This privacy notice provides information about how ESD Training and our training partners Sustainable Ireland Cooperative Society (t/a Cultivate), NICER Training and Sustainable Projects Ireland (t/a The Village) use the personal data we collect when you apply for one of our training courses, as well as additional data collected during the delivery of these training services.
1.Data Protection Law
The EU General Data Protection Regulation 2016/679 (GDPR) and the Data Protection Act 2018 (which supplements the GDPR) came into force on 25 May 2018. We refer to these as “data protection law”.Once in force, data protection law will regulate the processing of “personal data” relating to individuals by organisations (known as “data controllers”).
2. Key definitions
On this page, and the pages which it links to, we have used some words and phrases, and these are explained below.
“Personal data” means any information which relates to a living, identifiable person. It can include names, addresses, telephone numbers, email addresses etc but it is wider than that and includes any other information relating to that person or a combination of information which, if put together, means that the person can be identified.
“Special category data” means personal data about a person’s race, ethnic origin, politics, religion, trade union membership, genetics, biometrics (where used for ID purposes), health, sex life or sexual orientation.
“Processing” covers all activities relating to the use of personal data by an organisation, from its collection through to its storage and disposal and everything in between.
“Data subject” means the person whose personal data is being processed.“Data controller” means the organisation which is responsible for processing data and ensuring that personal data is processed in accordance with data protection law.
3.Privacy notices Personal data must be processed in accordance with specific principles set out in Data Protection Law. These include the principle that personal data should be processed ‘lawfully, fairly and in a transparent manner’. In order to comply with this principle, ESD Training will advise you on how it will process your information at the time we collect it. This information is normally set out in a “privacy notice” which we publish on our website.
4.ESD Training as data controller
ESD Training is the data controller for any personal data that we process in relation to you.Occasionally, ESD Training may be a joint data controller with other organisations, or we may be processing data about you on behalf of another organisation, but when this is the case, we will make you aware of this when the information is collected.
5.What personal data will be processed?
Any personal details provided to us are stored in our database, along with any subsequent relevant data provided to us at a later stage during your training course.
Information is gathered through our web-based enquiry forms, during telephone or face to face communications with us, and by email or post.
Personal data collected includes: your name, home address, business (if booking on behalf of an organisation), a contact mobile telephone number, email address, or any other personal information that you disclose to us at the point of your enquiry and during your training course.
In addition to this, we may need to process some data about you that is classed as ‘special category’ or sensitive personal data. We will usually ask you for consent to do this. This includes any relevant health and disability information you provide us. We will make sure that access to, and the sharing of, your special category personal data is controlled very carefully.Cookies are not collected on the website.
6. What is the purpose of the processing?
ESD Training will process your personal data for a range of purposes. These include the following:
- To deliver services and training to you.
- To support your medical, safety, wellbeing and welfare requirements.
- To communicate with you by post, phone, email or other electronic media, in order to provide you with relevant information and updates relating to your training.
- To enable us to contact others in the event of an emergency (we will assume that you have checked with individuals before you supply their contact details to us).
- To fulfil and monitor our responsibilities under equalities, immigration and public safety legislation.
- With your consent, to communicate with you for marketing and promotional purposes.
- To compile statistics for reporting purposes.
- To manage and develop the ESD Training business.
7. What is the legal basis of the processing?
If we require your consent for any use of your specific data, we will collect it at the appropriate time, explaining why we are collecting the data and how we will use it, and you can withdraw this consent at any time. In other cases, we consider the processing of your personal data for these purposes to be necessary for:
- The performance of our contractual obligations with you (e.g. to deliver training services to you).
- Compliance with a legal obligation.
- The pursuit of legitimate interests of ESD Training and its training partners in managing and developing its business.
We usually process your special category data with your explicit consent. In other cases, we do so because we consider it necessary:
- Very occasionally, for the establishment, exercise or defence of legal claims.
- For statistical purposes
Your personal data may be shared, on a considered and confidential basis, with a range of external organisations as is necessary for the purposes set out above and as permitted or required by law, including the following:
- Occasionally and when necessary the police and other law enforcement agencies, for the prevention or detection of crime.
- Occasionally and when necessary internal and external auditors and regulators.
Except as we have explained above, we will not normally publish or disclose any personal data about you to other external enquirers or organisations unless you have asked us to do or have consented to it, or unless it is in your vital interests to do so (e.g. in an emergency situation).9. How long is my personal data kept?
Personal data relating to your training course undertaken with us will be kept on our systems for five years after the training is completed.
Personal data collected as part of a course application which did not result in a training course being undertaken will be stored on our systems for a shorter period of time, as permitted by law.
We do this to ensure we can respond to any queries you or any third parties raise regarding current, future or past training courses undertaken with us.10. How we protect your personal data
ESD Training handles relatively small quantities of information about individuals. However it is important that individuals have trust and confidence that ESD Training will protect their privacy, and we take great care to ensure that personal data is handled, stored and disposed of confidentially and securely. We have put in place organisational and technical measures to ensure that personal data is processed in accordance with the 6 data protection principles set out in Data Protection Law.
Your personal data is collected, stored and transmitted securely in a variety of paper and electronic formats. Only relevant staff that require access to your personal data for the purpose for delivering our services will be able to access this data. Our use of your data will be strictly limited to the purpose and legal basis outlined below.11. Your rights as a data subject
As a data subject, you have the following rights in relation to your personal data which is processed by ESD Training:
- to access the personal information ESD Training holds about you. This is known as a Subject Access Request. More information about making Subject Access Requests and exercising your rights is available below;
- to correct inaccuracies or, where appropriate and taking into account the purpose for which we process your data, the right to have incomplete data completed;
- to have your personal data erased. This is a limited right which applies, among other circumstances, when the data is no longer required or the processing has no legal justification. There are also exceptions to this right, such as when the processing is required by law or in the public interest (e.g. when ESD Training needs to retain a historical archive);
- to object to the processing of your personal data for marketing purposes. If you ask us to delete your personal data, we will continue to maintain a core set of personal data comprising very brief information to ensure that we do not inadvertently contact you in future. We may also need to retain some financial records for statutory purposes;
- to object to the processing of your personal data when that processing is based on specific criteria such as the public interest or other legitimate interests, unless we have compelling lawful grounds to continue;
- to restrict the processing of your personal data. This is a limited right which will apply in specific circumstances and for a limited period;
- to ask for the transfer of your data electronically to a third party;
- where the legal basis for us processing your personal data is your consent, to withdraw that consent at any time.
- you would like more information on your rights;
- you would like to exercise any right;
- you have any queries relating to ESD Training’s processing of your personal data; or
- you wish to complain;
The Data Protection Officer
5 Royal Terrace East, Dun Laoghaire, Co. Dublin
Telephone: 086 8280978
You also have a right to complain to the Data Protection Commission (DPC) about the way in which we process your personal data. You can make a complaint using the DPC website13. Are changes made to this webpage?
This webpage is effective from 18 June 2019. It is reviewed when necessary and at least annually. Any changes will be published here and you may also be notified by email.