• The information we collect about you and its sources
• How we use your personal data?
• Who may we share your personal data with?
• How long will we store your personal data?
• Do we transfer your personal data outside the EEA?

The Design & Crafts Council Ireland (DCCI, we, us, our) is committed to protecting and respecting your privacy. This Data Protection Notice tells you about your privacy rights and sets out how we, as a Controller, collect, use, process and disclose your personal data relating to your interactions with us.

Information we may collect and process

Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). We may collect and process any type of personal data you provide to us in the course of your interactions with us.

If you do not provide us with your personal data, we may not be able to provide you with our services or respond to any questions or requests you submit to us. When we ask for personal data, we will tell you whether it is needed to perform our functions or information that is required to comply with our legal obligations.

How we use personal data we collect

We will only use your personal data for the purposes and legal basis set out at the time of collection and only for the purpose(s) for which it was obtained.

Why do I need to provide personally identifiable data to DCCI when applying for membership or funding?

When applying for funding, membership or to participate in DCCI events or workshops, DCCI may request personally identifiable information including your date of birth, gender, nationality, etc. The purpose of collecting these data is to avoid duplication of records and ensure that we can link any additional forms directly to you. These data will not be shared with third parties without your prior consent.

Retention of your personal data

We will store your personal data only for as long as necessary for the purpose(s) for which it was obtained. The criteria used to determine our retention periods include.

• The length of time we have an ongoing relationship and/or provide our services.
• Whether there is a legal requirement to which we are subject.
• Whether the retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation or regulatory investigations).

Please contact us if you wish to obtain further information concerning our retention periods, details below.

Disclosure of your personal data

We may disclose your personal data to third parties who provide a service to us in the normal course of our business and in line with the purpose for which we collected the data.

In the event of any future changes to legislation which may change the way in which we operate we may be under a duty to disclose or share your personal data in order to comply with any legal obligation, or where necessary for our legitimate business interests to protect the rights, property, or safety of DCCI, or others or for the purposes.

Such disclosure may, as appropriate, include exchanging information with other organisations, companies, auditors, Government Departments, Institutes of Technologies, recruiters, Semi State Agencies, universities and public bodies, where any such body provides a service to DCCI and we are satisfied that it complies with the GDPR requirements.

The personal data that we collect may be transferred to, and stored at, a destination outside the European Economic Area (“EEA”), for the purposes described above.

To the limited extent that it is necessary to transfer your personal data outside of the EEA, we will ensure appropriate safeguards are in place to protect the privacy and integrity of such personal data, including standard contractual clauses under Article 46.2 or adequacy decision under Article 45. Please contact us if you wish to obtain information concerning such safeguards (see Contact details for our DPO below).

Your rights 

You have several rights in relation to your personal data under applicable privacy and data protection law, which may be subject to certain limitations and restrictions.

We will respond to any valid requests within one month, unless it is particularly complicated or you have made repeated requests in which case we will respond, at the latest, within three months. We will inform you of any such extension within one month of receipt of your request, together with the reasons for the delay. You will not be charged a fee to exercise any of your rights unless your request is clearly unfounded, repetitive or excessive, in which case we will charge a reasonable fee in the circumstances or refuse to act on the request.

If you wish to exercise any of these rights, please contact us. We will request proof of identification to verify your request.

Your rights and what it means

Right to withdraw consent

If we are processing your personal data on the legal basis of consent, you are entitled to withdraw your consent at any time. However, the withdrawal of your consent will not invalidate any processing we carried out prior to your withdrawal and based on your consent.

Right of access

You can request a copy of the personal data we hold about you.

Right to rectification

You have the right to request that we correct any inaccuracies in the personal data we hold about you and complete any personal data where this is incomplete.

Right to erasure (‘right to be forgotten’)

You have the right to request that your personal data be deleted in certain circumstances including:

• The personal data is no longer needed for the purpose for which it was collected.
• You withdraw your consent (where the processing was based on consent).
• You object to the processing and there are no overriding legitimate grounds justifying us processing the personal data (see Right to Object below)
• The personal data have been unlawfully processed.
• To comply with a legal obligation.

However, this right does not apply where, for example, the processing is necessary.

To comply with a legal obligation
or
For the establishment, exercise or defence of legal claims.

Right to restriction of processing

You can ask that we restrict your personal data (i.e. keep but not use) where:

• The accuracy of the personal data is contested.
• The processing is unlawful but you do not want it erased.
• We no longer need the personal data but you require it for the establishment, exercise or defence of legal claims.
• You have objected to the processing and verification as to our overriding legitimate grounds is pending.

We can continue to use your personal data:

• Where we have your consent to do so.
• For the establishment, exercise or defence of legal claims.
• To protect the rights of another.
• For reasons of important public interest.

Right to data portability

Where you have provided personal data to us, you have a right to receive such personal data back in a structured, commonly-used and machine-readable format, and to have those data transmitted to a third-party data controller without hindrance, but in each case only where:

The processing is carried out by automated means
and
The processing is based on your consent or on the performance of a contract with you.

Right to object

You have a right to object to the processing of your personal data in those cases where we are processing your personal data in reliance on our legitimate interests, for the performance of a task carried out in the public interest or in the exercise of our official authority. In such a case we will stop processing your personal data unless we can demonstrate compelling legitimate grounds which override your interests and you have a right to request information on the balancing test we have carried out. You also have the right to object where we are processing your personal data for direct marketing purposes.

Right to complain

You have the right to lodge a complaint with the Data Protection Commission if you consider that the processing of your personal data infringes on the GDPR.

Security and where we store your personal data

DCCI is committed to protecting the security of your personal data. A variety of security technologies and procedures are used to help protect your personal data from unauthorised access and use.

Strict internal guidelines have been implemented to ensure that your privacy is safeguarded at every level of our organisation. DCCI will continue to revise policies and implement additional security features as new technologies become available.

Changes to this Data Protection Notice

We reserve the right to change this Data Protection Notice from time to time at our sole discretion.

Contact us

Questions, comments, requests and complaints regarding this Data Protection Notice and the personal data we hold are welcome and should be addressed to:

The Data Protection Officer, Design & Crafts Council Ireland, Castle Yard, Kilkenny R95 CAA6, or submitted by email to [email protected].