Privacy Policy

Last updated 20 September 2026

Candere Limited (“Candere”, “we”, “us”) respects your privacy. This policy explains how we collect, use and protect personal data when you visit our websites, contact us, or use our services, and sets out your rights under the General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.

1. Who we are

Candere Limited is a company registered in Ireland (company number 823459), with its registered office at 102 Rathdown Park, Greystones, Co. Wicklow, A63 FY74, Ireland. For any privacy question you can reach us at hello@canderegroup.com.

2. The two ways we handle personal data

We act as a data controller for people who visit our sites (candere.net, canderegroup.com) and who contact us — this policy governs that.

When we deliver bookkeeping, payroll, reporting and automation services, we act as a data processor: we process personal data on behalf of our clients and only on their documented instructions. For that data the client is the controller, our handling is governed by our services agreement and data-processing terms with that client, and the client’s own privacy notice applies to their staff and customers. The safeguards described below apply throughout.

3. The personal data we collect

When you use our enquiry form we collect: your name, organisation, email address, phone number (if you give it), the sector and area you select, and your message. If you choose the optional “a little more about you” step, we also collect your role, whether you are a group and its name, the lead company registration number, the number of employees and computer users, and any frustrations you list.

With each submission we also record technical data — your IP address, browser type (user-agent) and the date and time — which we use to keep the service secure and prevent abuse. If you email us, we hold your email address and the content of your message.

We do not use tracking or advertising cookies. Our site stores a single light/dark theme preference in your browser’s local storage; it stays on your device and is never sent to us.

4. Why we use it, and our legal basis

• To respond to your enquiry and discuss how we might help — on the basis of your consent (the tick box) and our legitimate interest in responding to enquiries.
• To provide and administer our services where you become a client — on the basis of performance of a contract and compliance with legal obligations (for example, accounting and tax law).
• To keep our systems secure and prevent misuse — on the basis of our legitimate interests.
• To meet legal and regulatory obligations — on the basis of a legal obligation.

5. Automation and automated decisions

We use automation and, in some internal processes, AI and large-language-model tools to draft, sort and speed up routine work. A person remains responsible for decisions. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

6. Where your data is held, and how we protect it

Your data is hosted on our own infrastructure located in the European Union (Ireland). We keep it encrypted in transit (TLS), restrict access on a least-privilege basis, isolate each client’s data from every other, and maintain audit-ready records. We do not transfer personal data outside the European Economic Area; if that ever changed, we would put appropriate safeguards in place first.

7. Who we share it with

We do not sell your personal data or share it for marketing. We rely on a small number of service providers who act as our processors under contract, principally:

• Hosting / infrastructure: Blacknight Internet Solutions Ltd (Ireland).
• Email: our own mail server, hosted in the European Union.

When we deliver client services, any additional sub-processors (for example, the accounting or payroll platforms a client uses) are set out in, and governed by, our data-processing agreement with that client. We may also disclose data where required by law, or to establish, exercise or defend legal claims.

8. How long we keep it

• Enquiries and general correspondence: for as long as needed to deal with your query and our relationship, and normally no longer than 24 months after our last contact, unless you become a client or ask us to delete it sooner.
• Client service records (including accounting and payroll records): retained for the periods required by Irish law — generally at least six years — after which they are securely deleted or returned in line with the client agreement.

9. Your rights

Under the GDPR you have the right to access a copy of your data; to have inaccurate data corrected; to have your data erased; to restrict or object to processing; to data portability; and, where we rely on consent, to withdraw it at any time (without affecting processing already carried out). To exercise any of these, email hello@canderegroup.com and we will respond within one month.

If we hold your data as a processor for one of our clients, please contact that client (the controller) in the first instance; we will support them in responding.

10. Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Data Protection Commission (DPC), 21 Fitzwilliam Square South, Dublin 2, D02 RD28 — dataprotection.ie.

11. Changes to this policy

We may update this policy from time to time. The “last updated” date at the top shows the current version, and significant changes will be highlighted on this page.

12. Contact

Questions about this policy or your data: hello@canderegroup.com, or write to Candere Limited, 102 Rathdown Park, Greystones, Co. Wicklow, A63 FY74, Ireland.