1. Scope
This notice applies to the website published at https://mrz.im and to any personal data processed in connection with it. It describes the categories of personal data processed, the purposes for which they are processed, the legal bases relied upon, the parties to whom data may be disclosed, the periods for which data are retained, and the rights available to data subjects. It applies to visitors to the website and to persons who submit an enquiry through it.
The website is an online portfolio. It does not offer goods or services for sale through the site, does not operate user accounts, does not host a discussion facility, and does not operate a mailing list or newsletter. No payment data is collected, processed or stored at any point. Save for the matters described in this notice, no personal data is collected from visitors.
2. Controller and contact
This website is operated by mrz.im, which is the controller in respect of the personal data described in this notice, within the meaning of Regulation (EU) 2016/679 (the General Data Protection Regulation) as applied in Ireland by the Data Protection Act 2018. Enquiries concerning this notice, or requests in respect of the rights set out in clause 11, may be addressed to [email protected].
3. Categories of personal data processed
Three categories of personal data are processed in connection with this website. The first is data submitted voluntarily through the enquiry form, comprising a name, an email address, the content of the message, and optionally an indication of the subject matter of the enquiry and a date or period to which it relates. The second is technical data generated automatically by the act of requesting a page, comprising an internet protocol address, the date and time of the request, the resource requested and the identifying string supplied by the requesting browser. The third is usage data generated by the analytics service described in clause 6.
No special categories of personal data within the meaning of Article 9 of the General Data Protection Regulation are sought or knowingly processed, and no data relating to criminal convictions or offences is processed. The website is not directed at children and does not knowingly process the personal data of persons under the age of sixteen.
4. The enquiry form
Data submitted through the enquiry form is transmitted by electronic mail to a mailbox operated on behalf of the controller. It is not written to a database, is not retained as a file on the web server, and is not transferred to any customer relationship management system, advertising platform or mailing list. The email address supplied by the sender is placed in the reply-to field of the resulting message so that a reply may be directed to it. Where transmission fails, the failure is recorded in the hosting account's error log; the content of the message is not written to that log in any circumstances.
The legal basis for this processing is Article 6(1)(b) of the General Data Protection Regulation, processing being necessary in order to take steps at the request of the data subject prior to entering into a contract, and, to the extent that an enquiry does not lead to a contract, Article 6(1)(f), the legitimate interest of the controller in responding to correspondence addressed to it. Provision of the data is not a statutory or contractual requirement, but an enquiry cannot be answered if a name, an address for reply and a message are not supplied.
5. Technical data, server logs and abuse prevention
In common with all web servers, the hosting provider records standard access logs in respect of each request made to the website. These logs are generated by the hosting infrastructure rather than by the website itself and are used solely for the diagnosis of faults, the maintenance of the service and the investigation of misuse. The legal basis is Article 6(1)(f), the legitimate interest of the controller in operating a secure and functioning website.
In order to prevent automated abuse of the enquiry form, a record is kept of the number of submissions recently received from a given connection. The internet protocol address is not stored. A one-way cryptographic hash of the address is used as a file name, and the file contains only the times at which submissions were received. A hash of this kind cannot be reversed to recover the address from which it was derived. The record is limited to a rolling period of one hour, entries older than that period being discarded when the file is next written, and it is not associated with the content of any message. The legal basis is Article 6(1)(f), the legitimate interest of the controller in preventing the misuse of a public facility.
6. Cookies and similar technologies
A cookie is a small file placed on a device by a website and returned to that website on subsequent requests, enabling the website to recognise the device. This website places cookies for analytical purposes only. It does not place advertising cookies, does not place cookies which track visitors across other websites, and carries no advertising.
The cookies placed are those of the analytics service described in clause 7 and are designated _clck and _clsk. The first serves to recognise a returning browser and the second serves to associate the pages viewed during a single visit. A notice displayed on first arrival states that continued use of the website constitutes acceptance of these cookies.
Consent may be withheld or withdrawn at any time by configuring the browser to block or delete cookies for this website, a facility provided by all commonly used browsers and ordinarily found under settings relating to privacy or site permissions. No functionality of this website depends upon the acceptance of cookies, and the website operates in full where cookies are blocked.
Separately from cookies, two items of information are stored locally in the browser: the visitor's selection of the light or dark presentation of the website, and the fact that the cookie notice has been displayed. These are held in local storage, are not transmitted to the server with requests, are not accessible to the controller, and are removed when the visitor clears the site data held by the browser.
7. Analytics
The website uses Microsoft Clarity, a website analytics service provided by Microsoft Corporation. The service records the manner in which pages are used, including pages viewed, the extent to which a page is scrolled, interactions with links and other elements, and the point at which a visit is ended. It further records technical characteristics of the visit, comprising the referring website where applicable, the dimensions of the display, the browser and operating system in use, and an approximate geographical location derived from the internet protocol address, being ordinarily no more precise than a town or city.
The information is used to understand in aggregate which parts of the website attract attention, for the purpose of maintaining and improving it. It is not used to identify any individual, is not combined with data submitted through the enquiry form or with any correspondence, and is not used for advertising or supplied to any party for advertising purposes. Microsoft acts as a processor in respect of this processing and is bound by its own terms in that capacity. The legal basis is Article 6(1)(a), the consent of the data subject, obtained in the manner described in clause 6.
8. Recipients and international transfers
Personal data processed in connection with this website may be disclosed to the following categories of recipient: the provider of the hosting infrastructure on which the website operates; the provider of the electronic mail service by which enquiries are transmitted and stored; and the provider of the analytics service identified in clause 7. Each acts as a processor on behalf of the controller. No personal data is sold, rented, exchanged or otherwise made available to any party for that party's own purposes.
Personal data may be disclosed where disclosure is required by law, is necessary for the establishment, exercise or defence of legal claims, or is necessary to protect the vital interests of any person. Where a disclosure of that kind is made, the data subject will be informed unless the controller is prohibited from doing so.
Processing by the analytics provider may involve the transfer of personal data to jurisdictions outside the European Economic Area. Such transfers are made on the basis of the safeguards adopted by that provider, including standard contractual clauses approved by the European Commission where applicable.
9. Retention
Correspondence arising from an enquiry is retained for so long as the enquiry remains live and thereafter as the record of any engagement to which it relates. The abuse prevention record described in clause 5 is retained for one hour. Server logs are retained by the hosting provider in accordance with the configuration of the hosting account. Analytics data is retained by the analytics provider in accordance with that provider's published retention periods. Personal data is erased on request in accordance with clause 11.
10. Security
The website is served over an encrypted connection. Access to the mailbox in which enquiry correspondence is held is restricted to the controller. The credentials by which electronic mail is transmitted are held outside the directory from which the website is served and are not accessible over the network. No personal data submitted through the website is stored on the web server itself. No method of transmission over the internet, and no method of electronic storage, is entirely secure, and no absolute guarantee of security can accordingly be given.
11. Rights of data subjects
Data subjects have the right to obtain confirmation as to whether personal data concerning them is being processed and, where that is the case, access to that data; the right to obtain the rectification of inaccurate data; the right to obtain the erasure of data; the right to obtain the restriction of processing; the right to object to processing carried out on the basis of legitimate interests; and the right to receive data in a structured, commonly used and machine-readable format and to have it transmitted to another controller. Where processing is founded on consent, consent may be withdrawn at any time, without prejudice to the lawfulness of processing carried out before its withdrawal.
Requests may be made to the address given in clause 2. No fee is payable and no particular form of words is required. A response will be provided within one month of receipt of the request, which period may be extended where permitted by Article 12(3). No decision producing legal effects concerning any person, or similarly significantly affecting any person, is taken on the basis of automated processing, and no profiling within the meaning of Article 4(4) is carried out.
12. Complaints
A data subject who considers that the processing of personal data relating to them infringes the General Data Protection Regulation has the right to lodge a complaint with a supervisory authority. The supervisory authority in Ireland is the Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, whose website is at dataprotection.ie. A complaint may be made without the matter first having been raised with the controller.
13. Third party websites
This website contains links to websites operated by third parties. Those websites are not under the control of the controller, and this notice does not apply to them. Visitors following such a link are advised to consult the privacy notice published by the operator of the website concerned. No content is embedded from third party websites, and no fonts, scripts or other resources are loaded from third party sources other than those required by the analytics service identified in clause 7.
14. Amendment
This notice may be amended from time to time in order to reflect changes in the processing carried out in connection with the website or changes in applicable law. The date stated below is the date on which the text was last amended. Earlier versions are not published; a request for the text in force on a particular date may be made to the address given in clause 2.
Version of 10 September 2026.