Privacy Policy
Effective 5 October 2026
This policy explains how Acornstar Limited, trading as Loresson ("Loresson", "we", "us"), handles personal data. Sections 1 to 11 apply to everyone. Section 12 adds rights for California residents and Section 13 for Australian residents.
1 Who We Are
Acornstar Limited, company number [CRO NUMBER], Acorn House, Lowtown, Robertstown, Naas, Co Kildare, Ireland, is the controller of personal data about our website visitors, enquirers, clients and marketing contacts. Contact our privacy team at hello@loresson.com.
2 When We Are a Processor
When you send us a brief, script, procedure or other course material for a production project, any personal data in that material belongs to you or your organisation. We process it only on your instructions under our Data Processing Agreement, and you remain the controller. Questions about that data should go to the organisation that supplied it.
3 Data We Collect
Enquiry data. Your name, work email, phone number, organisation and the details of your enquiry, provided by you through our forms, by email, by phone or when you book a call.
Campaign data. The source, medium, campaign and content parameters (UTM tags) on the link you arrived from, linked to your enquiry so we know which marketing activity led to it.
Client data. Contact details for your project team, contracts, project correspondence and approvals.
Project content. Briefs, scripts, procedures and the training materials we produce, handled as described in Section 2.
Billing data. Billing name, address, VAT status and payment confirmation. Card details are handled by our payment provider, not by us.
Marketing data. Your email preferences and responses to our campaigns, collected with your consent.
Website data. IP address, device, browser and pages visited, collected through cookies with your consent where the law requires. See our Cookie Policy.
4 Why We Use It and Our Legal Basis
Responding to enquiries and preparing quotes. Legitimate interests, or steps taken at your request before entering a contract.
Delivering projects and managing the client relationship. Contract.
Producing course content with AI providers. Contract.
Billing, tax and accounting. Contract and legal obligation.
Understanding which marketing works, using campaign data. Legitimate interests.
Security and preventing misuse. Legitimate interests.
Marketing emails. Consent, or legitimate interests for existing business clients, always with an easy opt-out.
Non-essential cookies and analytics. Consent.
5 Artificial Intelligence
We use AI providers to help produce course content and to help sort and respond to enquiries. These providers act as our sub-processors. We do not use your content to train AI models, and our AI providers are contractually barred from doing so. We do not use AI to make decisions that have legal or similarly significant effects on you. Full details are in our AI Transparency Statement.
6 Who We Share Data With
We never sell personal data. We share it only with the service providers listed on our Sub-processors page under written contracts, with professional advisers, with authorities where the law requires, or with a buyer of our business under equivalent protections.
7 International Transfers
Some providers process data outside the EEA and the UK, including in the United States. Where a provider is certified under the EU-US Data Privacy Framework and its UK extension, we rely on that. Otherwise we rely on the European Commission's Standard Contractual Clauses with the UK addendum. Our own systems are hosted in the European Union, in Ireland.
8 How Long We Keep Data
Enquiries that do not lead to a project. 2 years from our last contact.
Client and project records. The life of the relationship plus 6 years.
Project content you send us. The life of the project, then deleted from live systems within 30 days and from backups within 90 days, unless you ask us to keep it for future updates.
Billing and tax records. 6 years, as required by Irish tax law.
Marketing data. Until you unsubscribe or withdraw consent.
Consent records. 5 years.
AI providers keep data only for the limited periods set out in their commercial terms, as listed on our Sub-processors page.
9 Your Rights
You have the right to access, correct or delete your data, to restrict or object to our processing, to data portability, and to withdraw consent at any time. Email hello@loresson.com. We respond within one month. You can complain to the Data Protection Commission in Ireland (www.dataprotection.ie) or to your local authority, such as the Information Commissioner's Office in the UK (www.ico.org.uk).
10 Security
We use encryption in transit and at rest, access controls, multi-factor authentication for staff and regular security reviews. We will notify you and the regulator of a personal data breach where the law requires.
11 Children
Loresson is a business service and is not intended for anyone under 18. We do not knowingly collect their data.
12 California Residents
This section applies to California residents under the California Consumer Privacy Act as amended. In the last 12 months we collected the categories in Section 3, which correspond to identifiers, commercial information, internet activity and professional information. We use them for the purposes in Section 4.
We do not sell personal information. If we use advertising cookies that count as sharing for cross-context behavioural advertising, you can opt out through the Do Not Sell or Share My Personal Information link, and we honour Global Privacy Control signals.
You may know, access, correct and delete your personal information, limit use of sensitive information, and opt out of selling or sharing. We will not discriminate against you for exercising these rights. An authorised agent may act for you.
We do not use automated decision-making technology to make significant decisions about you.
To make a request, email hello@loresson.com. We will verify your identity and respond within 45 days.
13 Australian Residents
We handle personal information consistently with the Australian Privacy Principles. Data may be disclosed to recipients in Ireland, the EU, the UK and the United States as described in Sections 6 and 7. You may request access or correction at hello@loresson.com. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner.
14 Changes
We will post updates here with a new effective date. Where a change materially affects clients, we will tell them by email.
15 Contact Us
Email hello@loresson.com
Post Acornstar Limited, Acorn House, Lowtown, Robertstown, Naas, Co Kildare, Ireland