Data Protection Policy for Optima Training & Consulting Ltd

Transcription

1 Optima Training & Cnsulting Ltd Data Prtectin/Privacy Plicy Data Prtectin Plicy fr Optima Training & Cnsulting Ltd Intrductin Optima Training & Cnsulting Ltd is a QQI & IHF Accredited Cmpany and Privacy and Data Prtectin Rights are very imprtant t us. In the curse f ur wrk with yu, yu give us infrmatin abut yurself we respect yur trust in us t use, stre and share yur infrmatin in accrdance with new laws including GDPR related legislatin. In this Privacy Plicy, we explain hw we cllect persnal infrmatin abut yu, hw we use it and hw yu can engage with us abut it. Please be assured that the persnal infrmatin yu prvide t us will nly be used t ensure that yu receive the best Training & Cnsulting pssible, that yur data will be held legally, securely and in a cmpliant manner and that yur infrmatin can nly be assessed by thse wh require it fr the delivery f ur services. Enquiries abut this Data Prtectin Plicy shuld be made t: Optima Training & Cnsulting Ltd, Aras Mumhan, Newcastle, Castletry, C. Limerick - t DPO@OptimaTraining.ie ; Phne t Wh we are When this ntice mentins we r us, we mean the Training & Develpment Limited Cmpany perated by Adrian Carmdy (Managing Directr) and James McLughlin (Directr) and includes staff emplyed by them. Adrian Carmdy as Managing Directr has verall respnsibility fr Data Prtectin within the Cmpany and may be cntacted by r phne n the details given abve ; by calling t the ffice, r by writing t him at ur ffice address. Infrmatin & Yu S that we can deliver effective Training & Develpment service t yu, we must gather and use persnal infrmatin abut yu. If yu d nt prvide the persnal infrmatin, we may be unable t prvide the quality f service yu seek. Why we cllect yur Data We cllect and use persnal data infrmatin t prvide the fllwing services: The prvisin f Custmer Service, Enquiry Respnses, Qutatins and ther fllw up Infrmatin n yur request Custmisatin and Tailring f Curse Cntent fr participants T manage vendr accunts and fr accunting (payment) purpses T cmply with Regulatins and Statutry Obligatins T cmply with requirements impsed by Training Accreditatin bdies such as QQI, IHF where certificatin is required T prvide persnnel, payrll and pensin administratin services in cnnectin with ur emplyees T get and retain Clear and Opt-In Cnsent fr further marketing fllw up Fr prvisin f the enfrcement f legal rights fr the prtectin f bth ur interests Fr prvisin f Billing, Payment, Remittance r receipt/payment f mney n yur behalf

2 Optima Training & Cnsulting Ltd Data Prtectin/Privacy Plicy Hw we cllect infrmatin abut yu When yu visit ur Website Ckies are present t stre statistical details (See Ckie Sectin) Ggle Analytics identity general data n what pages users access and lng they stay Yu might submit Enquiries, Make Bkings r Make a payment thrugh 3 rd Party Secure site Yur payments are prcessed via PayPal - Yu can view their privacy plicy here Shpping Cart & Check Out Area Cntact Us Frm Newsletter Sign Up Frm When yu use the Training Curses & Cnsultancy services that we prvide Details nted when yu make enquiry by face t face calls, phne, r via website Frms (Registratin, Evaluatin, Attendance Lgs, Examinatins) used n training curses Details required relating t cntractual bligatins Surveys prvided fr the custmisatin f curse cntent Phtgraphy may be taken at Cmpany Events but any use is cnsent based When yu prvide us with Cnsent t send yu regular updates Cnsent Newsletter Sign Up Frm n Website Hardcpy Written Cnsent When yu visit r engage with ur Scial Media platfrms Engagement (Likes/Cmments/Cmpetitins n Facebk/Twitter/LinkedIn The Specific Details we Cllect First Name, Last Name Cntact infrmatin including address and telephne number Cmpany Rle if Applicable Cmpany r Hme Address and Billing address PPS number is required fr very specific curses relating t Safe Pass and QQI Certificatin Sign up time and date Newsletter subscriptin (nly if yu have pted-in) Transactin data (items purchased, number f items purchased, rder value, rder time and date) Banking Details (but we d nt stre sensitive payment data) Ckies (please refer t Ckie Plicy sectin) Ggle Analytics (n persnal identifiable infrmatin is passed n - all infrmatin is annymised) Website Ckie Plicy Our website use ckie technlgy. A ckie is a little piece f text that ur server places n yur device when yu visit any f ur websites r apps. They help us make the sites wrk better fr yu. The nly functin f ckies assciated with ur website is t track hits s as t mnitr the parts f the site which are f mst interest t visitrs and t enable adjustments t be made t suit thse requirements. N infrmatin is retained fr any ther purpse.

3 Optima Training & Cnsulting Ltd Data Prtectin/Privacy Plicy [Nte: Yu can change the settings n yur brwser t refuse all ckies. Hwever, yu shuld nte that disabling ckies may result in sme parts f the site nt wrking efficiently r in slwer dwnlads]. Fr further infrmatin abut ckies and hw t cntrl their use, please visit the fllwing third party educatinal resurces: and Sharing f Persnal Data The plicy f Optima Training & Cnsulting Ltd is nt t Share yur Persnal Data with 3 rd Parties Hwever frm time t time we may be required t pass yur data t 3 rd parties as utlined belw. Please nte this will be clarified t yu at the time that the data is cllected and will either be dne s as t prvide yu with a better service r because it is legally required t d s. Specific Office based Staff will have access t yur training related infrmatin t prcess the required paperwrk and undertake the necessary administratin such as Attendance Lgs, Certificates etc Our Trainers may receive yur data (cntact details & rle details) t cntact yu fr curse custmisatin t ensure curses are tailred t yur specified requirements Our Trainers may receive yur data (cntact details, rle detail and survey feedback) in advance f curses fr curse custmisatin and final preparatin. A Curse Organiser wh Bks a grup nt a curse may receive the persnal data f the attendees bked by them including Curse Cnfirmatins, Cpies f Survey Respnses, Attendance Lgs, Evaluatin Frm, Feedback including KPI & Certificates The Certificatin bdies with whm we wrk may receive yur data fr the purpsed f reviewing assessments and prcessing certificatin Specific Gvernment Departments r 3 rd Party Organisatins may receive yur data with yur cnsent in relatin t issue arund the applicatin, funding r payment f curses n yur behalf. Revenue Cmmissiners may receive details fr tax cmpliance reasns Our Accuntants may receive details fr Accunting, Audit and Regulatry purpses Cntractr & Third Party Data Prtectin Cmpliance We expect and actively require any Third Parties with whm we wrk t be cmpliant with their legal bligatins under Data Prtectin. It is ur plicy t require all cntractrs r thse wh may cme int cntact with any Persnal Data we hld t shw GDPR cmpliance via self assessment and audit thugh ur Supplier Data Prtectin Checklist. We will stre this checklist fr the duratin f ur wrking relatinship with that 3 rd party (+ 12 mnths)

4 Optima Training & Cnsulting Ltd Data Prtectin/Privacy Plicy Hw we keep yur Infrmatin Safe We take apprpriate measures under the laws that apply, t ensure yur data is safe. IT s & ther Electrnic Data is stred in secure clud system Database is a Clud Based secure applicatin AntiVirus Sftware is used n all IT Systems Encryptin is enabled n all systems hlding Persnal Data A Firewall assists against Netwrk Intrusin WiFi is secure Dcument Strage Dcuments are stred in a lcked Office in Individual cvered Files Data is managed Safely and nt left in areas where nn relevant emplyees can access Any data which might be viewed as in any way sensitive is stred in lcked cabinets in the ffice f the Managing Directr Printing Printing is cmpleted with Individual Emplyee Pin Cdes t ensure nly thse wh shuld have access t the printed d s and nly data which Emplyee A prints, is accessible t Emplyee A CCTV We d nt recrd r retain CCTV ftage but the Munster GAA Cuncil, as wners and managers f the building d use CCTV systems which may include yur persnal data Data Dispsal Althugh Optima Training & Cnsulting Ltd des nt hld sensitive data, it is ur plicy t engage with a GDPR Cmpliant Prfessinal Shredding Cmpany and safety/securely dispse f the Persnal Data we hld t ensure cmpliance see sectin n Data dispsal Calls relating t Persnal Data If yu cntact us abut yur infrmatin, we may need t ask yu t identify yurself and furnish prf f identity this is t help prtect yur infrmatin.

5 Optima Training & Cnsulting Ltd Data Prtectin/Privacy Plicy Hw lng d we keep yur persnal data We have plicy based and regulatry bligatins that mean we must keep yur data while yu are a client and fr certain perids f time after yu stp being a client. Thse perids depend n the nature f the wrk we have dne fr yu. General Data Retentin Plicy (Clients) We retain general training data fr a perid f 5 years General Data Retentin Plicy (Cntractrs/Trainers/Vendrs) We retain persnal data f the abve fr the duratin f wrking relatinship (+12 mnths) Accreditatin Requirements QQI 6 Years IHF 5 Years Legal Obligatins NERA & Revenue 6 Years What is the legal basis n which we gather and hld yur infrmatin? T use yur infrmatin lawfully, we rely n ne r mre f the fllwing legal bases: Perfrmance f a cntract Legal bligatin Prtecting the vital interests f yu r thers Public interest Our legitimate interests Yur cnsent T meet ur regulatry and legal bligatins, we cllect sme f yur persnal infrmatin, verify it, keep it up t date thrugh regular checks, and delete it nce we n lnger have t keep it. We may als gather infrmatin abut yu frm third parties t help us meet ur bligatins. If yu d nt prvide the infrmatin we need, r help us keep it up t date, we may nt be able t prvide yu with ur services. Dispsal f Persnal Data Once the perid f stated strage is cmplete, r based n a Request t delete persnal data (presuming we have n legal r statutry bligatin t retain it) it is ur plicy t have yur persnal date securely dispsed f thrugh 3 mnthly scheduled cntracts with ur prfessinal shredding cmpany. This service will dispse f persnal data such as has been cllected n Attendance Lgs, Frms, Feedback, Examinatins and mre. Date will be securely deleted frm the fllwing media: Paper Based Files CRM & Database Systems Electrnic Strage including Hard Disks, External Hard Drives, Memry Sticks & BackUp Date will be deleted als in relatin t these files

6 Optima Training & Cnsulting Ltd Data Prtectin/Privacy Plicy Cnsent Smetimes we need yur cnsent t use yur persnal infrmatin. With direct marketing fr example, we need yur cnsent t make yu aware f services which may be f interest t yu. We may d this by phne, pst, , text r thrugh ther digital media. It is ur plicy t keep, in as far as is pssible, a dcumented recrd f this cnsent. Often, at the end f a curse r piece f wrk fr yu, we cntact yu t give and get feedback. We will generally prvide ptins at this pint in relatin t hw yu might prvide cnsent r therwise fr us t cntact yu with updates, marketing material and ther prmtins. Breach Reprting The DPO will cnduct regular inspectins and maintain a systematic audit schedule t mnitr cmpliance and Optima Training will actively recrd and reprt any Breaches in relatin t Data Prtectin. Any emplyee, client r 3 rd party can alert the DPO t the breach, wh will update the Breach Lg befre identifying the breach type and evaluate any risk assciated with the breach. Where there is a pssibility f risk, and where the persnal data breached is neither Encrypted r Annymised, the DPO will reprt the breach t the DPC, and depending n the severity/urgency f the risk may als ntify the data subject. This will be dne as sn as pssible and within the required 72 hur limit. Staff Awareness & Training Training sessins have been cmpleted with all staff in advance f the GDPR arrival date f 25/05/18 All future inductin sessins with include a specific sessin n data prtectin. Yur Data Rights Yu can exercise yur rights by cntacting us n , ing us n DPO@OptimaTraining.ie r calling int ur Office - Optima Training & Cnsulting Ltd, Aras Mumhan, Newcastle, Castletry, C. Limerick Whenever yu cntact us t ask abut yur infrmatin, we may ask yu t identify yurself. This is t help prtect yur infrmatin. Yur right t btain infrmatin cannt adversely affect the rights and freedms f thers. Therefre, we cannt prvide infrmatin n ther peple withut cnsent. (See Sharing f Data fr further details) We generally d nt charge yu when yu cntact us t ask abut yur infrmatin. Hwever, if requests are deemed excessive r manifestly unfunded, we may charge a reasnable fee t cver the additinal administrative csts r chse t refuse the requests. The fllwing sectin details yur infrmatin rights and hw we can help ensure that yu are aware f these rights, hw yu can exercise these rights and hw we intend t deliver n yur requests. 1. Yu can ask us fr a cpy f the persnal infrmatin we hld and further details abut hw we cllect, share and use yur persnal infrmatin

7 Optima Training & Cnsulting Ltd Data Prtectin/Privacy Plicy 2. If yu want t update r crrect any f yur persnal details, please cntact us at n , ing us n DPO@OptimaTraining.ie r calling int ur Office - Optima Training & Cnsulting Ltd, Aras Mumhan, Newcastle, Castletry, C. Limerick 3. Yu can change yur mind wherever yu have given us yur cnsent, such as fr direct marketing r prcessing yur infrmatin. 4. Yu may have the right t restrict r bject t us prcessing yur persnal infrmatin. We will require yur cnsent t further prcess this infrmatin nce restricted. Yu can request restrictin f prcessing where; The persnal data is inaccurate and yu request restrictin while we verify the accuracy The prcessing f yur persnal data is unlawful Yu ppse the erasure f the data, requesting restrictin f prcessing instead Yu require the data fr the establishment, exercise r defence f legal claims but we n lnger require the data fr prcessing Yu disagree with the legitimate interest legal basis and prcessing is restricted until the legitimate basis is verified Yu may ask us t delete yur persnal infrmatin r we may delete yur persnal infrmatin under the fllwing cnditins: The persnal data is n lnger necessary in relatin t the purpses fr which it was cllected r therwise prcessed; Yu withdraw yur cnsent where there is n ther legal grund fr the prcessing Yu withdraw yur cnsent fr direct marketing purpses Yu withdraw yur cnsent fr prcessing a child s data Yu bject t autmated decisin making The persnal data have been unlawfully prcessed The persnal data has t be erased fr cmpliance with a legal bligatin. Yu declare t us that yu are n lnger a client f urs Data Prtectin Feedback, Further Infrmatin & Cmplaints If yu have a cmplaint abut the use f yur persnal infrmatin, please let a member f staff in ur Office knw, giving them the pprtunity t put things right as quickly as pssible. If yu wish t make a cmplaint yu may d s in persn, by phne, in writing and by . We will fully investigate all the cmplaints we receive. We ask that yu supply as much infrmatin as pssible t help us reslve yur cmplaint quickly. Yu can als cntact the Office f the Data Prtectin Cmmissiner in Ireland n the belw details: Visit their website inf@dataprtectin.ie Phne n +353 (0) r +353 (0) Write t Data Prtectin Office, Canal Huse, Statin Rad, Prtarlingtn, C. Lais, R32 AP23. Or 21 Fitzwilliam Square, Dublin 2, D02 RD28, Ireland. Review This Data Prtectin Plicy will be reviewed regularly in light f any legislative r ther relevant develpments. We will infrm yu f any changes t ur Privacy Plicy in the future.