Last updated 11 August 2026

Privacy policy

How Public Purse handles personal data under the GDPR and the Irish Data Protection Act 2018.

Who we are

Public Purse (“we”, “us”) operates the website at publicpurse.ie. We publish and index publicly available Irish public spending data so people can explore how public money is spent.

For data protection purposes, we are the controller of personal data processed through this website. Our contact address for privacy matters is privacy@publicpurse.ie.

What this site is for

Most of the information on Public Purse is public spending data already published by Irish public bodies — local authorities, government departments, agencies, and other organisations. That material is republished here for transparency and public interest purposes.

We are working towards indexing every line item of public spending. The dataset is incomplete and growing; presence or absence of a record does not by itself prove that spending did or did not occur.

Personal data we process

Depending on how you use the site, we may process:

  • Account email address — if you sign in or create an account, we store the email you provide so we can send passwordless sign-in links and (where relevant) service messages such as download-ready notifications.
  • Usage of signed-in features — for example, records of data export requests you make while signed in, so we can prepare and deliver files and show request status.
  • Technical logs — limited server and security logs (such as IP address, user agent, and timestamps) that may be generated when you use the site, for security, abuse prevention, and reliability.
  • Analytics — we use Fathom Analytics, a privacy-oriented analytics service, to understand aggregate traffic. Fathom is designed not to use cookies for tracking and not to collect personal data in the way traditional advertising analytics do.
  • Public spending records — spending line items may include supplier names, payment descriptions, amounts, and related fields as published by public bodies. Some of those fields can identify sole traders or other individuals when the original public body published them that way.

Why we process personal data (legal bases)

  • Contract / steps prior to contract (Article 6(1)(b) GDPR) — to create and operate your account, authenticate you, and provide features you request (such as CSV exports).
  • Legitimate interests (Article 6(1)(f) GDPR) — to run a secure website, understand aggregate usage, prevent abuse, and publish public-interest spending data already released by Irish public bodies. We balance those interests against your rights and freedoms.
  • Legal obligation (Article 6(1)(c) GDPR) — where we must retain or disclose information to comply with Irish or EU law.

Public spending data on this site is processed because it has already been made public by the relevant body, and republishing it supports transparency and accountability in how Irish public money is spent.

Where data comes from

Account and request data come directly from you. Spending data comes from publications and files released by Irish public bodies (and related open sources). We do not sell personal data and we do not buy marketing lists.

Who we share data with

We use service providers that process data on our instructions, for example:

  • Hosting and infrastructure providers that run the website and store application data
  • Email delivery providers used to send sign-in links and service emails
  • Fathom Analytics for privacy-oriented traffic measurement

We may also disclose information if required by law, by a court or competent authority in Ireland or the EU, or to protect the rights, safety, or integrity of Public Purse, our users, or the public.

Spending data displayed on the site is public by design and may be viewed, indexed, or reused by anyone who visits the site, subject to our terms of use and applicable law.

International transfers

Our primary aim is to process and host data in the EU/EEA where practicable. If a provider processes data outside the EEA, we rely on an appropriate transfer mechanism under the GDPR (such as an adequacy decision or standard contractual clauses) and additional safeguards where needed.

How long we keep data

  • Account email and account records — for as long as your account remains active, and for a short period afterwards if needed for security, dispute handling, or legal compliance.
  • Export requests and related files — for as long as needed to deliver the export and for a limited retention window afterwards, unless a longer period is required for security or legal reasons.
  • Security and server logs — for a limited period consistent with security and operational needs.
  • Public spending dataset — retained as part of the historical public ledger we are building, reflecting the underlying public publications.

Cookies and similar technologies

We aim to keep cookies to a minimum. Essential cookies or local storage may be required for security, session management, or core site functions. Our analytics provider (Fathom) is chosen specifically to avoid advertising trackers and invasive profiling cookies.

Where non-essential cookies are ever introduced, we will provide appropriate information and choices in line with the ePrivacy rules as applied in Ireland.

Your rights

Under the GDPR and the Data Protection Act 2018, you may have the right to:

  • Access personal data we hold about you
  • Rectify inaccurate personal data
  • Erase personal data in certain circumstances
  • Restrict or object to certain processing
  • Data portability, where applicable
  • Withdraw consent, where processing is based on consent

To exercise these rights in relation to account or site data we control, email privacy@publicpurse.ie. We may need to verify your identity before acting on a request.

If your concern relates to personal data that appears only because a public body published it in a spending file, you may also need to contact that public body. We can explain what we hold and how it was sourced, but we are not the original publisher of those records.

Children

Public Purse is not directed at children. We do not knowingly create accounts for children under 16. If you believe a child has provided personal data to us, contact us and we will take appropriate steps.

Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. No online service can guarantee absolute security.

Complaints

If you are unhappy with how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the Irish Data Protection Commission (DPC):

Data Protection Commission
21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
www.dataprotection.ie

Changes to this policy

We may update this privacy policy from time to time. The “Last updated” date at the top of this page will change when we do. Continued use of the site after an update means the revised policy applies to your ongoing use.

Contact

Privacy questions: privacy@publicpurse.ie