by a further 60 (sixty) days, in accordance with Article 12(3) GDPR. In such cases, we will inform the User of the extension and the reasons for the delay within the initial 30-day period.

14. Minors and Child Protection

14.1 Minimum Age for Access

Use of Happydemy®'s services is restricted to adult users (18 years or older). Registration by minors is not permitted.

14.2 Unauthorised Registrations

If the Company becomes aware of the registration of a minor, it will:

• immediately delete the data associated with the unauthorised account

• deactivate the account

• contact, where possible, a parent or legal guardian for information and verification

The deletion of data is carried out under Article 8 of the GDPR due to the minor's lack of valid consent.

We encourage anyone who becomes aware of unauthorised use to promptly report it via the Help Centre.

15. Breach Notifications

15.1 Obligations in Case of Breaches

In the event of a personal data breach that may pose risks to the rights and freedoms of natural persons, Happydemy LTD undertakes to:

• notify the event to the Irish Data Protection Commission within 72 hours

• document all details, and take corrective measures

15.2 Communication to Users

Where required by law, Happydemy will also inform users directly affected by the breach through transparent, timely, and clear communication.

16. Changes to This Policy

16.1 Update Procedure

Happydemy LTD reserves the right to update this Privacy Policy at any time to:

• comply with regulatory changes

• reflect changes in the Services offered

• introduce organisational or technical improvements

Each update will be published with a new "Last Updated" date displayed at the top of the document.

16.2 Notification of Changes

If the changes are significant or substantially affect the User's rights, Happydemy LTD will notify them through:

• visible communications on the Platform

• direct messages to registered Users, where appropriate

We encourage periodic review of the Privacy Policy to stay informed about our data practices.

16.3 Effective Date

Changes will take effect from the date of their publication, unless otherwise stated.

17. Official Contacts

17.1 Data Controller

Happydemy LTD
71 Baggot Street Lower
Dublin D02 P593 – Ireland
Company Number: 763825
Registered with the Data Protection Commission (DPC), Ireland.

17.2 Contact Channels

For any communication regarding the protection of personal data:

• Dedicated form on our official website in the Contact Us section

• Through the channels available within the Happydemy Platform

17.3 Competent Authority

The User has the right to complain to the Irish Data Protection Commission:

Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, D02 RD28 – Ireland
Website: https://www.dataprotection.ie