Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

DevEire Ltd is incorporated in Ireland and is subject to the General Data Protection Regulation (GDPR) as implemented in Irish law under the Data Protection Act 2018. We are committed to ensuring that your privacy is protected in accordance with all applicable data protection legislation.

2. Information We Collect

We collect information that you provide directly to us, information that is generated automatically when you use our Service, and information from third-party sources.

2.1 Account and Profile Data

When you register for an account or interact with our Service, we may collect:

• Full name and job title
• Email address
• Company or organisation name
• Phone number
• Billing and postal address
• Account credentials (passwords are stored in hashed form only)
• Role and permission settings within your organisation

2.2 Insurance Product Data

When you use ProductBuilder to design and manage insurance products, we process:

• Form schemas and field configurations
• Underwriting rules and rating tables
• Reference data sets (e.g. postcode lookups, SIC codes)
• Quote submissions and calculation results
• Policy and claims data managed through the platform

2.3 Usage and Technical Data

When you access our Service, we automatically collect:

• IP address and approximate geolocation
• Browser type, version, and language preferences
• Operating system and device information
• Pages visited, features used, and time spent on the Service
• Referring URL and exit pages
• Error logs and performance data

2.4 Cookie Data

We use cookies and similar tracking technologies to enhance your experience. This includes essential cookies required for the Service to function, analytics cookies to understand usage patterns, and preference cookies to remember your settings. For full details, please see our Cookie Policy.

2.5 Payment Data

We use Stripe as our payment processor. When you subscribe to a paid plan or make a payment, Stripe collects and processes your payment card details directly. We do not store your full card number on our servers. We receive from Stripe only:

• Last four digits of your card number
• Card brand and expiry date
• Billing address
• Transaction identifiers and payment status

2.6 Communications Data

When you contact us via email, through our website, or through in-app support, we collect the content of your communications, including any attachments, along with metadata such as date, time, and sender information.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Providing the Service: To create and manage your account, deliver the ProductBuilder platform, process insurance product configurations, and handle quote submissions and policy administration.
• Billing and Payments: To process subscription payments, send invoices, and manage your billing relationship through our payment processor, Stripe.
• Communication: To send you transactional emails (account verification, password resets, billing notifications), respond to your enquiries, and provide customer support.
• Product Improvement: To analyse usage patterns, diagnose technical issues, and improve the functionality, performance, and reliability of the Service.
• Security: To detect, prevent, and respond to fraud, abuse, security incidents, and other harmful activity.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests, including insurance regulatory requirements.
• Marketing (with consent): To send you information about new features, product updates, and industry insights, only where you have opted in to receive such communications.

4. Legal Basis for Processing

Under the General Data Protection Regulation (GDPR), we process your personal data on the following legal bases:

• Performance of a Contract (Article 6(1)(b)): Processing is necessary to provide the Service you have subscribed to, including account management, product configuration, and quote processing.
• Legitimate Interests (Article 6(1)(f)): We process data for our legitimate business interests, including improving the Service, ensuring security, preventing fraud, and conducting analytics. We carefully balance these interests against your rights and freedoms.
• Consent (Article 6(1)(a)): Where required, we obtain your explicit consent before processing, particularly for marketing communications and non-essential cookies. You may withdraw consent at any time.
• Legal Obligation (Article 6(1)(c)): We process data where necessary to comply with legal obligations, including tax, accounting, and insurance regulatory requirements.

5. Data Sharing and Third Parties

We do not sell your personal data. We share information only in the following circumstances:

5.1 Service Providers

• Stripe: Payment processing. Stripe acts as an independent data controller for payment data. See Stripe's Privacy Policy.
• Cloud Hosting Providers: Infrastructure and data storage, operating under strict data processing agreements with appropriate safeguards.
• Analytics Providers: Aggregated usage analytics to help us understand how the Service is used.
• Email Service Providers: Transactional and marketing email delivery.

5.2 Legal and Regulatory Disclosure

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5.3 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of assets, your personal data may be transferred to the acquiring entity. We will notify you of any such change and any choices you may have regarding your information.

5.4 With Your Consent

We may share your information with third parties when you have given us explicit consent to do so.

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.

• Account Data: Retained for the duration of your account and for up to 12 months after account closure, unless longer retention is required by law.
• Insurance Product Data: Retained for the duration of your subscription. Upon cancellation, product data is retained for 90 days to allow for reactivation, after which it is permanently deleted.
• Transaction and Billing Data: Retained for 7 years to comply with tax and accounting obligations under Irish and EU law.
• Usage and Analytics Data: Retained in aggregated, anonymised form indefinitely. Identifiable usage data is retained for up to 24 months.
• Communications Data: Retained for up to 36 months from the date of the last communication.

When data is no longer required, it is securely deleted or anonymised in accordance with our data disposal procedures.

7. Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights in relation to your personal data. You can exercise any of these rights by contacting us at hello@productbuilder360.com.

We will respond to all legitimate requests within one month. In certain circumstances, we may extend this period by a further two months, in which case we will inform you. If you are unsatisfied with our response, you have the right to lodge a complaint with the Data Protection Commission (DPC) of Ireland at www.dataprotection.ie.

8. International Data Transfers

Your personal data is primarily stored and processed within the European Economic Area (EEA). Where we transfer data outside the EEA, we ensure that appropriate safeguards are in place, including:

• Adequacy Decisions: Transfers to countries that the European Commission has determined provide an adequate level of data protection.
• Standard Contractual Clauses (SCCs): EU-approved contractual clauses that provide appropriate safeguards for personal data transferred to third countries.
• Data Processing Agreements: Binding agreements with all service providers that process personal data on our behalf, ensuring GDPR-equivalent protections.

You may request a copy of the safeguards in place for international transfers by contacting us at hello@productbuilder360.com.

9. Security Measures

We implement robust technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Our security framework is aligned with internationally recognised standards.

Our security measures include, but are not limited to:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Multi-factor authentication for administrative access
• Regular security assessments and penetration testing
• Access controls based on the principle of least privilege
• Continuous monitoring and logging of system activity
• Incident response procedures with defined escalation paths
• Regular employee security awareness training
• Secure software development lifecycle (SDLC) practices

While we strive to protect your personal data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we are committed to continuously improving our protections.

10. Children's Privacy

ProductBuilder is a business-to-business platform designed for use by insurance professionals and organisations. Our Service is not directed at individuals under the age of 18, and we do not knowingly collect personal data from children.

If we become aware that we have inadvertently collected personal data from a child under 18, we will take immediate steps to delete that information. If you believe we may have collected data from a minor, please contact us at hello@productbuilder360.com.

11. Third-Party Links

The Service may contain links to third-party websites, services, or applications that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access through our platform.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify you by email if the changes materially affect how we process your personal data
• Where required by law, obtain your consent before applying changes that affect existing data processing

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For data protection enquiries or to exercise your rights under GDPR, please include "Data Protection Request" in your email subject line. We aim to respond to all enquiries within 48 hours.