Down Syndrome Cork

Field of Dreams: Privacy Policy

Privacy Policy (Draft v.11th June 2019)

Down Syndrome Cork Field of Dreams is committed to protecting your privacy and the personal information you and others provide to us.  This privacy policy outlines what we do with the personal information you provide, why we gather it and what rights you have regarding it. If you are under 16 years of age, please read this statement with a parent or guardian and ensure you understand it. This statement outlines our approach to Data Protection to fulfil our obligations under the General Data Protection Regulation (GDPR).

Who are we?

We are Down Syndrome Cork Field of Dreams,  the Cork branch of Down Syndrome Ireland (DSI), a Company Limited by Guarantee.

The Down Syndrome Cork administration and therapy centre operates at Centre 21, Unit 7, Kilnap Business and Technology Park, Old Mallow Road, Cork. Phone: 021 4300 444.

Field of Dreams is a horticultural / social farm project of Down Syndrome Cork and operates from Clash Road, Curraheen, Co Cork, Phone: 021 4878 328.

As a branch of DSI, we are a charitable organisation which provides services to children and adults with Down Syndrome in County Cork. We process personal data and special category personal data about people to carry out this core work. We are also engaged in training, research, fundraising, direct marketing, office administration, finance and HR administration including payroll and recruitment. We manage relationships with volunteers, contractors and state agencies such as Cork ETB and departments such as the Department of Agriculture, Food and the Marine.

For the purpose of the GDPR, the data controller is Down Syndrome Cork Field of Dreams (“DSC”).

What personal data do we collect from you?

DSC processes personal data about service users and their family members /representatives, perspective volunteers, donors, advocates, supporters, contractors, suppliers and individuals in sponsor companies or partner organisations, job applicants or former employees. DSC does not engage in profiling or automated decision making. DSC processes different types of personal data and special category personal data depending on how and why you are interacting with us.

Purpose & Categories of data processed

Health & Social care services when attending our service centre in Blackpool or Field of Dreams in Curraheen

Health data (referral letter from a third party, medical records and assessments, diagnosis, medical/physical history and medication details, hospital details, physician/healthcare professionals details), contact names and initials, addresses, telephone numbers, email, date of birth, country of birth, gender, next of kin contact details and relationship to service user, photographs, videos, attendance records, healthcare professional reports and update reports for carers/guardians, medical card numbers, social preferences, dietary, social, sleep and spiritual needs, assistive technology needs and personal care needs, funding applications.

Communications

Contact names, addresses, telephone numbers, email, social media identifiers such as facebook, photographs, videos, stories and health data.

Training & Research

Contact names, addresses, telephone numbers, email, assignments, training records, health data.

Office Administration

Contact names, contact details, tax identifiers (e.g. VAT number for service providers), bank details, legal claims, timesheets and payment data, data associated with accounts receivable or accounts payable.

Office Administration & Finance Management

Contact names, contact details, PPSN for donors, bank details, health data, photographs, stories, video or audio footage and additional contact names and addresses.

Donations / Sponsorship / CSR

Contact name and address; email address; credit/debit card details; PayPal details; bank account details/direct debit mandate form; age group; tax payer status and PPSN number (where you wish to avail of tax relief in respect of your donation). For CSR / Employee Engagement days; employer; location of work; contact name and address; email address; role/position held; work schedule.

Human Resources / Volunteer management / Recruitment

Application form, references, CVs (employment history and education), Garda/Police vetting declarations, professional qualifications.

Wellbeing, Safety & Security

Occupational health data, accident & incident reports, safeguarding/ risk assessment information, location data and CCTV recordings (see CCTV policy).

Website management

See cookie policy.

Where do we get this information from?

We obtain personal data about you if:

  • you apply for a job, to volunteer with DSC Field of Dreams or in connection with your studies;
  • you or your parent/guardian/carer contact us to request you become a service user or a participant on a training course. If someone gives us information about you, we may add it to any personal information we already hold and use it in the ways described in this privacy policy. Before you disclose information to us about another person, you should be sure that you have their consent to do so. You should also show them this privacy policy to ensure they confirm that they know you are sharing their personal information with us. 
  • a health or social care professional or third level college employee shares data with us by way of a referral;
  • you contact us to become a donor, course participant or advocate;
  • we complete a business transaction with you as a supplier of products / services, or as a customer of our shops / produce.
  • you are an employer / business owner or an employee of a business that is offering work experience or paid work to a trainee, graduate or service user.

We may have your personal data because your company or organisation has entered into a partnership with DSC. In limited circumstances data is publicly available and there would be a reasonable expectation that an organisation such as DSC would process it, for example, you are a journalist, medical expert, academic, politician, business leader or celebrity.

Why do we collect this information?

We collect the information in order to provide you with our services, to market our services, to fundraise, to improve our organisation and to recruit staff and volunteers. We will use this information:

  • To carry out our obligations arising from any agreements entered into between you and us e.g. to provide you with our therapies and services where you are a service user;
  • To communicate with you as part of our relationship with you or in accordance with our agreement with you;
  • To carry out fundraising and marketing activity which is vital to the financial sustainability of our organisation;
  • To set you or your company up as a supplier on our systems and to pay you for products/services provided to us;
  • To liaise with you about projects that we are undertaking with you;
  • To create a candidate profile for you if you are a job applicant;
  • To communicate with and support you / your business in offering work experience or paid employment to a service user.
  • To administer and improve our site and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;
  • As part of our efforts to keep our site safe and secure;
  • To deliver information about our services and our organisation, where you have subscribed to receive same;

The legal bases for the processing of your data are:

  • Processing necessary for the performance of a contract which you have entered into with us or to take steps at your request prior to entering into a contract;
  • Processing necessary for compliance with a legal obligation to which we are subject.
  • Processing necessary in order to protect the vital interests of you or of another natural person;
  • That you have provided consent for the processing for one or more specified purposes such as marketing;
  • Processing necessary for the purposes of the legitimate interests which we pursue for example by providing you with information about our services prior to contract.

The legal basis for the processing of your Special Category Personal Data (i.e. your medical/health data) are:

  • That the processing is necessary for the provision of health care, treatment or social care and for the purposes of medical diagnosis;
  • That the processing is necessary in order to protect your vital interests or that of another person where you are physically or legally incapable of giving consent.

Who do we share your personal data with?

We may share your personal data and where necessary, Special Categories of Personal Data, with selected third parties including suppliers and contractors in order to provide you with our services. For example, these suppliers may include our web hosting provider and our IT service providers.

In addition, we may disclose your personal information (including Special Categories of Personal Data) to third parties:

  • We may share personal data with Down Syndrome Ireland of which DSC is a branch;
  • If we are under a duty to disclose or share your information in order to comply with any legal obligation, or in order to enforce or apply our terms of use and other agreements; or to protect our rights, property, or safety, our clients/customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction;
  • Where solicitors or your elected power of attorney have your written authorisation to be provided with the personal data we hold about you.

DSC in accordance with our obligations, keeps personal data and special category personal data for a range of periods. Our current retention periods are based on:

  • Statutory obligations for example, we are required to keep records created under Childcare legislation indefinitely;
  • Contractual obligations, for example, we are required to keep records for a certain period as provided for in contracts with service providers like IT service providers;
  • Quality assurance / best practice obligations set by state entities or regulatory bodies 
  • Our view that retention is necessary for the original purpose or a compatible purpose
  • On a case by case basis, records may be retained for longer where they are required for actual or potential legal actions or the management or mitigation of operational or strategic risks to Enable Ireland. Where records are subject to this kind of review the ongoing retention will be assessed annually.

You have the following rights:

  • The right to access the personal data we hold about you. Under the GDPR, we are obliged to respond to your access request without undue delay. In most instances, we will respond within 30 Days. If we are unable to deal with your request fully within 30 Days (due to the complexity or number of requests), we may extend this period by a further two calendar months. Should this be necessary, we will explain the reasons why. If you make your request electronically, we will, where possible, provide the relevant information electronically unless you ask us otherwise. We reserve the right not to have to respond to access requests that are excessive or manifestly unfound.
  • The right to require us to rectify any inaccurate personal data about you without undue delay.
  • The right to have us erase any personal data we hold about you in circumstances such as where it is no longer necessary for us to hold the personal data or, in some circumstances, if you have withdrawn your consent to the processing.
  • The right to object to us processing personal data about you such as processing for profiling or direct marketing.
  • The right to ask us to provide your personal data to you in a portable format or, where technically feasible, for us to port that personal data to another provider provided it does not result in a disclosure of personal data relating to other people.
  • The right to request a restriction of the processing of your personal data.
  • Where our processing of your personal data is based on your consent to that processing, you have the right to withdraw that consent at any time but any processing that we have carried out before you withdrew your consent remains lawful.
  • You may lodge a complaint with your local supervisory authority with respect to our processing of your personal data. The local Supervisory Authority in Ireland is the Data Protection Commissioner. The website is www.dataprotection.ie. A form called “raise a concern” is available on their website in this regard.

Contact Karen at Down Syndrome Cork 021 4300 444 or Sharon at Field of Dreams 021 487 8328 to exercise any of the above rights.

The implications of not sharing your personal data with us:

Sharing personal Information with us is in both your interest and ours. We need information in order to:

  • Provide our services. 
  • Assess your suitability for a job, voluntary or student placement with us.
  • Manage our business for our legitimate interests.
  • Comply with our legal obligations.

You can choose not to share information, but by doing so may limit the services we are able to provide to you because:

  • We may not be able to assess your suitability for a service, or, where relevant, give you a recommendation to provide you with a service, renew an existing service or continue to provide services to you if we do not have the ability to process your information.