1. Overview
Onboard Retail Limited (Company No. 812075), registered in Ireland at the address Building 11, Cherrywood Business Park D18 DH50, Dublin 18, trading as Onboard Retail (“we”, “us” and “our”) is committed to protecting and respecting your privacy and comply with our obligations under the Data Protection Act 2018 and the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, also commonly known as “General Data Protection Regulation” (GDPR) (together the “Data Protection Laws”).
Personal Data refers to any information relating to an identified or identifiable natural person (Data Subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, economic, cultural or social identity of that natural person.
This Privacy Statement explains how we collect, use, disclose, and protect personal data when you interact with our website, marketing activities, events, and recruitment processes.
In the context of this Statement, Onboard Retail acts as a Data Controller.
2. Personal data we collect
You may explore the website without providing any personal data. When you visit the website or fill in forms on the website, for example to contact us or to download our resources, it becomes essential for us to request that you provide personal data so that we can provide the information you requested.
We ensure that the personal data We collect is adequate, relevant, and limited to what is necessary for the purposes for which it is processed. We only request information that is required to provide our services, respond to enquiries, or fulfil specific business or legal obligations, and we do not collect excessive or unnecessary personal data.
2.1 Categories of personal data
Depending on our relationship with you, personal data collected may include:
- Information you provide to us
- Name
- Business contact details (email address, phone number)
- Employer, job title
- Preferences for receiving communications, along with records of interactions with us
- Information provided via forms or correspondence
- CVs and application-related information (for recruitment)
- Information collected automatically – When you use our website, we may collect:
- IP address
- Device and browser information
- Usage data (pages visited, time spent, referring URLs)
- Information from Third Parties – We may obtain limited business contact information from event organisers or from publicly available sources (e.g. professional networking platforms), where permitted by law.
3. How and why we use your personal data
We collect and process personal data for specific, explicit, and legitimate purposes. We only process personal data where we have a valid legal basis to do so under applicable data protection laws.
The provision of personal data is generally voluntary. However, where we require certain information to respond to your enquiry, provide requested services, or comply with legal obligations, failure to provide such data may mean that we are unable to fulfil your request or engage with you effectively.
We will always clearly indicate where personal data is mandatory at the point of collection.
3.1 Purposes and legal bases for processing
The table below outlines the purposes for which we process personal data and the lawful bases we rely on:
| Purpose of Processing | Categories of Data | Legal Basis |
| Responding to enquiries and providing requested information | Contact details, communication data | Legitimate interests |
| Managing and improving our website and user experience | Technical and usage data (e.g. IP address, browser type) | Legitimate interests (for essential functionality) Consent (for non-essential cookies), |
| Sending marketing communications and promotional content | Contact details, communication preferences | Consent and/or legitimate interests (where permitted by law, e.g. soft opt-in) |
| Administering events, webinars, and business relationships | Contact details, professional information | Legitimate interests |
| Managing recruitment processes | CVs, application data | Contractual necessity (pre-contractual steps) |
| Ensuring network and information security, preventing misuse | Technical data, system logs | Legitimate interests |
| Complying with legal and regulatory obligations | Relevant personal data as required | Legal obligation |
Where we rely on legitimate interests, we ensure that:
- the processing is necessary for a legitimate business purpose;
- it does not override your fundamental rights and freedoms; and
- appropriate safeguards are in place.
You have the right to object to processing based on legitimate interests at any time (see “Your rights” section 11).
4. Sharing your personal data
We only share personal data where necessary and in line with applicable law. Recipients may include:
- Service providers acting on our behalf (e.g. IT, hosting, CRM, recruitment systems)
- Professional advisers (legal, audit)
- Public authorities or regulators where required
All processors are subject to:
- Contractual obligations under Article 28 GDPR
- Appropriate confidentiality and security requirements
Please be informed that we do not sell your personal data to third parties.
5. International transfers
Where personal data is transferred outside the EEA, we ensure that appropriate safeguards are in place, such as European Commission Standard Contractual Clauses (SCCs) or transfers to countries with an adequacy decision. We assess transfers on a case-by-case basis and implement supplementary measures where required.
6. Automated decision-making and profiling
We do not carry out automated decision-making, including profiling, that produces legal effects or similarly significantly affects individuals.
If this position changes in the future, we will update this Privacy Statement and ensure that any such processing is carried out in compliance with applicable data protection laws, including implementing appropriate safeguards and informing you of your rights.
7. Data retention
We retain personal data for no longer than necessary for the purposes for which it was collected.
Typical retention periods are as follows.
- Marketing and business contacts: up to 2 years from last meaningful interaction
- Recruitment data: up to 12 months after process completion
- Technical data: in line with security and analytics requirements
We may retain data longer where necessary for legal compliance or for the establishment, exercise, or defence of legal claims.
8. Cookies and similar technologies
We use cookies in a transparent and lawful manner. For detailed information, please see our Cookie Statement.
9. Security of personal data
We implement appropriate technical and organisational measures aligned with ISO 27001 principles to ensure a level of security appropriate to the risk, including the following.
- Access controls and least-privilege principles
- Encryption and secure transmission
- System monitoring and incident detection
- Physical and organisational safeguards
- Any other technologies and tools that Retail inMotion believes may enhance the security of its systems and facilities
While we take appropriate measures, no system can be guaranteed to be completely secure.
10. Links to third party websites
The Onboard Retail website contains links to other websites that are not operated by us. Our Privacy Statement applies only to the website, and it does not address the privacy or any other practices of any third parties, including any third-party operating websites or services that may be accessible via a link from this website. We strongly advise you to review the privacy statements of these sites as we have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.
11. Your rights
You may have a right to access and rectify or erase your Personal Data or receive a copy of your personal data, restrict or object to the active processing of your data, ask us to share (“port”) your personal information to another entity, withdraw any consent you provided to us to process your data, a right to lodge a complaint with a statutory authority and such other rights as may be relevant under applicable laws.
To exercise these rights, you can write to Data Protection Office in Onboard Retail at dataprotection@onboardretail.com. We will respond to your request in accordance with applicable laws, without undue delay and within one month of receipt. In certain circumstances, where requests are complex or numerous, we may extend this period by a further two months. In such cases, we will inform you of the extension and the reasons for the delay. Requests are generally handled free of charge, however, where a request is manifestly unfounded, excessive, or repetitive, we may charge a reasonable fee or refuse to act on the request, in accordance with applicable data protection laws.
Please be informed that we may need to request specific information from you to confirm your identity before processing your request. This is a security measure to ensure that personal data is not disclosed to any person who does not have the right to receive it.
Note that, if you do not allow us to collect or process the required personal information or withdraw the consent to process the same for the required purposes, you may not be able to access or use the services for which your data was sought.
11.1 User's rights under GDPR (for EU/EEA users)
If you are a user located in EU or the EEA, you can exercise your privacy rights in accordance with applicable laws (i.e., data protection laws).
Considering the nature of the processing, we will respond to requests for exercising user's rights under GDPR as set forth below.
- The right to be informed – You have the right to receive fair processing information about your Personal data, including and without limitation, the recipients or categories of recipients to whom the Personal data has been or will be disclosed.
- The right to access – You have the right to request Onboard Retail for copies of your Personal data held by Us.
- The right to rectification – You have the right to request that Onboard Retail correct any information you believe is inaccurate. You also have the right to request Our Company to complete the information you believe is incomplete.
- The right to erasure (or right to be forgotten) – You have the right to request that Onboard Retail erase your Personal data, subject to certain conditions.
- The right to restrict processing – You have the right to request that Onboard Retail restrict the processing of your Personal data, subject to certain conditions.
- The right to object to processing – You have the right to object to Onboard Retail’s processing of your Personal data, subject to certain conditions.
- The right to data portability – You have the right to request that Onboard Retail transfer the data that we have collected to another organization, or directly to you, subject to certain conditions.
- The right to lodge a complaint – You also have the right to lodge a complaint with a supervisory authority if you believe that your personal data has been processed in a manner that does not comply with applicable data protection laws. For more information, please see the “Complaints” section below.
If you would like to exercise any of these rights, please contact our Data Protection Office at dpc@retailinmotion.com
Please note that these rights are not absolute and may be subject to certain conditions or limitations under applicable data protection laws.
12. Special categories of personal data
We do not generally seek to collect special categories of personal data through our website, marketing, business development, or general enquiry channels. Where special category data is provided to us, for example by a job applicant voluntarily including such information in an application, we will process it only where permitted by law and where necessary for the relevant purpose.
13. Children's privacy
None of our services are intended to be used by children under 16 years of age and we do not knowingly collect or process Personal data from children or wish to do so.
14. Changes to our Privacy Statement
We may update this Privacy Statement from time to time to reflect changes in legal, regulatory, or operational requirements.
We encourage you to review this page periodically.
If the revised Privacy Statement includes changes that we believe materially affect how we process your information, we will provide you with an appropriate online notice or alternative means (which may include, if you have authorised us to do so, notifying you via email).
15. Contact details
Onboard Retail is the Data Controller. If you have any comments or queries regarding Our Privacy Statement or Cookie Statement or if you have any concerns regarding your Personal data held with us, please contact Our Data Protection Office via:
- Email: dataprotection@onboardretail.com
- Telephone: +353 (0)1 445 1212
- Post: Onboard Retail, Building 11, Cherrywood Business Park, Loughlinstown, Dublin 18, D18 DH50, Ireland.
16. Complaints
If you believe your data has been handled in a way that does not comply with data protection law, you have the right to lodge a complaint with a supervisory authority.
As we are located in Ireland, we are regulated for data protection purposes by the Irish Data Protection Commission. You can contact the Data Protection Commissioner as follows.
- Website: https://www.dataprotection.ie/
- Phone: +353 1800 437 437 or +353 (0)1 7650 100
- Email: info@dataprotection.ie
- Webforms: https://forms.dataprotection.ie/contact
Last updated May 2026