Privacy Notice
Who we are and what this notice covers
The Mercantile Bar is operated by Orangeseed Designated Activity Company, a company registered in Ireland under company number 599431, with its registered office at 39/40 Dawson Street, Dublin 2, D02 X067, and is part of the Mercantile Entertainment Group. Orangeseed DAC is the data controller for the personal data described here. In this notice “we”, “us” and “our” mean Orangeseed DAC trading as The Mercantile Bar.
This notice explains what personal data we collect through this website, why we collect it, who we share it with, how long we keep it, and what rights you have.
If you have a question about this notice or want to exercise any of the rights described below, use our privacy request form or write to Data Protection, The Mercantile Bar, 25-27 Dame Street, Dublin 2. We aim to respond within one month.
This notice was last updated on 13/11/2026. We review it when our processing changes and will post any updated version at this address.
What personal data we collect
| When | What we collect |
|---|---|
| If you contact us | Your name, contact details and anything you tell us in your message |
| When you visit the website | Technical information such as your IP address, browser and device, and, if you agree, information collected through cookies as described in our Cookie Policy |
We do not seek special category data (such as health data or information about your beliefs) and ask that you do not send it to us.
What we use it for, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Answer your enquiry and keep a record of our correspondence | Legitimate interests: dealing properly with the people who contact us |
| Keep the website secure and block spam and automated abuse | Legitimate interests: protecting our website and the people who use it |
| Understand how the website is used | Your consent, given through our cookie banner |
Who we share your data with
We share personal data only where we need to, and only with organisations that are bound to protect it.
| Who | Why |
|---|---|
| WP Engine | Hosts the website and the data held on it |
| Gravity Forms | Handles the forms on this website; entries are stored on our own hosting |
| Google reCAPTCHA and CleanTalk | Check form submissions for spam and automated abuse. For this they receive what you entered and your IP address |
| SMTP2GO | Sends emails from the website, such as form notifications |
| Sucuri and WP Activity Log | Website security monitoring and logs of administrator activity, which include IP addresses |
| Cookiebot (Usercentrics) | Records the cookie choices you make on our website |
| Google Analytics and Google Tag Manager | Measure how the website is used, only where you have agreed through the cookie banner |
These organisations act on our instructions as processors, except public bodies and our professional advisers, who act as controllers in their own right. We do not sell your personal data.
Some of these providers are based outside the European Economic Area, or use infrastructure that is. Where personal data is transferred outside the EEA, we rely on the European Commission’s adequacy decisions (including the EU-US Data Privacy Framework) or on standard contractual clauses. You can ask us for details of the safeguards that apply.
How long we keep it
| What | How long |
|---|---|
| Website form submissions | 28 days on the website, then deleted |
| Correspondence with you | Two years from our last contact with you |
| Website security logs | 90 days |
Your rights, security, and how to complain
Your rights. You have the right to ask us for a copy of the personal data we hold about you; to have inaccurate data corrected; to have data erased where we no longer have a reason to hold it; to restrict or object to how we use it; and to receive data you gave us in a portable format. Where we rely on your consent, you can withdraw it at any time. Where we rely on legitimate interests, you can object and we will stop unless we have compelling grounds to continue.
To exercise any of these, use our privacy request form or write to us at the address above. We will respond within one month. We may ask you to confirm your identity first, so that we do not disclose your data to someone else.
Security. We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss or disclosure, and we require our processors to do the same. If a breach occurs that is likely to result in a risk to your rights, we will notify the Data Protection Commission, and you directly where the risk is high.
Cookies. Our use of cookies and similar technologies, and how to change your choices, is described in our Cookie Policy. Non-essential cookies are set only where you have agreed through the consent banner, and you can change your choice at any time.
Complaints. If you are unhappy with how we have handled your personal data, please tell us first so that we can put it right. You also have the right to complain to the Data Protection Commission at any time:
Data Protection Commission
6 Pembroke Row, Dublin 2, D02 X963
www.dataprotection.ie