Privacy Policy
Short version: we collect the minimum we need to prepare your paperwork, we tell you who else touches it, we don't sell your data, and we make it easy to exercise your rights. The long version follows.
What's in here
1. Who's responsible
NobleMC BV (trading as ClientReady), registered in the Netherlands, KvK 84270616. Founder and day-to-day data contact: Wayne O'Sullivan. Email hello@clientready.eu for any privacy question.
2. Our two roles: controller and processor
We wear two different data-protection hats depending on the data in front of us:
Controller — for your own account, billing and contact data. We decide why and how it's used (delivering your order, sending receipts, responding to support).
Processor — for tenant PII you upload as part of an RTB notice. The landlord is the data controller for the tenant. We process that tenant data only to prepare and deliver the notice you asked for; we don't reuse it for anything else, and we delete it on the retention schedule below.
If you're a letting agent, you and your landlord client should have your own paperwork sorting out who is controller versus processor between yourselves. Our processing terms with you (as processor) are set out in the RTB service order confirmation and, on request, in a standalone data-processing addendum for volume customers.
3. What we collect & why
When you buy an RTB notice
- Landlord full name and email address — to draft the notice, deliver the PDF, send receipts, provide support.
- Tenant full name — printed on the notice as required by section 12.
- Property address, Eircode, dwelling type, bedrooms, floor area, BER, tenancy commencement date, proposed rent — required to prepare the notice and to pull three comparables from the RTB Rent Register.
- PSRA licence number — only if you use the free agency trial, to verify eligibility against the public PSRA register.
When you buy a pack or an audit
- Business name and email — for delivery and support.
- Audit intake responses — whatever you tell us about your business so we can do the review.
When you contact us
- Email address, name, and whatever you write to us — to reply. We keep these threads for as long as they're useful for support (typically 2 years) and then delete them.
Automatically
- Server access logs at Netlify (static site) and Fly.io (notice-generation backend) — IP address, timestamp, requested URL, response code. Used for security monitoring and debugging. Retained per each provider's default (typically ≤ 30 days).
- Email delivery events at Postmark — sent/opened/bounced status for transactional emails, retained ~45 days by Postmark default.
What we do NOT collect
We do not run Google Analytics, Meta Pixel, Hotjar or any other behavioural analytics on the site. We do not sell, rent or share your data with advertisers. We do not build marketing profiles. If we ever add analytics, it will be a privacy-first tool (Plausible or similar), it'll be named here, and it'll respect your Do Not Track signal.
4. Legal bases (GDPR Article 6)
- Contract (Art 6(1)(b)) — for everything needed to deliver the service you paid for, including preparing the notice and emailing it to you.
- Legal obligation (Art 6(1)(c)) — for retaining order records and VAT invoices for the statutory tax retention period.
- Legitimate interest (Art 6(1)(f)) — for server security logs, fraud prevention, PSRA verification on the agency trial, and to reply to your support emails. Our interest: running a reliable and secure service. This is balanced against your interests, and you can object at any time.
- Consent (Art 6(1)(a)) — for any optional communication (e.g. if we ever email you a product update outside your order). Consent can be withdrawn at any time. We currently send only transactional emails; we don't run a marketing list.
5. Who else touches your data (sub-processors)
To run the service we use these third parties. Each has their own privacy terms and each is bound by a data-processing agreement or equivalent contractual protections with us.
| Sub-processor | Purpose | Location |
|---|---|---|
| Netlify Inc. | Static site hosting (clientready.eu). Serves HTML, CSS, images. | United States (edge nodes worldwide) |
| Fly.io Inc. | Backend for the RTB notice service (intake, PDF generation, order status). Hosted in Fly's EU region. | United States (data processing in EU region) |
| Wildbit LLC (Postmark) | Transactional email delivery — the PDF and receipts land in your inbox via Postmark. | United States |
| Payhip Ltd | Payment processing and EU merchant of record for digital goods. Captures your name, email and payment method. | United Kingdom |
| AutoAddress (via RTB Register) | Eircode lookup — resolves your Eircode into a street/town/city so we can populate the address fields. | Republic of Ireland |
| Google Fonts | Serves the Fraunces and Inter typefaces used on the site. Note: your browser makes a request to Google's font CDN which reveals your IP address. See Cookies section for the flag on this. | United States (edge nodes worldwide) |
Local, on-server tools that don't transfer data externally include LibreOffice and Microsoft Edge (headless) — used to render the notice PDF on our Fly.io server. No data leaves the Fly EU region for PDF rendering.
If we add or change a sub-processor, this list is updated with the "Last updated" date at the top of the page.
6. How long we keep it
- Order records at Payhip — retained per Payhip's policy, typically 7 years for tax/VAT reasons. This is a legal obligation.
- Generated notice PDFs on our Fly.io volume — 30 days. After 30 days the PDF is deleted by an automated purge and the re-download link expires. Ask us for a fresh copy if you need one later.
- Intake form data (property details, tenant name) on our server — 30 days, purged on the same schedule as the PDF.
- Email delivery logs at Postmark — Postmark's default 45-day retention for sent/opened/bounced events.
- Server access logs at Netlify & Fly.io — provider default, typically ≤ 30 days.
- Support emails — retained in our inbox for up to 2 years, then deleted or archived off-service.
- Agency trial PSRA verification records — retained for the life of your account plus 12 months, then deleted.
7. International transfers
Several of our sub-processors are US-based (Netlify, Fly.io, Postmark, Google Fonts). Where personal data flows to them we rely on the European Commission's Standard Contractual Clauses (SCCs) as the transfer mechanism, plus each provider's supplementary technical safeguards (encryption in transit, encryption at rest). None of these providers has flagged you individually to us in a way that would concern us; if that ever changed we'd tell you.
Payhip is UK-based; the UK has an EU adequacy decision so transfers there are permitted without additional safeguards.
8. Cookies & the website itself
We do not set analytics or marketing cookies on clientready.eu. The site serves static HTML from Netlify's edge; no session cookie is set for browsing. There is no consent banner because there is nothing to consent to for site browsing.
Two caveats worth naming honestly:
- Google Fonts — the site loads two typefaces (Fraunces, Inter) from Google's font CDN. This is a network request to Google that reveals your IP address; no cookie is set, but the request is made from your browser. Some EU regulators have taken a dim view of embedded Google Fonts (a 2022 German court ruling against a Google-Fonts-embedding site is the well-known example). We are aware of this and plan to self-host these fonts as a future improvement. In the meantime we've named it here rather than pretend it doesn't happen.
- The notice-generation backend (clientready-rtb-notice.fly.dev) may set a short-lived session cookie during the intake → payment flow to keep your order draft together. This is a strictly-necessary functional cookie.
- Payhip checkout — when you click "Buy" you go to Payhip's own domain, where their own cookies apply. Their privacy notice at payhip.com/privacy governs that step.
9. Your rights and how to use them
Under GDPR you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate data
- Erase your data ("right to be forgotten"), subject to our legal retention obligations
- Restrict processing in certain circumstances
- Object to processing based on legitimate interest
- Data portability — receive your data in a machine-readable format
- Not be subject to automated decisions that produce legal effects — for the record, we don't make any such automated decisions
How to exercise your rights
- Email hello@clientready.eu with the subject line "Data request — [rectification / erasure / access / etc]" and the email address you used with us.
- We may ask one or two questions to verify it's really you (usually just the order reference).
- We reply within 30 days. Simple requests are usually done same-week.
- The service is free. If a request is manifestly excessive or repetitive we may charge a reasonable admin fee — but this hasn't happened yet.
10. Complaints
If we've failed you, please tell us first — we take this seriously and it's the fastest route to a fix. If you're not satisfied with our response, you have the right to complain to a supervisory authority:
- Netherlands — Autoriteit Persoonsgegevens (AP), our lead supervisory authority as NobleMC BV is Dutch-registered.
- Ireland — Data Protection Commission (DPC), if you're in Ireland and your complaint relates to Irish processing.
- Any other EU/EEA supervisory authority in your country of residence.
11. Changes to this policy
We revisit this policy whenever a sub-processor changes, we launch a new product, or a regulator says something material. The "Last updated" date at the top of the page reflects the current version. Material changes affecting active customers are also emailed.
See also: Terms of Service · Refund Policy · IP Notice