Privacy Policy

IncorpHub (incorphub.ie), a service of Stein Commercial Ltd, trading as Workhub

1. Who we are

This privacy policy explains how Stein Commercial Ltd, trading as Workhub (CRO no. 565850, registered office 77 Lower Camden Street, Dublin 2, D02 XE80), operating the IncorpHub brand at incorphub.ie ("IncorpHub", "we", "us", "our"), collects and uses your personal data. We are the data controller responsible for your personal data.

Data-protection contact: Nicholas Simons, nick@workhub.ie, 77 Lower Camden Street, Dublin 2, D02 XE80, +353 1 270 6713.

2. Scope

This policy applies when you visit incorphub.ie, enquire about or use our company-formation, company-secretarial, registered-office, virtual-office, address, telephone, call-answering and workspace services, or otherwise deal with us.

We act as a data controller for the personal data we collect to run our business, including company-formation and secretarial work, anti-money-laundering checks, billing, and operating our website. We act as a data processor when we handle personal data solely on a customer's documented instructions (for example mail, parcels or calls relating to that customer's own clients), and in that case we process it only as instructed and the customer's own privacy notice governs that data.

3. The personal data we collect

• Identity and verification data: name, date of birth, nationality, residential address, photo ID, proof of address and other documents we are legally required to obtain.
• Company and beneficial-ownership data: details of directors, secretaries, shareholders and beneficial owners of the companies we form or service.
• Contact data: email address, telephone number and postal address.
• Transaction and account data: services purchased, plan, billing records, and correspondence with us.
• Payment data: processed by our payment provider (Stripe). We do not store full card details on our own systems.
• Mail and call data: where you use our registered-office, virtual-office, mail-handling, telephone-number or call-answering services, the items of mail and the call records handled on your behalf.
• Screening data: results of sanctions, politically-exposed-person (PEP) and adverse-media checks.
• Technical and usage data: IP address, device and browser information, and how you use our website (see our Cookies Policy).

Some of the information we ask for is required by law (for example identity and beneficial-ownership data under anti-money-laundering rules) or is necessary for us to provide the services. If you do not provide it, we will not be able to act for you.

4. How we collect it

We collect data directly from you when you enquire, register, purchase a service or correspond with us; automatically through cookies and similar technologies when you use our website; and from third parties such as the Companies Registration Office (CRO), the Register of Beneficial Ownership (RBO), sanctions, PEP and adverse-media screening providers, and our service partners.

5. How we use your data and our legal bases

• Performance of a contract: to provide the services you request, manage your account and take payment.
• Legal obligation: to meet our duties as a designated person under the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 (as amended), to make filings with the CRO and RBO, and to comply with tax and other law, including customer due diligence, PEP and sanctions screening and record-keeping.
• Legitimate interests: our specific interests in preventing fraud and the misuse of our services and address; keeping our systems, website and premises secure; recovering debts owed to us; understanding and improving our services; and sending you service and account messages. We have weighed these interests against your rights and freedoms, and you can ask us for our assessment.
• Consent: for non-essential cookies and any marketing communications. You can withdraw consent at any time.

6. Special-category and criminal-offence data

Where our screening identifies PEPs, sanctions matches or adverse information, we may process data relating to alleged or actual offences. We do so only where permitted under Articles 9 and 10 of the GDPR and the Data Protection Act 2018, principally to meet our legal anti-money-laundering obligations. Where the law requires, we may report to and share information with the authorities, and we may be legally prohibited from telling you that we have done so.

7. Who we share your data with

• Public registries: the Companies Registration Office (CRO) and the Register of Beneficial Ownership (RBO), as needed to form and maintain companies.
• Regulators and authorities: the Department of Justice Anti-Money Laundering Compliance Unit (AMLCU), Revenue, An Garda Síochána / Financial Intelligence Unit, and others where required or permitted by law.
• Service providers (processors): Nexudus (member, billing and service management), Stripe (payment processing), Google (Google Workspace email, and Google Analytics and Google Ads on our website), Vercel (website hosting) and Sanity (content management), each under a data-processing agreement.
• Professional advisers: solicitors, accountants and auditors, where necessary.
• Other companies in our group (operating under the Workhub brand), where needed to provide and administer the services.

We do not sell your personal data.

8. International transfers

Some of our providers (including Stripe, Google and Vercel) may process data outside the European Economic Area, including in the United States. Where they do, we rely on an adequacy decision (such as the EU–US Data Privacy Framework where applicable) or appropriate safeguards such as the European Commission's Standard Contractual Clauses. You can ask us for more information about these transfers, or a copy of the safeguards we rely on, by emailing info@workhub.ie.

9. How long we keep it

• Anti-money-laundering records (identity, verification and transaction records): five years after the end of our relationship with you, unless a longer period is specifically required or permitted by law.
• Company and filing records: as required by company law.
• Account, billing and tax records: six years, to meet tax and accounting obligations.
• Enquiries that do not become customers: up to 12 months, then deleted.
• Marketing data: until you withdraw consent or object.

After these periods we securely delete or anonymise the data, unless we are required to keep it for an ongoing legal claim or investigation.

10. Security

We use appropriate technical and organisational measures to protect your data, including access controls, encryption in transit, and limiting access to staff who need it. No method of transmission or storage is completely secure, but we work to protect your information and, where the law requires, to notify you and the Data Protection Commission of any breach.

11. Automated decision-making

We do not make decisions producing legal or similarly significant effects based solely on automated processing. Where we use screening tools, any match is reviewed by a member of our team before action is taken.

12. Children

Our services are for businesses and their representatives and are not directed at children. We do not knowingly collect data from anyone under 18.

13. Your rights

Subject to conditions and exemptions in the law, you have the right to access your data; to have inaccurate data corrected; to erasure; to restrict or object to processing; to data portability; and to withdraw consent. You can object to direct marketing at any time and we will stop. Some data (for example anti-money-laundering records) cannot be deleted before our legal retention period ends.

To exercise any right, contact nick@workhub.ie. You also have the right to complain to the Data Protection Commission (www.dataprotection.ie, 21 Fitzwilliam Square South, Dublin 2, D02 RD28).

14. Cookies

Our website uses cookies and similar technologies. Please see our Cookies Policy for details and for how to manage your preferences.

15. Changes to this policy

We may update this policy from time to time. The effective date above shows when it was last revised, and material changes will be notified on our website.