Ossory Forest School

Ossory Forest School – Privacy Policy

Ossory Forest School 

Privacy Policy

At Ossory Forest School, we are committed to protecting and respecting the privacy of our attendees, parents, and guardians. This Privacy Policy explains how we collect, use, process, and protect your personal data and your child’s or the participant’s personal data when you book sessions through our website and our third-party booking system, Ticket Tailor. This privacy policy is effective from 20th October, 2026. 

We operate as the Data Controller for your information. Our processing complies with the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018 [1.1, 1.2].

1. Information We Collect and Why

Because we provide outdoor educational sessions and events for children, we must collect specific information to ensure their physical safety, fulfillment of bookings, and compliance with safeguarding standards.

Personal Data (Parents/Guardians)

  • Contact Details: Name, email address, address, phone number, and billing details.
  • Purpose: To manage your bookings, send confirmation tickets via Ticket Tailor, process payments, and contact you in an emergency.

Personal & Special Category Data (Children)

  • Attendee Details: Participant’s / Child’s name, age, and gender.
  • Special Category Data: Medical conditions, severe allergies, dietary requirements, mobility or physical difficulties and relevant behavioral or accessibility needs [1.1].
  • Purpose: To ensure your child’s health, safety, and well-being while in the woods or on site.

2. Our Lawful Bases for Processing Data

Under Irish and EU data protection laws, we rely on the following legal grounds to process data:

  • Contractual Necessity: To fulfill the booking service you purchased from us.
  • Vital Interests: To protect the physical safety of your child in an emergency (e.g., passing critical medical or allergy info to emergency services or administering first aid in the case of an emergency) [1.1].
  • Legal Obligation: To comply with Irish child safeguarding regulations and tax laws.
  • Explicit Consent: For optional activities such as newsletter marketing, emails, social media posts, whatsapp announcements, whatsapp communities and groups, and promotional photography [1.1].

3. Photography, Videography, and Media Choices

We occasionally capture photos and videos during our forest school sessions. To protect children’s identities, our standard practice is to take photos where faces are not clearly visible (e.g., from behind, unclear faces or focusing on hands/activities). We respect your privacy by offering three granular options at checkout via Ticket Tailor:

  1. Full Consent: You permit photos/videos (without faces) to be shared with parent groups AND used on our public social media for marketing.
  2. Internal Only: You permit photos/videos (without faces) only to be shared privately with other parents/guardians from that specific event. They will not be put on public social media.
  3. Total Opt-Out: No photos or videos will be taken of your child under any circumstances.

You can change or withdraw your consent at any time by emailing us at: info@ossoryforestschool.ie

4. Data Sharing and Third-Party Processors

We never sell your data. We only share data with trusted service providers who actively comply with GDPR:

  • Ticket Tailor: Our ticketing platform. They act as our Data Processor, and all data is securely hosted on AWS servers located within the EU (Dublin, Ireland).
  • Payment Processors: Payments are securely processed via encrypted gateways (like Stripe or PayPal). We do not store or see your credit card details.
  • On-Site Forest School Leaders and Assistants: Certified leaders are given encrypted or password-protected access to medical and attendance registers solely for running active sessions safely. Volunteers and staff may also be temporarily given a paper copy of emergency contact details, medical information etc. on site – which is stored securely before and after events and is shredded within one year after an event. 

5. Data Retention: How Long We Keep Records

We do not store personal data longer than necessary for its operational purpose.

  • Ticket Tailor Accounts: General booking logs are reviewed and anonymized or deleted periodically after an event cycle concludes or within one year of an event. 
  • Digital logs of data on excel document – password protected – are kept for as long as necessary during and after events  – if consent is given for marketing
  • Medical Logs & Incident Reports: If an incident or injury occurs during a session, the relevant logs, sign-in sheets, and waivers are archived and kept securely in accordance with the strict timelines mandated by our public liability insurance policy and statutory limitation periods.

6. Your Legal Data Rights

Under the GDPR, you have the following rights regarding your data and your child’s data:

  • Right of Access: You can request a digital copy of all personal data we hold about you or your child.
  • Right to Rectification: You can ask us to correct inaccurate or incomplete information.
  • Right to Erasure (“Right to be Forgotten”): You can request that we delete your data, provided it does not conflict with our legal or insurance retention obligations.
  • Right to Restrict Processing: You can object to or limit how we use your data (e.g., opting out of marketing).

7. Contact Us & Complaints

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact our data compliance lead:

  • Name/Entity: Ossory Forest School
  • Location: Rathdowney, Co. Laois, Ireland
  • Email: info@ossoryforestschool.ie

If you are unsatisfied with how we handle your data, you have the right to lodge a formal complaint with the Irish supervisory authority: