Candidate Data Protection Information Notice
May 2024
What is this document?
This information notice relates to the Personal Data of individuals who apply for open positions with ID-Pal Limited (‘ID-Pal’), the obligations and responsibilities of ID-Pal, as Data Controller, in protecting such Personal Data and the rights of the candidate in relation to their Personal Data.
ID-Pal may receive your Personal Data directly from you or from a recruitment agency, who may also act as a Data Controller.
Who can you contact within the ID-Pal for data protection matters?
Sinéad McDonald
Data Protection Officer
sinead@id-pal.com
+35 386 232 1112
Details of the laws that apply to us with regard to processing your personal data
Irish and EU laws on data protection govern all activities we engage in with regard to our collection, storage, handling, disclosure and other uses of personal data.
Compliance with the data protection rules is a legal obligation. In addition, our compliance with the data protection rules helps individuals to have confidence in dealing with us and helps us to maintain a positive reputation in relation to how we handle personal information.
The data protection rules that apply to us are currently contained in the Data Protection Legislation. The rules are based around several important definitions. These include:
‘Personal Data’ is any information relating to an identified or identifiable natural person (‘data subject’).
‘Special categories of Personal Data’ means personal data revealing racial or ethnic origins, political opinion, religious or philosophical beliefs or trade union membership and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. References in this Data Protection Information Notice to Personal Data shall include Special categories of Personal Data.
‘Data Controllers’ are the people who or organisations which determine the purposes for which, and the manner in which, any personal data is processed, who/which make independent decisions in relation to the personal data and/or who/which otherwise control that personal data.
‘Data Processors’ are the people who or organisations which process personal data on behalf of, and on the instructions of, a data controller.
Where two or more controllers jointly determine the purposes and means of processing, they shall be ‘Joint Controllers.
‘Data Protection Legislation’ means both the EU General Data Protection Regulation 2016/679 (‘GDPR’), UK GDPR and the Data Protection Acts, 2018 in both Ireland and the United Kingdom.
What Personal Data does the ID-Pal process and why?
ID-Pal processes the following:
- Name
- Address
- Date of Birth
- Contact email address
- Mobile number
- Previous employment history
- References from previous employers
- Education details
- Technical assessments (where appropriate for the role)
- Health information that may be relevant
- Any other information included in your CV or obtained during recruitment process
The purpose of our processing of your Personal Data is to consider your application and during the recruitment process, to assess your suitability for a role, establishing your identity and determine the terms on which you may work with us and to manage an effective recruitment process.
The legal grounds that we rely on to process your Personal Data are your consent or that the processing is necessary to take steps at your request prior to entering our contract with you.
Who does the ID-Pal share Personal Data with?
ID-Pal may disclose specific and relevant Personal Data to various recipients in connection with the aforementioned purposes including:
- the board of ID-Pal Limited;
- External interviewers, if used;
- referees whose details you have provided to us;
- the recruitment agency, if used;
- other third parties who provide IT products and services to us e.g. Monday.com, Microsoft
How does the ID-Pal protect your Personal Data?
ID-Pal takes the security of your Personal Data seriously. We have internal policies and controls in place to try to ensure that your Personal Data is not lost, accidentally destroyed, misused, or disclosed, and is only accessed on a need-to-know basis.
Where ID-Pal engages third parties to process Personal Data on our behalf, they do so on the basis of authorised instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of the Personal Data.
Is Personal Data and Special categories of Personal Data transferred outside the European Economic Area?
How long is Personal Data retained for?
What happens if you do not provide us with your Personal Data
What rights do I as a Data Subject, have?
Subject to certain restrictions provided by Data Protection Legislation you have the right to:
- Request information about whether we hold personal data about you, and, if so, what that information is and why we are holding/using it.
- Request access to your personal data (commonly known as a ‘data subject access request’). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
- Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
- Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
- Object to processing of your personal data.
- Object to automated decision-making including profiling, that is not to be subject of any automated decision-making by us using your personal data or profiling of you.
- Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
- Request transfer of your personal information in an electronic and structured form to you or to another party (commonly known as a right to ‘data portability’). This enables you to take your data from us in an electronically useable format and to be able to transfer your data to another party in an electronically useable format.
You also have the right to lodge a complaint with the Data Protection Commission or the Information Commissioner’s Office. Details of this right can be found at:
https://www.dataprotection.ie/en/individuals/raising-concern-commission
Changes to this Candidate Data Protection Information Notice
Version control: v4 May 2024