1. Who we are
Mang Morgan Assurance is the trading brand of Mang Morgan Capital Limited. For the website, enquiries, proposals, contracts and our own business administration, the data controller is Mang Morgan Capital Limited, company number 700205, with its registered office at Suite 4, 3 Lombard Street East, Dublin 2, Ireland.
Privacy enquiries and data-rights requests can be sent to info@mangmorgan.ie. Do not use ordinary email to send passwords, credentials, personal records or confidential audit evidence.
2. Scope of this notice
This notice applies to visitors to this website, people who submit an enquiry, prospective and current client contacts, supplier and professional contacts, and people whose details appear in our business administration records.
It does not replace the engagement-specific data-processing schedule, confidentiality terms or secure-evidence instructions agreed with a client.
3. Our role during client engagements
Our data-protection role depends on the processing activity and is assessed during engagement acceptance. Mang Morgan may act as a processor where it handles personal data only on a client’s documented instructions. It may act as an independent controller for activities where it determines the relevant purposes and means, including professional independence, quality, legal obligations, conflict management, record retention or the establishment and defence of legal claims.
Where Mang Morgan is appointed as a processor, an Article 28-compliant written agreement must be in place before the processing begins. The agreement defines the subject matter, duration, instructions, data categories, confidentiality, security, sub-processors, rights assistance, incident support, audits and return or deletion arrangements.
4. Personal data we collect
- Contact and professional information: name, work email, organisation, role and correspondence.
- Scoping information: requested service, target dates, organisational size, locations, products, cloud environments, management-system maturity, evidence-readiness level and delivery preference.
- Privacy-management context: controller or processor role, jurisdictions, categories of personal data, processing activities and supplier categories. The form asks for categories, not identifying examples.
- Proposal and engagement records: scope, assumptions, acceptance decisions, conflicts, contracts, billing contacts, meeting records, approvals, findings and release records where applicable.
- Technical information: IP address, request time, browser or device information, requested page and security-event information processed by the hosting and delivery infrastructure.
We normally obtain this information directly from you, your organisation or an authorised representative. If information is provided by another source, we provide the required information unless an applicable exemption applies.
5. Purposes and lawful bases
| Purpose | Typical lawful basis |
|---|---|
| Respond to an enquiry, assess fit and prepare a requested call or proposal. | Our legitimate interest in responding to business enquiries. Where the enquirer is personally entering or considering a contract with us, steps requested before entering that contract may apply instead. |
| Conduct competence, capacity, conflict, independence and engagement-acceptance checks. | Legitimate interests in professional, ethical and risk-managed service delivery; legal obligation where applicable. |
| Administer an agreed engagement, communicate with client contacts and manage payment. | Our legitimate interest in delivering and administering services for organisational clients; legal obligation for records we must keep. Contract performance may apply where the individual is personally a party to the contract. |
| Secure the website, prevent abuse, diagnose failures and protect systems. | Legitimate interests in network, information and service security. |
| Maintain controlled records and establish, exercise or defend legal claims. | Legal obligation and legitimate interests in accountability and legal protection. |
The exact lawful basis can depend on the relationship and processing activity. We do not rely on the privacy-acknowledgement checkbox as consent. It confirms that the notice was presented. We do not use enquiry details for unrelated electronic marketing without a separate lawful basis and the controls required by law.
6. What happens when you submit the enquiry form
- Your browser sends the answers you enter over an encrypted connection to a server-side function hosted by Vercel. Please provide only non-confidential information.
- The function checks the required fields and applies anti-abuse controls. Those checks cannot determine whether free text contains confidential information. Form contents are not intentionally written to application logs or a website database.
- Resend, our selected transactional-email provider, sends one notification to the authorised Mang Morgan mailbox and one acknowledgement to your work email.
- Only after the email provider accepts both messages for delivery does the website show a reference. Provider acceptance does not guarantee inbox delivery.
Do not submit passwords, access tokens, personal records, special-category data, criminal-offence data or confidential evidence. A restricted evidence channel is agreed after engagement acceptance where required.
7. Recipients and service providers
Access is limited to people and providers who need the information for the stated purpose. Recipients may include authorised Mang Morgan personnel, Vercel as website hosting and serverless infrastructure provider, Resend as transactional-email provider, our business email provider, authorised IT support, approved engagement specialists, insurers, accountants, solicitors, auditors and public authorities where disclosure is legally required.
Service providers are subject to appropriate contractual, confidentiality and security obligations. An engagement-specific sub-processor list is provided where Mang Morgan acts as a processor and the contract requires it.
8. International transfers
Our hosting, email-delivery and business-mail providers may process information outside the European Economic Area, including in the United States. The destination and transfer mechanism depend on the provider, service and account configuration. Please contact us for information about the safeguards applicable to a particular transfer. We review provider terms and transfer arrangements when enabling or changing services.
9. Retention
- Enquiries that do not become engagements: normally deleted or anonymised 12 months after the last substantive contact.
- Successful proposals, contracts and engagement-administration records: normally retained for seven years after engagement closure, subject to legal, tax, insurance, professional or dispute requirements.
- Engagement evidence and workpapers: retained under the period stated in the engagement terms and records schedule, then securely deleted or returned as applicable.
- Transactional email copies and delivery logs held by Resend: retained under the activated account settings and our documented records schedule, with the period reviewed when provider settings or service needs change.
- Hosting and security logs: retained for the period made available under the selected Vercel plan and longer only where necessary to investigate a security or service event.
Records may be retained longer where required by law, litigation hold, an unresolved complaint, insurer instruction or the establishment, exercise or defence of legal claims. Retention is reviewed when our services, providers, legal obligations or insurance requirements change.
10. Security
We use measures proportionate to the information and risk, including encrypted transmission, access control, multi-factor authentication for administrative services where available, least-privilege access, data minimisation, controlled release processes, restricted evidence channels, provider due diligence, backups where appropriate and incident-management procedures. No method of electronic transmission or storage can be guaranteed completely secure.
11. Your rights
Subject to the conditions and exemptions in data-protection law, you may have rights to access your personal data, correct inaccurate data, request erasure, restrict processing, object to processing based on legitimate interests, receive eligible data in a portable form and withdraw consent where consent is the basis used.
Send a request to info@mangmorgan.ie. We may request information needed to verify identity and protect the data from unauthorised disclosure. Exercising a right is normally free of charge, although the law permits limited exceptions.
12. Complaints
Please contact us first so that we can try to resolve the concern. You also have the right to complain to the Irish Data Protection Commission (opens in a new tab) or, where applicable, another competent supervisory authority.
13. Required and optional information
The fields marked as required are needed to identify and respond to the enquiry. If they are not provided, we cannot process the request. Optional scope information helps us prepare for the conversation but is not required to submit an enquiry.
14. Automated decisions, profiling and marketing
We do not use the enquiry form for solely automated decisions that produce legal or similarly significant effects. We do not profile visitors for advertising, sell enquiry data or use behavioural advertising pixels.
15. Cookies and analytics
No non-essential analytics, advertising pixels or marketing cookies are configured. Essential hosting and security functions may process request information without placing non-essential cookies. If this changes, the notice and any required consent controls will be updated before activation.
16. Children
Our services are directed to organisations and professional contacts, not children. Do not submit information about a child through the website.
17. Changes to this notice
We review this notice when our services, providers or processing activities change and as part of the annual document-control cycle. Material changes will be identified through the version and effective date shown above.