Privacy.

Michael Lynch Safeguarding, 14 Arconagh, Naas, Co. Kildare, Ireland. Data protection enquiries through the contact form.

Only what is needed to do the work. When you make contact: your name, your organisation and whatever you choose to tell us, so that the enquiry can be answered. When your organisation buys training: the learner names your organisation supplies, and the record of what each learner was assessed on, so that certificates can be issued and your organisation holds the evidence it needs. Each learner has an account on the training platform holding their name and email address, the organisation they belong to, their attempts at the assessment and what they wrote or said in them, and the certificate issued, which carries the learner's name and the organisation's. Where an organisation names a designated liaison person to us, that person's name, email address and phone number are held so that the platform can route a concern to them.

The spoken assessment is processed to produce the result and the certificate. Recordings are held only as long as needed to produce and support that record, and are not used for any other purpose.

The processing is done by OpenAI. During the spoken part the microphone audio goes from the learner's browser to OpenAI directly, as it is spoken; during the written part what the learner types goes the same way. The scenarios are invented, but what a learner says in response to one is their own words, and the assessment deliberately watches for a learner disclosing something about a child's safety or their own, so that it can be brought to the organisation's designated liaison person. That text is in the request sent to OpenAI. What is not sent is who the learner is: their name, email address and organisation stay on the platform and are not included.

Contract, where the processing is needed to provide a service you have asked for. Legitimate interest, for answering enquiries. Legal obligation, where retention is required.

Personal data is never sold, is never used for advertising, and neither this website nor the training platform runs analytics of any kind. Eleven providers are named below: five in serving this website and handling an enquiry sent from it, and six in running the training platform. They are eight separate companies, because Cloudflare does three of those eleven jobs and Resend does two. Each is named here, with what it receives.

Serving this website, and an enquiry sent from it.

Cloudflare hosts this site, so every page you open is requested from its network: it sees your IP address, the user agent your browser sends, and which page was asked for. Turnstile is Cloudflare's check that the contact form is being used by a person rather than a script. It loads on the contact page for every visitor, before anything is typed and whether or not you go on to send anything, and what it takes is, in Cloudflare's own words, “client IP address, TLS Fingerprint, User-Agent Header and Sitekey and associated origin”. It sets no cookie here. For blocking bots, Cloudflare acts on this practice's instruction; for improving Turnstile itself, it acts on its own account and decides that purpose for itself. Its terms for both are the Turnstile Privacy Addendum.

Resend turns the contact form into an email, and is the only one of the five that sees what you wrote: your name, your email address, your organisation, the topic you chose, and the whole of your message. Microsoft 365 holds the mailbox that email arrives in, and so keeps it for as long as the mailbox does. Google Fonts serves the two typefaces this site is set in, which the next section describes.

Running the training platform. This is where learner records live, and it is a different set of providers from this website's.

Vercel hosts the platform, so every page a learner opens is requested from its network: it sees the IP address, the user agent your browser sends, and which page was asked for. Supabase is the database and the sign-in system behind it, and it holds everything the platform knows: names and email addresses, the organisations people belong to, every assessment attempt and what was written in it, the certificates and the names on them, the designated liaison person's contact details, and anything the assessment flagged as a possible disclosure. The training records this policy keeps for seven years are held there. Its database sits in Amazon's eu-west-1 region in Ireland, the same region the platform's own code runs in, and its interface is reached through Cloudflare's network.

OpenAI runs the assessment, and what reaches it is described under “Assessment recordings” above. Resend sends the platform's email as well as this website's — including the sign-in emails, so it sees the address of everyone who signs in and the contents of what is sent to them, and when a message bounces it reports the address back to the platform. Turnstile also runs on the platform's certificate-verification page, taking the same things it takes here, under the same Turnstile Privacy Addendum.

Stripe is the card processor the platform is built to use, and it is switched off: checked on 18 September 2026, the checkout does not answer. It is named here rather than left out, because it is in the platform and will be turned on. When it is, what will reach it is the buyer's email address and what they are buying. Card numbers would be typed on Stripe's own page and would never reach this practice.

None of these providers is asked to profile you or to advertise to you, and each is used only for the one purpose named against it.

Where a review or an investigation involves information about a child or a named individual, it is handled under the confidentiality terms agreed in writing for that engagement, and under the reporting obligations of the Children First Act 2015, which override any commercial confidentiality.

Enquiries: two years, in the mailbox they were delivered to. Training records: seven years, because your organisation may need to evidence training in that period — these are held in the platform's Supabase database, which is where the seven years are actually counted. Consultancy files: as agreed in the terms of reference for the engagement, and held by this practice rather than on the platform.

Access, rectification, erasure, restriction, portability and objection. Write to us through the contact form and it will be dealt with within one month. You may also complain to the Data Protection Commission, dataprotection.ie.

This website sets no cookies at all — none of its own, and none for tracking or advertising. Nothing is kept in your browser either: checked on 18 September 2026, this page and the contact page both left local storage and session storage empty, and neither set a cookie.

The training platform is different, and in one way only. Its public pages set no cookie either — checked the same day on its front page, its sign-in page, its certificate-verification page and its information page. Signing in sets a cookie that keeps you signed in. It is necessary for the platform to work at all, it is not used for tracking or advertising, and signing out ends it.

Two things are fetched from outside this website, and a browser cannot ask another server for a file without telling it where to send the reply, so each fetch discloses your address. The typefaces are fetched from Google Fonts (fonts.googleapis.com and fonts.gstatic.com) on every page, giving Google the address you are connecting from, the user agent, and the page you are reading. Turnstile (challenges.cloudflare.com) is fetched on the contact page only, and is described in the section above. The training platform fetches neither: it serves its typefaces from its own address, and it loads Turnstile on its certificate-verification page only.