Privacy Policy

Drogheda Grammar School ("we", "us", or "the School") operates the DGS Trade Fair website ("the Service"). This policy explains what personal data we collect, why we collect it, how it is protected, and what rights you have over it.

We have designed the Service with privacy as a priority. We collect only what is strictly necessary, we do not share your data with third parties for any commercial purpose, and we retain it only for as long as needed.

1. Data Controller

The data controller for personal data processed through this Service is Drogheda Grammar School, Mornington Road, Drogheda, Co. Louth, Ireland. If you have any questions or concerns about how your data is handled, please contact the School office.

2. What Data We Collect

When you sign in using your school Google account, we receive and store:

• Your full name as registered with Google
• Your school email address
• Your Google profile picture (URL only; the image is not copied to our servers)

If you submit a stall application, we additionally store the content of that application, including your stall name, description, your school year group (e.g. 3rd year), and any supporting details you provide. Your year group is also kept on your account so it can be suggested automatically if you apply again in a future year. If you withdraw or delete an application, we keep a record of the reason you give (along with your name, email, and stall details) so the Trade Fair team can understand why applications are withdrawn.

If you add stall partners to an application, we store each partner's name and, where you provide it, their email address, so we can keep them informed about the stall and the Trade Fair. If a partner already has (or later creates) an account with the matching email, we link the two so their participation is recorded on their account. Only add someone as a partner if they are happy to take part and to be contacted at that address.

If you raise a support ticket, we store the content of that ticket and any replies on it, including any screenshots you attach (along with your name and email), so the Trade Fair team can investigate and respond to your issue. Tickets are visible only to you and to Trade Fair staff.

If you use the "trouble logging in?" form on the sign-in page, we send the name, email address, and message you enter to the Trade Fair team so they can help you. This form does not require an account.

For security purposes we also keep limited technical logs: when you sign in, or when our systems block suspicious activity (such as an unusually high number of requests in a short period), we record the IP address the request came from, the time, and the account involved (if signed in).

We do not collect home addresses, phone numbers, payment details, or any other personal information beyond what is listed above.

3. How We Use Your Data

Your data is used solely to operate the DGS Trade Fair, specifically to:

• Authenticate you and maintain your session securely
• Associate your stall application with your account
• Allow staff to review and respond to applications
• Allow staff to respond to support tickets you raise
• Notify you and your stall partners about your stall and Trade Fair announcements
• Display your stall publicly if your application is approved

Signed-in users can view a short profile card for another user by clicking their name (for example, a stall's organiser). This card shows the person's name, photo, role, and how many stalls they have run. Contact details such as email address and year group are shown to Trade Fair staff only.

We do not use your data for advertising, profiling, automated decision-making, or any purpose unrelated to the Trade Fair.

4. Legal Basis for Processing

We process your personal data on the basis of legitimate interests (Article 6(1)(f) GDPR), specifically the legitimate interest of the School in organising and administering the annual Trade Fair as a curricular and co-curricular activity. Where you are under 16, we rely on the School's existing relationship and parental consent obtained through normal school enrolment processes.

5. Data Sharing

We do not sell, rent, or share your personal data with any third party for commercial or marketing purposes.

The Service and its database are hosted on a server operated by us with DigitalOcean, located in the European Economic Area. DigitalOcean acts as a data processor on our behalf under a Data Processing Agreement and does not use your data for any independent purpose. Uploaded images and security logs (see Section 6) are stored with Amazon Web Services (S3 and CloudWatch respectively), and transactional emails (such as application updates) are sent via Zoho ZeptoMail; both act as data processors under equivalent agreements.

Authentication is handled via Google OAuth 2.0. Signing in takes you briefly to Google's own login page; we receive only the profile fields listed in Section 2 and do not have access to your Google password or any other Google account data.

6. Security

We take appropriate technical measures to protect your data, including:

• Session tokens are stored in HTTP-only cookies, making them inaccessible to JavaScript and protecting against cross-site scripting attacks
• Refresh tokens are hashed with bcrypt before being stored in the database
• All traffic is served over HTTPS
• CSRF protection is applied to all state-changing requests
• Requests are rate limited to protect the Service against abuse and automated attacks
• Security-relevant events (sign-ins and blocked requests) are logged with the IP address involved, so that suspicious activity can be investigated

7. Data Retention

Account data is retained while your account remains active. Once a Trade Fair concludes and the next fair begins, your stall application for that year is archived as a private stall history visible only to you (and Trade Fair staff): it is no longer publicly listed, and you can optionally reuse its details when applying the following year. Security logs (see Section 2) are retained for 90 days and then deleted automatically. If you would like your data removed sooner, see Section 8 below.

After each fair, we publish a public "Trade Fair Wrapped" page of aggregate statistics for that year (for example the number of stalls, participants, and the most-visited stalls). It contains no personal data beyond stall names that were already publicly listed during the fair.

8. Your Rights

Under GDPR, you have the right to:

• Access: request a copy of the personal data we hold about you
• Rectification: ask us to correct inaccurate or incomplete data
• Erasure: request deletion of your data where there is no overriding legitimate reason to retain it
• Restriction: ask us to limit how we use your data while a concern is resolved
• Portability: receive your data in a structured, machine-readable format
• Object: object to processing based on legitimate interests

To exercise any of these rights, please contact the School office. We will respond within 30 days. You also have the right to lodge a complaint with the Data Protection Commission (Ireland's supervisory authority).

9. Changes to This Policy

If we make material changes to this policy, we will update the date at the top of this page. Continued use of the Service after changes are posted constitutes acceptance of the revised policy.