Privacy Notice

The Chinese Business Association of Ireland (CBAI) is the data controller for the personal data described in this notice. This means we decide why and how that data is used.

You can reach us at:

• Chinese Business Association of Ireland
• 508B Mitchelstown Road, NW Business Park, Ballycoolin, Dublin 15, D15 A276, Ireland
• Email: info@ichina.ie

We are not required to appoint a Data Protection Officer, and we have not appointed one. If you have any question about privacy or about your rights, write to info@ichina.ie and your message will reach the person responsible.

We handle a small amount of personal data. It reaches us from the following sources.

Information you send us by email. Today, people contact us by email: the address is on our contact page. When you email us, we receive your email address, your name if you give it, and whatever you choose to write. If you send an attachment, we receive that too.

Information from our web server records. Like every website, our server keeps a record of the requests it receives. Each record contains the IP address the request came from, the date and time, the page or file requested, the result, and the browser identification string (the "user agent"). We do not use these records to build a profile of you and we do not link them to your identity.

Information you send through a contact form. If a page on this website offers a contact form, the details you type into it — your name, email address, subject and message, and optionally your telephone number, company name, enquiry category and preferred language — are sent to us and stored so that we can reply. We handle those details in exactly the same way as an email, on the same legal basis, and delete them on the schedule in section 6.

Information stored on your device. This website can store two small items on your device, and only if you click for them: a language preference cookie, and a marker recording that you closed our first-visit message. Neither identifies you and neither is used to measure or follow you. Our Cookies page lists both in full — what they hold, how long they last, and which of them reaches our server — and you can delete both at any time from Privacy and site settings.

Information our board members give us. We publish who leads the Chamber. For each member of our board that means their name in English and Chinese, their photograph, the office they hold, in some cases their employer and the city they come from, and a short biography. They give us these details for that purpose. Our legal basis is our legitimate interests (Article 6(1)(f) of the GDPR): members and the public are entitled to see who runs the Chamber. Any board member can object at any time under Article 21 by emailing info@ichina.ie, and we will take their details down.

We do not ask for and do not want special categories of data — for example data about health, religion, ethnic origin, political opinions or trade union membership. Please do not send such information to us.

Data protection law requires us to have a legal basis for each use of personal data. Ours are set out below.

To answer you. When you contact us, we use your details to read your message, reply, and keep a short record of the exchange. Our legal basis is our legitimate interests (Article 6(1)(f) of the GDPR). Our interest is in being able to receive and answer correspondence addressed to us, and in remembering what was discussed. Where your message is about joining the Chamber or about an existing membership, our legal basis is the performance of a contract with you, or steps taken at your request before entering one (Article 6(1)(b)).

To keep the website running and secure. We use our server records to keep the site available, to find and fix faults, and to detect and block attacks, scraping and other abuse. Our legal basis is our legitimate interests (Article 6(1)(f)). Our interest is in the security and availability of our own systems. EU data protection law expressly recognises network and information security as a legitimate interest.

To meet our own legal duties. Where the law requires us to do something with personal data — for example, to record and answer a request you make about your data — our legal basis is compliance with a legal obligation (Article 6(1)(c)).

To remember your language, if you ask us to. If you switch the language preference on, we store a small cookie on your device holding "en" or "zh". Storing it requires your consent under Regulation 5(3) of S.I. No. 336 of 2011, and where any personal data is involved our legal basis is your consent (Article 6(1)(a) of the GDPR). You can withdraw it at any time by switching the preference off, which deletes the cookie. A language code does not identify you. Our Cookies page explains this in full.

Where we rely on legitimate interests, you have the right to object. Section 8 explains how.

We do not use your data for advertising. We do not sell it. We do not share it with anyone for marketing purposes.

We keep the number of parties involved as small as we can. Personal data reaches only the following categories of recipient.

Our hosting provider. This website and its database run on servers we manage ourselves, on cloud infrastructure supplied by a hosting provider. That provider acts as our processor: it supplies the infrastructure and does not use the data for its own purposes. We have a data processing agreement with it as Article 28 of the GDPR requires.

Our email provider. Email sent to info@ichina.ie is delivered and stored by our email service provider, which also acts as our processor under a data processing agreement.

Professional advisers and authorities. In rare cases we may need to give personal data to our accountants or legal advisers, or to a public authority, court or regulator where the law requires it. We will only do this where we are obliged to, or where it is necessary to establish or defend a legal claim.

We name our processors as categories here because the specific companies can change over time, and we would rather this page stay accurate than name a company we later replace. If you want to know exactly who they are today, email info@ichina.ie and we will tell you.

Nobody else receives personal data from this website. There is no analytics service, no advertising network, no social media tracking, no tag manager, and no third-party font, video or map embedded in our pages.

Our website hosting and our database are located in the European Economic Area, in Ireland.

The website loads all of its own content — text, images, video and fonts — from our own servers. Nothing is loaded from another company's servers when you view a page, so viewing this site does not send your IP address to any third party.

Apart from that, we do not transfer personal data outside the European Economic Area, except where one of our providers does so in the course of delivering its service to us. Where that happens, the transfer is protected either by an adequacy decision of the European Commission or by the European Commission's standard contractual clauses, as Chapter V of the GDPR requires. If you would like to know which transfers apply and what protects them, email info@ichina.ie and we will tell you.

Our contact page includes an ordinary link to a map service. If you choose to click it, you leave our website and the other company's own privacy policy applies to what happens next. The same is true of any other external link.

We keep personal data only for as long as we need it, and then delete it. Where the data is held in our own systems, these periods are applied automatically by a scheduled job, not by hand.

• Server records: 30 days, then deleted. These records are not included in our backups, so 30 days is the total time we hold them.
• Contact form messages: 12 months from our last contact with you about the matter, then deleted. If we reply to an old enquiry, the 12 months start again from that reply, so an active conversation is never deleted underneath you.
• Email you send to info@ichina.ie: 24 months from the last message in the conversation, then deleted.
• Membership and financial records: six years from the end of the financial year they relate to, because Irish company and tax law requires us to keep them.

Correspondence that becomes a membership or financial record is kept under the rule for that record instead of the email rule.

There is one exception. If we have a legal or contractual reason to keep a particular record for longer — for example a dispute, a claim, or an obligation to a third party — we mark that record so the automatic deletion skips it. We keep only that record, and only for as long as the reason applies. Everything else is deleted on the normal schedule.

We also keep a nightly backup copy of our database, so that we can recover from a failure. Backups are kept for 30 days and then overwritten. This means that when we delete something, it is gone from our live systems on the schedule above, and gone from our backups within a further 30 days as those backups rotate out.

The two items this website can store on your device are not held by us and are not covered by the periods above. Each expires six months after it is written, and you can delete both at any time from Privacy and site settings. Our Cookies page lists them.

We take reasonable steps to protect personal data. The website is served over an encrypted connection (HTTPS). Access to our content management system requires a personal account and is limited to the people who need it. Our systems are kept up to date.

No website can promise perfect security, and we do not make that claim. If a security breach ever puts your rights at risk, we will notify the Data Protection Commission within 72 hours as Article 33 of the GDPR requires, and we will tell you directly where Article 34 requires it.

Under the GDPR and the Data Protection Act 2018 you have the following rights in relation to your personal data.

• Access (Article 15) — ask us whether we hold data about you, and get a copy of it.
• Rectification (Article 16) — have inaccurate data corrected, or incomplete data completed.
• Erasure (Article 17) — ask us to delete your data, where there is no good reason for us to keep it. We remove it from our live systems without undue delay, and it is gone from our backup copies within a further 30 days as those backups rotate out. We will confirm to you when both steps are done.
• Restriction (Article 18) — ask us to stop using your data while a question about it is being resolved.
• Data portability (Article 20) — receive data you gave us in a common machine-readable format, where we handle it by automated means on the basis of your consent or a contract.
• Objection (Article 21) — object at any time to our use of your data where we rely on legitimate interests. If you object, we will stop unless we can show compelling legitimate grounds that override your interests, or we need the data for legal claims.
• Automated decisions (Article 22) — not to be subject to a decision based only on automated processing that has a legal or similarly significant effect on you. We do not make such decisions (see section 9).
• Withdraw consent — where we rely on your consent for something, you can withdraw it at any time, and withdrawing is as easy as giving it. Withdrawing consent does not affect what we did lawfully before you withdrew it. There is one thing we rely on your consent for: storing the language preference cookie on your device, if you switch that preference on. Switching it off withdraws your consent and deletes the cookie immediately. Nothing else described in this notice depends on your consent.

To use any of these rights, email info@ichina.ie and tell us what you want. These rights are free to use. We may need to ask a question to confirm who you are, so that we do not give your data to someone else.

We will reply within one month of receiving your request. If your request is complicated, or if you have made several, we may need up to two further months — we will tell you within the first month if that happens, and why.

We do not use your personal data to make automated decisions about you, and we do not build profiles of visitors. Nothing on this website scores, ranks, targets or categorises you.

This website is aimed at businesses and professionals. It is not directed at children and we do not knowingly collect personal data from children. If you believe a child has sent us personal data, please contact info@ichina.ie and we will delete it.

If you are unhappy with how we have handled your personal data, please tell us first at info@ichina.ie. We would like the chance to put it right.

You also have the right to complain to the supervisory authority at any time. In Ireland this is the Data Protection Commission:

• Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland
• Portarlington office: Canal House, Station Road, Portarlington, Co. Laois, R32 AP23, Ireland
• Website: www.dataprotection.ie
• Online complaint form: in the "Contact us" section of the Data Protection Commission website

The Data Protection Commission does not accept complaints by telephone. Complaints must be made in writing, using the contact form on its website or by post.

If you live or work in another EU or EEA country, you may also complain to the supervisory authority there.

If we change how we handle personal data, we will update this notice and change the date at the top. Where a change is significant, we will say so clearly on this page for a reasonable period. Please check this page from time to time.

This notice was last updated on 21 July 2026.