Privacy notice

1. Who we are

The Oatlands College Past Pupils' Union is the data controller for the personal data described in this notice. We are an unincorporated voluntary association of past pupils of Oatlands College, run by an elected committee.

The Union is a separate body from Oatlands College. The school does not have access to our mailing list, and we do not have access to school records.

Data contact: privacy@oatlandsppu.ie, or write to us at the address in the contact page. The Secretary is the committee member responsible for data protection. We are not required to appoint a Data Protection Officer and have not appointed one.

2. What we hold, and why

What	Why we have it	Do you have to give it?
First and last name	To address you properly in emails, and for name badges at reunions	Yes
Email address	To send you what you asked for, and to give you access to your own record	Yes
Year you left Oatlands	To tell you when your year group has a milestone reunion coming up, and to plan reunions for years that are well represented	No
Phone number	Only to reach you about a last-minute change to an event you have booked. Never used for marketing	No
Which of our three mailings you want	So we only send you what you actually asked for	Yes — at least one
A one-way scrambled version of your email address and of the IP address you signed up from	To prove, if we are ever asked, that you consented and when. We cannot turn these back into the original values	Automatic
Dates: when you signed up, confirmed, last changed something	To show our records are accurate and to apply our retention policy	Automatic

That is the complete list. We do not hold, and never ask for, your address, date of birth, occupation, employer, family details, or anything about your time at the school beyond the year you left.

We hold no special category data — nothing about health, religion, politics, ethnicity or anything else in that class.

If you send us a message

The contact form keeps your name, email, subject and message so we can reply. It is forwarded to the committee inbox and the stored copy is deleted automatically after 90 days.

3. Our legal basis

For everything we email you, our legal basis is your consent (Article 6(1)(a) of the UK and EU General Data Protection Regulation, and the Regulations of 2011 implementing the ePrivacy Directive in Ireland).

Consent means you had to do something positive to give it, and you can take it back at any time without giving a reason and without it being any harder than giving it was. Both of those are true here: you gave consent by clicking a link in an email, and one click on the link in any email we send takes it back.

For replying to a message you sent us, our basis is our legitimate interest in answering correspondence addressed to us (Article 6(1)(f)).

For the one-way scrambled record we keep after someone asks to be deleted, our basis is our legitimate interest in making sure that request is actually honoured — see section 7.

4. How we got your details

From you, and only from you. We use double opt-in: you fill in the form, we email the address you gave, and nothing goes on the list until you click the link in that email. If you never click it, the incomplete record is deleted within 30 days.

We do not buy lists, we do not take addresses from LinkedIn or Facebook, and we do not add people because a classmate suggested them. If a past pupil passes on a friend’s name, all we will do is ask that person to forward them the signup link.

5. Who else sees it

We never sell, rent, swap or share your details. Not with the school, not with other past pupil bodies, not with charities, not with businesses that sponsor our events.

Within the Union, access is limited to the committee officers who need it — in practice the Secretary, who runs the list, and the Treasurer for event bookings.

We use two suppliers, who process data on our instructions only:

Who	What they do	Where
Cloudflare, Inc. Data processing terms	Website hosting and the members database (Cloudflare Pages and D1)	Data stored in the European Union
Resend (Plus Five Five, Inc.) Data processing terms	Sending confirmation emails and the newsletter	United States, under the EU–US Data Privacy Framework and Standard Contractual Clauses

Both are bound by written data processing agreements. Sending email inevitably means a provider outside the EU handles the address it is being sent to; that transfer relies on the EU–US Data Privacy Framework and on Standard Contractual Clauses.

We would disclose data if we were legally required to — a court order, for instance. It has never happened.

6. How long we keep it

A retention policy nobody carries out is worthless, so ours runs automatically as a scheduled job rather than depending on a volunteer remembering.

Record	Kept for	Then
Signup that was never confirmed	30 days	Deleted
Confirmed member, still subscribed	As long as you want to hear from us	—
Member who has been inactive for 5 years	5 years	We email to ask you to re-confirm; no reply means deletion
Member who unsubscribed	24 months, in case you come back	Deleted
Contact form message	90 days	Deleted
Consent audit log (scrambled identifiers only)	7 years	Deleted
Do-not-contact record after an erasure request	Indefinitely — scrambled email only, nothing else	—

You do not have to wait for any of that. You can delete your record yourself, immediately, from your details page.

7. Your rights

You have the following rights over your personal data. The point of how this site is built is that you can exercise most of them yourself, in about ten seconds, without asking anyone’s permission or waiting for a reply.

Right	What it means	How
Access	See everything we hold about you	Instantly, on your details page
Rectification	Correct anything that is wrong	Instantly, same page
Erasure	Have your record permanently deleted	Instantly, same page. You get written confirmation by email
Portability	Get a machine-readable copy to take elsewhere	Download button, same page
Withdraw consent	Stop hearing from us, without deleting your record	Unsubscribe link in every email
Restriction and objection	Ask us to stop or limit what we do with it	Email privacy@oatlandsppu.ie

If you would rather email than use the website, that is entirely fine. Write to privacy@oatlandsppu.ie and we will respond within one month, which is the statutory deadline. There is never a charge.

Automated decisions

We make none. There is no profiling and no automated decision-making of any kind.

What survives deletion, and why

When you delete your record, your name, email address, phone number and graduation year are removed from the database entirely. Two things remain:

• A one-way scrambled version of your email address, on a do-not-contact list. Its only purpose is to make sure your deletion sticks: if an old spreadsheet is ever imported, or a well-meaning committee member re-adds a class list, this stops you being silently put back. We cannot turn it back into your address, and we cannot use it to contact you. This is recognised under GDPR as necessary to give effect to your original request.
• The consent audit log, which records that a signup, confirmation and deletion happened, and when. It is keyed to the same scrambled value and contains no name, address or contact detail.

If you would prefer even those removed, say so and we will remove them — you just lose the protection against being accidentally re-added later.

8. Photographs

The gallery and archive contain photographs of people, some going back to 1955. Photographs of identifiable people are personal data, and old photographs are no exception.

How we handle it:

• We publish photographs given to us by past pupils, their families, or the school, on the basis of the Union’s legitimate interest in recording the history of the school community.
• We do not name anyone in a caption unless the person who gave us the photograph named them, or the name was already published — in the school magazine, for example.
• If you want a photograph of yourself removed, we take it down the day you ask. No reason needed, no form, no argument. Ask here or email privacy@oatlandsppu.ie.
• The same applies to a photograph of a family member who has died, if it distresses you to see it published.
• We do not use facial recognition, and we do not tag photographs against the mailing list.

At events we run, a notice at the door tells people that photographs are being taken and who to speak to if they would rather not be in them.

9. Cookies and tracking

That is why you have not been shown a cookie banner. There is nothing to consent to. We would rather not know how many people visited a page than track them to find out.

Two small exceptions, both of which only happen if you choose them:

• The “open in maps” and “add to Google Calendar” buttons take you to Google. That is a link you clicked, not an embed, and nothing is sent to Google unless you click it.
• If the committee ever turns on Cloudflare Turnstile to stop automated signup abuse, that loads a script from Cloudflare on the signup and contact pages only. Turnstile is designed not to track people across sites and does not set advertising cookies. It is off at present.

Cloudflare, who host the site, keep short-lived server logs including IP addresses for security and abuse prevention. We do not have access to them as a marketing tool and they are not linked to your mailing list record.

10. How it is protected

• The site is served over HTTPS only, with HSTS.
• The database is Cloudflare D1, encrypted at rest and reachable only from our own server code — it is not exposed to the internet.
• Your email address and the IP you signed up from are also stored as keyed hashes. Even someone with a copy of the database could not run a dictionary of likely addresses against them.
• The link that gets you into your own record is a 256-bit random token, stored only as a hash. It is rotated every time you request a new one, which invalidates the old one.
• Confirmation links are single-use and expire after seven days.
• The signup form is rate-limited and protected by a hidden honeypot field, so automated abuse does not fill the list with junk.
• There is no admin login to phish, because there is no admin web interface. The committee exports a list when one is genuinely needed and deletes the file afterwards.
• Pages that can show personal data are marked never-cache and never-index.

If you think you have found a security problem, please tell us at privacy@oatlandsppu.ie. We will not take issue with anyone reporting a genuine problem in good faith.

If something goes wrong

If there is ever a breach that is likely to result in a risk to your rights, we will report it to the Data Protection Commission within 72 hours and tell affected people directly, in plain language, without waiting to be asked.

11. Current students

This mailing list is for past pupils. We do not knowingly collect details from anyone under 18, and the signup form is not aimed at current students.

Sixth Years are welcome to join once they have left. Where the Union runs something that involves current students, their details are held by the school under the school’s own policies — never by the Union.

12. Complaints

If you are unhappy with how we have handled your data, please tell us first at privacy@oatlandsppu.ie — most things are a misunderstanding we can sort out quickly.

You also have the right to complain directly to the Irish supervisory authority, and you do not need to come to us first:

13. Changes to this notice

This notice is versioned, and the version you consented to is recorded against your record — you can see which one on your details page.

If we change anything material, we will email everyone on the list before it takes effect, and we will say plainly what changed. We will not quietly widen what we do with your data and rely on a website update to cover it.

Current version: 2026-09-01, last updated 1 September 2026.