1. Who we are
Strategic Sourcing Alliance Limited is the controller of personal data collected through ssalimited.com (the "Website"). This policy explains what we collect, why, and the rights you have under the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Acts 1988–2018.
- Company: Strategic Sourcing Alliance Limited, a private company limited by shares registered in Ireland under the Companies Act 2014
- Company registration number (CRO): 802150
- Registered office: The Black Church, St. Mary's Place, Dublin 7, D07 P4AX, Ireland
- Privacy contact: joul@ssalimited.com
We have not appointed a Data Protection Officer because we are not legally required to. Send any privacy question to the contact address above.
This policy covers the Website and enquiries made through it. Personal data processed under a contract with a client or supplier is also governed by that contract.
2. Data we collect
We collect only what you send us and the minimum technical data needed to run the Website.
| Category | Examples | Source |
|---|---|---|
| Contact details | Name, email address, company, job title, phone number | You, via the contact form or email |
| Enquiry content | Your message, project requirements, attachments | You |
| Business correspondence | Emails, call notes, quotes, contract discussions | You and our team |
| Technical data | IP address, browser type, device, pages requested, date and time | Your browser, automatically |
| Due diligence data | Company ownership, end-user and end-use information, sanctions screening results | You, public registers, screening databases (see section 7) |
The Website is aimed at businesses. We do not knowingly collect data from children, and we ask you not to send us special categories of data (such as health or political opinions) through the contact form.
3. Why we use your data and our legal basis
Every use of personal data has a legal basis under Article 6 GDPR.
| Purpose | Legal basis |
|---|---|
| Answering your enquiry and preparing quotes | Steps taken at your request before entering a contract (Art. 6(1)(b)); our legitimate interest in replying to business contacts (Art. 6(1)(f)) |
| Performing and administering a contract with you or your company | Performance of a contract (Art. 6(1)(b)) |
| Export control, sanctions and anti-fraud checks | Legal obligation (Art. 6(1)(c)); legitimate interest in lawful trading (Art. 6(1)(f)) |
| Keeping accounting and tax records | Legal obligation (Art. 6(1)(c)) |
| Running, securing and fixing the Website | Legitimate interest in a safe, working website (Art. 6(1)(f)) |
| Sending occasional business updates to existing contacts | Legitimate interest (Art. 6(1)(f)); you can opt out at any time |
| Establishing or defending legal claims | Legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interest, we have weighed it against your rights. You can ask us for details of that assessment. We do not use automated decision-making that produces legal or similarly significant effects on you.
4. Cookies
Cookies are small text files a website stores on your device. Similar technologies, such as local storage, are covered by this section too. The Website uses only strictly necessary cookies, which do not require consent under the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011.
| Cookie | Provider | Purpose | Category | Duration |
|---|---|---|---|---|
| cookie_consent | ssalimited.com | Stores your cookie choices | Strictly necessary | 12 months |
| Session / security cookie | ssalimited.com | Keeps the site secure and protects forms from spam | Strictly necessary | Session |
The Website does not use analytics, advertising, tracking or social media cookies. If we add such cookies in future, we will ask for your consent first and update this policy. You can review or change your cookie choice at any time via the Cookie Notice link in the footer.
Fonts and other assets are served from our own servers, so loading a page does not send your IP address to font or CDN providers. You can block or delete cookies in your browser settings; blocking strictly necessary cookies may stop parts of the Website from working.
5. Who receives your data
We never sell personal data. We share it only with the recipients below, and only as far as each needs it.
| Recipient | Purpose | Location |
|---|---|---|
| Hosting provider | Hosting the Website and its servers | EU |
| Email / form delivery provider | Delivering contact form messages and business email | EU |
| Certified manufacturers and R&D partners | Preparing quotes and fulfilling orders, only where your enquiry requires it | EU and outside the EU |
| Logistics and customs providers | Shipping and customs clearance | EU and outside the EU |
| Professional advisers, auditors, insurers | Legal, accounting and compliance advice | Ireland / EU |
| Public authorities, including export control and customs authorities | Where the law requires us to disclose data | Ireland / EU |
Service providers act as our processors under written contracts (Art. 28 GDPR).
Transfers outside the EEA. Our partner network is global, so some data may be transferred outside the European Economic Area. We transfer data only where the destination has an EU adequacy decision, or under the European Commission's Standard Contractual Clauses with additional safeguards where needed. You can request a copy of the relevant safeguards from our privacy contact.
6. How long we keep data
We keep personal data only as long as the purpose requires, then delete or anonymise it.
| Data | Retention period |
|---|---|
| Enquiries that do not lead to a contract | 24 months after our last contact |
| Contract and order records | 6 years after the contract ends (limitation period for contract claims) |
| Accounting and tax records | 6 years, as required by Irish tax law |
| Export control and sanctions screening records | At least 5 years after the end of the calendar year of the export, as required by EU dual-use rules |
| Server logs | 30 days, unless needed to investigate a security incident |
We may keep data longer where needed for a pending legal claim or an official investigation.
7. Export control and sanctions screening
Some products we source, including drone systems and specialised components, may be dual-use items under Regulation (EU) 2021/821 or subject to EU sanctions. Before we enter into a transaction, we screen counterparties, their owners and the stated end user against EU, UN and other applicable sanctions lists.
This screening uses names, company details, ownership information and end-use declarations. It is required by law and by our legitimate interest in trading lawfully. If screening shows a possible match, a member of our compliance team reviews it manually before any decision. We may share screening results with competent authorities where the law requires it.
8. Security
The Website is served only over HTTPS. Access to personal data is limited to staff and processors who need it, protected by access controls and multi-factor authentication. If a personal data breach is likely to put your rights at risk, we will notify the Data Protection Commission within 72 hours and inform you where required.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy
- have inaccurate data corrected
- have your data erased, where there is no legal reason for us to keep it
- restrict our processing of your data
- object to processing based on legitimate interest, including direct marketing
- receive your data in a portable format, where processing is based on consent or contract
- withdraw consent at any time, without affecting earlier processing
To use any of these rights, email joul@ssalimited.com. We reply within one month, extendable by two months for complex requests. We may ask you to confirm your identity first.
10. Complaints
If you are unhappy with how we handle your data, please contact us first so we can try to resolve it. You also have the right to complain to the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland (dataprotection.ie), or to the supervisory authority in the EU country where you live or work.
11. Changes to this policy
We may update this policy when our services or the law change. The "Last updated" date at the top shows the current version. We will notify existing contacts of significant changes by email.