Last updated: August 2026

This Data Protection Notice (this "Notice") explains how your Personal Data will be handled by Common Knowledge, and sets out the personal information relating to you ("Personal Data") that will be collected and processed by us, and/or on our behalf by our third party service providers, if you visit our website ourcommonknowledge.org (the "Website"), if you interact with us via our social media platforms, if you contact us or enter into correspondence with us, book a course or event with us, take part in a project, stay with us, if you make a donation or subscribe to our membership programme, if you volunteer with us, or if you express an interest in doing any of these. We are required to notify you of this information under the General Data Protection Regulation ("GDPR").

Who we are. "Common Knowledge", "our", "we" and "us" refer to two related Irish companies:

Common Knowledge Centre for Sustainable Living Company Limited by Guarantee (company number 705098) — the parent, a not-for-profit company limited by guarantee, and the controller of your Personal Data in relation to our charitable, community, membership, volunteering and donation activities.

Common Knowledge Activities Limited (company number 725061) — its wholly owned trading subsidiary, and the controller of your Personal Data in relation to course and event bookings, accommodation and hospitality, and payments.

Both have their registered office at Boghill, Kilfenora, Co. Clare, V95 DK38. Where this Notice does not distinguish between them, it applies to both.

You can contact our Privacy Manager at info@ourcommonknowledge.org.

1. Purpose and scope of notice

Set out above.

2. Your personal data collected and obtained

Please note that the below list of Personal Data we may collect about you, while intended to be as complete and accurate as reasonably possible, is not exhaustive and may be updated from time to time. We may collect and process some or all of the following Personal Data about you set out below.

2.1 Personal Data we collect via our Website

When you use our Website we may collect certain Personal Data from you. This may include information about your device browser including your IP address, the type of device you used to access the internet, whether you reached the Website using a search engine or if you clicked a link on another website, and other information derived from cookies used on the Website. This can also include details of your visits to the Website such as traffic data, location data, and linked websites that you can access through the Website. See the Cookies section below.

2.2 Contact and correspondence Personal Data

If you contact us or enter into correspondence with us, we may collect some or all of the following: name; address; e-mail address; phone number; and any Personal Data you may communicate to us.

2.3 Donating, booking, taking part, or subscribing

If you make a donation, book a course or event, take part in a project, book accommodation, or subscribe to our membership programme, via our Website or otherwise, we may collect some or all of the following: name; address; e-mail address; age; gender; and payment card details.

2.4 Volunteering Personal Data

If you sign up to volunteer with us, via our Website or otherwise, we may collect some or all of the following: name; address; gender; age; e-mail address; phone number; what you would like to achieve by volunteering; where you would be travelling from; details of any contributions you may make; any preferences and living requirements you may have; and any other Personal Data you may choose to communicate to us.

2.5 Lift sharing

Where we help course participants and visitors share lifts to and from our site, we collect your name, the area you would be travelling from, and your journey intentions, and we make this available to others taking part so that journeys can be arranged. See the Retention section below for how long this is kept.

3. Health, dietary and accessibility information

Some of the information you give us is what the GDPR calls special category data — in our case, principally information about your health, including allergies, dietary requirements and accessibility needs.

Why we ask for it. We cook for and accommodate the people who come to us. We cannot feed you safely, or make our site and courses usable for you, unless we know what you need. We ask for it so that we can meet your needs, and for no other reason.

How we handle it. We ask for your explicit consent to hold and use this information at the point where you give it to us — a separate, clearly marked choice, not something bundled into our terms and conditions. You can withdraw that consent at any time by contacting our Privacy Manager, though if you do we may no longer be able to cater for you or accommodate your requirements. Where the information is needed to protect your life or someone else's in an emergency and you are not able to give consent, we may act on it on that basis.

Who can see it. Access is limited to the members of our team who need it to do their job — principally our kitchen, hospitality and course delivery staff. We hold it in our booking and records systems. We do not manually enter health, dietary or accessibility information about you into general-purpose software assistants of the kind described below; where such details need to be discussed using those tools, our team uses initials or codes instead.

4. Third party sources

We may receive the following Personal Data about you from third party sources.

4.1 Third party Personal Data

We may receive information about you from third parties. For example, where our employees or volunteers have listed you as their emergency contact and provided your name and contact details.

4.2 Service provider Personal Data

We may receive information such as your name, address, phone number, email address, age, gender or purchase, payment and donation information from our third party service providers — principally our payment provider, our website and booking platforms, and our customer relationship and email platform.

4.3 Social media Personal Data

We may receive limited information about you from social media platforms, such as Facebook, Instagram and LinkedIn, when you interact with us via such platforms. This includes information such as details of how you shared our Website via the social media resources on the Website.

5. How and why we process your data

Below, we set out the legal bases on and purposes for which we collect and process your Personal Data.

5.1 Entering into or performance of a contract

It is necessary to process your Personal Data to enter into and perform a contract with you. We process your information to allow us to deliver courses and accommodation and to complete the payment transaction. You are obliged to provide us with your Personal Data as it is necessary to enter into a contract with us; otherwise we will not be able to process your booking or your payment.

5.2 Consent

When you freely and voluntarily give us your Personal Data for the purposes listed, you consent to our processing of your Personal Data. The purpose of this is to take account of any information, preferences or requirements you notify us of, whether you are engaging with us as a volunteer, a participant, a guest or otherwise, and to seek your views and comments on the activities we undertake. Where the information is health, dietary or accessibility information, we ask for your explicit consent separately, as described above. You may withdraw consent at any time. Any processing carried out before you withdraw your consent will remain valid.

5.3 Compliance with a legal obligation

It is necessary for us to collect and process your Personal Data in order to comply with legal obligations imposed on us — for example, under applicable provisions of company, tax and charity law.

5.4 Legitimate interests

It is necessary for the purposes of our legitimate interests to process your Personal Data. For example: to send you marketing communications, newsletters or information about your subscriptions and donations; to carry out the general administration of our organisation, including maintaining our records and handling our correspondence; and to perform data analytics to develop an understanding of the people who take part in what we do, so that we can improve it. In volunteering situations, we also process this data to contact you in emergencies where a volunteer has listed you as their emergency contact, to make arrangements with you, and to engage your assistance when you sign up as a volunteer with Common Knowledge.

You have a right to object at any time to the processing of your Personal Data where we process it on the legal basis of pursuing our legitimate interests. You also have a right to object at any time to the processing of your Personal Data for direct marketing purposes.

6. Software assistants and automated processing

We are a small team, and some of our day-to-day work is carried out with the help of software assistants — for example, organising records, drafting correspondence, summarising documents and preparing reports. Where this involves Personal Data, the following applies:

We use business accounts. Our use is governed by a written data processing agreement with the provider, under which they act only on our instructions.

Your information is not used to train models. It is not used to train the provider's own systems, and it may not be used to train any third party's. This is a contractual commitment of the business accounts we hold.

We do not manually enter special category information. Health, dietary, accessibility or similar sensitive details about you are not put into these tools by our team, as described above.

We do not make decisions about you by automated means. Nothing affecting you is decided automatically. A member of our team reviews, and remains responsible for, any decision that concerns you.

If we ever intend to use these tools in a way that goes meaningfully beyond the above, we will update this Notice and tell you before we do so.

7. The technology we choose

We think the tools an organisation runs on are part of what it stands for, so we try to be deliberate about them rather than defaulting to whatever is easiest.

Where we want to get to. Our long-term intention is to move to a data-sovereign, largely self-hosted platform — one where the information you give us lives on infrastructure we control, and where we depend on as few third parties and large technology companies as possible.

Where we are now. We are not there yet, and we would rather say so than imply otherwise. We are a small team with limited time and money, and some of the tools that do the job well are run by companies we would not choose in an ideal world. For now we make those trade-offs consciously, weighing what we actually need against what is practically available to us, and we revisit them as our own capacity grows and better options appear.

8. Cookies

Our Website uses cookies and similar technologies. Cookies are small text files placed on your device that allow a website to work, to remember your choices, and to collect information about how the site is used.

Strictly necessary cookies are needed for the Website to function — for example, to keep you signed in or to hold the contents of a booking while you complete it. These are set without your consent because the site cannot work without them.

All other cookies — including any analytics, performance and marketing cookies — are set only if you consent. When you first visit the Website you will be asked to make a choice, and you can change or withdraw that choice at any time through the cookie settings on the Website.

Where cookies collect Personal Data, the rest of this Notice applies to it. Refusing non-essential cookies will not stop you using the Website.

9. Disclosure of your data

We may disclose some or all of the Personal Data we collect from and obtain about you to the following categories of recipient:

9.1 Third party service providers

Our payment provider; our website hosting and event booking platforms; our customer relationship management and email delivery providers; our accounting and payroll providers; our productivity, file storage and software assistant providers; and our insurers and professional advisers. Each of these acts as a processor on our behalf under a written data processing agreement, and may only use your Personal Data on our instructions.

9.2 Other recipients

Or where we are under a duty to disclose or share your Personal Data in order to comply with any legal or regulatory obligation or request.

You may ask our Privacy Manager for the identity of the providers we use at any time, and we will tell you.

10. Transfers of your personal data

It is our policy to hold and process your Personal Data within the European Economic Area ("EEA") wherever that is viable. When we choose and review the services we rely on, European hosting and storage is what we look for first, and it is what we choose whenever a suitable option exists.

Some of the services we depend on nonetheless process data in the United States — at present these include our payment provider, our website hosting platform and our software assistant provider. Where we use such a service we do so as a considered decision, and only where we are satisfied that appropriate safeguards are in place.

Where Personal Data is transferred outside the EEA, we rely on safeguards approved under the GDPR — principally the European Commission's Standard Contractual Clauses, incorporated into the written data processing agreements we hold with each of these providers. You may request further information about these safeguards, and a copy of them, by contacting our Privacy Manager using the details below.

11. Retention of your personal data

We keep your Personal Data for as long as it is needed for the purpose we collected it for. Rather than a single fixed period, we apply the following criteria.

Contact, membership, donation and participation records are kept for as long as you remain in a relationship with us — because people come back to us years later, and we would rather still know who you are than ask you to start again. If you unsubscribe, ask us to stop contacting you, or ask us to erase your data, we act on that. We also review our records periodically and remove people who have had no contact of any kind with us for a long period.

Financial and transaction records — including payments, donations and anything else forming part of our accounts — are kept for at least six years, because company and tax law requires it, and then deleted.

Health, dietary and accessibility information is kept only for as long as we need it to look after you, and is deleted when your consent is withdrawn or when it is no longer needed for that purpose.

Lift sharing information is kept indefinitely, because it forms part of the record of our community and of the impact of what we do. You can ask us to remove it at any time.

Website and cookie data is kept for the period set out in the cookie settings on our Website.

In certain circumstances we may retain your Personal Data for longer if we determine that we are required to do so — for example, if we are dealing with an ongoing claim, or believe in good faith that the law or a relevant regulator may reasonably in our view expect or require us to preserve it.

12. How we store your data

We care about protecting your Personal Data. That is why we put in place appropriate measures that are designed to prevent unauthorised access to, and misuse of, your Personal Data. These include measures to investigate and deal with any actual or suspected data breach.

We are committed to taking reasonable and appropriate steps to protect the Personal Data that we hold from misuse, loss, or unauthorised access. We do this by having in place a range of appropriate technical and organisational measures. These include limiting access to our systems and tools to those members of our team who need it, using business accounts that we control and administer, and maintaining internal rules setting out what information may and may not be entered into the software assistants described above.

13. Your rights

You have rights in relation to your Personal Data, which are set out below. Note that in certain circumstances these rights may not be absolute.

13.1 Right of access

You have the right to request a copy of the Personal Data held by us about you. We will only charge you for making such an access request where we feel your request is unjustified or excessive.

13.2 Right to rectification

You have the right to request that we amend any inaccurate Personal Data that we have about you.

13.3 Right to erasure

You have the right to ask us to erase your Personal Data where your Personal Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed by us; you withdraw your consent and no other legal ground permits us to process your Personal Data; you object to the processing and there are no overriding legitimate grounds for the processing; your Personal Data have been unlawfully processed; or your Personal Data must be erased in order to comply with a legal obligation.

We may not be able to comply with a request where we require your Personal Data for compliance with a legal obligation or in connection with legal proceedings or for exercising our own rights.

13.4 Right to restriction of processing

You have the right to ask us to restrict processing your Personal Data in the following situations: where you contest the accuracy of your Personal Data; where the processing is unlawful and you do not want us to delete your Personal Data; where we no longer need your Personal Data for the purposes of processing but you require the data in relation to a legal claim; or where you have objected to our processing of your Personal Data pending the verification of whether or not our legitimate business interests override your interests, rights and freedoms or in connection with legal proceedings.

When you exercise this right we may only store your Personal Data. We may not further process the Personal Data unless you consent or the processing is necessary in relation to a legal claim or to protect the rights of another person or legal person or for reasons of important public interest. We will inform you before the processing restriction is lifted.

13.5 Right to data portability

You may request us to provide you with your Personal Data which you have given us in a structured, commonly used and machine-readable format, and you may request us to transmit your Personal Data directly to another data controller where this is technically feasible. This right only arises where we process your Personal Data on the basis of your consent or where it is necessary to perform our contract with you and the processing is carried out by automated means.

13.6 Right to object

You have a right to object at any time to the processing of your Personal Data where we process your Personal Data on the legal basis of pursuing our legitimate interests.

You have a right to object at any time to the processing of your Personal Data for direct marketing purposes.

13.7 Right to withdraw consent

Where we process your Personal Data on the basis of your consent — including the explicit consent we ask for in relation to health, dietary and accessibility information — you may withdraw that consent at any time by contacting our Privacy Manager. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

13.8 Rights in relation to automated decision-making

You have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you. As set out above, Common Knowledge does not make decisions about individuals by solely automated means.

13.9 Exercising your rights

You can exercise any of these rights by submitting a request in writing to our Privacy Manager at info@ourcommonknowledge.org.

We will provide you with information on any action taken upon your request in relation to any of these rights without undue delay and at the latest within one month of receiving your request. We may extend this up to two months if necessary, however we will inform you if this arises. Please note that we may ask you to verify your identity when you seek to exercise any of your data protection rights.

You also have the right to lodge a complaint with the Data Protection Commission. For further information see www.dataprotection.ie.

14. Changes to this notice and questions

We may amend this Notice on occasion, in whole or part. Where we make minor or clarifying changes, the revised Notice will take effect once published on our Website.

If we decide to use your Personal Data in a manner significantly different from that stated in this Notice, or otherwise disclosed to you at the time it was collected, we will notify you by e-mail or post before doing so, and you will have a choice as to whether or not we use your Personal Data in the new manner.

If you have any questions, comments or concerns about the way your Personal Data are being used or processed by Common Knowledge, please submit your question, comment or concern in writing to our Privacy Manager at info@ourcommonknowledge.org.