Privacy policy
Last updated: 19 September 2026
This policy explains what personal data Atoro collects through this website, why we collect it, and the rights you have over it. Atoro is a cyber compliance consultancy registered in Ireland. We keep this simple and honest, the way we advise our clients to.
Who we are
Atoro is the controller of the personal data described in this policy.
Office 6, Portarlington Enterprise Centre, Canal Road, Portarlington, Co. Laois, R32 XD4F, Ireland.
Privacy contact: info@atoro.io.
What we collect and why
Contact form enquiries
When you use the contact form we collect your name, email address and message. We use this to respond to your enquiry and, where relevant, to discuss our services with you. The lawful basis is taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR) and our legitimate interest in responding to business enquiries (Article 6(1)(f)). Submissions are stored in our website system and sent to our team by email.
Analytics and cookies
We use analytics tools, loaded through Google Tag Manager, to understand how the site is used, such as pages visited and general location at city level. This may set cookies or similar identifiers in your browser. We use this information in aggregate to improve the site; we do not use it to identify you personally.
Server logs
Our hosting provider keeps standard server logs, including IP addresses and requests, for security and reliability. These are retained for a limited period as part of ordinary hosting operations.
Email correspondence
If you email us, we hold your message and address in our business email system for as long as we need it to deal with your enquiry and maintain a record of our correspondence.
Job applicants
This section applies when you apply for a role at Atoro through this website.
What we collect. Your name, email address, a link to your LinkedIn profile, where you are based, and anything you write in your note. If we ask for your CV after a first review, you send it to us by email and we hold it in our business email system. We also read your profile and CV, and we keep notes from any interviews or technical discussions with you. Please do not include sensitive information, such as details of your health, religion or trade union membership, in your CV or note: we do not need it to assess your application.
Why we use it. To assess your application for the role you applied for and, if it goes well, to make you an offer. The lawful basis is taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR) and our legitimate interest in recruiting the right people (Article 6(1)(f)). You do not have to give us this information, but we cannot consider your application without it.
Future roles. If you tick the box on the application form, we keep your application on file so we can contact you about other roles at Atoro that may suit you. The lawful basis is your consent (Article 6(1)(a)). You can withdraw it at any time by emailing info@atoro.io; if you do, we treat your application as if you had not ticked the box.
Who sees it. Only the people at Atoro involved in hiring. Applications are stored in our website system and sent to our hiring team by email, using the service providers listed under “Who we share data with” below. We do not share your application with anyone else.
How long we keep it. If you ticked the future roles box, we keep your application for 12 months from the date you apply, then delete it. If you did not, we keep it until we finish recruiting for the role and for six months after that, in case we need to respond to a legal claim about the recruitment process (our legitimate interest, Article 6(1)(f)), then delete it. If you join Atoro, your application becomes part of your employment records.
How we decide. A person at Atoro reviews every application. We do not make hiring decisions by automated means alone.
Who we share data with
We do not sell personal data. We share it only with the service providers that run this website and our business systems, acting as processors on our behalf: our hosting provider (Hostinger), our email and productivity provider (Google Workspace), and our analytics tooling (Google). Where these providers process data outside the European Economic Area, transfers rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision.
How long we keep it
We keep enquiry data for as long as needed to handle your enquiry and for a reasonable period afterwards in case the conversation resumes. If you become a client, information moves into our client records and is retained per our engagement terms. You can ask us to delete your enquiry data at any time. Job applications are kept for the periods set out under “Job applicants” above.
Your rights
Under the GDPR you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to our processing of it, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time; this does not affect anything we did before you withdrew it. To exercise any of these rights, email info@atoro.io. We will respond within one month.
If you are unhappy with how we handle your data, you can complain to the Irish Data Protection Commission (dataprotection.ie) or to your local supervisory authority.
Changes to this policy
If we change how we handle personal data, we will update this page and revise the date at the top.