Privacy Policy

PHP Hospitality Partners Ltd., trading as 360 Bia Óg, is a hot school meals provider based in Dungarvan, Co. Waterford. We deliver freshly prepared meals to primary schools across Munster.
This privacy policy explains how we collect, use, store, and protect personal data belonging to parents, guardians, schools, and other users of our website and Parent Portal. It applies to all processing activities where 360 Bia Óg acts as a data controller.

Note on school data: Where we receive personal data from schools under the terms of our service contract, the school acts as the data controller and we act as the data processor. This relationship is governed by a separate Data Processing Agreement between 360 Bia Óg and each school, as required under Article 28 of the GDPR.

Parent Portal Registration

When you register on the 360 Bia Óg Parent Portal, we collect the following personal data:

• Your name and email address

• Your child's Student ID (issued by the school)

• Your child's name, class, and school

• Meal preferences and order selections

• Dietary requirements and allergen information

 
Lawful basis: Registration and meal ordering are processed on the basis of contractual necessity as part of delivering the school meals service you have signed up for.

Allergen and dietary data: This is health data and, where relevant, may relate to religious dietary requirements. Both are special categories of personal data under Article 9 GDPR. We collect this data only on the basis of your explicit consent, given at the point of registration. You may withdraw this consent at any time by contacting us at support@360biaog.ie, though this may affect our ability to accommodate specific dietary needs.


 

School Registration Data

When a school is onboarded to our platform, we receive a school register from the school containing student names, class information, and parent or guardian contact details including email addresses/phone numbers. This data is provided by the school in its capacity as data controller and is used solely to set up the Parent Portal for that school. We do not use school register data for any purpose other than service delivery. Any changes to school register data must be requested through the school.

 

Website and Contact Enquiries

If you contact us through our website contact form or by email, we collect your name, email address, and the content of your message. This is processed on the basis of our legitimate interest in responding to enquiries.
 

We use Google Analytics to understand how visitors use our website. Google Analytics collects anonymised data including device type, browser type, and pages visited. This is processed on the basis of your consent, which is captured via our cookie consent banner before any tracking begins. You can withdraw consent at any time through your browser settings or using the Google Analytics Opt-Out Browser Add-on.

We do not sell personal data. We do not share it for marketing purposes. We share data only where necessary for service delivery or required by law:

​

• Microsoft Ireland Operations Ltd. acts as a data processor for our organisation. Our systems are built on Microsoft 365, hosted within the EU, and a Data Processing Agreement is in place.

• Schools may receive relevant information to confirm account changes, verify data accuracy, and coordinate service delivery.

• Logistics partners may receive data where relevant to meal delivery. All partners are bound by confidentiality obligations and GDPR-compliant data processing agreements.

• Google (Analytics) receives anonymised website usage data only, on the basis of cookie consent. Any data transfers to the US are covered by Google's participation in the EU-US Data Privacy Framework.

• Legal or regulatory authorities may receive data where required by law, or where necessary to protect the rights, property, or safety of individuals.

We take privacy seriously and do not sell or share personal data with third parties, except in the following cases:

Service Providers: We may share data with service providers (e.g., logistics partners) who assist us in delivering our meals. These partners are required to adhere to strict confidentiality agreements and comply with GDPR.

Schools: We may share relevant information with schools to ensure smooth service delivery and compliance with dietary restrictions.

Google Analytics: We use Google Analytics to analyse the use of our platform. Google Analytics anonymises data and does not include personal identifying information. You can learn more about how Google Analytics uses data here.

Legal Compliance: If required by law, we may disclose personal data to comply with legal obligations or protect the rights, property, or safety of 360 Bia Óg or others.

​

Data Retention

We retain personal data for as long as is necessary to provide our services and fulfil our legal obligations. Once data is no longer needed, it will be securely deleted or anonymised.

We retain personal data only for as long as is necessary for the purpose for which it was collected, or as required by law.

• Parent Portal accounts and meal order records are retained for the duration of the contract with the school and deleted within 30 days of contract end.

• Allergen and dietary data is retained for the duration of the service and deleted when the parent account is closed or the school contract ends.

• School register data is retained for the duration of the contract with the school and deleted or returned to the school within 30 days of contract end.

• Contract and enquiry records are retained for the duration of any related business relationship and for a period of up to 6 years thereafter, in line with the applicable limitation period for legal claims.

• Financial and transaction records are retained for 6 years, as required by Revenue.

All personal data processed by 360 Bia Óg is stored within the European Economic Area. Our systems are built on Microsoft Power Platform, with our production environment set to the Europe region. Data does not leave the EEA except where required by law or covered by an appropriate transfer mechanism (such as Google's participation in the EU-US Data Privacy Framework for Analytics data).

Microsoft acts as our data processor under a Data Processing Agreement that meets the requirements of Article 28 GDPR.

We process personal data relating to children (students) as part of delivering the school meals service. This data is received from schools and handled strictly in accordance with the Data Processing Agreement in place with each school.

Parents and guardians manage their child's account directly through the Parent Portal. We do not use children's data for any purpose other than meal provision and service delivery. We do not use children's data for profiling, marketing, or any automated decision-making.

Allergen and health data relating to children is treated as special category data and is subject to the same explicit consent and access controls described in Section 2.

Under GDPR and the Data Protection Act 2018, you have the following rights:

• Right of access. You can request a copy of the personal data we hold about you at any time.

• Right to rectification. You can ask us to correct inaccurate or incomplete personal data.

• Right to erasure. In certain circumstances, you can ask us to delete your personal data.

• Right to restriction. You can ask us to limit how we process your data in certain circumstances.

• Right to object. You can object to processing based on legitimate interests.

• Right to data portability. Where processing is based on consent or contract, you can ask for your data in a portable format.

• Right to withdraw consent. Where processing is based on consent, including for allergen data and cookies, you can withdraw consent at any time without affecting the lawfulness of prior processing.

• To exercise any of these rights, contact us at support@360biaog.ie. We will respond within one month. There is no charge for making a request.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include:

​

• Role-based access controls ensuring only authorised personnel can access personal data relevant to their function

• Encryption of data in transit and at rest within our Microsoft-hosted systems

• Regular review of access permissions

• Staff awareness of data protection obligation

Our website uses cookies to improve your experience and to analyse how the site is used. We use Google Analytics, which sets cookies to collect anonymised information about how visitors use our site.

When you first visit our website, you will be asked to consent to non-essential cookies before any tracking begins. You can change your cookie preferences at any time through your browser settings, or opt out of Google Analytics entirely using the Google Analytics Opt-Out Browser Add-on available at tools.google.com/dlpage/gaoptout.

If you are not satisfied with how we handle your personal data, or with our response to a data rights request, you have the right to lodge a complaint with the Data Protection Commission (DPC), the Irish supervisory authority for GDPR.

​

• Website www.dataprotection.ie

• Phone 01 765 0100 / 1800 437 737

• Address 21 Fitzwilliam Square South, Dublin 2, D02 RD28

We may update this privacy policy from time to time to reflect changes in our services, systems, or legal obligations. When we make significant changes, we will notify users through the website 360biaog.ie or by email. The current version of this policy is always available at www.360biaog.ie/privacy-policy.

For any questions about this privacy policy or how we handle your personal data, contact us at:

• support@360biaog.ie

• 058 64633