Privacy notice

Last updated: 23 July 2026

This notice explains what Shamrock PCs does with your personal information. It's written to meet the General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.

Who's responsible

Sviatoslav Hrabas, a sole trader trading as Shamrock PCs, of Yellow Walls Road, Malahide, Co. Dublin, Ireland. You can reach me at [email protected] about anything on this page.

What I collect, and why

What I don't do

• I don't sell, rent or trade your details to anyone. Ever.
• I don't add you to a marketing list because you asked a question. If I ever start a newsletter you'd have to opt in.
• I don't use tracking or advertising cookies. There's no analytics script and no Facebook pixel. The only cookie the site can set is from the live chat, and only if you choose to start it (see below).
• I don't ask for card details on this website and never will. If you pay by card you are handed over to Stripe's own checkout, so your card number never reaches my site or my hands. Bank transfer, Revolut and cash all remain available if you'd rather not use a card at all.

Live chat

The chat button in the corner is powered by Tawk.to, a live-chat service, so you can talk to me directly. Nothing from Tawk loads until you click the button and choose to start a chat — at that point Tawk sets a cookie on your device and the messages you send are processed on Tawk's servers so I can read and reply to them. If you never open the chat, none of that happens and no cookie is set. You're welcome to ring, email or WhatsApp me instead and skip it entirely. Tawk.to's own handling of your data is covered by their privacy policy.

Session recording

To see what actually works on this site and what does not, I use Microsoft Clarity. It records how a page is used — where the pointer moves, what gets clicked, how far you scroll — and plays it back to me as an anonymous replay. It shows me, for example, that people keep clicking something that is not a button, so I can fix it.

None of it runs unless you accept the banner. Decline and no recording script is loaded at all. If your browser sends a Global Privacy Control signal, that is treated as a decline and you are not asked. Your choice is kept in your own browser and you can change it by clearing site data.

Anything you type is masked before it leaves your browser. The contact form, the build configurator, the checkout window and the account pages are all excluded — your name, phone number, address and email never appear in a recording. Clarity is operated by Microsoft, who act as a processor on my behalf; their own privacy statement covers what they do with it.

Who else sees your data

Only where it's needed to do the job:

• Cloudflare — hosts the website, runs the domain's DNS, forwards email sent to addresses on this domain to my inbox, and stores the accounts and orders database. That database is located in Cloudflare's Western Europe region. Cloudflare is a US company operating a global network, so some processing may occur outside the EU under the standard contractual clauses permitted by the GDPR.
• Web3Forms — receives what you type into the contact and build forms and emails it to me. It stores submissions only briefly and does not use them for anything else.
• Tawk.to — only if you choose to start a live chat, it carries and stores that conversation so I can reply to you.
• Microsoft (Clarity) — only if you accept session recording, it receives the anonymous replay of how the page was used. Everything you type is masked out before it is sent.
• Stripe — only if you pay by card. You are taken to Stripe's own checkout page and they process the payment. I receive confirmation that it succeeded, the amount, and the name and email you gave them — never your card number.
• The courier — gets your name, address and phone number so they can deliver the machine.
• My accountant and the Revenue Commissioners — sales records, as required by Irish tax law.

If you contact me through Facebook Marketplace or WhatsApp instead, those platforms have their own privacy policies and handle that conversation on their terms, not mine.

If you create an account

An account is entirely optional — you can order without one. If you make one, here is exactly what changes.

• There is no password. Signing in works by a one-time link emailed to you, so there is no password stored here to be stolen or reused against you elsewhere.
• What's kept: your email, and whatever you choose to save — name, phone, delivery address, Eircode and county — plus the orders you've placed.
• Where: in a Cloudflare D1 database in the Western Europe region.
• Sign-in links expire after 20 minutes and work once. Sessions last 60 days, and both are stored hashed rather than in readable form.

On your account page you can download everything held about you as a file, or delete the account outright. Deleting removes your name, address, phone and email permanently and signs you out. The sale record itself stays, because Revenue requires business records for six years — but stripped of everything that identifies you.

How long I keep it

• Enquiries that don't lead to a sale: deleted after 12 months.
• Order and warranty records: kept for 6 years, which is how long Revenue requires business records to be retained and how long statutory consumer claims can run.
• Server logs: whatever the host's default retention is, typically a few weeks.
• Account details: for as long as you keep the account. Delete it and they go at once.
• Sign-in links: 20 minutes. Sessions: 60 days, or until you sign out.

Your rights

Under the GDPR you can ask me to:

• Give you a copy of everything I hold about you
• Correct anything that's wrong
• Delete your data, where I'm not legally required to keep it
• Restrict or object to how I'm using it
• Provide it in a portable format
• Withdraw consent at any time, without affecting anything done before you withdrew it

Email [email protected] and I'll deal with it within one month, free of charge.

If you're not happy with how I've handled your data, you're entitled to complain to the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28.

Data on machines I handle

If you hand me an old PC for a trade-in, a data transfer or WEEE recycling, I only access what's needed to do the job you asked for. Drives are securely wiped or physically destroyed before anything leaves my hands, and I'll confirm in writing which one I did if you want that.

Changes

If this notice changes materially, the date at the top changes with it, and anyone with an open order gets an email.