Privacy questions or requests: contact our Privacy Team at privacy@glyzconsulting.com. We acknowledge every request within two business days and respond within one month.
1. About this policy
This policy explains how Glyz Consulting Limited (“Glyz”, “we”, “us”) collects and uses personal data when you visit glyzconsulting.com, contact us, deal with us as a client, prospective client, supplier or partner, or apply to work with us. It gives you the information required by Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 (GDPR).
We process personal data in line with the GDPR, the Irish Data Protection Acts 1988 to 2018, and the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336 of 2011), which govern cookies and electronic marketing in Ireland. Section 9 explains how Canadian and Indian law apply where our group companies are involved. Our cookie information is in section 10.
2. Who we are and how to contact us
The controller of your personal data is Glyz Consulting Limited, a company registered in Ireland under company number 771141, with its registered office at 20 Harcourt Street, Dublin 2, D02 H364, Ireland.
Our Privacy Team handles all privacy questions and requests. You can contact it by email at privacy@glyzconsulting.com, or by post to the Privacy Team at the address above. We acknowledge every request within two business days.
We have assessed that we are not required to appoint a Data Protection Officer under Article 37 GDPR, because our core activities do not involve large-scale monitoring of individuals or large-scale processing of special category data. The Privacy Team is your point of contact for all data protection matters.
Glyz Consulting Limited is part of a group that also includes Glyz Consulting Canada Limited, in Brampton, Ontario, and Glyz Consulting Private Limited, in India.
3. The personal data we collect
3.1 When you contact us
When you send an enquiry through the contact form on our website, we receive your name and email address, your organisation, role and phone number if you choose to give them, the area you are interested in, your message, and your agreement that we may use these details to respond. The form stores your enquiry in our website’s database, which is hosted by our hosting provider, and sends a copy by email to contact@glyzconsulting.com. The form does not record your IP address or browser details and does not place a cookie on your device. If you email or phone us directly, we receive the information you choose to give us.
3.2 When you visit our website
Our hosting provider records technical information about each visit in server logs, including your IP address, browser type, the date and time of the request and the pages requested. We use these logs to keep the website secure and working. The hosting provider also produces traffic statistics from these logs (AWStats and Webalizer), which can include IP addresses. These statistics are generated automatically by our hosting provider and we do not use them to identify visitors.
If you consent to analytics, Jetpack Stats, a service provided by Automattic, records your IP address, browser user agent, the pages you visit, the page you came from and your country, so that we can see aggregated visitor statistics. We see only totals, not individual visitors. If you do not consent, Jetpack Stats does not run.
Our consent banner records the choices you make about cookies and analytics, so that we can respect them and show that we did. Section 10 gives the detail.
3.3 Clients, prospective clients, suppliers and partners
If you work for, or are, a client, prospective client, supplier or partner, we hold business contact details such as your name, job title, organisation, business email address and phone number, together with our correspondence and meeting records, and contract, purchase order and invoice details. We obtain this from you, from your organisation, from introductions made by mutual contacts, and from public professional sources such as your organisation’s website or your professional networking profile.
3.4 Job applicants
If you apply to work with us, we hold your CV and contact details, your employment history and qualifications, interview notes, references and, where the role requires it, the results of pre-engagement screening checks. We obtain this from you, from recruitment agencies you have asked to represent you, from your referees and from screening providers. We tell you in advance which checks apply to the role and only carry out checks the law permits.
3.5 Special category data and children
We do not ask for special category data, such as information about health, religion, ethnicity or sexual orientation, through our website or in the normal course of business. Please do not include it in an enquiry. Our website and services are intended for businesses and professionals and are not directed at anyone under 18. We do not knowingly collect personal data from children.
4. Why we use your data and our legal basis
| Purpose | Legal basis under Article 6 GDPR |
|---|---|
| Responding to your enquiry | Taking steps at your request before entering into a contract (Article 6(1)(b)), or our legitimate interest in responding to and managing business enquiries (Article 6(1)(f)) |
| Delivering our services and managing our relationship with clients, suppliers and partners | Performance of a contract where you are the contracting party (Article 6(1)(b)); otherwise our legitimate interest in managing our business relationship with your organisation (Article 6(1)(f)) |
| Invoicing, accounting, tax and company records | Compliance with a legal obligation (Article 6(1)(c)) |
| Assessing job applications and carrying out pre-engagement checks | Taking steps at your request before entering into a contract (Article 6(1)(b)), our legitimate interest in assessing suitability for a role (Article 6(1)(f)), and compliance with a legal obligation where a check is required by law (Article 6(1)(c)) |
| Keeping our website secure and working, using server logs | Our legitimate interest in operating a secure and reliable website (Article 6(1)(f)) |
| Website analytics through Jetpack Stats | Your consent (Article 6(1)(a)) |
| Recording your cookie choices | Compliance with a legal obligation to respect and demonstrate consent (Article 6(1)(c)) |
| Sending you news and insights by email | Your consent (Article 6(1)(a)), or, for existing clients, our legitimate interest in telling them about similar services (Article 6(1)(f)), as permitted by Regulation 13 of S.I. No. 336 of 2011 |
| Protecting our systems, investigating security incidents and preventing misuse | Our legitimate interest in keeping our systems and information secure (Article 6(1)(f)) |
| Establishing, exercising or defending legal claims, and responding to lawful requests from authorities | Compliance with a legal obligation (Article 6(1)(c)), or our legitimate interest in protecting our legal position (Article 6(1)(f)) |
Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms and concluded that our interests are not overridden. You can ask the Privacy Team for details of that assessment.
Where we rely on consent, you can withdraw it at any time, as easily as you gave it. Withdrawing consent does not affect processing carried out before you withdrew it.
5. Whether you have to give us your data
You are not required by law to give us personal data. If you want a reply to an enquiry, we need at least your name and email address. If you are a party to a contract with us, some information is needed to perform that contract, and without it we may not be able to provide or receive services. If you apply for a role and do not provide the information we ask for, we may not be able to consider your application. Analytics is optional, and declining it does not affect your use of the website.
6. Who we share your data with
We do not sell your personal data and we do not use it for advertising. We share it only where necessary, with the following recipients.
| Recipient | Role and purpose | Location |
|---|---|---|
| Microsoft Ireland Operations Limited | Processor. Email, file storage and collaboration through Microsoft 365, where enquiries and business correspondence are held | European Union, with limited access from outside the EU as described in section 7 |
| Newfold Digital, Inc. (Bluehost) | Processor. Website hosting and server logs | United States |
| Automattic Inc. (Jetpack Stats) | Processor. Website analytics, only if you consent | United States |
| CookieYes Limited | Processor. Consent banner and records of your cookie choices | United Kingdom, with consent records stored in Ireland and Malta |
| Glyz Consulting Canada Limited and Glyz Consulting Private Limited | Group companies whose personnel help deliver our services and run our business | Canada and India |
| Professional advisers, including lawyers, accountants, auditors and insurers | Advice, audit and insurance | Ireland, and Canada or India where relevant |
| Screening providers, where a role requires checks | Pre-engagement screening of job applicants | Notified to you before any check |
| Courts, regulators, Revenue and law enforcement | Only where the law requires it or to protect our legal rights | Ireland, or as the request requires |
| A buyer or successor of our business | Only if we reorganise or sell all or part of our business, under confidentiality obligations | As applicable |
Our processors act only on our instructions, under written contracts that meet Article 28 GDPR.
7. International transfers
Some recipients are outside the European Economic Area (EEA). Where we transfer personal data outside the EEA, we use one of the safeguards in Chapter V GDPR:
- The European Commission has recognised Canada as providing adequate protection for personal data transferred to organisations subject to the Personal Information Protection and Electronic Documents Act (PIPEDA), which applies to Glyz Consulting Canada Limited. The United Kingdom is also covered by a European Commission adequacy decision.
- Transfers to Glyz Consulting Private Limited in India are made under the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), in an intra-group data transfer agreement, supported by a transfer risk assessment.
- Transfers to service providers in the United States rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the Standard Contractual Clauses with any supplementary measures needed.
You can ask the Privacy Team for a copy of the safeguards that apply to your data.
8. How long we keep your data
| Data | How long we keep it |
|---|---|
| Website enquiries | Until the enquiry is closed, and no longer than 24 months, unless it leads to an engagement |
| Client, supplier and partner contracts, purchase orders and invoices | Financial and accounting records for as long as Irish company and tax law requires. Contracts for 7 years after they end, so that we can deal with any claims |
| Business correspondence with clients, suppliers and partners | For the engagement, and up to 7 years after it ends |
| Applications from unsuccessful candidates | 6 months after the decision |
| Records of people who join us | For the duration of the engagement, and 7 years after it ends |
| Marketing preferences | While your consent stands, and 1 year after you withdraw it, as a record of your choice |
| Website server logs | Up to 24 hours, until our hosting provider processes them. We do not keep archived copies |
| Traffic statistics produced by our hosting provider from server logs | Deleted at least once a month |
| Jetpack Stats logs containing IP addresses | 28 days, held by Automattic. The statistics we see are aggregated and do not identify you |
| Your cookie choice on your device | 6 months, after which we ask you again |
When the period ends, we delete the data securely or anonymise it. Where a legal claim or investigation is under way, we keep the relevant data until it is resolved.
9. Canada and India
Where Glyz Consulting Canada Limited handles personal data in Canada, it does so under the Personal Information Protection and Electronic Documents Act (PIPEDA). You can ask for access to, or correction of, your personal information through privacy@glyzconsulting.com, which is the designated contact for privacy matters in Canada. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.
Where Glyz Consulting Private Limited processes digital personal data in India, it does so under the Digital Personal Data Protection Act 2023 and the Digital Personal Data Protection Rules 2025, as their provisions come into force. Grievances can be sent to privacy@glyzconsulting.com and, once its powers are in force, to the Data Protection Board of India.
10. Cookies and similar technologies
Cookies are small files placed on your device. Similar technologies, such as scripts and browser storage, can also read or store information on your device. We place only strictly necessary items without your consent. Anything else, including Jetpack Stats, is used only after you agree through our consent banner.
| Name | Provider | Purpose | Duration | Consent needed |
|---|---|---|---|---|
| cookieyes-consent | CookieYes | Remembers your consent choices | 6 months | No, strictly necessary |
| humans_21909 | Our hosting provider | Distinguishes genuine visitors from automated traffic to protect the website | Session | No, strictly necessary |
| Jetpack Stats | Automattic | Counts visits and page views so we can see aggregated statistics. Does not set cookies on your device, but reads browser and page information | Logs held for 28 days | Yes |
We do not use advertising or marketing cookies. You can change or withdraw your choices at any time through the cookie settings button on our website, and you can also block or delete cookies through your browser settings. If we add any new cookie or tracking technology, we will update this section and ask for your consent where required.
11. Marketing
We send news and insights by email only to people who have agreed to receive them, or to existing clients about services similar to those they have bought from us. Every message includes a simple way to unsubscribe, and you can also unsubscribe by emailing privacy@glyzconsulting.com. We act on unsubscribe requests straight away.
12. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you and receive a copy of it.
- Have inaccurate or incomplete data corrected.
- Have your data erased where there is no longer a good reason for us to keep it.
- Restrict how we use your data in certain circumstances.
- Receive data you have given us in a structured, machine-readable format, and have it transmitted to another organisation, where we process it on the basis of consent or contract by automated means.
- Withdraw your consent at any time where we rely on consent.
- Not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you. We do not make such decisions.
Your right to object. You have the right to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. We will then stop unless we have compelling legitimate grounds that override your interests, rights and freedoms, or need the data for legal claims. You have an absolute right to object to the use of your data for direct marketing, and we will stop as soon as you tell us.
To exercise any of these rights, email privacy@glyzconsulting.com. We respond within one month of receiving your request. Where a request is complex or we receive several from you, we may extend this by up to two further months, and we will tell you within the first month. We do not charge a fee unless a request is manifestly unfounded or excessive. Before releasing or changing any data, we may need to confirm your identity, usually by replying to the contact details we already hold for you.
Where we hold your data only because a client has shared it with us to deliver a service, we may pass your request to that client, which is responsible for answering it, and we will tell you that we have done so.
13. Your right to complain
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland, at dataprotection.ie. You can also complain to the supervisory authority in the EU or EEA country where you live or work, or where you believe the problem occurred. We would welcome the chance to resolve your concern first, but you do not need to contact us before complaining.
14. How we protect your data
We use appropriate technical and organisational measures to protect personal data. These include multi-factor authentication on every Glyz account, full-disk encryption and managed endpoint protection on Glyz devices, access limited to those who need it for their role, encrypted connections to our website, written agreements with our processors, and regular privacy and security training for everyone who works with us.
If a personal data breach is likely to result in a risk to your rights and freedoms, we notify the Data Protection Commission without undue delay and, where feasible, within 72 hours of becoming aware of it. If it is likely to result in a high risk to you, we also tell you without undue delay.
15. Links to other websites
Our website links to other sites, such as our LinkedIn page. Those sites have their own privacy policies, and we are not responsible for how they handle your data. This policy applies only to glyzconsulting.com and to the personal data Glyz Consulting Limited processes as described above.
16. Changes to this policy
We review this policy at least once a year and whenever our processing changes. The date at the top shows when it was last updated. If we make a significant change, we will make it clear on our website and, where we hold your contact details and the change affects you, tell you directly.
17. Contact us
Privacy Team, Glyz Consulting Limited
20 Harcourt Street, Dublin 2, D02 H364, Ireland
privacy@glyzconsulting.com
For general business enquiries, contact contact@glyzconsulting.com.