Privacy Policy

1 General

The Cpl Institute is committed to protecting all personal categories of data held on you.

As such, The Cpl Institute wants you, the ‘data subject’, to understand how The Cpl Institute collects, uses, stores, and shares your personal data. The Cpl Institute also wants you understand what rights you can invoke to help you to protect your privacy. In this regard, it is important that you read this Privacy Notice and understand how The Cpl Institute uses your personal data. Please note The Cpl Institute reserves the right to update this Privacy Notice as required. The most recent version of this document can be found on The Cpl Institute’s website through the following link: https://www.thecplinstitute.ie/privacy-policy/

1.1 The Cpl Institute Information

The Cpl Institute embodies the Learning and Development Pillar of the Cpl Group’s business streams.

The Cpl Institute boasts multiple accreditation systems including the provision of over 60 QQI validated programmes, PHECC, IOSH Licensed, NISO, RoSPA & RSA membership and holds ISO 9001 quality assurance accreditation. If you wish to locate further information on The Cpl Institute, you can find this on The Cpl Institute website through the following link: https://www.thecplinstitute.ie/

1.2 Legislation

All personal data processed by The Cpl Institute is done so in accordance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

1.3 Queries and Complaints

If you are unhappy with the way The Cpl Institute handles your personal data and wish to complain, or if you simply want further information about the way your personal data will be used, please contact The Cpl Institute at the below:

Data Protection Officer

The Cpl Institute

5 St. Fintan’s, North Street,

Swords,

Co. Dublin

Ireland

Telephone: +353 01 895 5755

Email: dataprivacy@cpl.com

You have the right to lodge a complaint with the Data Protection Commission. To contact the Data Protection Commission, please use the following details:

Data Protection Commission

21 Fitzwilliam Square South

Dublin 2

D02 RD28

Ireland

Telephone: +353 (0)761 104 800

Telephone: +353 (0)57 868 4800

Email: info@dataprotection.ie

1.4 Breaches

The Cpl Institute will take all appropriate technical and organisational steps to safeguard your personal data. In the unlikely event of a data breach, The Cpl Institute will contact you in line with The Cpl Institute’s legal obligations.

2 How Does The Cpl Institute Collect Information?

The Cpl Institute collects personal data to enable the provision of services to support The Cpl Institute’s purpose. The following non-exhaustive methods of data collection are an indication of ways in which The Cpl Institute may obtain your information:

• Obtain personal data directly from you; and
• Personal data that The Cpl Institute receives from other sources

It is important that the personal data you provide The Cpl Institute is up to date and accurate. As outlined in Section 7.4 of this notice, if personal data The Cpl Institute holds on you is inaccurate or incomplete, please contact The Cpl Institute and The Cpl Institute will update the information.

3 What Does The Cpl Institute Use Information For?

3.1 Process, Purpose, and Lawful Basis

The Cpl Institute uses personal data collected to fulfil The Cpl Institute’s obligations to provide Training & Consultancy services and to enable the provision of services to support The Cpl Institute’s purpose.

The Cpl Institute uses personal data for any of the following purposes:

4 Who Does The Cpl Institute Share Information With?

The Cpl Institute may share personal data with other parties in the course of The Cpl Institute’s duties. When this is done, The Cpl Institute adheres to the following principles:

• The transfer is based on a legal obligation, the performance of a contract, or explicit consent.
• Where data is transferred to another party, The Cpl Institute ensures appropriate technical and organisational safeguards are used to protect your personal data.
• Where The Cpl Institute engages a third party to provide a service to The Cpl Institute, The Cpl Institute ensures the provider has taken appropriate technical and organisational measures to process, store, and safeguard your personal data.
• The Cpl Institute, as a Data Controller, will not sell your data to any third party and will take all appropriate steps to ensure the security of your data in dealings with third parties.

While the parties The Cpl Institute engage may change occasionally, The Cpl Institute believe it is important you are aware of the types of parties The Cpl Institute shares data with. The categories and types of third parties outlined below is a non-exhaustive list but provides an indication of the parties The Cpl Institute shares data with.

4.1 Other Third Parties

Third parties for the purposes of internal and external audits, carrying out research, general practitioners, and or third parties who may improve The Cpl Institute’s processes and services (such as consultants).

4.2 Government Departments, Bodies or Agencies

The Cpl Institute is legally obligated to share personal data with state actors which is outlined in the Data Protection Act 2018.

Recipients of this data include Government departments, agencies, bodies, investigatory bodies, local authorities, and the Gardaí.

4.3 International Transfers

Where personal data is transferred outside the European Economic Area, The Cpl Institute use safeguards known as Standard Contractual Clauses (SCCs).

5 What Type of Information is Collected?

To fulfil The Cpl Institute’s mandate and perform tasks as outlined in this statement, The Cpl Institute needs to collect various types of personal data.

While the type of personal data may change occasionally, The Cpl Institute believes it is important you are aware of the types of data The Cpl Institute gathers and uses. The following table is a non-exhaustive list and provides an indication of the categories and types of data The Cpl Institute uses to perform The Cpl Institute’s tasks.

Please note that information listed under one category may be used for the performance of a task or in relation to activities under another heading or as outlined under Section 3.

6 How Long Does The Cpl Institute Retain Information?

The Cpl Institute has developed a record retention schedule for all the personal data The Cpl Institute holds. Each retention period varies dependent on the nature and the purpose of the processing.

The main factors which determine retention periods are as follows:

1. How long it is required to perform the task;
2. Any legal requirements to hold onto the data;
3. Any pending legal actions.

If you would like to see a copy of the Retention Policy, please contact the DPO at dataprivacy@cpl.com

7 What Are Your Rights?

As a data subject, you will have the following rights as outlined in this section 7. However, restrictions may apply in certain situations.

7.1 Where do I send requests?

Please send all your requests to the contact details provided in Section 1, with as much detail as possible about your requirements to allow The Cpl Institute to deal with your request efficiently. To answer your request, The Cpl Institute may ask you to provide identification for verification purposes.

7.2 How long will a request take?

Upon receipt of a request, The Cpl Institute will have 30 days to provide an answer with an extension of two further months if required. If The Cpl Institute requires more time to deal with your request, The Cpl Institute will notify you of the delay and the reasons behind it within 30 days of the receipt of the request. If The Cpl Institute refuses your request, The Cpl Institute will also notify you within 30 days of the receipt of the request accompanied by the reasons for the refusal.

The Cpl Institute will not charge a fee for any requests, provided The Cpl Institute does not consider them to be unjustified or excessive. If The Cpl Institute considers these to be unjustified or excessive, The Cpl Institute may charge a reasonable fee (also applicable for multiple copies) or refuse the request.

You are entitled to contact the Data Protection Commission if The Cpl Institute refuses your request.

7.3 Right of Access

You have a right to know what personal data The Cpl Institute hold on you, why The Cpl Institute holds the data, and how The Cpl Institute is processing your personal data.

When submitting your request, please provide The Cpl Institute with information to help verify your identity and as much detail as possible to help The Cpl Institute understand the information you wish to access (i.e. date range, subject of the request) and email dataprivacy@cpl.com

Please note that an access request is free of charge, however, where The Cpl Institute determines a request to be unjustified or excessive, The Cpl Institute may charge you a reasonable fee.

7.4 Right to Rectification

You have a right to request that The Cpl Institute information held on you is up to date and accurate.

Where information is inaccurate or incomplete, The Cpl Institute encourage you to contact The Cpl Institute to have this information rectified. Upon receipt of request, The Cpl Institute will ensure that the personal data is rectified and as up to date as is reasonably possible.

7.5 Right to be Forgotten

You have the right to seek the erasure of your personal data in the following circumstances:

• The personal data is no longer required for the purposes for which is was obtained;
• Where data is being processed on the basis of consent, you withdraw consent to the processing and no other lawful basis exists;
• The personal data is being unlawfully processed;
• You object to the processing of personal data and there are no overriding legitimate grounds for the processing;
• Your personal data requires deletion in line with legal requirements.

However, The Cpl Institute will be unable to fulfil an erasure request if the processing of personal data is necessary for the following:

• Exercising the right of freedom of expression and information;
• Compliance with a legal obligation or for the performance of a task carried out in public interest;
• Reasons of public interest in the area of public health;
• Archiving or statistical purposes in the public interest;
• The establishment, exercise, or defence of legal claims;

Please note that the where the legal basis for The Cpl Institute’s processing of personal data is on the basis of a legal obligation, some processing in relation to your data may not be subject to the right to erasure.

To determine your request for erasure, The Cpl Institute will carry out an assessment of the justification for the retaining your personal data where a legal requirement applies and contact you if The Cpl Institute is unable to fulfil your request.

Please be aware that in some circumstances The Cpl Institute may need to retain some information to ensure all your preferences are properly respected. For example, The Cpl Institute cannot erase all information about you where you have also asked The Cpl Institute not to send you marketing material. Otherwise, The Cpl Institute would delete your preference not to receive marketing material.

7.6 Right to Restriction

You have the right to restrict the extent of personal data processed by The Cpl Institute in circumstances where:

• You believe the personal data is not accurate (restriction period will exist until The Cpl Institute updates your information);
• The processing of the personal data is unlawful, but you wish to restrict the processing of data rather than erase it;
• Where the personal data is no longer required by The Cpl Institute, but you require retention of the information for the establishment, exercise, or defence of a legal claim;
• You have a pending objection to the processing of the personal data;

When processing is restricted, your personal data will only be processed: with your consent; for the establishment, exercise or defence of legal claims; for the protection of the rights of other people; or for reasons important to public interest.

The Cpl Institute will contact you confirm where the request for restriction is fulfilled and will only lift the restriction after The Cpl Institute has informed you that The Cpl Institute is doing so.

7.7 Right to Data Portability

You have the right to the provision of all personal data held in relation to you in a structured, commonly used and machine-readable format where:

• Processing is completed on the basis a contract;
• Processing is completed based on consent by the you;
• Processing is carried out by automated means.

You may also request that The Cpl Institute sends this personal data to another data controller where technically feasible.

7.8 Right to Object

You have the right to object to the processing of your personal data; however, the processing must have been undertaken on the basis of public interest or legitimate interest by The Cpl Institute.

If you wish to object to the processing of data, please contact The Cpl Institute with your request. The Cpl Institute will then stop the processing of personal data unless it is required for legal proceedings.

This privacy policy is effective from 10/06/2020