1. Who we are
TheLit.org (operated by Waterford Youth Arts
Registered address: Waterford Youth Arts, Barrack St., Waterford, Ireland.
Email: thelityoungwritersfestival@gmail.com

2. What data we collect & why

• We will never collect your data without your explicit consent.
  We only collect data you actively supply (e.g. via contact forms, subscriptions): name, email, message—processed only with your consent to reply or provide updates.

• All data is:

• Collected only for stated lawful purposes

• Minimised to what’s strictly necessary

• Kept accurate & up to date

• Deleted or anonymised as soon as retention is no longer required
  (GDPR Articles 5 principles: lawfulness, purpose, minimisation, accuracy, storage limitation, integrity/confidentiality) 
   

3. Cookies & similar
We use strictly necessary cookies only (e.g. session management).
We’ll clearly explain what they do and ask your explicit consent before placing optional ones.
You can refuse or withdraw consent easily at any time.

4. Legal bases for processing

• Consent (clear opt‑in for subscriptions or messages)

• Legitimate interest (improving site reliability or analytics), where your right to privacy is not overridden.
   

5. Who we share data with

• Processors (e.g. hosting providers, email platforms): only engage those offering appropriate GDPR safeguards (e.g., EU‑adequacy, Standard Contractual Clauses).

• Statutory reporting: if lawfully required (e.g. court orders or investigations), we may disclose where obliged.
  (GDPR requires clear disclosures of third‑party recipients & safeguards for transfers)
   

6. Retention policy

• Form‑submitted messages and emails: retained until actioned or as long as necessary, then deleted securely.

• Analytics: stored in aggregated, anonymised form only for twelve months, then purged.
   

7. Your rights
You’re entitled to:

• Access your personal data

• Rectify inaccuracies

• Erase (“right to be forgotten”)

• Restrict processing

• Object to certain uses (e.g. marketing, profiling)

• Data portability (where applicable)

• Rights related to automated decision‑making and profiling (if used)
  Requests are free, fulfilled without charge within one month (or 40 calendar days if extension applies)

To exercise these rights, contact us at thelityoungwritersfestival@gmail.com.

8. Data security & breach response
We embed privacy by design/default throughout our operations—anticipating and preventing mishaps rather than reacting.
We enforce:

• TLS encryption for data in transit

• Access control and regular audits

• Secure deletion when required
  If a breach that risks your rights occurs, we’ll inform the Data Protection Commission within 72 hours, and notify you promptly if there’s a high risk to your rights.
   

9. Updates to this policy
This policy is a living document. We’ll update it as our practices or legal obligations change, and display its effective date at the top.

10. Complaints
If you're ever unhappy with how we handle your data, you can lodge a complaint with the Irish Data Protection Commission (DPC) at info@dataprotection.ie or call 01 7650100 / 1800 437 737.
(Users must be informed of supervisory authority rights) gov.ie