Privacy Notice
This Notice sets out the basis on which any personal data we at Waterford Intellectual Disability Association (W.I.D.A.) collect from you, or from others, will be processed by us. Please read the following carefully to understand our practices regarding your personal data and how we will treat it.
This Notice is divided into several sections – if you click on a heading in the Table of Contents, you will be taken directly to that section. More detailed information is available in several sections, or on request in some instances
Who are we and how can you contact us?
What personal data do we collect & use and where do we get your personal data from?
What information about you do we obtain from others?
Do you collect information from children?
How and why we use personal data?
Is personal data sent outside the European Union?
What is the legal basis for WIDA collecting and processing personal data ?
What are my rights, and how do I exercise them?
How to stop getting emails, text messages and other communications from us?
How long do we retain personal data for?
Who are we and how can you contact us?
“We” are Waterford Intellectual Disability Association (W.I.D.A.)
W.I.D.A is a voluntary and not for profit organisation that provides services and supports to children and adults with special needs since insert .W.I.D.A is a Company Limited by Guarantee, not having a Share Capital and registered in Ireland (No439556 )
This Notice applies to W.I.D.A as the Data Controller for the purposes of the General Data Protection Regulation EU 2016/679, and the Data Protection Act 2018. W.I.D.A is also a Processor for other Third-Party Bodies for the provision of services,
For data protection issues, please email our DPO at dpo@wida.ie or call us 051-897822.
Or write to us at:
Data Protection Officer
Waterford Intellectual Disability Association (W.I.D.A.)
Ashley Drive,
Cherrymount,
Waterford.
X91 WP80
What personal data do we collect & use and where do we get your personal data from?
“ Personal Data” is data that can identify you, either directly or indirectly, as an identified or identifiable individual.”
“ Special Category/Sensitive Data” is defined in the GDPR as:
-
- Personal data regarding racial or ethnic origin;
- personal data that reveals political opinions;
- personal data about religious or philosophical beliefs;
- personal data that shows trade union membership;
- genetic data;
- biometric data
- data concerning an individuals health;
- data concerning sex life; and
- data concerning the sexual orientation of a person.
You may give us personal data or special category /sensitive data by:
-
- Engaging the W.I.D.A services. Your personal data and special category data (including specific health data) will be collected and processed for the purposes of the various services including in order to facilitate the operation, management, and coordination of these services. Personal data relating to your emergency contacts and parents or guardian details for under 18s will be processed by us. This personal data will also be processed jointly and as a processor for and with various State Agencies.
- In some circumstances, service users may disclose health data relating to their relatives.
- Corresponding with us by phone, e-mail or otherwise. We ask you to disclose only as much personal data as is necessary to provide you with services or to submit a question/suggestion/comment in relation to our website or our services.
- Filling in forms on our website such as the contact us form and/or a booking form. When filling in forms on the website, via download or in person we will use the personal data you provide in connection with our services.
- Donating to our organisation by phone, email or arranging fundraising activities for us.
- Taking part in events photographs and recorded images of attendees are taken to celebrate achievements.
- Using our facilities CCTV systems are installed externally only for the purpose of enhancing security of the building and participants and staff. These CCTV systems may record images of staff, services users, parents and members of the public who visit the premises via the car park.
- Applying to work with us. The type of information you may provide in your CV, a cover letter, your name, address, e-mail address and phone number.
- Volunteering with us as stipulated in The National Vetting Bureau (Children and Vulnerable Persons) Acts 2012 to 2016 all W.I.D.A staff, volunteers, and other individuals who provide services to us and who interact with children or vulnerable persons must be vetted by A Gardaí Síochána. Garda Vetting is a procedure through which A Garda Síochána is asked, with a person’s permission, to disclose any information held on Garda file. The vetting process requires the provision of verified proof of identify and proof of address by all vetting candidates and, subsequently, checks by An Gardaí Síochána of their records. The purpose for processing your Personal Data in this context is that it is necessary to comply with our legal obligations under the National Vetting Bureau (Children and Vulnerable Persons) Acts 2012 to 2016.
- When you access our website your device’s browser provides us with information such as your IP address, browser type, access time and referring URL which is collected and used to compile statistical data. This information may be used to help us to improve our website and th 12 e services we offer, and to offer services to you.
- Personal data which will be sought and recorded through staff and volunteer records: As well as existing members of staff/volunteers (and former members of staff/volunteers), these records may also relate to applicants applying for positions. These staff/volunteer records may include:
- Name, address and contact details, PPS number
- Contract of employment and any amendments to it
- Original records of application and appointment to promotion posts
- Financial information records
- Payroll records
- Employee review meetings
- Grievance and disciplinary procedures information
- Details of approved absences (career breaks, parental leave, study leave etc.)
- Information relating to your health, which could include reasons for absence and GP reports and notes
- Details of work record
- Details of any accidents/injuries sustained on WIDA property or in connection with the staff member carrying out their duties
- Records of any reports (or its employees) have made in respect of the staff member to State departments and/or other agencies under mandatory reporting legislation and/or child-safeguarding guidelines.
- CCTV images for car park only
- Personal data which will be sought and recorded through Parents/Guardians’ Records: we may hold some or all of the following information about parents and/or guardians of service users Names and addresses of parents/legal guardians and their contact details (including any special arrangements with regard to guardianship, custody or access) and other related correspondence.
- We may also process other data, which is not personal data.
What information about you do we obtain from others?
When you use our services, we may obtain the following categories of personal data from others:to include Health Care Practitioners, Government Agencies/ Public Sector Bodies, Other NGOs and Community Services, Tusla, the HSE and /or your authorised Representatives or involved Agencies and Statutory bodies.
Do you collect information from children?
Children’s Personal Data: We do collect and manage information about children due to the nature of our services. The information is usually collected when children use our services. Where possible and appropriate we will seek consent from a parent or guardian before collecting information about children.
How and why we use personal data?
We collect the information in order to provide our services, to
We will use this information:
- To enroll you on our systems so as to provide you with our services in order to facilitate the operation, management and coordination of our services.
- To liaise with you in relation to the services that we are providing to you and to contact your relatives where necessary.
- To deliver information about our services.
- To fulfil our statutory functions.
- To administer and improve our website and for internal operations, including troubleshooting, and statistical and survey purposes where consent is given.as part of our efforts to keep our website safe and secure.
- To make suggestions and recommendations to you and other users about services that may interest you or them.
- To publicise and promote the benefits of our services for their participants, by way of social media and other online platforms.
- To create a candidate profile for you if you are a prospective employee or volunteer;
- To process employment applications, including by assessing qualifications, verifying information, conducting reference or other employment-related checks, and notifying you of future opportunities that might be of interest to you.
Do we share personal data?
We may share your personal data with our selected suppliers and contractors to provide you with our services. The Personal Data held on your record will be disclosed to relevant staff/volunteers of W.I.D.A and other State Agencies or NGOs. All staff/volunteers are made aware of the procedures they must follow to ensure your Personal Data is appropriately protected.
The Personal Data you provide may be disclosed to third parties if we are under a duty to disclose or share your Personal Data in order to comply with any legal or regulatory obligation or request or to perform a public function.
We may also disclose your Personal Data to governmental, regulatory and/or public bodies or other third parties:
- If we are under a duty to disclose or share your information in order to comply with any legal obligation, or in order to enforce or apply our terms of use and other agreements; or to protect our rights, property, or safety, our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.
- Statutory and regulatory bodies (including central and local government) and law enforcement authorities in order to comply with any applicable laws, grant applications and /or court orders
- Your Authorised representatives
- Third parties with whom: (i) we need to share your information to facilitate transactions you have requested, and (ii) you ask us to share your information.
We attach at Schedule 1 a list of some entities (non-exhaustive) with whom your personal data is shared.
Is personal data sent outside the European Union?
We will, from time to time, make use of services provided by 3rd parties for the delivery of our services which may necessitate the transfer of personal data outside the EU/EEA. For example, we use a variety of cloud-based tools such as Office 365/Microsoft. Where Personal Data needs to be transferred or processed outside the EU/EEA, we chose providers who process Personal Data on the basis of
- Standard Contractual Clause (s)(SCC’s)
- An Adequacy Decision from the European Commission.
What is the legal basis for WIDA collecting and processing personal data ?
Irish and EU law sets out the grounds upon which data controllers and data processors such as W.I.D.A can rely on to lawfully process personal data.
We rely on the following grounds:
Processing necessary to provide you with services;
Where you have given, us consent to the processing of your personal data for a specific purpose.
The processing is necessary for us to fulfil our contract with you or others, such as funding agencies.
The processing is necessary for compliance with a legal obligation, for example to comply with child protection and/or Revenue requirements.
The processing is necessary in order to protect the vital interests of a staff member or another person, for example, an attendee at a training course in a medical emergency.
The processing is necessary for the purposes of the legitimate interests pursued by W.I.D.A or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.
The legal bases for the processing of your special category data or sensitive data (for example health and wellbeing data) are:
- Processing necessary to provide you with services;
- Processing necessary to protect your vital interests;
- That you have explicitly provided consent.
- Processing is necessary for compliance with a legal obligation to which we are subject.
- Processing is necessary for substantial reasons of public interest, which will always respect the essence of the right to data protection.
What are my rights, and how do I exercise them?
As an individual, under EU law you have certain rights to apply to us to provide information or make amendments to how we process your Personal Data. These rights apply in certain circumstances and are set out below: –
The right to access Personal Data relating to you (‘access right’).
The right to rectify/correct Personal Data relating to you (‘right to rectification’).
The right to object to processing of Personal Data relating to you (‘right to object’).
The right to restrict the processing of Personal Data relating to you (‘right to restriction’).
The right to erase/delete Personal Data relating to you (i.e., the ‘right to erasure’).
The right to ‘port’ certain Personal Data relating to you from one organisation to another (‘right to Personal Data portability’).
These rights are not absolute and only apply in certain circumstances. You may exercise any of the above rights by contacting us accompanied by all necessary information via:
an e-mail to dpo@wida.ie
Or write to us at:
Data Protection Officer
Waterford Intellectual Disability Association (W.I.D.A.)
Ashley Drive,
Cherrymount,
Waterford.
X91 WP80
You may lodge a complaint with your local supervisory authority with respect to our processing of your personal data. The local Supervisory Authority in Ireland is the Data Protection Commission. The website is www.dataprotection.ie
DATA PROTECTION COMMISSION contact details are:
Dublin Office Portarlington Office
21 Fitzwilliam Square Canal House
Dublin 2 Station Road
D02 RD28 Portarlington
Ireland R32 AP23
Phone +353 57 868 4800 or +353 761 104 800
LoCall 1 890 25 22 31
Fax +353 57 868 4757
email: info@dataprotection.ie
We would ask that you contact us first at dpo@wida.ie to enable us to try to deal with the matter to your satisfaction.
Where our processing of your personal data is based on your consent to that processing, you have the right to withdraw that consent at any time but any processing that we have carried out before you withdrew your consent remains lawful.
The exercise of Data Subjects’ rights as some other “interactions” requires the univocal identification of the person submitting such request as being, in fact, the Data Subject to whom such Personal Data pertains to, hence we may have to set in place a process or mechanism that allows it to document having undergone such assertive identification.
How to stop getting emails, text messages and other communications from us?
Yes!
If you no longer wish us to contact you in a particular way, for example, to no longer send you text messages, just advise us of that and we will respect your wishes.
It may be necessary for us to contact you from time to time in connection with services, for example to ensure your Personal Data is correct.
If you no longer wish to receive communications by electronic means advise us at admin@wida.ie
How is personal data secured?
We are committed to protecting the security of your Personal Data. We use a variety of security technologies and procedures to help protect your Personal Data from unauthorised access and use. As effective as modern security practices are, no physical or electronic security system is entirely secure. We cannot guarantee the complete security of our databases, nor can we guarantee that information you supply will not be intercepted while being transmitted to us over the Internet. We will continue to revise policies and implement additional security features as new technologies become available.
The transmission of information via the internet is not completely secure and may involve the transfer of Personal Data to countries outside of the European Economic Area (EEA). This occurs typically through use of cloud solutions for web hosting, email hosting or proprietary software solutions delivered to us through the Cloud. We do not however authorise any third party to use your Personal Data for their own purposes. Non-EEA countries may not provide an adequate level of protection in relation to processing your personal data. By submitting your Personal Data, you agree to this transfer, storing and processing. The sharing, storage and processing of your personal data/ information will predominantly take place within the EEA.
Although we will do our best to protect your Personal Data, we cannot guarantee the security of your Personal Data transmitted to us. Any transmission of Personal Data is at your own risk. Once we receive your Personal Data, we use appropriate security measures to seek to prevent unauthorised access.
How long do we retain personal data for?
The time periods for which we retain your information depends on the type of information and the purposes for which we use it. We will keep your information for no longer than is required or permitted.
We keep your Personal Data for as long as is necessary for the performance of the contract between you and us and to comply with our legal obligations. If you no longer want us to use your Personal Data to provide this service to you, you can request that we erase your Personal Data. Please note that if you request the erasure of your Personal Data:
- We may retain some of your Personal Data as necessary for our legitimate business interests, such as fraud detection and prevention and enhancing safety
- We may retain and use your Personal Data to the extent necessary to comply with our legal or contractual obligations.
- Because we maintain our records to protect from accidental or malicious loss and destruction, residual copies of your Personal Data may not be removed from our backup systems for a limited period of time.
How do you contact us?
You have the right to complain to the Data Protection Commission if you feel that we are in breach of any of your rights. Full contact details are provided below.
We would ask that you contact us first, to enable us to try to deal with the matter to your satisfaction.
Please contact us by e-mail to dpo@wida.ie
Or write to us at:
Data Protection Officer
Waterford Intellectual Disability Association (W.I.D.A.)
Ashley Drive,
Cherrymount,
Waterford.
X91 WP80
If you wish to exercise any of the rights you have in respect of your data, please contact us at dpo@wida.ie
Payments
We may need to collect the following information, as it is necessary for the adequate performance of the contract with you and to comply with applicable law (such as anti-money laundering regulations).
· Payment Information. When you make payments, we require certain financial information (like your bank account or credit card information) in order to process payments and comply with applicable law.
· Identity Verification and Other Information. We may require identity verification information, in order to verify your identity and comply with applicable law.
Links to other sites
Our website may, from time to time, contain links to and from other websites. If you follow a link to any of those websites, please note that those websites have their own privacy policies/notices and that we do not accept any responsibility or liability for those policies/notices. Please check those policies/notices before you submit any Personal Data to those websites,
Social Networks
We may maintain active social network accounts. We embed widgets from these networks to provide follow buttons, like boxes and stream embeds. This will involve cookies being set by these networks while using our site. You may choose to refuse these cookies. Your use of these social media platforms remains subject to your own user agreements with the platform providers.
Changes to this Notice
This notice may change from time to time, and any changes will be posted on our website and will be effective when posted. Please review this notice each time you use our website or our services. This notice was last updated on Oct 16th, 2024.
This Notice is effective from Dec 9th 2024.
Schedule 1
We have set out below a non-exhaustive list of third parties with whom we share your Personal Data.
| Third party name | Description of services provided |
| Cloud Service Providers | Microsoft |
| IT and website Providers | Heskap |
| Vcare | User Information system |
| Other Service Providers/Funders | List can be provided on request |
Useful Information
Useful Links
Connect
051 897822
admin@wida.ie
WIDA Ashley Drive, Cherrymount, Waterford, X91 WP80