Privacy policy
Last updated: 5 November 2026
1. About this policy
This policy explains how Niall Keely & Associates (“we”, “us”, “our”) collects and uses personal data. It applies to personal data we collect:
- through our website kce.ie;
- when you contact us or instruct us as a client;
- when we carry out inspections, surveys, or other consulting engineering services;
- when you speak to us by phone (see section 3.5 regarding call recording); and
- through our business operations generally (e.g. dealings with suppliers, contractors, and contacts).
We are a consulting engineering company based in Cork, Ireland. Our work includes inspections of properties on behalf of insurance companies (in connection with claims) and on behalf of local authorities (in connection with private rental properties). As part of that work we necessarily process personal data about tenants, landlords, and other individuals connected to the properties we inspect.
We are the controller of the personal data described in this policy, except where we process personal data on behalf of and under the instructions of an instructing client (such as an insurance company or local authority). In those cases, the instructing client is the controller and we act as processor. This includes our local authority inspection work, some of which we deliver in collaboration with Davies Group (see section 6.1). Where we act as processor, our processing is governed by the data processing agreement we have with the instructing client; this policy is provided for transparency.
2. Who we are and how to contact us
- Controller
- Niall Keely & Associates Ltd
- Office address
- 2nd Floor, Block B, Heritage Business Park, Bessboro Road, Blackrock, Cork T12 RW2C
- Registered office
- Windy Ridge, Willow Lawn, Ballinlough, Cork T12 T66C
- Company registration
- Registered in Ireland, company number 353003
- Phone
- +353 21 453 6590
- Email for privacy queries
- privacy@kce.ie
- Data Protection Officer
- dpo@kce.ie
3. The personal data we collect
3.1 Website visitors (kce.ie)
Our website does not use cookies, tracking, analytics, or third-party advertising technologies, and it has no contact forms. When you visit kce.ie:
- Our web host records standard server log information, including IP address, browser type, pages requested, and timestamps. This is used for security, operational, and troubleshooting purposes and is not used to profile visitors.
- Contact data: if you email or phone us, the information you provide (typically your name, email, phone, and the content of your message) is collected so we can respond to you.
3.2 Clients and prospective clients
If you instruct us or enquire about our services we collect:
- name, job title, employer, business contact details;
- correspondence with us;
- billing and payment information for invoicing purposes;
- any other information you choose to provide.
3.3 Inspection subjects (tenants, landlords, occupiers, and others)
When we carry out inspections we process personal data about individuals connected to the property, which may include:
- names and contact details (address, phone, email) of tenants, landlords, and occupiers;
- the address being inspected;
- photographs, measurements, notes, and other findings recorded during the inspection;
- correspondence relating to scheduling and access;
- any other personal data provided to us by the instructing client or recorded during inspection.
Where we obtain this data from someone other than the individual (for example, from the instructing insurance company or local authority), we are providing this policy to satisfy our obligations under Article 14 GDPR. A link to this policy, together with an information link from the relevant local authority, is included at the bottom of the appointment letters we send to tenants and landlords. We obtain inspection-related personal data from our instructing clients and, where relevant, from publicly available sources or third parties (such as letting agents).
3.4 Suppliers, contractors, and other contacts
We hold standard business contact details for individuals at our suppliers, sub-contractors, and other organisations we deal with.
3.5 Phone calls and call recording
We use Cisco Webex for our phone calls.
Calls relating to our local authority projects are recorded. This is to maintain accurate records of communications with tenants, landlords, and other parties, to support the integrity of the inspection process, and to assist in resolving any queries or disputes. Recordings may capture the personal data of any individual on the call, including names, contact details, voice, and the content of the conversation. Where a call is recorded, you will be informed at the start of the call.
Calls that do not relate to our local authority projects are not routinely recorded.
4. How we use personal data and our lawful basis
We rely on the following lawful bases under Article 6 GDPR:
| Purpose | Lawful basis |
|---|---|
| Providing consulting engineering and inspection services to our clients | Performance of a contract (with our client); legitimate interests (in delivering our services); legal obligation (where the inspection is mandated by law) |
| Processing inspection findings concerning tenants, landlords, and occupiers | Legitimate interests (ours and our client’s, in carrying out the inspection we have been instructed to perform); legal obligation (where the inspection is required by law, e.g. statutory inspections under the Housing (Standards for Rented Houses) Regulations) |
| Sending appointment letters and related communications to tenants and landlords | Legitimate interests (in arranging access to inspect the property); legal obligation (where the inspection is required by law) |
| Recording calls relating to local authority projects | Legitimate interests (in maintaining accurate records, supporting the integrity of the inspection process, and resolving queries or disputes); legal obligation, where applicable |
| Responding to enquiries by email or phone | Legitimate interests (in responding to communications directed to us) |
| Sending service updates and administrative communications to clients | Legitimate interests; performance of a contract |
| Operating and securing kce.ie (server logs) | Legitimate interests |
| Billing, accounting, and tax records | Legal obligation; legitimate interests |
| Establishing, exercising, or defending legal claims | Legitimate interests; legal obligation |
| Complying with regulatory and professional obligations | Legal obligation |
Where we rely on legitimate interests, we have considered the impact on individuals and concluded that our processing is proportionate and would not override their rights and freedoms. You can request more information about our balancing assessment using the contact details above.
5. Special category data
Inspections may occasionally involve incidental processing of special category data (for example, information about an occupier’s health where it is relevant to the property or the claim). Where this happens we will rely on an appropriate Article 9 GDPR condition, typically:
- the establishment, exercise, or defence of legal claims; or
- substantial public interest (where applicable to statutory inspections).
We do not deliberately seek out special category data unless it is necessary for the instruction.
6. Who we share personal data with
6.1 Local authority projects with Davies Group
For some of our local authority work, we collaborate with Davies Group in scheduling and carrying out inspections. In those engagements, the local authority is the controller, and both Niall Keely & Associates and Davies Group act as processors of personal data on the local authority’s behalf and under its instructions. The local authority provides us with the personal data needed to schedule and perform the inspections, and personal data may be shared between us and Davies Group as necessary for that purpose.
Our processing in this role is governed by the data processing agreement(s) in place with the relevant local authority and the contractual arrangements between us and Davies Group, which include obligations relating to the security and confidentiality of personal data. Davies Group’s privacy notice is available at https://davies-group.com/privacy-notice/.
If you wish to exercise your data protection rights in relation to processing carried out for one of these projects, you should contact the relevant local authority as the controller. We can also assist by passing your request on.
6.2 Other recipients
We also share personal data with:
- Instructing clients — the insurance company, local authority, or other organisation that instructed the work, who receive our inspection reports and findings.
- Service providers (processors) acting on our behalf:
- Microsoft Ireland Operations Ltd (Microsoft 365 / OneDrive, and Microsoft Azure) — cloud storage and productivity services used to store and process documents, correspondence, and inspection records, and hosting for kce.ie.
- Flowfinity Wireless Inc. — the mobile inspection platform used to record and submit inspection data for our local authority work.
- Cisco Webex (Cisco Systems, Inc.) — telephony and call recording for our business calls, including the recording of local authority project calls. Privacy statement: https://www.cisco.com/c/en/us/about/legal/privacy-full.html
- Esendex (Commify Ireland) — sends SMS messages on our behalf, including appointment notifications. Privacy policy: https://www.esendex.ie/privacy-policy/
- Quadient — handles outbound postal communications on our behalf, including appointment letters. Privacy policy: https://www.quadient.com/en-gb/quadient-website-privacy-statement
- Professional advisers — including our legal advisers and professional indemnity insurers, where relevant.
- Regulators, courts, and law enforcement — where required by law, regulation, or legal process (for example, the Data Protection Commission, the Revenue Commissioners, or a court order).
- Buyers or successors — if we sell or restructure our business.
All processors are bound by written contracts that meet the requirements of Article 28 GDPR.
We do not sell personal data.
7. Cookies
Our website does not set any cookies, and we do not use analytics, advertising, or marketing cookies. Our web host records standard server log information for security and operational purposes, as described in section 3.1.
8. International transfers
We are based in Ireland and store personal data primarily within the European Economic Area (EEA).
Some of our service providers are headquartered outside the EEA and personal data may, in limited circumstances, be transferred outside the EEA:
- Microsoft is headquartered in the United States. Under Microsoft’s EU Data Boundary for the Microsoft Cloud, customer data for EU customers using Microsoft 365 / OneDrive is stored and processed within the EU. However, limited access from outside the EU (for example, for technical support or certain backend services) may still occur. Our website, kce.ie, is hosted on Microsoft Azure, whose network delivers the site’s pages from locations around the world, so server log information about visits may be processed outside the EEA. Microsoft relies on its certification under the EU–US Data Privacy Framework and on Standard Contractual Clauses as appropriate safeguards.
- Cisco (Webex) is headquartered in the United States. Cisco operates data centres in multiple regions and offers EU data residency options for Webex. Cisco relies on its certification under the EU–US Data Privacy Framework and on Standard Contractual Clauses as appropriate safeguards for any transfers outside the EEA.
- Flowfinity Wireless Inc. is based in Canada. Canada benefits from a partial adequacy decision of the European Commission for transfers to commercial organisations subject to PIPEDA, which provides an appropriate safeguard for these transfers.
- Esendex / Commify group entities are based in both Ireland and the United Kingdom. Transfers to the UK are covered by the European Commission’s adequacy decision for the UK.
Where any other transfer outside the EEA takes place, we rely on appropriate safeguards under Chapter V GDPR, which may include an adequacy decision, Standard Contractual Clauses, or another lawful transfer mechanism. You can request a copy of the safeguards we use by contacting us at privacy@kce.ie.
9. How long we keep personal data
We retain personal data for as long as is necessary for the purposes set out in this policy. Typical retention periods include:
- Accounting and tax records: at least 6 years, in line with the Taxes Consolidation Act 1997 and the Companies Act 2014.
- Server logs (kce.ie): 90 days.
We may retain personal data for longer where required by law, regulation, professional rules, or for the establishment, exercise, or defence of legal claims.
10. Security
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse. These include access controls, multi-factor authentication on our Microsoft 365 environment, staff training, encryption in transit, secure handling of inspection records, and contractual obligations on our sub-processors.
11. Your rights
Under GDPR you have the right to:
- access the personal data we hold about you;
- request rectification of inaccurate data;
- request erasure in certain circumstances;
- request restriction of processing in certain circumstances;
- object to processing based on legitimate interests;
- request data portability in certain circumstances;
- withdraw consent at any time where we rely on consent (without affecting prior processing).
To exercise any of these rights, contact us at privacy@kce.ie or our Data Protection Officer at dpo@kce.ie. We will respond within one month (extendable by two months for complex requests). We may need to verify your identity before responding.
If your personal data has been provided to us by an insurance company, local authority, or other instructing client and we are processing it on their behalf (including for the local authority projects described in section 6.1), the controller is the instructing client, and we may need to refer your request to that client.
12. Complaints
If you are unhappy with how we have handled your personal data, please contact us first at privacy@kce.ie (or dpo@kce.ie) so we can try to resolve the matter. You also have the right to lodge a complaint with the supervisory authority in Ireland:
Data Protection Commission
21 Fitzwilliam Square South, Dublin 2, D02 RD28
Website: https://www.dataprotection.ie
Phone: +353 (0)761 104 800
13. Children
Our services are not directed to children. We do not knowingly collect personal data from children through our website. Where children are incidentally referenced in an inspection record (for example, as members of a household), we process that information only as necessary for the inspection.
14. Changes to this policy
We may update this policy from time to time. The “last updated” date at the top shows when it was last revised. Material changes will be notified through our website or, where appropriate, directly.