This Privacy Policy explains how MyStatePension.ie ("we," "our," or "us") collects, uses, processes, and shares personal data when you visit our website and use our pension inquiry forms.
We operate strictly as an online marketing and lead generation platform. We are not a financial advisor or retail intermediary, and we are not regulated by the Central Bank of Ireland.
01The personal data we collect
We practise "data minimisation" and only collect the bare minimum information required to fulfil your inquiry:
- Identity Data
- Full name.
- Contact Data
- Email address and phone number.
- Contextual Data
- Age bracket or basic inquiry type (e.g., "Starting a new pension" or "Consolidating an old pension").
- Technical Data
- IP address, browser type, and submission timestamp (collected automatically to satisfy audit and compliance tracking requirements).
We strictly do not collect any financial information (such as bank details or income) or special categories of sensitive data (such as health conditions or PPS numbers).
02Legal basis for processing
Under Article 6 of the GDPR, we rely on the following lawful bases to handle your data:
- Consent
- You give us explicit, unambiguous permission via an active opt-in checkbox on our form to route your contact details to an authorised broker. You can withdraw this consent at any time.
- Legitimate Interests
- We process your technical data (IP address, timestamps) to secure our website against fraud and maintain a verifiable audit trail of your data consent.
03How we share your data (data recipients)
We operate an independent data transfer model. We act as an Independent Data Controller up until your data is transferred. Upon submitting an inquiry, your identity and contact details will be shared securely with one of our vetted, Central Bank of Ireland-regulated partner brokers.
- Independent Control
- Once your data is transferred, the receiving partner broker becomes an Independent Data Controller of that data. They will process your data under their own corporate Privacy Policy and Terms of Business to provide you with pension advice.
- Purpose Limitation
- Our partners are contractually banned from using your shared contact details for any purpose other than fulfilling your specific pension inquiry. They cannot sell or distribute your data to third-party marketing networks.
- Commercial Disclosure
- We receive a lead-generation fee from our partner brokers for initiating this introduction.
04Technical security & data routing
We protect your data using industry-standard security safeguards:
- Encryption in Transit
- All web form submissions are fully encrypted via HTTPS while travelling from your browser to our database.
- Secure API Routing
- Your data is transmitted to the partner broker via secure, password-protected CRM integrations or encrypted webhooks, never via plain-text spreadsheets or standard unencrypted email.
05Data retention (our 30-day purge policy)
We do not store your personal details indefinitely.
- Anonymisation Window
- We retain your active contact information (name, email, phone number) for a maximum of thirty (30) days from the date of submission. This short window is used solely to handle lead validation queries or payment reconciliations with our partner brokers.
- Automatic Deletion
- Upon the expiration of the 30-day window, your identifiable contact records are automatically and permanently purged from our live web servers, leaving only anonymous metadata (e.g., date of lead, token ID) for financial accounting records.
06Where your data is processed
Your personal data is hosted and stored on servers located within the European Economic Area (EEA). We do not transfer your personal data outside of the EEA or to countries lacking an adequate data protection framework under EU law.
07Your GDPR data subject rights
As an Irish resident, you hold extensive rights under the GDPR regarding your personal data. You may exercise these at any time by emailing us at info@mystatepension.ie.
- Right of Access
- Request a copy of the personal data we hold about you.
- Right to Rectification
- Request correction of inaccurate contact details.
- Right to Erasure ("Right to be Forgotten")
- Request that we wipe your information from our database prior to our automated 30-day purge cycle.
- Right to Withdraw Consent
- Revoke your consent to have your data shared (if the transfer has not occurred yet).
If you believe your data has been handled unlawfully, you have a legal right to lodge a formal complaint with the Data Protection Commission (DPC) via their official portal at www.dataprotection.ie.
08Cookies & analytics
We do not use advertising or tracking cookies. We use one optional analytics tool, and it is switched off until you actively agree to it.
- Consent first
- When you first visit, we ask whether you are happy for us to use analytics cookies. Nothing is loaded and no analytics cookie is set unless you choose "Yes." If you decline, the analytics script is never downloaded, and the site works exactly the same.
- What we use it for
- If you agree, we use Google Analytics 4 to understand which pages visitors find useful — for example, which guides get read and where people drop off — so we can improve the site. We do not use it to identify you personally, and we have IP anonymisation enabled.
- The cookies it sets
- Google Analytics sets _ga and _ga_<property id>, which distinguish one browser from another and expire after 2 years. These are set by Google, who act as our data processor; Google may process this data outside the EEA under its own safeguards. See Google's Privacy Policy.
- Remembering your choice
- We store your cookie choice in your browser's local storage (not a cookie) purely so we don't ask you on every page. This is strictly necessary to honour your preference and is kept for about six months, after which we will ask again.
- Changing your mind
- You can withdraw or grant consent at any time using the Cookie settings link in the footer of every page. Withdrawing consent deletes the analytics cookies from your browser. You can also clear or block cookies in your browser settings at any time.
Separately from cookies, when you submit the contact form we record technical data such as your IP address and a timestamp — that is covered in section 01 and is not related to analytics.
09Changes to this policy
We review and update this Privacy Policy annually to ensure ongoing regulatory compliance. Any updates will be published immediately on this page with an updated "Last Updated" timestamp.