The Puffins Back to website

Privacy Policy

Last updated: 24 August 2026

This privacy notice explains how The Puffins handles personal data when you visit this website, contact us, or enquire about our video production services.

1. Who we are

The Puffins is a video production studio based in Dublin, Ireland. The Puffins is the data controller for the personal data described in this notice.

For privacy questions or to exercise your data protection rights, email [email protected].

2. Personal data we collect

Information you give us

When you use our contact form or email us, we receive your email address, your message, and any other information you choose to include. Contact-form submissions are stored in our WordPress database and sent through the Telegram Bot API to a restricted team group so that we can respond promptly. Please do not send sensitive personal data unless it is genuinely necessary for your enquiry.

Technical and security information

Our website and infrastructure providers may process technical information needed to deliver and protect the site, such as IP address, browser and device information, requested pages, timestamps, diagnostic data, and security signals.

External media and anti-spam services

Google reCAPTCHA protects the contact form from spam and abuse. If you play an embedded YouTube, Vimeo, or Instagram video, the relevant provider receives technical information about the request and may use cookies or similar technologies as described in our Cookie Policy.

3. Why we use personal data and our legal bases

  • To answer enquiries and prepare requested proposals: taking steps at your request before a possible contract, and our legitimate interest in communicating with prospective clients.
  • To provide agreed services and manage client relationships: performance of a contract and our legitimate business interests.
  • To keep business, tax, and legal records: compliance with legal obligations and our legitimate interest in establishing, exercising, or defending legal claims.
  • To operate, secure, troubleshoot, and improve the website: our legitimate interest in providing a reliable and secure website.
  • To load optional external media: your consent, expressed by playing a video or enabling external media in “Privacy settings”. You can change or withdraw this choice at any time through “Privacy settings” in the site footer.

4. Who receives personal data

We disclose personal data only where necessary. Recipients may include our website hosting, content delivery, security, communications, email, and technical support providers; authorised members of the private Telegram group used for enquiry handling; professional advisers where required; and public authorities where disclosure is required by law.

Cloudflare helps deliver and protect the website and provides cookie-free performance analytics. Google provides reCAPTCHA. Telegram receives the email address and message submitted through the contact form for delivery to our restricted team group. YouTube, Vimeo, and Meta (for Instagram Reel embeds) receive data only when their services are loaded as described in the Cookie Policy. See Telegram’s Privacy Policy and Meta’s Privacy Policy for Instagram.

5. International transfers

Some service providers may process data outside the European Economic Area. Telegram states that data for people who signed up from the EEA or UK is stored in data centres in the Netherlands and that transfers within its group outside the EEA use European Commission standard contractual clauses. For other providers and transfers, we rely on an applicable adequacy decision or appropriate safeguards such as standard contractual clauses, as required by data protection law.

6. How long we keep personal data

We generally keep enquiries for up to 24 months after the last substantive contact, including the operational copy delivered to our restricted Telegram group. If an enquiry leads to a client engagement, relevant correspondence and business records may be retained for up to six years after the relationship ends, or longer where a legal obligation or live claim requires it. Security and diagnostic data is retained for the shorter periods applied by our infrastructure providers and only for as long as needed for security, troubleshooting, and service delivery.

7. Your rights

Depending on the circumstances, you may have the right to access your personal data; correct inaccurate data; request erasure or restriction; object to processing based on legitimate interests; receive certain data in a portable format; and withdraw consent at any time. Withdrawing consent does not affect processing that was lawful before withdrawal.

To make a request, email [email protected]. We may ask for information needed to verify your identity. You also have the right to lodge a complaint with the Irish Data Protection Commission at dataprotection.ie.

8. Automated decisions and children

We do not use personal data collected through this website to make decisions that produce legal or similarly significant effects. reCAPTCHA uses automated risk analysis only to protect the contact form from abuse. This website is not directed at children.

9. Security and changes to this notice

We use proportionate technical and organisational safeguards, but no internet transmission is completely secure. We review this notice when our practices or legal obligations change and publish the updated date at the top of this page.