Legal

Privacy policy

Last updated 6 October 2026

1. Who we are

Archer Ventures Limited is a private company limited by shares, registered in Ireland under company number 826807. Our registered office is shown at the foot of every page of this website.

For the personal data described in this policy, Archer Ventures Limited is the data controller. That means we decide why and how the data is used, and we are responsible for looking after it under the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR") and the Data Protection Acts 1988 to 2018.

You can contact us about anything in this policy, or about any personal data we hold about you, by emailing hugh@thedoomscrollbook.com or by writing to us at our registered office.

We have not appointed a data protection officer. Article 37 GDPR does not require us to appoint one. Our director is responsible for data protection and answers every request personally.

2. What this policy covers

This policy covers personal data that Archer Ventures Limited handles:

• when you visit this website;
• when you email, write to or otherwise contact the company;
• when you or the business you work for supplies services to us, advises us, partners with us or deals with us in any other business capacity; and
• in the statutory, accounting and tax records that Irish law requires every company to keep.

It does not cover The Doomscroll Book, a product we operate, which collects different information and has its own privacy policy (see section 18). It also does not cover any website we link to, which is responsible for its own handling of personal data.

3. Words we use

• Personal data means any information about an identified or identifiable living person, such as a name, an email address or an IP address.
• Processing means anything done with personal data, including collecting, storing, reading, sharing and deleting it.
• Controller means the organisation that decides why and how personal data is processed. For this policy, that is us.
• Processor means an organisation that processes personal data on a controller's behalf and only on its instructions, such as our hosting and email providers.
• EEA means the European Economic Area: the EU member states plus Iceland, Liechtenstein and Norway.
• "We", "us" and "our" mean Archer Ventures Limited. "You" means the person whose personal data we process.

4. Personal data we handle

This section lists every category of personal data we handle, where it comes from, why we use it, and the legal basis we rely on. Retention periods are set out in section 11.

4.1 Visiting this website

When your browser requests a page from this website, our hosting provider's servers automatically receive and log technical information. This happens on every website and is needed to send the page to your device.

• What: your IP address, the date and time of the request, the page or file requested, the address of the page that linked to it (the "referrer", if your browser sends one), your browser type and version, your operating system, and whether the request succeeded.
• Source: collected automatically from your browser.
• Why: to deliver the website to you, keep it running, protect it from attacks and abuse, and diagnose technical faults.
• Legal basis: our legitimate interests in operating a secure and working website (Article 6(1)(f) GDPR).

We do not use this information to identify you, build a profile of you or follow you across other websites, and we do not combine it with any other data. We only look at it if something goes wrong, such as a fault or a suspected attack.

4.2 Emailing or writing to us

• What: your name, email address and any other contact details you include, the content of your message, any attachments, and the date and time it was sent. If you write by post, your postal address and the content of your letter.
• Source: you.
• Why: to read and reply to your message, deal with what you ask, and keep a record of the conversation.
• Legal basis: our legitimate interests in answering correspondence and running our business (Article 6(1)(f) GDPR). If you contact us about entering into a contract with us, the basis is taking steps at your request before a contract (Article 6(1)(b) GDPR).

Please do not send us sensitive information, such as details of your health, religious beliefs or political opinions, unless we specifically ask for it. If you do send it, we will only use it to deal with your message, and we will delete it once it is no longer needed.

4.3 Suppliers, advisers, partners and other business contacts

• What: names, job titles, business email addresses, phone numbers, business postal addresses, the content of our correspondence and contracts, and, for individuals we pay directly, bank and invoicing details.
• Source: you, the organisation you work for, or publicly available business sources such as company websites.
• Why: to buy services, receive advice, manage contracts and partnerships, make and receive payments, and keep business records.
• Legal basis: performing a contract with you or taking steps toward one (Article 6(1)(b) GDPR); where the contract is with your employer, our legitimate interests in dealing with that organisation (Article 6(1)(f) GDPR); and where we must keep records by law, legal obligation (Article 6(1)(c) GDPR).

4.4 Company, accounting and tax records

Irish law requires every company to keep certain records, some of which contain personal data.

• What: details of our directors, company secretary, shareholders and beneficial owners, including names, addresses, dates of birth, nationalities and shareholdings; and details of individuals that appear in our accounting records, such as names on invoices and receipts.
• Source: the individuals concerned, and the documents we create in running the company.
• Why: to keep the statutory registers required by the Companies Act 2014, file information with the Companies Registration Office, register beneficial owners with the Register of Beneficial Ownership, keep accounting records, and meet our obligations to the Revenue Commissioners.
• Legal basis: legal obligation (Article 6(1)(c) GDPR).

Some of this information, including directors' names and the registered office address, is published on public registers maintained by the Companies Registration Office, as the law requires. We do not control those registers.

4.5 Job applications and unsolicited CVs

We are not currently recruiting. If you send us a CV or an application anyway:

• What: the information in your CV and message, such as your name, contact details, education and work history.
• Why: to consider whether we have a suitable role and to reply to you.
• Legal basis: taking steps at your request before a contract (Article 6(1)(b) GDPR) and our legitimate interests in considering applications (Article 6(1)(f) GDPR).

4.6 Legal claims, compliance and security

• What: any of the personal data described above, where it is relevant to a legal claim, a regulatory inquiry, a security incident or a request from a public authority.
• Why: to establish, exercise or defend legal claims, comply with the law and with lawful requests from courts, regulators and An Garda Síochána, and investigate and prevent fraud, abuse and security incidents.
• Legal basis: legal obligation (Article 6(1)(c) GDPR) where the law requires it, and otherwise our legitimate interests in protecting our company, our rights and the people we deal with (Article 6(1)(f) GDPR).

4.7 Do you have to give us personal data?

No. You do not have to give us any personal data. If you choose not to, we may be unable to reply to you or deal with you. Our directors and shareholders must provide certain details by law, for the company registers described in section 4.4.

5. What we do not collect

To be clear about the limits of what we do, this website:

• sets no cookies of any kind;
• uses no analytics, statistics or visitor-tracking tools;
• uses no advertising networks, pixels, tags or social media plugins;
• loads no content from third-party servers, because its fonts and images are hosted on the site itself;
• has no contact forms, newsletter sign-ups, user accounts, comments or payment pages; and
• does not intentionally collect special category data (such as health, ethnicity, religion, sexual orientation or political opinions) or data about criminal convictions.

We do not sell personal data, rent it, or share it with anyone for their own marketing.

6. Our legal bases

The GDPR only allows personal data to be processed where there is a legal basis for it. We rely on the following:

• Contract (Article 6(1)(b)): where processing is needed to perform a contract with you, or to take steps you have asked for before entering one.
• Legal obligation (Article 6(1)(c)): where Irish or EU law requires the processing, such as keeping company registers and tax records.
• Legitimate interests (Article 6(1)(f)): where processing is needed for our legitimate interests, or a third party's, and those interests are not overridden by your interests, rights and freedoms.

Where we rely on legitimate interests, we have weighed our interests against yours. Our interests are running a secure website, answering correspondence, dealing with the businesses we work with, and protecting our company. We think the processing is modest, expected, and has little impact on you, especially because we collect so little. You can ask us for more detail on this assessment, and you have the right to object (see section 14).

We do not currently rely on consent for any processing described in this policy. If we ever do, we will ask for it clearly and you will be able to withdraw it at any time.

7. Cookies and similar technologies

Cookies are small files that a website stores on your device. Similar technologies include local storage, pixels and device fingerprinting.

This website uses none of them. Because it stores nothing on your device and reads nothing from it beyond what your browser sends with every request, the consent rules in the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 do not apply, and there is no cookie banner.

If we ever add cookies or similar technologies that are not strictly necessary, we will update this policy first and ask for your consent before setting them.

8. Automated decisions and profiling

We do not make any decisions about you based solely on automated processing, and we do not profile you. Article 22 GDPR therefore does not apply to anything we do.

9. Who we share personal data with

We only share personal data where we need to, and only with the following.

9.1 Service providers who act for us

• Vercel Inc. hosts this website and processes the server log data described in section 4.1.
• Google Cloud EMEA Limited, through Google Workspace, provides our email and stores our correspondence and business documents.

These providers act as our processors. They may only use the data to provide their service to us, under data processing terms that meet Article 28 GDPR, and they must keep it secure and confidential.

9.2 Professional advisers

We may share personal data with our accountants, auditors, solicitors, insurers and other professional advisers where they need it to advise us or provide their services. They are bound by professional duties of confidentiality.

9.3 Public authorities and regulators

We share personal data with public bodies where the law requires it, including the Companies Registration Office, the Register of Beneficial Ownership, the Revenue Commissioners, the Data Protection Commission, courts and tribunals, and An Garda Síochána. We will only disclose data in response to a request where we are satisfied it is lawful.

9.4 Business changes

If we sell, merge or restructure all or part of our business, personal data may be shared with the prospective buyer or new owner and their advisers, under confidentiality obligations. The new owner would have to use it in line with this policy, or tell you about any change.

9.5 To protect rights and safety

We may share personal data where it is needed to establish, exercise or defend legal claims, or to protect the rights, property or safety of our company, the people we deal with, or the public.

10. Transfers outside the EEA

Vercel Inc. is based in the United States, and Google may process data in countries outside the EEA as part of providing Google Workspace. Where personal data leaves the EEA, it is protected by at least one of the following:

• an adequacy decision by the European Commission, such as the decision on the EU-US Data Privacy Framework, for providers certified under that framework; or
• the European Commission's Standard Contractual Clauses, together with any extra safeguards needed (Article 46 GDPR).

You can ask us for more information about these safeguards, or a copy of them, using the details in section 21.

11. How long we keep personal data

We keep personal data only for as long as we need it for the purpose we collected it for, or as long as the law requires. When that period ends, we delete it or anonymise it.

• Server logs: kept by our hosting provider for a limited period under its own retention policy, then deleted. We do not export them or keep copies.
• General correspondence: for as long as the conversation needs, and then for no more than two years after it ends, unless it becomes part of a business or legal record below.
• Supplier, adviser and partner records: for the length of the relationship, and then for six years after it ends, which matches the period in which contract claims can be brought under the Statute of Limitations 1957.
• Accounting and tax records: for six years from the end of the financial year they relate to, as required by the Companies Act 2014 and the Taxes Consolidation Act 1997, or longer if Revenue requires it.
• Statutory company registers: for as long as the Companies Act 2014 and the beneficial ownership regulations require, which for some registers is the life of the company.
• Unsolicited CVs and applications: up to six months after we reply, unless you agree to us keeping them longer.
• Legal claims, complaints and incidents: until the matter is fully resolved, plus the relevant limitation period.

12. How we protect personal data

We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access (Article 32 GDPR). These include:

• serving this website only over an encrypted HTTPS connection;
• protecting our accounts with strong, unique passwords and two-factor authentication;
• limiting access to personal data to people who need it to do their job;
• choosing service providers with strong security standards and contractual security commitments; and
• collecting as little personal data as possible in the first place.

No method of sending data over the internet or storing it is completely secure. We cannot guarantee absolute security, but we work to protect the data we hold and to respond quickly if something goes wrong.

13. Personal data breaches

If a personal data breach happens, we will act to contain it and limit its effects. Where the law requires it, we will notify the Data Protection Commission within 72 hours of becoming aware of the breach (Article 33 GDPR), and tell the people affected without undue delay if the breach is likely to pose a high risk to their rights and freedoms (Article 34 GDPR). We keep a record of all breaches, whether or not they need to be reported.

14. Your rights

Under the GDPR you have the following rights over your personal data. Some depend on the legal basis we rely on, and some have exceptions set out in the GDPR and the Data Protection Act 2018.

• Right of access (Article 15): to know whether we process your personal data, and to receive a copy of it together with information about how we use it.
• Right to rectification (Article 16): to have inaccurate personal data corrected and incomplete data completed.
• Right to erasure (Article 17): to have your personal data deleted where, for example, we no longer need it, you have objected and we have no overriding grounds, or it was processed unlawfully. This does not apply where we must keep it by law or need it for legal claims.
• Right to restriction (Article 18): to ask us to limit how we use your data, for example while we check its accuracy or consider an objection.
• Right to data portability (Article 20): to receive data you gave us in a structured, commonly used, machine-readable format, or have it sent to another organisation, where we process it under a contract or with consent and by automated means.
• Right to object (Article 21): to object at any time to processing based on our legitimate interests, on grounds relating to your particular situation. We will stop unless we have compelling legitimate grounds that override your interests, or we need the data for legal claims. You can always object to direct marketing, although we do not carry out any.
• Right to withdraw consent (Article 7(3)): where we rely on consent, to withdraw it at any time without affecting processing that took place before.
• Rights about automated decisions (Article 22): not to be subject to decisions based solely on automated processing that significantly affect you. As explained in section 8, we make no such decisions.
• Right to complain: to lodge a complaint with a supervisory authority (see section 19).

15. How to use your rights

To use any of your rights, email hugh@thedoomscrollbook.com or write to us at our registered office. It helps if you tell us which right you want to use and give us enough information to find your data.

• Identity: we may ask you to confirm your identity before we act, to make sure we do not give your data to someone else. We will only ask for what is reasonably necessary.
• Timing: we will reply within one month of receiving your request. If a request is complex, or you make several, we can extend this by up to two further months, and we will tell you within the first month if we need to.
• Cost: using your rights is free. If a request is clearly unfounded or excessive, in particular because it is repetitive, we may charge a reasonable fee or refuse it, and we will explain why.
• Someone acting for you: another person can make a request on your behalf if we receive evidence that they are authorised to.

16. Children

This website is a company information site and is not aimed at children. We do not knowingly collect personal data from anyone under 16, the age of digital consent in Ireland. If you believe a child has sent us personal data, please contact us and we will delete it.

17. Other websites

This website links to other websites, such as the Data Protection Commission and The Doomscroll Book. Once you follow a link, the other site's own privacy policy applies. We are not responsible for how other websites handle personal data.

18. The Doomscroll Book

Archer Ventures Limited also operates The Doomscroll Book at thedoomscrollbook.com. That service handles different personal data for different purposes, such as waitlist sign-ups and creator consent, and has its own privacy policy at thedoomscrollbook.com/privacy. Where the two policies differ, The Doomscroll Book's policy applies to that service.

19. Complaints

If you are unhappy with how we have handled your personal data, please contact us first so we have the chance to put it right.

You also have the right to complain to the Data Protection Commission, the supervisory authority in Ireland, at dataprotection.ie. If you live or work in another EU or EEA country, or the issue happened there, you can also complain to the data protection authority in that country. Complaining to a supervisory authority does not affect your right to seek a remedy through the courts.

20. Changes to this policy

We review this policy regularly and update it when the way we handle personal data or the law changes. The date at the top of the page shows when it last changed. If we make a significant change, such as starting to collect a new kind of personal data, we will update this page before the change takes effect.

21. Contact us

Archer Ventures Limited
Email: hugh@thedoomscrollbook.com
Post: our registered office, shown at the foot of this page.