Privacy Policy

7. Accountability

7.1 Introduction
The GDPR states that the data controller shall be responsible for, and be able to demonstrate compliance with the above principles (“accountability”). This means that we must:

• maintain relevant documentation on all data processing activities (see 5.2 below);
• implement appropriate technical and organisational measures that ensure and demonstrate that we comply;
• implement measures that meet the principles of privacy by design and by default (see 5.3 below), such as:
• data minimisation;
• pseudonymization;
• transparency; and
• creating and improving security features on an ongoing basis.
• use data protection impact assessments where appropriate.
• record all data security breaches (see 5.5 below).

7.2 Records of Processing Activities: Registers of Personal Data
In order to maintain documentation on processing activities, Kingdom Installation Ltd has created a central Register of Personal Data which documents what personal data we hold as a Data Controller, what we use it for, the legal basis we are relying on in order to process the data, who we may share it with, where it is held and how long we keep it.

Kingdom Installation Ltd is also required to hold a register of personal data it holds where it acts as a data processor.

Every department/unit/office in Kingdom Installation Ltd is required to record the information required to compile the Registers. This process is coordinated by the Information Compliance Manager. Heads of each Department must return the required information to the Information Compliance Manager. Heads must also notify the Information Compliance Manager with details of any changes to the processing of personal data carried out in their area.

7.3 Privacy by Design and by Default
Privacy by design and by default is written into Article 25 of the GDPR.
Privacy by Design states that any action an organisation undertakes that involves processing personal data must be done with data protection and privacy in mind at every step. This includes internal projects, product development, software development, IT systems, and much more. In practice, this means that Kingdom Installation Ltd must ensure that privacy is built in to a system during the whole life cycle of the system or process.

Privacy by Default means that once a product or service has been released to the public, the strictest privacy settings should apply by default, without any manual input from the end user. In addition, any personal data provided by the user to enable a product’s optimal use should only be kept for the amount of time necessary to provide the product or service. If more information than necessary to provide the service is disclosed, then “privacy by default” has been breached.
Members must apply the principles of Privacy by Design and by Default when processing any personal data by:

• Performing a Data Protection Impact Assessment (DPIA) – see section below – where data processing is likely to result in a high risk to the rights and freedoms of individuals, especially when a new data processing technology is being introduced.
• Performing a DPIA where systematic and extensive evaluation of individuals is to be carried out based on automated processing (profiling), large scale processing of special categories of data and personal data relating to criminal convictions.
• Collecting, disclosing and retaining the minimum personal data for the minimum time necessary for the purpose;
• Anonymising personal data wherever necessary and appropriate.

7.4 Data Protection Impact Assessments (DPIA)
When Kingdom Installation Ltd processes personal data, the individual whose data we are processing is exposed to risks. A Data Protection Impact Assessment (DPIA) is the process of systematically identifying and minimising those risks as far and as early as possible. It allows Kingdom Installation Ltd to identify potential privacy issues before they arise, and come up with a way to mitigate them.
See DPIA Procedure for further information on assessing whether a DPIA is required and guidance on how to conduct a DPIA.

7.5 Personal Data Security Breaches
Kingdom Installation Ltd will take all necessary steps to reduce the impact of incidents involving personal data by following Kingdom Installation Ltd Personal Data Security Breach Management Procedure. Where a data breach is likely to result in a risk to the rights and freedoms of data subject, the Information Compliance Manager will liaise with the Data Protection Commissioner’s Office and report the breach within 72 hours of discovery. The Information Compliance Manager will also recommend, where necessary, actions to inform data subjects and reduce risks to their privacy arising from the breach.
Members who discover a personal data security breach must immediately inform their manager who will contact the Information Compliance Manager following the above procedure. It is important that all Members act quickly and report any suspected incident without delay.

7.6 Data Subject Rights
The GDPR provides the following rights for individuals:

The right to be informed
Individuals have the right to be informed about the collection and use of their personal data. This is a key transparency requirement under the GDPR. See section above on Data Protection Notices.

The right of access
Data subjects are entitled to make an access request under the Data Protection Acts for a copy of their personal data and for information relating to that data. This must be complied with within one calendar month.

If a data access request is received by Kingdom Installation Ltd, the recipient should forward it immediately to Kingdom Installation Ltd Information Compliance Manager (contact details below) who will respond to the request on behalf of Kingdom Installation Ltd, consulting with staff in relevant offices/departments and taking into account the narrow exemptions set out in the legislation.

Please refer to Kingdom Installation Ltd Data Subject Right’s Procedure.
In certain circumstances, Kingdom Installation Ltd is able to avail of exemptions from the restrictions in the Data Protection Acts (e.g., disclosure required by law). These exemptions are subject to strict conditions, and should only be availed of where authorised by Kingdom Installation Ltd Information Compliance Manager.

The personal information of a data subject must not be disclosed to a third party, be they potential employer, employer, professional body, etc. without the consent of the individual concerned.

The right to rectification
The GDPR includes a right for individuals to have inaccurate personal data rectified, or completed if it is incomplete. An individual can make a request for rectification verbally or in writing. Kingdom Installation Ltd must respond to a request within one calendar month. In certain circumstances, Kingdom Installation Ltd can refuse a request for rectification.
All requests for rectification of personal data should be notified to the Information Compliance Manager without delay who will advise further on the steps to be taken to respond to the request.

The right to erasure
The GDPR introduces a right for individuals to have personal data erased. The right to erasure is also known as ‘the right to be forgotten’. Individuals can make a request for erasure verbally or in writing. Kingdom Installation Ltd must respond to a request within one calendar month. The right to erasure is not absolute and only applies in certain circumstances.

All requests for erasure of personal data should be notified to the Information Compliance Manager without delay who will advise further on the steps to be taken to respond to the request.

The right to restrict processing
Individuals have the right to request the restriction or suppression of their personal data. This is not an absolute right and only applies in certain circumstances. When processing is restricted Kingdom Installation Ltd is permitted to store the personal data, but not use it. An individual can make a request for restriction verbally or in writing and Kingdom Installation Ltd must respond within one calendar month.

All requests to restrict the processing of personal data should be notified to the Information Compliance Manager without delay who will advise further on the steps to be taken to respond to the request.

The right to data portability
The right to data portability allows individuals to obtain and reuse their personal data for their own purposes across different services. It allows them to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without hindrance to usability.

The right to data portability only applies:

• to personal data an individual has provided to a controller;
• where the processing is based on the individual’s consent or for the performance of a contract; and
• when processing is carried out by automated means.
• All requests in relation to portability of personal data should be notified to the Information Compliance Manager.

The right to object
Individuals have the right to object to:

1. processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling):
2. Individuals must have an objection on “grounds relating to his or her particular situation”.
3. You must stop processing the personal data unless:
4. you can demonstrate compelling legitimate grounds for the processing, which override the interests, rights and freedoms of the individual; or
5. the processing is for the establishment, exercise or defense of legal claims.
6. You must inform individuals of their right to object “at the point of first communication” and in your privacy notice.
7. This must be “explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information”.

Direct marketing (including profiling)

• You must stop processing personal data for direct marketing purposes as soon as you receive an objection. There are no exemptions or grounds to refuse.
• You must deal with an objection to processing for direct marketing at any time and free of charge.
• You must inform individuals of their right to object “at the point of first communication” and in your privacy notice.
• This must be “explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information”.
• Data subjects must be given the option to opt out of further communications each and every time they are contacted. They must also be given the opportunity to segment their preferences.

Processing for purposes of scientific/historical research and statistics.
Individuals must have “grounds relating to his or her particular situation” in order to exercise their right to object to processing for research purposes. If you are conducting research where the processing of personal data is necessary for the performance of a public interest task, you are not required to comply with an objection to the processing.

Rights in relation to automated decision making and profiling
You must offer a way for individuals to object online.

7.7 External Data Processors
It is occasionally necessary for Kingdom Installation Ltd to engage the services of external suppliers. If the service involves the external hosting of personal data by the supplier on behalf of Kingdom Installation Ltd, a number of steps must be taken before any personal data can be disclosed to the supplier:

• The Externally Hosted Personal Data Policy and approval process must be followed
• Where determined applicable by Kingdom Installation Ltd.’s Third Party Hosting Group, there must be a written contract between Kingdom Installation Ltd (as data controller) and the supplier of the service (as data processor).
• the supplier must be entered into Kingdom Installation Ltd register of data processors held by the Information Compliance Manager.

7.8 Transfers of Personal Data Outside of the E.U.
The GDPR imposes restrictions on the transfer of personal data outside the European Union, to third countries or international organisations. These restrictions are in place to ensure that the level of protection of individuals afforded by the GDPR is not undermined. Personal data may only be transferred outside of the EU in compliance with the conditions for transfer set out in Chapter V of the GDPR.
Transfers may be made where the Commission has decided that a third country, a territory or one or more specific sectors in the third country, or an international organisation ensures an adequate level of protection.

• You may transfer personal data where the organisation receiving the personal data has provided adequate safeguards. Individuals’ rights must be enforceable and effective legal remedies for individuals must be available following the transfer.
• Adequate safeguards may be provided for by;
• a legally binding agreement between public authorities or bodies;
• binding corporate rules (agreements governing transfers made between organisations within in a corporate group);
• standard data protection clauses in the form of template transfer clauses adopted by the Commission;
• standard data protection clauses in the form of template transfer clauses adopted by a supervisory authority and approved by the Commission;
• compliance with an approved code of conduct approved by a supervisory authority;
• certification under an approved certification mechanism as provided for in the GDPR;
• contractual clauses agreed authorised by the competent supervisory authority; or
• provisions inserted into administrative arrangements between public authorities or bodies authorised by the competent supervisory authority.

If you intend to transfer personal data outside of the E.U., contact the Information Compliance Manager in the first instance, who will seek the appropriate legal advice where required.

7.9 Marketing / Mailing Lists / Electronic Privacy Regulations
The Electronic Privacy Regulations 2011 (SI 336 of 2011) sit alongside the Data Protection Acts. They give people specific privacy rights in relation to electronic communications and contain specific rules on:

• Marketing calls, emails, texts and faxes;
• Cookies (and similar technologies);
• Keeping communications services secure; and
• Customer privacy regarding traffic and location data, itemized billing, line identification, and directory listings.

While primarily aimed at electronic communications companies (telecommunications companies and internet services providers), the Regulations also apply to any entity (such as Kingdom Installation Ltd) using such communications and electronic communications networks to communicate with customers, e.g., by telephone, via a website or over email, etc.
Unsolicited direct marketing is one of the main sources of complaint from individuals to the Data Protection Commissioner and anyone who fails to comply with the E-Privacy Regulations can be prosecuted as each unlawful marketing message or call constitutes a separate offence.
It is imperative that the necessary marketing opt-ins and opt-outs (via a data protection notice or otherwise) are in place before using personal data for marketing purposes. The Data Protection Commissioner’s guidance note is available here.
Where Members process personal data to keep people informed about Kingdom Installation Ltd activities and events, they must provide in each communication a simple way of opting out of further communications.
Members are required to follow the Guide to Direct Marketing when seeking to send out marketing communications on behalf of Kingdom Installation Ltd.

7.10 Personal Data relating to Criminal Convictions/Offences (incl. Garda Vetting)
To process personal data about criminal convictions or offences, Kingdom Installation Ltd must have both a lawful basis under Article 6 of the GDPR and either legal authority or official authority for the processing under Article 10. This must be established before processing begins and must be documented. See Appendix C for further information.

Garda vetting disclosures made to Kingdom Installation Ltd must be stored securely with access restricted to a small number of authorised personnel.

7.11 Profiling and/or Automated Decision Making
Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a person, in particular to analyse or predict aspects concerning their performance at work or studies, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
While the law recognises profiling and automated decision-making can be useful for individuals and organisations, GDPR restricts profiling and gives data subject rights around profiling-based decisions. For example, there is a general prohibition on ‘solely’ automated processing producing ‘legal’ or ‘similarly significant’ effects unless permitted by law and the transparency requirements (set out in section 1 above) are complied with.
There is a distinction between the concepts of profiling and automated decision-making. There are three ways in which profiling can be used in practice:

• general ‘profiling’, defined in Article 4(4) GDPR
• human decision-making based on profiling; and
• purely automated decision-making under Article 22 GDPR, which includes profiling legal effects concerning, or similarly significantly affecting, the data subject.

Advice and guidance on profiling can be sought from Kingdom Installation Ltd.’s Information Compliance Manager.

7.12 CCTV
All usage of CCTV other than in a purely domestic context must be undertaken in compliance with the requirements of the Data Protection Acts. Extensive guidance on this issue is available on the Data Protection Commissioner’s website.
In summary, all uses of CCTV must be proportionate and for a specific purpose. As CCTV infringes the privacy of the persons captured in the images, there must be a genuine reason for installing such a system. If installing a CCTV system, the purpose for its use must be displayed in a prominent position.
Before installing a CCTV system in Kingdom Installation Ltd, Members must consult with the Office of Corporate & Legal Affairs (Information Compliance Manager) and a Data Protection Impact Assessment must be undertaken.

7.13 Children’s Personal data
Children are identified in the GDPR as “vulnerable individuals” and deserving of “specific protection”. Guidelines on the use of personal data relating to children are outlined in Appendix E.

11. Definitions

The Data Protection Acts govern the processing of personal data. As with any legislation, these and other terms used in the Data Protection Acts have a specific meaning. The following are some important definitions used in this policy, taken from the Data Protection Acts, with additional comments provided where appropriate:

Personal data
Personal data means information relating to-

a. an identified living individual

b. a living individual who can be identified from the data, directly or indirectly, in particular by reference to

an identifier such as a name, an identification number, location data or online identifier, or
one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual
This can be a very wide definition depending on the circumstances.

Special categories of personal data
Special categories of personal data (formerly known as “sensitive personal data”) receive greater protection under the Data Protection Acts and refer to the following:

• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• trade union membership;
• genetic data or biometric data for the purpose of uniquely identifying a person;
• data concerning health;
• data concerning a person’s sex life or sexual orientation

Data subjects have additional rights under Article 9 of the GDPR in relation to the processing of any such data.
Whilst criminal convictions and offences are not classed as special categories of personal data, the Data Protection Acts also provide additional rights to data subjects in this regard.

Data concerning health
Data concerning health means personal data relating to the physical or mental health of an individual, including the provision of health care services to the individual, that reveal information about the status of his or her health.

Data subject
Data subject is a living person who is the subject of personal data.

Data controller
Data controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. KINGDOM INSTALLATION LTD, for example, is a data controller in relation to personal data relating to its own staff and clients.

Data owner
Data owner means the most senior person in Kingdom Installation Ltd within which the data is created. An exception can be made if this role has been explicitly and formally delegated to someone else by the most senior person in the aforementioned areas. Data owners have overall responsibility for the quality and integrity of the data held in their area.

Data processor
Data processor means a natural or legal person, public authority, agency or other body that processes personal data on behalf of a controller (Note: the term ‘Data Processor’ does not include an employee of a data controller who processes such data in the course of their employment. Examples of data processors include payroll companies, accountants and market research companies, all of which could hold or process personal information on behalf of someone else).

Direct marketing
Direct marketing is defined as:
“The communication (by whatever means) of any advertising or marketing material which is directed to particular individuals”.
This covers all advertising or promotional material, including that promoting the aims or ideals of not-for-profit organisations – for example, it covers a charity or political party campaigning for support or funds.
The marketing must be directed to particular individuals. In practice, all relevant electronic messages (e.g., calls, faxes, texts and emails) are directed to someone, so they fall within this definition.
Genuine market research does not count as direct marketing. However, if a survey includes any promotional material or collects details to use in future marketing campaigns, the survey is for direct marketing purposes and the rules apply.
An unsolicited message is any message that has not been specifically requested. So even if the customer has ‘opted in’ to receiving marketing from you, it still counts as unsolicited marketing. An opt-in means the customer agrees to future messages (and is likely to mean that the marketing complies with the Electronic Privacy Regulations) but this is not the same as someone specifically contacting you to ask for particular information.

Members:
In this Policy, ‘Members’ is used to refer to:

• any person who is employed or engaged by Kingdom Installation Ltd who processes personal data in the course of their employment or engagement;
• individuals who are not directly employed by KINGDOM INSTALLATION LTD, but who are employed by contractors (or subcontractors) and who process personal data in the course of their duties for KINGDOM INSTALLATION LTD.

Processing:
Processing is widely defined under the Data Protection Acts and means performing any operation or set of operations on personal data, whether or not by automated means, including-

• the collection, recording, organisation, structuring or storing of the data;
• the adaptation or alteration of the data;
• the retrieval, consultation or use of the data;
• the disclosure of the data by their transmission, dissemination or otherwise making the data available;
• the alignment or combination of the data; or
• the restriction, erasure or destruction of the data.

Pseudonymisation
Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person. The Data Protection Acts still apply to personal data which has been pseudonymised.