Lookout

Privacy notice

Version 2026-10-13

What Lookout is

Lookout is an incident log for the shops in a centre. Shop staff record thefts, attempted thefts, suspicious behaviour, aggression, refund fraud and damage as they happen, so that security and the other shops know, and so that the centre can give the Gardaí an accurate weekly picture.

Who is responsible

Each shopping centre that uses Lookout is the data controller for its incident records; Paul Blanche is the processor. Contact for anything in this notice: info@lookoutcentre.com. Each shop remains responsible for its own dealings with the Gardaí.

What is recorded

  • What happened: the type of incident, a short description, the shop, the time, and an estimated value.
  • Appearance only: a description of the person or people involved, such as clothing, build or age range. Lookout does not record names, does not guess identities, and has no facial recognition.
  • Vehicles: registration, make, model and colour where relevant.
  • Photos of goods or the scene taken by shop staff. Shop staff are told not to photograph faces.
  • CCTV stills, which may show a person. Only centre security and management can add or see these. Shops never can.
  • Whether the shop reported the incident to the Gardaí, and the Garda PULSE reference if it did.

Why, and on what basis

The centre and its tenants have a legitimate interest in preventing and detecting crime on the premises and in keeping staff safe (GDPR Article 6(1)(f)). Where an incident is reported to the Gardaí, the record supports that complaint. Information is shared with An Garda Síochána for the prevention, investigation and prosecution of criminal offences.

Who can see it

  • Staff of shops in the centre who have a Lookout account can see the incidents logged at this centre.
  • Centre security and management can see everything at this centre, including CCTV stills.
  • The Garda liaison receives a weekly brief: totals, patterns, repeat descriptions and vehicles, and the incident log for the week. The brief is shared by a private link.
  • Other centres using Lookout cannot see this centre's data.
  • A shop's own head office, if the retailer has asked for it, can see the incidents its own stores logged, at this centre and at other centres using Lookout. It sees only its own stores' entries, read-only, without photos or CCTV.
  • Paul Blanche (sole trader), who builds and operates Lookout, has a platform-administrator account that can access every centre's data in order to run, support and secure the service. That access is used for administration and support only: never to identify or track anyone, never to compare people across centres, and never to pass one centre's data to another.

How long it is kept

Incidents that are not kept on file for the Gardaí are deleted automatically 90 days after they happened, together with their photos, descriptions and vehicle details. Incidents kept on file for a Garda complaint are retained for 24 months from when they happened, then deleted the same way. The weekly brief is rebuilt from the live record each time it is opened. Lookout keeps when a brief was sent and who it was sent to. It does not keep a separate copy of the incidents.

Your rights

If you believe Lookout holds information about you, you can ask to see it, ask for it to be corrected or deleted, or object to it being processed. Contact info@lookoutcentre.com. You can also complain to the Data Protection Commission (dataprotection.ie). Because descriptions are of appearance only, we may need details from you to find the relevant record.

If you use Lookout as shop staff

We hold your name, email address, shop and role so the app works and so your entries are attributed. If you turn on alerts, a push-notification subscription for your phone is stored. When you leave, the centre manager removes your access; your past entries remain on the record. You can reset your password from the sign-in screen.

Where it is stored

Incident records and files are hosted in the EU (Ireland), on Supabase. App pages are set to run in the EU (Ireland), on Vercel. Sign-in checks can also run on Vercel's edge network, which is not limited to Ireland. Sign-in emails and the weekly brief are sent through Resend. When something goes wrong in the app, a technical error report (what failed and where in the code, never the incident text, your name or your device's address) goes to Sentry. Resend and Sentry are used on EU regions. This notice does not claim those services, or the edge checks, process data only in Ireland.

Back to Lookout