Privacy Policy

Gorman Electrical Services Ltd (“GES”, “we”, “us”, “our”) is an electrical contracting company registered in Ireland. Our registered office is Unit 26 Canal Walk, Cherry Orchard, Park West, Co. Dublin, D12 PK16.

We are the data controller responsible for the personal data collected and processed as described in this policy, within the meaning of Article 4(7) of the GDPR. For any data protection enquiries, you may contact us at info@gormanelectrical.ie or by calling 01 963 6636.

This privacy policy applies to all personal data collected through our website at www.ges.ie (the “Website”), via telephone, email, in person, or through any other channel in the course of providing our services. It applies to all individuals whose data we process, including customers, prospective customers, website visitors, and business contacts.

By providing us with your personal data — whether through our Website, by phone, by email, or in person — you acknowledge that you have read and understood this policy.

We may collect and process the following categories of personal data:

• Identity and contact data — name, email address, telephone number, and postal address, provided when you request a quote, book a service, submit a form, or otherwise contact us.
• Property data — information about your property (e.g. number of bedrooms, age of wiring, property type) provided through our quote forms, estimator tools, or during on-site assessments.
• Service records — records of work carried out at your property, including inspection reports, Safe Electric completion certificates, compliance documentation, and photographs taken before, during, or after projects.
• Financial data — billing and invoicing details necessary to process payments. We do not store full payment card numbers; all card transactions are processed through PCI DSS-compliant third-party payment processors.
• Technical data — IP address, browser type and version, device type, operating system, time zone, and other technology identifiers collected automatically when you visit our Website.
• Usage data — information about how you use our Website, including pages visited, click paths, referral source, and session duration, collected via cookies and similar tracking technologies.
• Communication records — the content and metadata of emails, telephone calls, text messages, and other correspondence between you and our team.

We process your personal data for the following purposes:

• To provide quotations, schedule appointments, and deliver our electrical services under an agreed contract.
• To issue Safe Electric completion certificates and other regulatory compliance documentation.
• To communicate with you regarding your booking, project progress, aftercare, and service follow-ups (e.g. periodic inspection reminders).
• To process invoices, collect payments, and maintain financial records.
• To maintain internal records for quality assurance, training, and dispute resolution.
• To improve our Website, services, and customer experience through anonymised analytics.
• To comply with legal and regulatory obligations, including tax law, health and safety regulations, and electrical certification requirements.
• To establish, exercise, or defend legal claims.

We will only send you direct marketing communications where you have given explicit, informed consent in accordance with Regulation 13 of the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336 of 2011). You may withdraw consent at any time by contacting us directly, and we will cease marketing communications without undue delay.

We process your personal data on one or more of the following legal bases, as set out in Article 6(1) of the GDPR:

• Performance of a contract (Article 6(1)(b)) — processing necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract (e.g. providing a quotation).
• Legitimate interests (Article 6(1)(f)) — processing necessary for our legitimate business interests, including service improvement, fraud prevention, and the effective administration of our business, provided such interests are not overridden by your fundamental rights and freedoms.
• Legal obligation (Article 6(1)(c)) — processing necessary to comply with a legal obligation to which we are subject under Irish or EU law (e.g. tax records under the Taxes Consolidation Act 1997, electrical certification requirements under S.I. No. 732 of 2008).
• Consent (Article 6(1)(a)) — where you have given clear, affirmative consent for a specific processing purpose, such as receiving marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

We do not sell, rent, or trade your personal data to any third party. We may disclose your personal information to the following categories of recipients, solely for the purposes described in this policy and subject to appropriate contractual safeguards:

• Safe Electric / ECSSA — to register completion certificates as required under the Electro-Technical Council of Ireland (ETCI) National Rules and S.I. No. 732 of 2008.
• ESB Networks — where reconnection, disconnection, or meter work forms part of the project scope.
• Payment processors — PCI DSS-compliant payment service providers engaged to process card and bank transactions securely on our behalf.
• Cloud and IT service providers — GDPR-compliant hosting, email, and project management platforms used to store and process data on our behalf under written data processing agreements (Article 28 GDPR).
• Professional advisors — our accountants, auditors, and legal advisors, where necessary for the administration of our business or the establishment, exercise, or defence of legal claims.
• Regulatory and law enforcement authorities — where we are required to do so by law, court order, or regulatory obligation.

All third-party recipients are contractually required to process your data in accordance with GDPR and applicable data protection legislation. We do not permit our processors to use your data for their own purposes.

We primarily store and process your personal data within the European Economic Area (EEA). Where any data is transferred to a country outside the EEA (e.g. if a cloud service provider operates servers in the United States), we ensure that appropriate safeguards are in place, including:

• An adequacy decision by the European Commission under Article 45 of the GDPR.
• Standard Contractual Clauses (SCCs) approved by the European Commission under Article 46(2)(c) of the GDPR.
• Other legally recognised transfer mechanisms under Chapter V of the GDPR.

You may request further details about the safeguards in place by contacting us.

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law. Our retention periods are as follows:

• Service records and certificates — retained for a minimum of 7 years following completion of work, in accordance with Irish tax legislation (Taxes Consolidation Act 1997, Section 886) and building regulation requirements.
• Contractual records — retained for 6 years following the end of the contractual relationship, in line with the Statute of Limitations Act 1957 (as amended).
• Quote enquiries (no contract formed) — retained for 12 months from the date of enquiry, then securely deleted.
• Marketing consent records — retained for the duration of your consent and for a reasonable period thereafter to evidence compliance.
• Website analytics — anonymised data retained for up to 26 months.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with you.

Our Website uses cookies and similar technologies in accordance with the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336 of 2011). We use:

• Strictly necessary cookies — required for the Website to function correctly (e.g. form submissions, session management). These do not require consent.
• Analytics cookies — used to collect anonymised data about how visitors use our Website (e.g. Google Analytics with IP anonymisation enabled). These are placed only with your consent.

You can manage or withdraw cookie consent at any time through your browser settings. Disabling certain cookies may affect the functionality of the Website. For further information on cookies, visit www.aboutcookies.org.

Under the GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:

• Right of access (Article 15) — request confirmation of whether we process your personal data and, if so, obtain a copy of that data.
• Right to rectification (Article 16) — request correction of inaccurate or incomplete personal data without undue delay.
• Right to erasure (Article 17) — request deletion of your personal data where there is no compelling reason for its continued processing, subject to applicable legal retention obligations.
• Right to restriction of processing (Article 18) — request that we restrict the processing of your data in certain circumstances (e.g. while we verify accuracy).
• Right to data portability (Article 20) — receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Right to object (Article 21) — object to processing based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will cease processing without exception.
• Right to withdraw consent (Article 7(3)) — where processing is based on consent, withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact us at info@gormanelectrical.ie. We will respond to your request within one calendar month of receipt, in accordance with Article 12(3) of the GDPR. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests. We will inform you of any such extension within one month of receipt.

We may request proof of identity before processing your request to ensure that personal data is not disclosed to any person who has no right to receive it.

We do not use your personal data for automated decision-making or profiling that produces legal effects or similarly significant effects on you, within the meaning of Article 22 of the GDPR. Any estimates generated by our online tools are indicative only and are not the product of solely automated processing — all quotations are reviewed and confirmed by our team.

Our services are not directed at individuals under the age of 18, and we do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a person under 18 without appropriate parental or guardian consent, we will take steps to delete that data without undue delay. If you believe we hold data relating to a minor, please contact us immediately.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing and against accidental loss, destruction, or damage, in accordance with Article 32 of the GDPR. These measures include, but are not limited to:

• Encryption of data in transit (TLS/SSL) and at rest where technically feasible.
• Access controls limiting data access to authorised personnel on a need-to-know basis.
• Secure, GDPR-compliant cloud infrastructure with regular security updates.
• Staff awareness of data protection obligations and confidentiality requirements.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with Article 33 of the GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly in accordance with Article 34 of the GDPR.

We may update this privacy policy from time to time to reflect changes in our practices, legal requirements, or regulatory guidance. Any material changes will be posted on this page with an updated “Last updated” date. Where changes are significant, we may also notify you by email or through a prominent notice on our Website.

We encourage you to review this page periodically. Your continued use of our Website or services after the publication of changes constitutes your acknowledgement of the updated policy.

If you have a concern about how we handle your personal data, we encourage you to contact us first at info@gormanelectrical.ie so that we can address your concern directly.

You also have the right to lodge a complaint with the Data Protection Commission (DPC), the independent supervisory authority for data protection in Ireland:

• Website: www.dataprotection.ie
• Phone: +353 (0)1 765 0100 / 1800 437 737
• Address: 21 Fitzwilliam Square South, Dublin 2, D02 RD28

Lodging a complaint with the DPC is without prejudice to any other administrative or judicial remedy available to you.