Privacy Policy

Last updated: 21 October 2026

CROSS (Cancer Research of Oesophageal and Stomach Surgery / “Cross Cancer Research”, “CROSS”, “we”, “us”, “our”) is committed to protecting your privacy and handling your personal data in an open and transparent manner. This policy explains what personal data we collect, how we use it, and the rights you have under the General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.

1. Who we are (Data Controller)

CROSS is a registered charity supporting cancer research and patient care at the Trinity St James’s Cancer Institute.

• Registered Charity Numbers: CHY 389874 · RCN 20052850
• Address: Cross Cancer Research, Department of Surgery, Trinity Centre for Health Sciences, St James’s Hospital, Dublin 8, Ireland
• Email: info@crosscharity.ie
• Phone: (01) 896 2189

For any questions about this policy or your data, contact us using the details above.

2. The personal data we collect

We only collect data you choose to provide, or that is necessary for the website to function:

• Contact enquiries — when you use our contact form, we collect your name, email address and the content of your message.
• Donations — donations are made by direct bank transfer to our charity bank account using the details on our Donate page. No payments are processed through this website, and we do not collect or store any card or payment details. When you donate, we may receive your name and payment reference through our bank statement, which we use to record and acknowledge your donation.
• Technical data — like most websites, our host and certain embedded services may collect limited technical information (e.g. IP address, browser type) for security and performance. See Cookies below.
• Usage data — only if you accept analytics cookies: how you use the site, such as the pages you visit, the device and browser you use and your approximate location. See Cookies below.

We do not knowingly collect data from children, and we do not collect special category (e.g. health) data through this website unless you choose to share it with us directly.

3. How and why we use your data (legal basis)

Purpose	Data used	Legal basis (GDPR)
Responding to your enquiry	Contact form data	Legitimate interests / your consent
Processing and acknowledging donations	Donation data	Contract / legitimate interests
Keeping the site secure and working	Technical data	Legitimate interests
Understanding how the site is used, so we can improve it	Usage data (only if you accept analytics cookies)	Your consent

We will never sell your personal data, and we will not use it for purposes unrelated to those above without telling you.

4. Sharing your data

We share data only with trusted service providers acting on our behalf (“processors”), and only as far as necessary:

• Website host — WP Engine, which hosts this website and processes server logs on our behalf.
• Website analytics — Google Analytics (Google Ireland Limited), only if you accept analytics cookies. It processes information about how you use the site, such as the pages you visit, the device and browser you use and your approximate location, and gives us aggregated statistics. We do not use it for advertising.
• Fonts and videos on this site are hosted by us directly and do not involve any third-party service.

Some of these providers may process data outside the European Economic Area; where they do, appropriate safeguards are in place, such as Standard Contractual Clauses or, for Google, the EU–US Data Privacy Framework.

We may also disclose data where required by law.

5. Cookies

This website does not use advertising, profiling or cross-site tracking cookies. When you first visit, we ask whether you are happy for us to use analytics cookies, and none are set unless you choose “Accept analytics”. We use:

• Your cookie choice — we remember whether you accepted or rejected analytics cookies, using your browser’s local storage, so we do not ask on every page. This is strictly necessary and contains no personal information.
• Analytics cookies (optional) — only if you accept, Google Analytics sets the _ga and _ga_* cookies, which last up to two years, to tell visits apart and count how the site is used.
• Visitor statistics — we use WP Statistics, which runs on our own server. It anonymises and hashes IP addresses, does not record browser details and does not set tracking cookies. No data is shared with any advertising network.

You can change your choice at any time using the Cookie settings link at the bottom of every page, and you can block or delete cookies in your browser settings. The website works fully either way.

6. How long we keep your data

We keep personal data only as long as necessary for the purposes above, or as required by law (for example, donation records may be kept for accounting and tax-compliance purposes). Enquiry emails are kept for two years and then deleted.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased (“right to be forgotten”), where applicable;
• restrict or object to our processing;
• data portability;
• withdraw consent at any time.

To exercise any of these rights, contact us at info@crosscharity.ie. We will respond within one month.

8. Complaints

If you are unhappy with how we have handled your data, you may lodge a complaint with the Irish supervisory authority:

Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28 — www.dataprotection.ie

9. Changes to this policy

We may update this policy from time to time. The latest version will always be available on this page, with the “Last updated” date revised accordingly.