The Chroma Institute Privacy Policy
Last updated: 29 August 2026
The Chroma Institute respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use and protect personal information when you visit our website, contact us, participate in surveys or otherwise interact with the Chroma Institute or Paint Lab.
1. Who We Are
The Chroma Institute is a registered business in Ireland.
The Chroma Institute
CRO No. 791282
6 Acorn Lane
Dundrum
D16 DH93
Ireland
For the purposes of the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, the Chroma Institute is the data controller for personal data collected and processed for our own purposes.
If you have questions about this Privacy Policy or how we process your personal data, you can contact us using the details provided on the Contact page of this website.
2. Information We Collect
Information You Provide to Us
When you contact the Chroma Institute through our website contact form, by email or through other correspondence, we may collect:
We ask that you do not provide personal information that is not necessary for your enquiry.
Surveys and Research
The Chroma Institute and Paint Lab may conduct surveys and other research activities.
The information collected will depend on the particular survey. Where a survey collects personal data, information will be provided at the point of collection explaining what information is being collected, why it is required, how it will be used and how long it will be retained.
Survey results may also be analysed and reported in aggregated or anonymised form. Where information has been effectively anonymised so that individuals can no longer be identified, it is no longer considered personal data under the GDPR.
3. How We Use Personal Information
We may use personal information to:
We do not sell personal information.
We will not use identifiable personal information for purposes incompatible with those for which it was collected unless we have an appropriate lawful basis for doing so.
4. Our Legal Basis for Processing
Under the GDPR, we must have a lawful basis for processing personal data.
Depending on the circumstances, we may process personal information on the following bases:
Legitimate interests — where processing is reasonably necessary for the operation and development of the Chroma Institute and Paint Lab, including responding to enquiries, managing professional relationships and protecting our website from spam, fraud and abuse, provided those interests are not overridden by your rights and interests.
Contract or steps before entering into a contract — where processing is necessary in connection with an agreement or potential agreement with you or your organisation.
Consent — where we specifically ask for your consent, including where consent is the appropriate basis for particular surveys or communications. Where processing is based on consent, you may withdraw your consent at any time.
Legal obligation — where processing is necessary for us to comply with applicable law.
5. Website Hosting, GoDaddy and Microsoft 365
The Chroma Institute website is built and hosted using GoDaddy Websites + Marketing.
GoDaddy provides the technical infrastructure used to operate this website and may process technical and usage information associated with visits to the site. This can include information such as IP addresses, device or browser information and information relating to website usage.
GoDaddy may also process information submitted through features of the website on behalf of the Chroma Institute.
The Chroma Institute uses Microsoft 365 services supplied through GoDaddy for business email and communications. Personal information contained in emails sent to or from the Chroma Institute may therefore be processed and stored using services provided by GoDaddy and Microsoft.
Some information processed through these services may be transferred to or processed outside the European Economic Area. Where this occurs, applicable safeguards for international transfers of personal data are used in accordance with data protection law.
Further information about these service providers' processing of personal data is available in the GoDaddy Global Privacy Notice and Microsoft Privacy Statement.
6. Contact Form and reCAPTCHA
Our website contact form uses Google reCAPTCHA technology to help protect the website against spam, fraud, abuse and automated submissions.
When you use a page protected by reCAPTCHA, technical information may be processed in order to determine whether an interaction is legitimate. This processing may include information associated with your device, browser and network connection.
The purpose of this processing is website security and the prevention of fraudulent or abusive activity.
Google provides the reCAPTCHA service and processes relevant data in accordance with its applicable terms and data processing arrangements.
The contact form displays links to Google's Privacy Policy and Terms of Service.
7. Cookies and Similar Technologies
This website and the services used to provide it may use cookies and similar technologies.
Some cookies and technologies are necessary for the operation, security and functionality of the website. These may include technologies used to protect the site against spam, fraud and abuse.
The website platform may also provide analytics or other technologies used to understand website usage.
Where a cookie or similar technology requires consent under applicable law, it will only be used in accordance with applicable consent requirements.
You can also control or delete cookies through your browser settings, although disabling necessary cookies may affect the operation of some website features.
8. Sharing Personal Information
The Chroma Institute does not sell or rent personal information.
We use third-party service providers where necessary to operate our website, communications and related services. These currently include:
These service providers may process personal information where necessary to provide their services to the Chroma Institute and are subject to their respective contractual and data protection obligations.
We may also disclose personal information where required by law or where reasonably necessary to establish, exercise or defend legal rights.
9. International Data Transfers
Some service providers used by the Chroma Institute may process or store personal information outside the European Economic Area.
Where personal data is transferred internationally, we rely on appropriate transfer mechanisms and safeguards as required by applicable data protection law.
10. How Long We Keep Personal Information
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected or where retention is required by law.
Routine enquiries that do not result in an ongoing relationship will normally be deleted when they are no longer required.
Information relating to an ongoing manufacturer, research, contractual or business relationship may be retained for the duration of that relationship and for an appropriate period afterwards where required for legitimate business, legal or record-keeping purposes.
Survey data will be retained in accordance with the information provided to participants for the relevant survey or research activity.
When identifiable personal information is no longer required, it will be securely deleted or anonymised as appropriate.
11. Security
We take reasonable technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration, loss or destruction.
We also use service providers and technologies, including reCAPTCHA, to help protect our website and communications against spam, fraud and other forms of abuse.
No method of transmitting or storing information electronically can be guaranteed to be completely secure.
12. Your Data Protection Rights
Under the GDPR, depending on the circumstances, you may have the right to:
These rights are subject to the conditions and exceptions provided by applicable data protection law.
To exercise your rights, please contact the Chroma Institute using the contact details provided on this website.
13. Complaints
If you have concerns about how the Chroma Institute processes your personal information, please contact us so that we can investigate your concern.
You also have the right to lodge a complaint with the Irish Data Protection Commission.
14. Third-Party Websites
This website may contain links to websites operated by other organisations.
The Chroma Institute is not responsible for the privacy practices of third-party websites. We recommend reviewing the privacy information provided by those organisations when visiting their websites.
15. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes to the Chroma Institute, Paint Lab, our website, our research activities, the services we use or applicable legal requirements.
Any revised version will be published on this page and the date at the top of the policy will be updated.
16. Contact
For questions about this Privacy Policy, requests concerning your personal data or other data protection enquiries, please contact:
The Chroma Institute
CRO No. 791282
6 Acorn Lane
Dundrum
D16 DH93
Ireland
Please use the contact details provided on the Contact page of this website.