Mosney Village Privacy Statement

1.Who we are Mosney Village’s Privacy Statement refers to our commitment to our compliance to data protection legislation including the Irish Data Protection Acts and the EU General Data Protection Regulation. Throughout this document “we”, “us”, “our”, “village” and “ours” refers to Mosney Village. Where we refer to data throughout this statement we are referring to personal data as defined in GDPR as ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

2.How to contact us There are many ways you can contact us, including by phone, email, and post. More details can be seen here https://www.mosneyvillage.ie/ Mosney Village Julianstown Co Meath A92 ED6V Contact Data Protection Officer dataprotection@mosney.ie, Telephone 041 9829200

3.What happens if we make changes to this notice Where changes to this Privacy notice occur, the updated version will be published on our website and where appropriate/possible communicated directly to individuals through a communication channel such as email. The current version issued in use is MV PS CSV Version 1.00

4.Who do we collect data about We collect and process your personal data only when such data is necessary in the course of providing our resident services. This personal data includes any offline physical data or online data that makes a person identifiable. We process data for the following groups of individuals where it is necessary: A.Contracting Authority B.Suppliers and Service Providers to Mosney Village C.Service Providers directly to residents D.Visitors- to visit the management and staff of the village E.Visitors- to visit the residents We are the controller for the personal information we process, unless otherwise stated. We process personal data for residents residing in Mosney Village on behalf of the Contracting Authority, the International Protection Accommodation Services (IPAS), as their data processor. Please find the link to IPAS GDPR/Privacy Notice https://www.gov.ie/en/publication/8fe22-gdprprivacy-notice

5.When we collect your data You directly provide us with most of the data we collect. We collect data and process data when you provide your information to engage with us •as the Contracting Authority of Mosney Village •as a supplier/service provider to Mosney Village •to conduct an audit of our village •to provide services directly to the residents •to visit the management and staff of the village •to visit the residents •use or view our website via your browser’s cookies

6.What types of your data do we collect A.Contracting Authority As part of providing a service to the Contracting Authority, we need to obtain and process personal data as required where necessary: Name, address, contact phone number, email address, job classification, brief statement of duties, car registration, incidents/accidents, CCTV. B.Suppliers/Service Providers to Mosney Village As part of providing a service to us, we need to obtain and process personal data as required where necessary: Name, address, contact phone number, email address, brief statement of duties, start date, due diligence (qualifications, garda vetting, previous experience, CRO details) job classification, payment records, confidentiality statement, car registration, incidents/accidents, CCTV. C.Service Providers directly to residents As part of providing a service to us, we need to obtain and process personal data as required where necessary: Name, address, contact phone number, email address, brief statement of duties, organisation being represented, start date, payment records where applicable, garda vetting confirmation, job classification, confidentiality statement, car registration, incidents/accidents, CCTV. D.Visitors to meet the management and staff of the village Where any individual is on site in the Village, we need to obtain and process personal data as required where necessary: Name, company, address, date, email address, brief statement of duties, job classification, time sign in and time sign out, place of work, car registration, CCTV, incident or accident reports. E.Visitors to meet residents Where any individual is on site in the Village to meet a resident, we need to obtain and process personal data as required where necessary: Name, name of resident being visited, time in and time out, car registration, incident/accidents, CCTV.

7.When do we collect sensitive personal data Sensitive data is known as special categories of data in Data Protection law. Special categories of data are defined by GDPR as processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. We may collect the following special categories of data where necessary: •In the event of an incident or accident we may collect relevant health data associated with this situation We will process special categories of personal data in the following circumstances: 1. In limited circumstances, with your explicit written consent. 2. Where we need to carry out our legal obligations to comply to health and safety and in line with our data protection policy. 3. Where it is needed in the public interest, and in line with our data protection policy. Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.

8.When do we receive your data from a third party Where is it necessary for the service provided, we may receive your data indirectly from the following sources: •As an employee of the Contracting Authority of Mosney Village, we may receive your information from your employer in the course of the services by us to your organisation •As an employee of a supplier/service provider to Mosney Village, we may receive your information from your employer in the course of the services provided by your company •As an employee of a service provider providing services to the residents, we may receive your information from your employer

9.What is the legal basis we process your data We collect your data based on the following legal basis: A.Consent Where you have explicitly agreed to us processing your information for a specific reason such as •Photograph or videos for publication at events •Cookie (see cookie policy) Right to withdraw consent at any time Where consent is relied upon as a basis for processing of any personal data, you will be presented with an option to agree or disagree with the collection, use or disclosure of personal data. Once consent is obtained, it can be withdrawn at any stage. B.Contract Processing is necessary for the performance of a contract of service with you and your company/organisation or in order to take steps at our request prior to entering into a contract. We will collect your data in order to consider the suitability of your services for Mosney Village. C.Compliance The processing is necessary for compliance with a legal obligation we have such as keeping records for revenue or tax purposes or providing information to a public body or law enforcement agency, compliance to rules set out by contracting authority within a Government Department; we may be required to process certain data to carry out our obligations under health and safety, child protection, or international protection of the residents. We may also disclose your information for the prevention and detection of crime and to protect the interests of us or others, or if required to do so by law or other binding request. Where it is necessary and proportionate, we may allow authorised people to see our records (which may include information about you) for reporting, compliance and auditing purposes. D.Legitimate interest We have a legitimate interest to process your data in certain circumstances for our business reasons where we always respect your interests and fundamental rights. Where we rely on our legitimate interest, we provide the purposes in this section below. •Use of CCTV on our premises to safeguard the health, safety and security of all resources •Satisfaction Surveys •To enhance the training for our staff. •To establish, exercise and safeguard our rights, (including where necessary to take enforcement action) and to respond to claims made against the use. •To safeguard the safety and security of the employees, IT systems and devices, property, and resident, all individuals onsite in the village, buildings, information located or stored on the premises, and assets, and those of residents, clients, suppliers, all visitors and volunteers and advisors that assist us in carrying out its functions •In the prevention and detection of fraud or crime •To operate our business generally, manage and administer our services to residents, clients, suppliers/service provider to Mosney Village and to residents and all visitors •For the establishment, exercise or defence of legal claims.

10.What happens if you do not provide us with the data if legal basis is contract or compliance Where lawful basis is a statutory or contractual requirement, if an individual is obliged to provide the personal data, failure to provide this information may result in us being unable to engage in the services of such individual.

11.What is the purpose (s) for processing your data General •To provide this website to you and respond to your queries •To comply with all relevant law •To manage your health, safety and security while you are on our premises •To facilitate the prevention, detection and investigation of crime and the apprehension or prosecution of offenders •To investigate, exercise or defend legal claims or other claims of a similar nature •To obtain consent from any individual for the purposing of publishing photos/video of such person. Contracting Authority •Set up, provide our contractual services, contact you and administer our contract with you Suppliers/Service providers of Mosney Village •Set up, avail of your services, contact you and administer our account as a customer with you Service providers directly to residents •Set up, avail of your services, contact you and administer our account with you where applicable Visitors to meet management and staff of Mosney Village •To facilitate the purpose of the visit in a safe and secure manner Visitors to meet residents of Mosney Village •To ensure the visitors comply with the IPAS House Rules and Procedures as set out by the Contracting Authority. •To facilitate the visit in a safe and secure manner

12.What you need to do when you provide us with other individuals information data If you are providing personal information on behalf of a third party, you must ensure that the third party receives a copy of this Privacy Statement before their personal information is shared with us (e.g., an employee of your organisation where you need to share their personal data with us). You do not need to provide this Privacy Statement in the following situations •the individual already has the information •obtaining or disclosure such information is expressly laid down in the law to which the credit union must comply and which provides appropriate measures to protect the individual’s legitimate interests •where the personal data must remain confidential subject to an obligation of professional secrecy regulated by law.

13.Protecting your data We collect this data in a transparent way and only with the full knowledge of interested parties. Once this information is available to us, the following rules apply. Our data will be: •Accurate and kept up-to-date •Collected fairly and for lawful purposes only •Processed by us on the basis of either a valid contract, consent, legal compliance or legitimate interest •Protected against any unauthorised access or illegal processing by internal or external parties. Our data will not be: •Communicated to any unauthorised internal or external parties •Stored for longer than required for the purpose obtained •Transferred to organisations, states or countries outside the European Economic Area without adequate safeguards being put in place as required under Data Protection Law. Our commitment to protect your data: •Restrict and monitor access to sensitive data •Develop transparent data collection procedures •Train employees in data protection and security measures •Build secure networks to protect online data from cyberattacks •Establish clear procedures for reporting privacy breaches or data misuse •Establish data protection practices (document shredding, secure locks, data encryption, frequent backups, access authorisation etc.).

14.Who we share your information with Your personal information may also be processed by other organisations on our behalf for the purposes outlined above which may include IT providers, couriers, shredding company, security company, printing company, CCTV company, administration services, accountant/auditors, insurers, recruitment agents, marketing consultants, outsourced service providers or subcontractors. We only engage with third-party service providers who provide sufficient guarantees to protect your data following our instructions and are bound by a data processing agreement. We may disclose your information where necessary to the following: Contracting Authority within a Government Department, Revenue, HSE, HSA, Child protection services, Social Welfare, Data Protection Commission, legal advisors, Insurance advisors, business advisors, law enforcement, An Garda Síochána, Volunteer Agencies, and to possible successors to our business

15.How long will we hold your information We will only retain personal data for as long as necessary for the purposes for which it was collected as required by law or regulatory guidance to which we are subject or to defend any legal actions.

16.Processing your information outside the EEA We process all our personal data within the EEA.

17.How to exercise your information rights (including the right to object) A.Erasure When have I the right to all my personal data being deleted by Mosney Village? You have the right to have your personal data deleted without undue delay if: •The personal data is no longer necessary in relation to the purpose(s) for which it was collected/processed •You are withdrawing consent and where there is no other legal ground for the processing •You object to the processing and there are no overriding legitimate grounds for the processing •The personal data has been unlawfully processed •The personal data must be erased so that we are in compliance with legal obligation What happens if Mosney Village has made my personal data public? If we have made your personal data public, we, taking account of available technology and the cost of implementation, will take reasonable steps, including technical measures, to inform those who are processing your personal data that you have requested the erasure. What happens if Mosney Village has disclosed my personal to third parties? Where we have disclosed your personal data in question to third parties, we will inform them of your request for erasure where possible. We will also confirm to you details of relevant third parties to whom the data has been disclosed where appropriate. B.Data portability When can I receive my personal data in machine readable format from Mosney Village? You will receive your personal data concerning you in a structured, commonly used and machine-readable format if: •processing is based on consent or contract and •processing is carried out by automated means. Would Mosney Village transfer the personal data to another service provider if I requested this? We can transfer this data to another company selected by you on your written instruction where it is technically feasible taking account of the available technology and the feasible cost of transfer proportionate to the service we provide to you. Under what circumstances can Mosney Village refuse? You will not be able to obtain, or have transferred in machine-readable format, your personal data if we are processing this data in the public interest or in the exercise of official authority vested in us. C.Will Mosney Village provide me with my personal data if the file contains the personal data of others? We will only provide you with your personal data, ensuring we protect the rights and freedoms of others. Where personal data of another person may be on the same files as yours, we will redact the full details of the other person. Contact us at dataprotection@mosney.ie or Mosney Village, Julianstown, Co. Meath A92 ED6V D.Automated individual decision making What are my rights in respect of automated decision making? Mosney Village does not have any automated decision-making processes. Where any such processes are introduced, we will provide you with the relevant information required under the “General Data Protection Regulation”. E.Object Have I already been informed about my right to object? We have informed you of your right to object prior to us collecting any of your personal data as stated in our privacy statement. When can I object to Mosney Village processing my personal data? You can object on grounds relating to your situation. Mosney Village will stop processing your personal data unless: •we can demonstrate compelling legitimate grounds for the processing, which override your interests, rights and freedoms •the processing is for the establishment, exercise or defence of legal claims. What are my rights to object for direct marketing purposes? Where your personal data is processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where you object to processing for direct marketing purposes, we will no longer process this data for such purposes. What are my rights to object in the use of information society services? In the context of the use of information society services, you may exercise your right to object by automated means using technical specifications. Contact us at dataprotection@mosney.ie or Mosney Village, Julianstown, Co. Meath A92 ED6V F.Restrict processing When can I restrict processing? •You may have processing of your personal data restricted: •While we are verifying the accuracy of your personal data which you have contested •If you choose restricted processing over erasure where processing is unlawful •If we no longer need the personal data for its original purpose but are required to hold the personal data for defence of legal claims •Where you have objected to the processing (where it was necessary for the performance of a public interest task or purpose of legitimate interests), and we are considering whether our legitimate grounds override. G.What if Mosney Village has provided my personal data to third parties? Where we have disclosed your personal data in question to third parties, we will inform them about the restriction on the processing, unless it is impossible or involves disproportionate effort to do so. How will I know if the restriction is lifted by Mosney Village and/or relevant third parties? We will inform on an individual basis when a restriction on processing has been lifted. Contact us at dataprotection@mosney.ie or Mosney Village, Julianstown, Co Meath A92 ED6V H.Rectification What can I do if Mosney Village is holding incorrect personal data about me? Where you suspect that data we hold about you is inaccurate, we will on demand rectify any inaccuracies without undue delay and provide confirmation of same. What happens if Mosney Village has transferred data to third parties? We will inform them and request confirmation that rectification has occurred. We will also provide you with details of the third parties to whom your personal data has been disclosed. Contact us at dataprotection@mosney.ie or Mosney Village, Julianstown, Co Meath A92 ED6V I.Withdraw consent Under what circumstances could I withdraw consent? You can withdraw consent if we are processing your personal data based on your consent. When can I withdraw consent? You can withdraw consent at any time. If I withdraw consent what happens to my current data? Any processing based on your consent will cease upon the withdrawal of that consent. Your withdrawal will not affect any processing of personal data prior to your withdrawal of consent, or any processing which is not based on your consent. Contact us at dataprotection@mosney.ie or Mosney Village, Julianstown, Co. Meath A92 ED6V J.Access your data When do I have the right to access my personal data from Mosney Village? Where Mosney Village process any personal data relating to you, you have the right to obtain confirmation of same from us, and to have access to your data. What information will Mosney Village provide to me? If we are processing your personal data, you are entitled to access a copy of all such personal data processed by us subject to a verification process to ensure we are communicating with the correct person. We will provide any of the following information: •why we are processing your personal data •the types of personal data concerned •the third parties or categories of third parties to whom the personal data have been or will be disclosed. We will information you if any of the third parties are outside the European Economic Area (EEA)or international organisations •how your personal data is safeguarded where we provide your personal data outside the European Economic Area or to an international organisation •the length of time we will hold your data or if not possible, the criteria used to determine that period •your rights to: •request any changes to inaccurate personal data held by us •have your personal data deleted on all our systems •restriction of processing of personal data concerning you •to object to such processing •data portability •your right to lodge a complaint with the Data Protection Commission info@dataprotection.ie •where we have collected your personal data from a third party, we will provide you with the information as to our source of your personal data •any automated decision-making, including profiling which includes your personal data. We will provide you with meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you. What Information is not provided? Business Information pertaining to your role as an employee How long will it take to receive my personal data from Mosney Village? We will provide you with a copy of the personal data we are currently processing within one month of request. In rare situations if we are unable to provide you with the data within one month we will notify you, within one month of your valid request, explaining the reason for the delay and will commit to delivery within a further two months. How much will it cost me to receive my personal data? We will not charge for providing your personal data unless we believe the request is excessive and the cost of providing your data is disproportionate to your services provided. Can I request additional copies of my personal data? If you require additional copies we will charge €20 to cover our administrative costs. Can I receive my personal data electronically? You can request your personal data by electronic means and we will provide your personal data in a commonly used electronic form if technically feasible. What will Mosney Village do if another person’s personal data is shared with my personal data? We will only provide you with your personal data, ensuring we protect the rights and freedoms of others. Where personal data of another person may be on the same files as yours, we will redact the full details of the other person. Contact us at dataprotection@mosney.ie or Mosney Village, Julianstown, Co. Meath A92 ED6V K.Lodge a complaint to the Data Protection Commission Can I lodge a complaint with the Data Protection Commission? You can lodge a complaint with the Data Protection Commission in respect of any processing by or on behalf of Mosney Village of personal data relating to you. How do I lodge a complaint? Making a complaint is simple and free. All you need to do is write to the Data Protection Commission giving details about the matter. You should clearly identify the organisation or individual you are complaining about. You should also outline the steps you have taken to have your concerns dealt with by the organisation, and what sort of response you received from them. Please also provide copies of any letters between you and the organisation, as well as supporting evidence/material. What happens after I make the complaint? The Data Protection Commission will then take the matter up with Mosney Village on your behalf.