Privacy Policy & Data Protection Policy

Effective date: October 2026 (Rev 2.1; replaces Rev 2.0, September 2026)

Data controller: The Tallest Branch Limited (CRO: 812437), 16 The Crescent, Athlumney Abbey, Navan, Co. Meath, C15 H30R

Contact: Anthony Kolodziej Behan, Director – anthony@thetallestbranch.ie

1. Overview

The Tallest Branch Limited is committed to protecting your privacy. This policy explains what personal data we collect, why we collect it, how we keep it safe and what your rights are. It applies to our website (thetallestbranch.ie), our courses, workshops and one-to-one sessions, and our day-to-day business operations.

We follow the General Data Protection Regulation (GDPR) and the Irish Data Protection Acts 1988–2018.

2. What We Collect and Why

  • Contact and course enquiries: your name, email address and phone number when you contact us or register interest. Legal basis: our legitimate interest in responding to you, and steps taken at your request before a booking.

  • Health and safety information (health data): before an MBSR course or one-to-one somatic coaching, we ask about your health and wellbeing in our intake questionnaire. Before a workshop, walk or workplace session, we ask a few short health and safety questions. This lets us make sure the service is suitable and safe for you. For workplace sessions, each person’s form comes directly to us and is never shared with their employer. Health information is a special category of data under GDPR. Legal basis: your explicit consent (GDPR Article 9).

  • Course materials and practice audio: your name and email address, so we can send you course materials and home-practice recordings. Legal basis: to deliver the service you have booked.

  • Payments: payments are handled securely by Stripe. We never see or store your full card details. Legal basis: to deliver the service you have booked, and our legal obligation to keep financial records.

  • Emergency contact: the name and phone number of someone we can contact if you become unwell during a session. It is used only in an emergency. Legal basis: our legitimate interest in keeping participants safe.

  • Website and advertising cookies: if you accept marketing cookies on our website, the Meta Pixel collects information about your visit, such as the pages you view, to help us measure our Facebook and Instagram adverts. Legal basis: your consent, which you can withdraw at any time. See our Cookie Policy.

3. How We Store Your Data and Our Use of AI Tools

  • Storage: personal data, intake forms and correspondence are stored in the business's Google Workspace account, which is access-controlled and used only by the Director.

  • AI tools: we use AI tools only for general administration and drafting. We never enter client information, health information, intake forms or session notes into any AI tool.

4. Recording of MBSR Sessions for Teacher Assessment

As part of the teacher's accreditation, some MBSR course sessions are recorded and reviewed by assessors from MBI-TAC, a UK-based teacher assessment body, and by the teacher's supervisor.

  • What is recorded: video of the teacher only. Participants are recorded as audio only. No video of participants is captured.

  • Consent: recordings only take place with the written consent of every participant, collected at orientation. You can decline, or withdraw your consent at any time, without affecting your place on the course. If you withdraw, your contributions will not be submitted for assessment.

  • Who sees it: only the teacher, the teacher's supervisor and the MBI-TAC assessors. Recordings are never published or used for marketing.

  • Storage and deletion: our copies are stored securely in the business Google Workspace account and deleted within 3 months of receiving the assessment result. MBI-TAC keeps any copies it receives under its own data protection policy.

  • Legal basis: your explicit consent.

5. Who We Share Your Data With

We only share your data with trusted service providers who help us run the business. Each of them processes it on our behalf under a data processing agreement:

  • Google Workspace: email and secure file storage

  • Squarespace, including Acuity Scheduling (owned by Squarespace): our website, contact forms and booking system

  • Stripe: online payments

  • Zoom: online course sessions

  • Intuit QuickBooks: bookkeeping, covering names and payment records only

  • Our accountant: financial records, as required by law

  • MBI-TAC and our supervisor: session recordings only, as set out in section 4

  • Meta Platforms Ireland: advert measurement, only for website visitors who accept marketing cookies

Some of these providers may store data outside the European Economic Area. Where this happens, it is only under safeguards approved by EU law, such as an EU adequacy decision or standard contractual clauses.

We never sell your data. Apart from the Meta Pixel, for website visitors who choose to accept marketing cookies, we never share your data for marketing purposes.

6. How Long We Keep Your Data

  • General enquiries: up to 12 months after your last contact with us.

  • Client and course records, including intake forms and health and safety declarations: for the length of the service plus 7 years, in line with professional insurance requirements.

  • Session recordings: as set out in section 4.

  • Financial records: 6 years, as required by Section 886 of the Taxes Consolidation Act 1997.

7. Your Rights

Under Irish and EU data protection law, you have the right to:

  • ask for a copy of the personal data we hold about you

  • ask us to correct anything that is inaccurate

  • ask us to delete your data, unless we are legally required to keep it

  • ask us to limit how we use your data, or object to how we use it

  • ask for your data in a format you can take elsewhere

  • withdraw your consent at any time, including for health information and session recordings

To use any of these rights, email anthony@thetallestbranch.ie. We will reply within one month.

8. Complaints

If you are unhappy with how we handle your data, please contact us first so we can put it right. You also have the right to complain to the Irish Data Protection Commission at www.dataprotection.ie.

9. Changes to This Policy

We may update this policy from time to time. The latest version will always be on our website, with the date it took effect.