Modeligo National SchoolCeapach, Dungarvan, Co. Waterford

Privacy Policy

Privacy Policy

Last updated: April 2026

Modeligo National School ("we", "us", "our") is committed to protecting the privacy of all visitors to this website and all members of our school community in accordance with the General Data Protection Regulation (GDPR), the Data Protection Acts 1988–2018, and the ePrivacy Directive (as transposed into Irish law).

Data controller

The Board of Management of Modeligo National School is the data controller for all personal data processed by the school. For data protection queries, contact:

What information do we collect?

Website visitors

Strictly necessary cookies

These cookies are essential for the website to function (e.g. remembering your cookie preferences). They do not store any personally identifiable information and cannot be switched off.

Analytics cookies (optional)

If you consent, we use Cloudflare Web Analytics to collect anonymous information about how visitors use our website. This includes:

  • Pages visited and time spent on pages
  • General geographic region (country level only)
  • Browser and device type
  • Referring website

Cloudflare Web Analytics is privacy-first: it does not use cookies to track users, does not collect or store IP addresses, does not use fingerprinting, and does not share data with advertisers. No cross-site tracking occurs. Cloudflare Web Analytics is compliant with GDPR, PECR, and COPPA.

Contact forms and applications

If you submit a form through this website (e.g. an enrolment application or contact form), the information you provide is transmitted securely and processed only for the stated purpose. Form submissions are not stored on this website — they are forwarded to the school via email or to our school administration system.

School community (pupils, parents/guardians, staff)

The school collects and processes personal data relating to pupils, parents/guardians, staff, and Board of Management members as set out in our full Data Protection Policy. This includes information gathered at enrolment, during the course of a pupil's time in the school, and during employment.

How do we use your information?

We use personal data only for the purposes for which it was collected:

  • Analytics data — solely to understand how our website is used so we can improve it for our school community
  • Contact and enrolment data — to respond to enquiries and process applications
  • Pupil and staff data — for the management and administration of school business, in compliance with educational legislation

We do not sell, share, or transfer any data to third parties for commercial purposes.

Lawful basis for processing

Under Article 6 of the GDPR, we process personal data on the following bases:

  • Consent — for analytics cookies, photography/images, and optional activities
  • Legal obligation — to comply with education, child protection, and employment legislation
  • Legitimate interest — for the day-to-day management and administration of the school
  • Public task — to perform tasks carried out in the public interest in the field of education

Your rights under GDPR

Under the GDPR and the Data Protection Acts 1988–2018, you have the right to:

  • Be informed — know what personal data we hold and why (this policy and our Data Protection Policy)
  • Access — request a copy of any personal data we hold about you (a Data Subject Access Request, or DSAR)
  • Rectification — have inaccurate personal data corrected
  • Erasure ("right to be forgotten") — request deletion of your personal data where it is no longer necessary for the purpose it was collected, subject to any legal retention obligations
  • Restrict processing — request that we limit how we use your data in certain circumstances
  • Data portability — receive your personal data in a structured, commonly used format
  • Object — object to processing based on legitimate interest or for direct marketing
  • Withdraw consent — at any time where consent is the lawful basis (e.g. by clicking "Cookie Settings" in the footer for analytics, or by contacting the school to withdraw photography consent)

You will not be charged a fee for exercising these rights in most circumstances.

How to make a request

To exercise any of the above rights, please contact the school in writing:

We will respond to your request within one calendar month of receipt, as required by the GDPR. In exceptional circumstances (e.g. complex or numerous requests), this may be extended by a further two months — we will inform you of any extension within the first month.

You may be asked to verify your identity before we can process your request.

Data retention

We retain personal data only for as long as necessary for the purpose it was collected, or as required by law:

Data typeRetention period
Website analytics (Cloudflare)90 days
Cookie consent preferencesStored locally in your browser — cleared when you clear browser data
Published pupil photographsMaximum 3 years from publication, then reviewed and removed
Photography consent recordsDuration of pupil's enrolment + 1 year
Pupil recordsIn line with Department of Education guidelines
Staff recordsIn line with DES and Revenue Commissioner requirements
Enrolment applicationsDuration of pupil's enrolment + 1 year (unsuccessful applications: 12 months)
Board of Management records7 years after end of term of office

For full retention details, see our Data Protection Policy.

Data storage and security

  • Website data — this website is hosted on Cloudflare Pages. Cloudflare processes data in accordance with its Privacy Policy and is certified under the EU–US Data Privacy Framework.
  • School records — manual records are stored in a secure, locked filing cabinet in a locked office accessible only to authorised personnel. Digital records are stored on password-protected, encrypted devices.
  • Third-party processors — the school uses Aladdin as a data processor for school administration. A Data Processor Agreement is in place in accordance with Article 28 of the GDPR.

We do not transfer personal data outside the European Economic Area (EEA) except where adequate safeguards are in place (e.g. Cloudflare's Data Privacy Framework certification).

Photography and images of pupils

Photographs and video of pupils published on this website are personal data under GDPR. We only publish such images where written consent has been obtained from the relevant parent or guardian. Consent is specific (separate for website, newsletter, and social media) and may be withdrawn at any time.

For full details of how we handle pupil images, including retention periods and your right to withdraw consent, please see our Photography & Image Policy.

Children's data

As a primary school, much of the personal data we process relates to children. We are committed to protecting children's data in accordance with the GDPR's enhanced protections for minors. Parental/guardian consent is obtained for any processing based on consent for children under 16 years of age.

Data breaches

In the event of a personal data breach that is likely to result in a risk to individuals' rights and freedoms, we will notify the Data Protection Commission (DPC) within 72 hours. Where the breach is likely to result in a high risk to affected individuals, we will also notify those individuals without undue delay.

Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Data Protection Commission (DPC):

We would appreciate the opportunity to address your concerns directly before you contact the DPC.

Related policies

Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated date. We encourage you to review this page periodically.