1. .Introduction

1.1. WorkJuggle regards the protection of personal data as important, both to protect the data rights of data subjects and to protect our brand. Moreover, the General Data Protection Regulation and Irish law provide for significant penalties for failure to adequately protect data rights. The types of personal data that WorkJuggle might process include information about current, past and prospective employees (including students), suppliers, consumers, and others with whom it interacts.

2. Purpose

2.1. This Policy sets out WorkJuggles rules on data protection. It covers the principles contained in the Data Protection Acts 1988 to 2018 and the General Data Protection Regulation (GDPR).

3. Scope

3.1. This policy covers the processing by WorkJuggle of all ‘personal’ data and ‘special categories’ of personal data in relation to data subjects. It applies equally to personal data held in manual or electronic form.

4. Definitions

4.1. Personal data means data relating to a living individual who can be identified from that data (or from that data and other information in possession of WorkJuggle. Personal data can be factual, such as a name, address or date of birth; or it can be an opinion, such as a performance appraisal. In order to be considered personal data the information must have the data subject as its focus and affect the individuals privacy in some way.

4.2. Special Categories of personal data include information about a persons racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health or condition sexual orientation or sexual life, or about the commission of or legal proceedings for any offence. Special categories of data may only be processed for specific, explicit purposes as outlined in this policy. 1

4.3. Processing is any activity that involves use of the data. It includes obtaining, recording or holding the data, or carrying out any operation on the data including organising, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transferring personal data to third parties.

4.4. Data subjects for the purpose of this policy, include all living individuals about whom WorkJuggle holds personal data e.g. an employee or consumer.

5. General Policy & Guidelines

5.1. WorkJuggle processes personal data of its customers and consumers in the management and administration of its business activities and contracts. It also processes employee personal data for employment related purposes that are necessary and relevant for the execution of the employment contract, administration of operations and for the provision of a safe and professional working environment. In processing personal data, WorkJuggle will comply with the following principles:

1. a) WorkJuggle will process data fairly, lawfully (see below) and in a transparent manner.

Unless the term special categories is used specifically in this policy, both personal data and special categories of personal data are referred to as personal data

 b) Data will only be used for the purpose(s) for which it was gathered;   

c)  WorkJuggle will not process more data than is necessary for its lawful purpose;

d) Data will be accurate, complete and up-to-date were necessary;

e) Data will not be retained for longer than is necessary to comply with the purpose(s) for which it was gathered (see Data Retention Policy that accompanies this document);

f) Data will be retained with appropriate security and confidentiality.

5.2. WorkJuggle will only process personal data where it has a lawful basis for doing so:

a) Consent: Where the data subject gives his/her explicit consent to processing the data;

b) Contractual obligation: Where the processing of the data is necessary to fulfil a contract;

c) Compliance with a legal obligation: Where the data is necessary to allow for compliance with law (other than a contract);

d) To protect vital interests: Where the data is necessary to protect the life of an individual;

e) Legitimate interest: Processing is necessary for the legitimate interests pursued by WorkJuggle or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the individual.

5.3. ‘Special Categories’ of personal data will only be processed where at least one of the following circumstances applies:

a) Where the data subject has given explicit consent;

b) Where processing is necessary for employment, social security and social protection law;

c) Where processing is necessary for the vital interest of the data subject and they are incapable of consenting;

d) Where the personal data has been explicitly made public by the data subject;

e) Where processing is necessary for the establishment, exercise or defence of legal claims;

f) Where the processing is necessary for the purposes of preventive or occupational medicine or for the assessment of the working capacity of the employee;

g) Where processing is necessary in the public interest, or as made lawful in European Union or Irish law.

5.4. WorkJuggle may disclose personal data to external recipients such as agents, contractors and other third-party data processors (such as payroll providers and IT providers) where such third parties are retained to provide a service on behalf of WorkJuggle. Prior to the disclosure of personal data to such parties, WorkJuggle will ensure that there is an appropriate written contract with that service provider.

5.5. WorkJuggle will put in place procedures and technologies to maintain the security of all personal data from the point of collection to the point of destruction. WorkJuggle requires that only people who are authorised to use the data can access it.

5.6. WorkJuggle may process personal data through the use of CCTV. Further information on the processing of personal data through CCTV is outlined in WorkJuggle’s CCTV Policy.

5.7. WorkJuggle may use and/or monitor personal data to prevent, detect and investigate fraud, or any other criminal activity and to investigate any actual or alleged improper use of products or services offered by us.

6. Data Access Requests (DARs)

6.1. All data subjects are entitled to make a “subject access request” and in so doing:

a) To be told whether any personal data is being processed;

b) Be given a description of the personal data, the reasons it is being processed, and whether it will be given to any other organisations or people;

c) Be given a copy of the information comprising the data;

d) To correct any inaccuracies; and

e) To request the deletion (erasure) of data. Deletion of data on request applies only to data provided on the basis of consent, and not for legal or contractual obligation.

6.2. In some instances, WorkJuggle does not have to disclose information, or delete as set out above, even if this is requested by the data subject. This is because the Acts allow restrictions on the disclosure of information in certain specified circumstances. For instance, there may be restrictions on the information that can be disclosed where this would involve disclosing information about someone other than the data subject, or during the course of an investigation. While usually no charge may be levied to provide data to the requestor, if the retrieval of the personal data requires any significant work, a reasonable fee may be charged.

6.3. Care will be taken to ensure that if personal data is provided, that this contains no information regarding another individual where their explicit consent to the sharing of their data has not been obtained.

6.4. There is a clear distinction between Data Access Requests (DARs) and general enquiries. A consumer’s request for simple information can be addressed by any authorised employee.

7. Breach

7.1. Where any data is lost, stolen, unlawfully disclosed or compromised, then this will be managed and reported consistent with the Data Breach Procedure accompanying this document.

8. Compliance

8.1. All employees of WorkJuggle, contractors and agency employees must comply with this policy and any other guidelines issued by WorkJuggle regarding the processing of personal data. Failure to do so may lead to disciplinary action up to and including dismissal, depending on the severity of the non-compliance.

9. Questions

9.1. If you have any questions about this policy then please contact [WorkJuggle Manager.]

9.2. Other information can be sought from the Data Protection Commissioner’s website: www.dataprotection.ie

Please note the terms of this policy may be changed from time to time to reflect the requirements of ourselves, our suppliers and partners as well as legal and regulatory changes and you should make sure you keep it under regular review.

APPENDIX 1

Additional Definitions and Definition information

Data is recorded information whether stored electronically, on a computer, or in certain paper- based filing systems.

Data protection principles mean the legal conditions for processing personal data.

Data subjects for the purpose of this policy, include all living individuals about whom WorkJuggle holds personal data. A data subject need not be an EU national or resident. All data subjects have legal rights in relation to their personal information.

Personal data means data relating to a living individual who can be identified from that data (or from that data and other information in possession of WorkJuggle). Personal data can be factual (such as a name, address or date of birth) or it can be an opinion (such as a performance appraisal). It can even include a simple e-mail address. It is important that the information has the data subject as its focus and affects the individuals privacy in some way.

Mere mention of someones name in a document does not constitute personal data, but personal details combined such as for example someones contact details and name, wages/salary would still fall within the scope of the Data Protection Acts 1988 to 2018.

According to the Data Protection Commissioner’s website, Personal data means data that relate to a living individual who can be identified:

(a) from those data, or

(b) from those data and other information that is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual.

It is important to note that, where the ability to identify an individual depends partly on the data held and partly on other information (not necessarily data), the data held will still be “personal data”.

Data controllers are the people or organisations who determine the purposes for which, and the manner in which, any personal data is processed. They have a responsibility to establish practices and policies in line with the Act.

WorkJuggle is the data controller of all personal data used in its business.

Data users include employees whose work involves using personal data. Data users have a duty to protect the information they process by following WorkJuggles data protection and security policies at all times.

Data processors include any person who processes personal data on behalf of a data controller. Employees of data controllers are excluded from this definition but it could include suppliers which process personal data on

WorkJuggles behalf.

Processing is any activity that involves use of the data. It includes obtaining, recording or holding the data, or carrying out any operation or set of operations on the data including organising, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transferring personal data to third parties.

Special Categories of personal data includes information about a persons racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health or condition or sexual life, or about the commission of, or proceedings for, any offence committed or alleged to have been committed by that person, the disposal of such proceedings or the sentence of any court in such proceedings. Special Categories of personal data can only be processed under strict conditions.