Privacy Policy

This Privacy Policy explains how Shake On It Limited, trading as TradeFile.ie ("we", "us", "our"), collects, uses, stores, and protects your personal data. We act as a Data Controller for your account management and billing data, and as a Data Processor when handling documents strictly on your instructions to deliver our document organisation service. We are committed to processing personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Data Protection Acts 1988–2018 (Ireland), and all applicable Irish and European Union data protection law.

1. Our Role Under GDPR

2. Personal Data We Collect

2.1 Identity and Contact Data

• Full name
• Business name and legal structure
• Email address
• Phone number / WhatsApp number
• Postal address (if provided)

2.2 Client-Submitted Documents (Processed on Your Behalf)

As a core part of our service, you transfer business documents to us including receipts, invoices, supplier statements, and related paperwork. We process these documents strictly as a Data Processor acting on your instructions to fulfil our contract with you.

These documents may contain supplier names and VAT numbers, transaction amounts and dates, bank account references (where visible on documents), business addresses, and names of third parties appearing on submitted documents.

We do not analyse, interpret, audit, or act on the financial content of these documents beyond naming and filing them. Any category labels applied are for organisational purposes only and do not constitute financial or tax advice.

2.3 Payment Data

Payment is processed by Stripe, Inc. We do not collect or store your card details. Stripe processes payment data under its own privacy policy (available at stripe.com/ie/privacy) and acts as an independent data controller for payment processing. We receive transaction confirmation and basic billing information from Stripe.

2.4 Usage and Technical Data

• IP address and browser type (collected via website logs and cookies — see our Cookie Policy)
• Pages visited and time spent on our website
• Device type and operating system

2.5 Communications Data

• WhatsApp message history relating to your account
• Email correspondence
• Support queries and complaints

3. Legal Basis for Processing

We process your personal data on the following legal bases under Article 6 GDPR:

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You have the right to object to processing based on legitimate interests at any time — see Section 9.

4. How We Use Your Personal Data

We use your personal data solely for the purposes described in Section 3. Specifically:

• To provide the document organisation and filing service you have signed up for
• To create and maintain your Google Drive folder and document log
• To communicate with you about your account, documents received, and monthly summaries
• To process payments via Stripe
• To comply with our legal obligations under Irish company law, tax law, and GDPR
• To investigate and resolve complaints or disputes
• To improve our service where this is based on anonymised and aggregated data

We will never use your data for marketing purposes without your explicit consent. We will never sell, rent, or trade your personal data to any third party.

5. Third Parties and Data Sharing

We share your personal data only in the following limited circumstances:

We do not transfer personal data outside the European Economic Area (EEA) except where the European Commission has issued an adequacy decision for the destination country, or where appropriate safeguards are in place (such as Standard Contractual Clauses). Where US-based processors are used (e.g. Stripe), we rely on Standard Contractual Clauses or equivalent mechanisms approved under GDPR Chapter V.

6. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, subject to any legal retention obligations.

On cancellation of your subscription, your Google Drive folder access will be revoked. We will retain copies of your filed documents for the applicable retention period. You should download and retain your own copies before cancelling.

7. Data Security

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

• Two-factor authentication (2FA) on all accounts holding client data
• Google Workspace Business Starter — EU-hosted, with data stored in Google data centres within the EEA
• No client financial data stored on personal devices
• Access to client data restricted to authorised personnel only
• Encrypted transmission (HTTPS/TLS) for all web communications
• Regular review of access permissions

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours and will notify you without undue delay where the breach is likely to result in a high risk to your rights, in accordance with Articles 33 and 34 GDPR.

8. Cookies

We use cookies and similar technologies on our website. For full details of the cookies we use, our legal basis for using them, and how to manage your preferences, please see our Cookie Policy.

9. Your Rights Under GDPR

Under GDPR and the Data Protection Acts 1988–2018, you have the following rights. These rights apply in most circumstances but may be subject to limitations where permitted by law.

To exercise any of these rights, contact us at info@shakeonit.ie with the subject line "Data Subject Request". We will respond within one calendar month. We may request proof of identity before processing your request.

10. Automated Decision-Making and Profiling

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you within the meaning of Article 22 GDPR. All document organisation is carried out by human operators. No automated decisions are made in relation to your data.

11. Children's Data

Our services are directed at adults (18 years and over) operating businesses. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that personal data of a minor has been collected, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by email at least 30 days before they take effect. The current version will always be available at tradefile.ie/privacy.

13. Contact and Supervisory Authority