Privacy Policy

1. Introduction

1.1. This Privacy Policy explains how Rody O’Brien Legal Education (“we”, “us”, or “our”) collects, uses, discloses, and protects your personal data when you visit our website, engage with our tuition services or purchase our Continuing Professional Development (CPD) services for solicitors.

1.2. We are committed to safeguarding your privacy and ensuring that your personal data is handled in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), and the Data Protection Act 2018.

1.3. This Policy sets out the purposes for which we process your personal data and the lawful basis relied upon for each, as detailed in Section 4. Where any specific processing activity relies on your consent (for example, certain non-essential cookies or direct marketing), we will seek that consent separately, and you may withdraw it at any time as set out in Section 9.

2. Data Controller and Data Protection Lead

2.1. The Data Controller is:

Rody O’Brien, Principal – Rody O’Brien Legal Education
Telephone: (01) 539 4180 | Email: [email protected]

2.2. We have appointed a Data Protection Lead (DPL) to oversee compliance with this Privacy Policy and applicable data protection legislation. Our DPL can be contacted directly with any questions or concerns about how your personal data is handled, or to exercise any of your rights set out in Section 9.

Patrick O’Brien, Data Protection Lead – Rody O’Brien Legal Education
Telephone: (01) 539 4180 | Email: [email protected]

3. Information we collect

3.1. We may collect and process the following categories of personal information:

(a) Information You Provide Directly

• Full name
• Email address
• Phone number
• Billing address
• Firm name or employer (for CPD clients)
• Payment details (processed securely via third-party providers such as Stripe)
• Information provided through meetings, forms or correspondence
• Account login or subscription details (where applicable)

(b) Automatically Collected Information

When you visit our website, certain data may be automatically collected through cookies or analytics tools, such as:

• IP Address and approximate geographic location
• Browser type and version
• Device type and operating system
• Pages visited, time spent on site, and referring URL.

(c) Tuition and CPD Information

When you engage in our tuition or CPD services, we may also collect:

• Educational background or subject preferences
• Notes or communications exchanged before, during or after sessions
• CPD attendance records and course completion status (CPD clients)
• CPD certificates issued and related training records (CPD clients)

We do not generally collect special category data (as defined in Article 9 GDPR, such as health information).

Where such data is provided to us, for example if a student or CPD attendee discloses a health condition or disability relevant to reasonable accommodations for tuition, examinations, or CPD attendance, we process this only with your explicit consent (Article 9(2)(a) GDPR), and only for the specific purpose disclosed.

4. How we use your information

4.1. We use your personal information for the following purposes:

• To provide and manage tuition services
• To provide, manage, and issue certificates for CPD services
• To process payments and manage billing
• To communicate with you regarding your sessions, schedules and updates
• To send administrative information, such as changes to policies and/or terms
• To maintain and improve our website and user experience
• To comply with legal obligations or respond to lawful requests

4.2. Each purpose above is processed under one of the following lawful bases under Article 6 GDPR:

• Performance of a contract (Article 6(1)(b)): providing tuition and CPD services, and managing bookings and payment.
• Legal obligation (Article 6(1)(c)): tax, accounting and regulatory record-keeping.
• Legitimate interests (Article 6(1)(f)): maintaining and improving our website and services, and ensuring the security of our systems, provided these interests are not overridden by your rights and interests.
• Consent (Article 6(1)(a)): only where we ask for it separately, for example certain cookies or marketing communications you have opted in to receive.

4.3. Where we send you marketing communications, you may opt out at any time using the unsubscribe link provided or by contacting us directly.

5. Disclosure of information

5.1. We may disclose your information to the following, strictly for operational reasons:

• Payment processors (e.g. Stripe) to handle transactions securely
• IT and website hosting providers, for technical maintenance and security
• Professional regulatory bodies (e.g. the Law Society of Ireland), where CPD attendance or completion verification is requested
• Legal or regulatory authorities, where required by law or court order

5.2. All third parties are bound by confidentiality and data protection obligations consistent with GDPR requirements, and are subject to written Data Processing Agreements between us and them in accordance with Article 28 GDPR.

5.3. Our current processors and the purposes for which we use them are set out below:

5.4. We may update this list from time to time, as our service providers change. While we will endeavour to update this Policy as promptly as possible, you may request the current list from our DPL.

6. International transfers

6.1. Your data is primarily processed within the European Economic Area (EEA), and we choose our service providers with this in mind.

6.2. Some of our processors, as identified in Section 5.3, are established outside the EEA. Where this is the case, we ensure an appropriate safeguard under Chapter V GDPR is in place before any transfer occurs, which may include:

• An EU adequacy decision (for example, Switzerland, where Infomaniak is established, benefits from a European Commission adequacy decision);
• Certification under the EU-U.S. Data Privacy Framework, for U.S. processors participating in that framework; or
• Standard Contractual Clauses (SCCs) approved by the European Commission, together with a transfer risk assessment, for processors not otherwise covered by an adequacy decision or the Data Privacy Framework.

6.3. We maintain an internal record of the safeguard relied upon for each processor named in Section 5.3, and review this periodically as our processors or their certifications change. This record is available on request from our DPL.

7. Data security

7.1. We take your data security incredibly seriously. We implement appropriate technical and organisational measures to protect your personal data from unauthorised access, alteration, disclosure or destruction.

These measures include, but are not limited to:

• Utilising secure server hosting and TLS encryption on all sites and services;
• Encrypting personal data at rest where technically appropriate;
• Restricting internal access to personal data through strict access controls, ensuring data is only accessible on a principle of least privilege and need-to-know basis;
• Encrypted payment processing via trusted third-party providers, e.g. Stripe;
• Requiring staff and contractors to comply with confidentiality obligations and providing data protection training relevant to their role;
• Regular data backups, system patching, and monitoring for suspicious activity.

7.2. While we take all reasonable precautions, no online system can guarantee absolute security. Users share data at their own risk.

7.3. We maintain an internal data breach response procedure. Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission without undue delay and, in any event, within 72 hours of becoming aware of it, in accordance with Article 33 GDPR. Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, in accordance with Article 34 GDPR.

8. Data retention

8.1. We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. This includes:

• For active tuition or CPD clients: for the duration of the contractual relationship, and for a further period of 6 years following its end, to allow for the handling of any post-contractual queries or claims.
• For legal, accounting or tax obligations: typically 6 years from the end of the relevant financial year;
• For CPD attendance, completion and certification records: typically 6 years from the date of the relevant CPD cycle, or such longer period as required to verify compliance with the Law Society of Ireland’s CPD Regulations;
• For website analytics data: typically 12/24 months, after which it is anonymised if required for future use, or deleted.

8.2. When data is no longer required, it is securely deleted.

8.3. There are some cases in which data may have to be retained longer than our internal retention policies state (e.g. legal proceedings). In such cases, the DPL will review the legal obligation, issue a formal data retention hold, and document the justification.

9. Your data protection rights

9.1. Under the GDPR and Data Protection Act 2018, you have the following rights:

• The right of access – to request a copy of your personal data;
• The right to rectification – to correct inaccuracies in your personal data where they exist;
• The right to erasure – to request deletion of your personal data where no legal basis for retention exists, or the legal basis for retention is no longer valid;
• The right to restrict processing – to limit how we use your data;
• The right to data portability – to request a copy of your personal data in an easily accessible, machine-readable format;
• The right to object to processing – to object to the processing of your personal data, where it is based on legitimate interests or direct marketing;
• The right to withdraw consent – where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal;
• Rights related to automated decision-making – we do not carry out automated decision-making, including profiling, that produces legal or similarly significant effects on you;
• The right to lodge a complaint – to lodge a complaint with a supervisory authority. You may complain to the supervisory authority of your habitual residence, place of work, or the place of the alleged infringement, as well as to the supervisory authority of our main establishment. As our main establishment is in Ireland, this is the Data Protection Commission, at dataprotection.ie.

9.2. To exercise any of these rights, please contact our Data Protection Lead, Patrick O’Brien, at [email protected]. We will respond within one month of receiving your request, extendable by a further two months where necessary given the complexity or number of requests; we will inform you if an extension is required. There is no fee for making a request, save where it is manifestly unfounded or excessive.

10. Cookies and tracking technologies

10.1. Our website uses cookies and similar tracking technologies to operate correctly, understand usage, and improve our services.

10.2. We distinguish between:

• Strictly necessary cookies, which are required for the website to function and do not require your consent;
• Non-essential cookies, such as analytics or marketing cookies, which are only placed with your prior consent.

10.3. Where non-essential cookies are used, you will be presented with a cookie banner allowing you to accept, reject, or manage your preferences, and you may change your choice at any time via our cookie settings tool, CookieAdmin.

10.4. A current list of the cookies we use, their purpose, and their retention period is available on our Cookie Policy.

10.5. You may also adjust your browser settings to refuse cookies, though some website features may not function properly as a result.

11. Changes to this Privacy Policy

11.1. We may update this Privacy Policy from time to time to reflect changes in our practices, or legal requirements. The revised version will be posted on this page with an updated “Last Updated” date.

11.2. This version (V3.0) was updated on 29 August 2026 to extend the scope of this Privacy Policy to include Continuing Professional Development (CPD) services for solicitors. Changes include new CPD-specific data categories, a new purpose and lawful basis for issuing CPD certificates, disclosure to professional regulatory bodies (such as the Law Society of Ireland) for CPD compliance verification, a CPD-specific data retention period, and the addition of our self-hosted Moodle platform.

Version history

12. Contact us

If you have any questions about this Privacy Policy, or how your data is handled, please contact:

Patrick O’Brien, Data Protection Lead – Rody O’Brien Legal Education
Telephone: (01) 539 4180 | Email: [email protected].