Privacy Policy

25th May 2018

  1. INTRODUCTION

This privacy notice provides you with details of who we are and how we collect and process your personal data.

This is the privacy statement of Cafferkey Civils Limited, whose place of business and registered address is Unit 8, Block G, Maynooth Business Campus, Maynooth, Co. Kildare, W23 C6T7, Ireland:

Cafferkey Civils Limited “the Company” (referred to as “we”, “us” or “our” in this privacy notice), is responsible for the collection and processing of personal data due to our commercial relationships. This obliges us to take responsibility for your personal data.

Our email address is: dataprotection@cafferkey.ie

Our postal address is: Unit 8, Block G, Maynooth Business Campus, Maynooth, Co. Kildare, W23 C6T7, Ireland.

If you have any questions about this privacy notice, including any requirements to exercise your legal rights please contact us at dataprotection@cafferkey.ie.

It is very important that the information we hold about you is accurate and up to date. Please let us know if at any time your personal information changes by emailing us at dataprotection@cafferkey.ie.

  1. THE DATA THAT WE COLLECT ABOUT YOU, THE PURPOSE FOR WHICH WE COLLECT IT AND THE GROUNDS UPON WHICH WE PROCESS IT

Personal Data is information about any living individual from which the individual is directly or indirectly identifiable, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, mental, economic, cultural or social identity of that individual.

Processing means anything that is done with any Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaption or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

We collect your personal data so that we can manage our relationships with you. Activities that we require personal data for include:

  • Provision of products or services to you;
  • Improving our existing products and services;
  • Communicating with you via any means (including via email, telephone, text message, social media, post or in person);
  • Health and Safety assessments and record keeping, compliance with related legal obligations;
  • Maintenance of our Quality Management System;
  • Maintenance of our Environmental Management System;
  • Management of our Human Resources and processing of payroll;
  • Surveys: engaging with you for the purposes of obtaining your views on our services; and
  • Security: physical security of our premises, yards and sites (including records of visits to our premises, yards and sites and CCTV recordings).

We shall only process your personal data:

  • In order to provide our products and services to you and perform any other obligations in accordance with our contract with you;
  • In order to comply with our legal or regulatory obligations; and
  • Where it is necessary for the purposes of our legitimate interests and those interests are not over ridden by the data subjects’ own privacy rights.

In Processing of your Personal Data in connection with the purposes set out in this Notice, we may rely on one or more of the following legal bases, depending on the circumstances.

  • Consent: We may Process your Personal Data where we have obtained your prior, express consent to the Processing (this legal basis is only used in relation to Processing that is entirely voluntary – it is not used for Processing that is necessary or obligatory in any way);
  • Contractual necessity: We may Process your Personal Data where the Processing is necessary in connection with any contract that you may enter into with us;
  • Compliance with applicable law: We may Process your Personal Data where the Processing is required by applicable law;
  • Vital interests: We may Process your Personal Data where the Processing is necessary to protect the vital interests of any individual; or
  • Legitimate interest: We may Process your Personal Data where we have a legitimate interest in carrying out the Processing for the purpose of managing, operating or promoting our business, and that legitimate interest is not overridden by your interests, fundamental rights, or freedoms.

We may process the following categories of personal data about you:

  • Communication Data includes any communication that you send to us whether that be through contact forms on our website, through email, text, voice calls, VOIP, social media messaging, social media posting or any other communication that you may send us. We process this data for the purposes of communicating with you, for record keeping and for the establishment, pursuit or defence of legal claims. Our lawful ground for this processing is our legitimate interests which in this case are to reply to communications sent to us, to keep records and to provide the agreed services for which we have been engaged.

 

  • Personal Contact Data includes data such as your name, title, address, employer, email address, phone number and contact details. We process this data to communicate with you, for record keeping and for the establishment, pursuit or defence of legal claims. Our lawful ground for this processing is our legitimate interests which in this case are to reply to communications sent to us, to keep records, to grow our business and remain in contact with you and to provide the agreed services for which we have been engaged.

 

  • Marketing Data includes data about your preferences in receiving marketing from us and your communication preferences. We process this data to enable you to partake in our promotions and offers, to deliver relevant website content and advertisements to you and to measure or understand the effectiveness of this advertising. Our lawful ground for this processing is our legitimate interests which in this case are to study how customers use our products/services, to develop them, to grow our business and to decide our marketing strategy.

 

  • Website Data includes data that you may provide to us if you visit our website.

 

  • Special Categories of Data

Special Categories of Data refers to data that includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data and information about criminal convictions and offences.

We may need to collect Special Categories of Data in order to provide the agreed services for which we have been engaged.

Where it becomes necessary to process Special Categories of Data for any reason, we rely on one of the following legal bases:

  • Compliance with applicable law: We may Process your Special Category Data where the Processing is required or permitted by applicable law;
  • Detection and prevention of crime: We may Process your Special Category Data where the Processing is necessary for the detection or prevention of crime (including the prevention of fraud);
  • Establishment, exercise or defence of legal rights: We may Process your Special Category Data where the Processing is necessary for the establishment, exercise or defence of legal rights; or
  • Consent: We may Process your Special Category Data where we have, in accordance with applicable law, obtained your prior, express consent prior to Processing your Special Category Data.

Where we are required to collect personal data by law, or under the terms of the contract between us and you do not provide us with that data when requested, we may not be able to perform the agreed service for which we have been engaged. If you don’t provide us with the requested data, we may have to cease to provide the product or service to you but if we do, we will notify you at the time.

We will only use your personal data for a purpose it was collected for or a reasonably compatible purpose if necessary. In case we need to use your details for an unrelated new purpose we will let you know and explain the legal grounds for processing.

We may process your personal data without your knowledge or consent where this is required or permitted by law.

We do not carry out automated decision making or any type of automated profiling.

  1. HOW WE COLLECT YOUR PERSONAL DATA

We may collect data about you by you providing the data directly to us (for example by filling in forms on our website or in our offices or by sending us emails and correspondence by post or by speaking with us on the telephone and in meetings). We may collect data from third parties who you authorise us to obtain the data from on your behalf (for example the Revenue Commissioners, the Companies Registration Office, financial institutions or another professional or adviser).

  1. MARKETING COMMUNICATIONS

Our lawful ground of processing your personal data to send you marketing communications is either by your consent or our legitimate interests (namely to grow our business).

Under the Data Protection Legislation, we may send you electronic marketing communication if (i) you made a purchase or asked for information from us about our goods or services or (ii) you agreed to receive marketing communications and in each case you have not opted out of receiving such communications since.

We will not share your personal data with any third party for their own marketing purposes without your express consent.

You can request us to stop sending you electronic marketing messages at any time by following the opt-out links on any marketing message sent to you.

You can request us to stop sending you marketing messages by emailing us at dataprotection@cafferkey.ie, by writing to us at Unit 8, Block G, Maynooth Business Campus, Maynooth, Co. Kildare, W23 C6T7, Ireland or by telephoning us at 00353 (0)1 6293400.

If you opt out of receiving marketing communications, this opt-out does not apply to personal data provided in connection with a matter on which we are acting or have acted on your behalf and are obliged to obtain a record of for the purposes of complying with our legal obligations.

  1. DISCLOSURES OF YOUR PERSONAL DATA

We may share your Personal Data with, or disclose your Personal Data to the following categories of third parties:

  • Legal and Regulatory Authorities, upon request, or for the purposes of reporting any actual or suspected breach of applicable law or regulation;
  • Any Relevant Party, Law Enforcement Agency or Court, to the extent necessary for the establishment, exercise or defence of legal rights;
  • Any Relevant Party for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including safeguarding against and the prevention of threats to public security;
  • Outside Professional Advisers including accountants, auditors, solicitors, bankers, IT specialists, pension advisers and insurers who provide consultancy, banking, legal, insurance, accounting services and regulatory support and compliance services;
  • Certification Bodies including Health & Safety, Quality Management Systems and Environmental Management Systems;
  • Service Providers who provide business administration services, including third party dictation, typing and transcription services and external file storage and archiving services;
  • Other external bodies: in certain circumstances, we may be required by law to disclose Personal Data to external bodies, such as local authorities, government departments or An Garda Síochána; and
  • Any Relevant Third-Party Acquirer(s), in the event that we sell or transfer all or any relevant portion of our business or assets (including in the event of a reorganization, dissolution or liquidation).

We require all third parties to whom we transfer your data to respect the security of your Personal Data and to treat it in accordance with the law.

  1. INTERNATIONAL TRANSFERS

We do not transfer your personal data outside the European Economic Area (EEA).

  1. DATA SECURITY

We have put in place commercially reasonably and appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know such data. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

  1. DATA RETENTION

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

The length of time we keep any part of your personal information will depend on the type of information and the purpose for which it was obtained.

In some circumstances you can ask us to delete your data: see below for further information.

In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for legal know-how, research or statistical purposes in which case we may use this information indefinitely without further notice to you.

  1. YOUR LEGAL RIGHTS

Under certain circumstances, you have rights under data protection laws in relation to your personal data. These include:

  • The right to Access – you have the right to request a copy of the personal data that we hold about you, together with other information about our processing of that personal data.
  • The right to Rectification of your personal data – you have the right to request that any inaccurate data that is held about you is corrected, or if we have incomplete information you may request that we update the information such that it is complete.
  • The right to Erasure – in certain circumstances, you may have the right to have some or all of your personal data deleted from our records. This is sometimes referred to as the “right to be forgotten”. This may occur if, for example, we retain data which is no longer required by us, or if you withdraw a consent. If you continue to have a relationship with us, we must retain the data we need to manage this relationship. We will respond promptly to your request, and provide reasons if we object to the deletion of any of your personal data.
  • The right to Object to processing and restrict processing – you have the right to request that we no longer process your personal data for particular purposes, or to object to our processing of your personal data for particular purposes.
  • The right to Data portability – where it is possible for us to provide it, you have the right to receive a digital copy of the personal data that you have provided to us.

If we are processing personal data based on your consent, you may withdraw that consent at any time. This does not affect the lawfulness of processing which took place prior to its withdrawal.

You can see more about these rights at:

www.dataprotection.ie

Should you require any further details regarding our treatment of personal data, please contact us at dataprotection@cafferkey.ie.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

If you are not happy with any aspect of how we collect and use your data, you have the right to complain to the Data Protection Commission (DPC), the Irish supervisory authority for data protection issues (www.dataprotection.ie). Please contact us first if you do have a complaint so that we can try to resolve it for you.