Privacy notice: victorygarden.ie waiting list

Last updated: 19 October 2026

This notice explains what we do with your information when you join the victorygarden.ie waiting list. We’ve kept it short and in plain English. The waiting list is open only to people who live in Ireland or Northern Ireland.

1. Who we are

The controller of your personal data (the person responsible for it) is:

Jason Roe, a sole trader trading as Victory Garden
Address: Bandon, Co. Cork, Ireland
Email for privacy questions: [email protected]

We have not appointed a Data Protection Officer because the law does not require us to.

2. What we collect

When you sign up, we collect:

  • Your email address.
  • Where you live: whether it’s Ireland or Northern Ireland.
  • The first part of your Eircode or postcode: your Eircode routing key in Ireland (the first three characters, for example D02), or your postcode district in Northern Ireland (for example BT1). We don’t ask for your full Eircode or postcode.
  • A record of your consent: the fact that you ticked the consent box, the consent wording you saw and its version, the date and time you signed up, and the date and time you clicked the link in our confirmation email.

All of these fields are required. If you don’t give them, you can’t join the waiting list. Nothing else happens if you don’t sign up.

The form also contains a hidden box designed to catch spam bots. People never see or fill it in, and we don’t keep it. We don’t record your IP address with your sign-up, and the form doesn’t use any outside anti-spam service.

We don’t ask for your name, phone number or payment details, and we don’t use the information you give us to make automated decisions about you.

3. Why we use it, and our legal basis

We use your information to:

  • add you to our waiting list and confirm your sign-up: we email you a link, and you’re only signed up once you click it;
  • email you when victorygarden.ie opens, and send occasional emails about growing food at home, as described in the consent box;
  • check that you live in Ireland or Northern Ireland, the only places we deliver to, and get a rough idea of which areas interest is coming from so we can plan deliveries; and
  • keep a record that you agreed to hear from us, so we can prove it if asked.

Legal basis: your consent (Article 6(1)(a) GDPR, and the UK GDPR for Northern Ireland). We keep the consent record because it is needed to show that you consented (Article 7(1)).

Marketing emails: we only send you marketing emails because you ticked the box and confirmed by email. Every email we send says who it’s from and includes an unsubscribe link.

4. Withdrawing consent and unsubscribing

You can withdraw your consent at any time, for free:

Withdrawing consent doesn’t affect anything we did before you withdrew it. Once you unsubscribe, we stop emailing you. We keep only your email address on a “do not contact” list so that we don’t add you again by mistake.

5. Who we share it with

We don’t sell your information, and we don’t share it for other companies’ marketing.

We use service providers (“processors”) who handle your information only on our instructions, under a contract that meets data protection law:

  • Where your sign-up is stored. Our website runs on WordPress. Our sign-up form is built with the free SureForms plugin, which stores sign-ups in our own website database. They aren’t sent to the plugin’s maker.
  • Website hosting: Hostinger International Ltd (Larnaca, Cyprus). Hostinger hosts our website and its database on servers in France. Hostinger also keeps daily backups of the website, which contain copies of sign-ups, in Lithuania.
  • CDN, security and analytics: Cloudflare, Inc. (USA). Visits to our website, including the sign-up form, pass through Cloudflare’s network, which protects the site and helps it load quickly. Cloudflare also provides privacy-first Web Analytics (see section 10). We use Cloudflare through our own Cloudflare account.
  • Sending our emails. Confirmation emails and waiting-list update emails are sent from our website through our host, Hostinger International Ltd (Cyprus), using Hostinger’s mail servers. Hostinger delivers those emails through its email-delivery sub-processor MailChannels Corporation (Canada). There is no open or click tracking on our emails.

We may also disclose information if the law requires it, for example to a regulator or court.

6. Transfers outside Ireland, the EEA and the UK

Your sign-up is stored in the European Union. Our website and its database are hosted in France, and backups are kept in Lithuania.

Some of our providers are based outside the European Economic Area:

  • Cloudflare is a US company. Your information passes through Cloudflare’s network when you visit our website or sign up, and Cloudflare’s analytics script reports page views to Cloudflare, so it may be processed outside the EEA. That transfer is protected by the EU-US Data Privacy Framework (including its UK extension) and by Standard Contractual Clauses, with the UK Addendum for Northern Ireland users.
  • MailChannels Corporation is a Canadian company. When Hostinger sends our confirmation and update emails, they are delivered through MailChannels. Transfers to Canada for this kind of commercial email delivery are covered by the European Commission’s adequacy decision for Canadian commercial organisations (Commission Decision 2002/2/EC, reviewed in January 2024). For Northern Ireland users, the same Canadian commercial sector is covered by UK adequacy regulations (partial adequacy limited to processing subject to Canada’s PIPEDA).

Hostinger’s data processing terms also say that transfers outside the EEA by Hostinger or its sub-processors are covered by the EU Standard Contractual Clauses, plus the UK International Data Transfer Addendum for data from the UK. For Northern Ireland users, UK law treats the EEA as giving adequate protection. You can ask us for a copy of these safeguards at the email address in section 1.

7. How long we keep it

We keep your information until the waiting list closes or 18 months after you sign up, whichever comes first. Then we delete it automatically. If you don’t click the link in our confirmation email, we delete your sign-up automatically after 30 days. If you unsubscribe, we delete your details within 30 days, apart from your email address on our “do not contact” list (see section 4). Deleted sign-ups may stay in our website backups for up to about six weeks before the backups are overwritten. We keep your consent record for as long as we keep your details, in case we need to show we had your consent.

8. Your rights

You have the right to:

  • access your information and get a copy of it (Article 15);
  • have it corrected if it’s wrong (Article 16);
  • have it deleted (Article 17);
  • restrict how we use it (Article 18);
  • receive it in a portable format, or have it sent to another organisation (Article 20);
  • object to direct marketing at any time (Article 21); and
  • not be subject to decisions based solely on automated processing (Article 22). We don’t make any.

To use these rights, email [email protected]. It’s free. We’ll reply within one month, and we may ask you to confirm your identity first.

9. Complaints

Please contact us first so we can try to put things right. You also have the right to complain to a data protection regulator:

10. Cookies and analytics

Our website sets no cookies when you visit. Our sign-up form doesn’t use reCAPTCHA or any other outside anti-spam service. Our fonts are served from our own website. Our emails don’t contain open-tracking pixels or click-tracking links.

We use Cloudflare Web Analytics, a privacy-first analytics tool from Cloudflare, Inc. Cloudflare injects a small script (static.cloudflareinsights.com/beacon.min.js) on every page. That script collects page views and performance data (for example how long a page takes to load). According to Cloudflare, it does not set cookies, does not use local storage, and does not fingerprint visitors by IP address, browser details or other data for analytics. Because no cookies are set, there’s no cookie banner for this tool. If we add any cookies or other tracking later, we’ll ask for your consent first where the law requires it, and update this notice.

11. Age

The waiting list is for adults aged 18 or over. We don’t knowingly collect information about children. If you think a child has signed up, contact us and we’ll delete their details.

12. Changes to this notice

We may update this notice, for example if we change providers. We’ll change the “Last updated” date at the top, and if a change is significant we’ll tell you by email before it takes effect.