Policies and agreements

Service User Privacy Statement

Important notices: 

• If you're at serious risk to yourself or others, we will need to reach out to emergency services to keep you and/or others safe. 

• If you're under 18 and you tell us you are at risk of abuse or neglect, we will need to reach out to emergency and/or TUSLA to keep you safe. 

• If you give us information about an alleged abuser, where other children may be at risk, we will need to reach out to Ireland’s child protection agency TUSLA.

Who are we?

spunout (“we” or “us”) is a charity based in the Republic of Ireland. We provide active listening and information services, including Text About It, Youth Information Chat and spunout Academy. Our registered charity number is 20057923. 

We are independent, but receive financial support from the Irish state through the Health Service Executive (HSE), the Department of Children, Equality, Disability, Integration and Youth, the Department of Community and Rural Development, the City of Dublin Youth Services Board, and Pobal. 

What is personal information?

Personal information is any information that can identify you in some way. It can include things like your name, address, data of birth and computer’s IP address. This information is considered to be normal or non-sensitive data. 

Some personal information needs to be more protected because it is sensitive. This is known as ‘sensitive data’ or ‘special category data’. Sensitive data includes information about your health, ethnicity, sexuality, sex life, religious or political beliefs, or trade union membership. 

Legal reasons for using your personal information

In order to use your personal information, we need to have a legal reason for doing so. This is known as our ‘legal basis’ for using your personal information. 

We use your non-sensitive personal information to provide you with our services. Our legal basis for using your personal information in this way is ‘legitimate interest’. This means that we need to use your personal information in order to provide you with the services you need, and to provide, maintain and improve those services for you and others. 

If your messages to us include sensitive personal information, we must have an additional legal basis for using that information. Our legal bases for using your sensitive data are:

• Vital interests: We may also share your personal information (including your sensitive data) with third parties, such as emergency services (for example, the National Ambulance Service), where we think there is an imminent risk of harm to you or someone else. The lawful basis for this is your ‘vital interests’, to keep you safe. For more information, please see ‘What do we use your personal information for’ below. 

• Substantial public interest: We rely on the ‘substantial public interest’ legal basis to use your sensitive data and this data is required to provide our confidential support services in the public interest. 

We may rely on your consent to use your personal information (including your sensitive data). Where this is the case, we will always tell you when we collect your personal information and the reason we need it. Where you give us your consent, you can change your mind and withdraw consent at any time. 

What personal information do we collect?

When you first contact our services, we will have access to your contact information. We keep this in order to be able to provide you with our service. 

We keep the content of any messages you exchange with us, including any personal information you may have included in your conversation, including sensitive data. 

Once you have finished using our services, you will have the option to complete a feedback survey. Any personally identifying information will be removed from any feedback you provide before it is shared with any third party. 

Your data rights and how to exercise them

Irish and European Union law provides you with certain rights in relation to your personal information. These include the right to:

• Access and receive a copy of your personal information;

• Object to the processing of your personal information; 

• Restrict (or limit) the processing of your personal information;

• Port your personal information (this means to move, copy or transfer personal information easily from one location to another, in a safe and secure way);

• Correct your personal information if you think it is inaccurate; and

• Erase or delete your personal information. 

In some cases, your ability to exercise these rights may be limited. For example, we may not always be able to delete your personal information when we are required by law to retain it, or where it is essential to retain personal information for reasons of business continuity. 

If you wish to exercise any of your rights, please contact us at dpo@spunout.ie or at our postal address below in the ‘How to contact us’ section. 

If you make a request relating to any of the rights listed above, we will consider each request in line with data protection law. No fee will be charged for considering and/or complying with your request to exercise your rights. 

If you would like to access a copy of all the personal information we hold about you, please email dpo@spunout.ie with the subject line ‘Data Access Request’. Please include your name in the body of the email and, if possible, the most recent time you used spunout services. You will be asked to confirm your request and, once you do, we will action your request within 30 days. 

If you would like us to erase any personal information that we may hold about you, please text ‘ERASE’ to 50808 or email dpo@spunout.ie with the subject line ‘Data Erasure’. You will be asked to confirm your request and, once you do so, we will delete your personal information within 30 days, unless we are required to keep it under the law. 

If you start a conversation with one of our services and decide you no longer wish to receive messages, you may opt out at any time by texting the word STOP. We will confirm receipt of your STOP message and will not contact you further after this. 

What do we use your personal information for?

To provide spunout services

We use your personal information for the purpose of providing you with spunout services. If you decide to use our services again, our staff may need to look back at your previous conversations to make sure that we are giving you the best support possible. They might also need to look back at conversations for legal reasons, or to review the quality of our services.

To share your details with the emergency services or other appropriate third parties to keep you (or someone else) safe

We take your confidentiality very seriously and your conversations are confidential, unless we are concerned about your safety or the safety of another person. If we think you or someone else is in immediate physical danger or that you or someone else’s life is at imminent risk, we will try to work with you to form a safety plan. If this is not possible or if we think you are at risk of what are called ‘safeguarding issues’ (for example abuse or neglect), we may share your details with the emergency services or appropriate authorities, including police, ambulance/medical and social services, in order to keep you (or anyone else) safe and as necessary to protect your vital interests. 

If you tell us about any abuse or potential abuse of children, either ongoing or in the past, we are obliged to share your personal information with Tusla, the Child and Family Agency. 

To anonymise conversations for data analytics and research purposes (including sharing information with selected partners)

We effectively anonymise and aggregate data from your conversations to ensure you cannot be identified from such information. We analyse anonymised conversation data to help us understand the needs of our texters and to improve spunout services. We sometimes share anonymised data with carefully selected partners (including academic partners) for research purposes and/or to help improve people’s lives across Ireland. We use this information for our legitimate interests in improving spunout services and to better understand mental health trends.

To prioritise those most at risk of harm

When you first message us, we analyse the information you provide in order to prioritise those most at risk of harm. We use this information for our legitimate interests in ensuring we respond more quickly to those in need of urgent support and in order to keep you safe (to protect your vital interests).

To protect against, identify and prevent abuse of spunout services and our policies, and other unlawful activity

If we think someone is abusing our services, we may share your data with third parties for the purposes of discouraging this behaviour. This might include where someone is using the service to break the law, misusing the service or is communicating in a threatening way with spunout volunteers or staff. We use this information for our legitimate interests in keeping our services safe and secure for both texters and volunteers.

To improve spunout services and understand mental health trends

We effectively anonymise and aggregate data from your conversations to ensure you cannot be identified from such information. We use this information to improve our services and to understand mental health trends. We are always trying to make our services better and create new features that improve how the service operates. Anonymised conversation data helps us do this by better understanding how spunout operates, developing and testing new service features and products, and advancing the technology we use. We use this information for our legitimate interests in improving our services by providing a better service to texters and better understanding mental health trends.

To conduct feedback surveys

Once you have finished engaging with us, you will have the option to complete a feedback survey. This survey includes questions relating to your experience of using our services and questions that help us to understand more about our service users. Completion of the survey is entirely optional and based on your consent. Any personally identifying information will be removed from any feedback you provide before it is shared with any third party.

To comply with our legal obligations

We may disclose your personal information to comply with the law or in response to a court order, government request, or other legal process, including criminal investigations, or to protect the interests, rights, safety, or property of spunout.

How we share your personal information

We respect and seek to preserve the confidentiality of people who use spunout services. However, in certain circumstances, we may share your personal information with third parties, including with: 

• An Garda Síochana, social and ambulance/medical services to keep you safe and protect you from harm; 

• Tusla, the Child and Family Agency, if you tell us about any abuse or potential abuse of children, either ongoing or in the past;

• Researchers at universities and other institutions to help us understand the mental health needs of our texters and to improve our services. As outlined above, we will only share anonymised data with research partners; 

• Service providers that perform services on our behalf, such as IT service providers, hosting providers and our advisers. For example, we have engaged with Crisis Text Line who provide certain IT services, including technology that allows us to prioritise incoming messages; and

• Other third parties, as necessary, to comply with the law or in response to a court order, government request, or other legal process, including criminal investigations, and to protect the interests, rights, safety, or property of spunout, its employees or agents, including but not limited to our volunteers. 

How long do we keep your information?

Your information is securely stored. We will keep information such as your telephone number and the record of the text messages that you exchange with us for up to seven years after you contact spunout. Then we will permanently delete this information from our records. If you contact us again after this time, you will appear to be a new service user. We will not have any record of our previous conversations with you.

Effectively anonymised and aggregated data from your conversations, from which you cannot be identified, will be retained indefinitely. 

Do we transfer personal information to other countries?

We hold all of your data securely in Ireland and Germany, and any companies who do work for us are obliged to keep your personal data in the European Economic Area (EEA). 

spunout engages service providers that perform services on our behalf, such as IT service providers, hosting providers and our advisers, some of which may be based outside of the EEA. For example, we have engaged with Crisis Text Line who provide certain IT services, including technology that allows us to prioritise incoming messages. 

In order to transfer your data outside the EEA, we rely on relevant “adequacy regulation” from the European Union (EU) by which they recognise certain countries outside of the EEA to ensure an adequate level of protection for personal information. For example, the UK in 2024 is not part of the EEA, but is recognised as providing adequate protection for personal data under EU law. 

For personal data to be transferred to recipients located in countries that have not been recognised as providing an adequate level of data protection (such as the USA), spunout will put in place appropriate safeguards with the data recipients to ensure full compliance with EU data protection law. 

Protecting your data

Always be careful and responsible regarding your personal information and sensitive data. You might want to delete conversations with our services from your phone. You might even want to clear us from your history and make sure we are not saved in your contact list. 

Changes to this Privacy Statement

We may update this Privacy Statement at any time. If we make significant changes to the way we use your personal information, we will bring these to your attention by posting a link to an updated version of the Privacy Statement in a clear and prominent location on our websites. The date this Privacy Statement was last updated is indicated at the top of this page. 

How can you make a complaint?

If you have any question or concerns about this Privacy Statement and our privacy practices or if you wish to file a complaint, please contact us by emailing dpo@spunout.ie or by writing to our Data Protection Officer at the address below. 

If we fail to satisfactorily resolve your concerns or complaint, or you otherwise consider it necessary, you have the right to lodge a complaint with the Data Protection Commission of Ireland. Contact information for the Data Protection Commission is listed below. 

Webpage: www.dataprotection.ie 

Email: info@dataprotection.ie
Telephone: (01) 765 0100 or 1800 437 437, Monday-Friday from 9:30am-5pm
Address: Data Protection Commissioner, 21 Fitzwilliam Square, Dublin 2, D02 RD28 

How can you contact us?   
If you have any general questions, you can email us at hello@spunout.ie. 

If you have any questions about how we use your data, you can email our Data Protection Officer at dpo@spunout.ie. 

Our postal address is spunout, 48 Fleet Street, Dublin 2.