Contents

Introduction

1.      Why EO process personal information and an overview of the legal basis for processing personal information;

2.      How you, a data subject, can execute your rights under existing data protection legislation;

3.       Who we share your personal information with;

4.      Transferring personal information outside of the EEA;

5.      How long EO will keep your personal information

6.      How to raise a complaint

7.      Cookies

1. Introduction

 

EO is committed to protecting your privacy rights in relation to the processing of personal information both in electronic and paper format and take our obligations with regards to the protection of personal information entrusted to us very seriously. EO has a Data Protection Officer who can advise you on any queries you have in relation to this privacy statement or the rights afforded to you under the applicable data protection law such as the General Data Protection Regulation (“GDPR”). The EO Data Protection Office can be contacted at childrensofficer.erinsown.cork@camogie.ie

The information below is intended to inform you how your personal information will be used, by whom, for what purposes and explains your data protection rights.

EO is the data controller for the majority of processing activities however there will be circumstances where EO will act as joint controller alongside the GAA.

1.      Why EO processes personal information and an overview of the legal basis for processing personal information

EO will process personal information in a way compatible with your interaction and involvement with the organisation and this will vary depending on whether you are for example a player, coach match official, club member, attendee at matches, camps or other events or a visitor to our club, website of social media channels

To ensure personal information is processed lawfully we identify and apply the most appropriate lawful basis. The six lawful basis are:

. Legal obligation for example to comply with the National Vetting Bureau (Children & Vulnerable Persons) Acts 2012 – 2016 or to comply with instruction from regulatory bodies such as the Data Protection Commission/ICO or law enforcement such as An Garda Siochana

. For the performance of a contract: for example where you apply for membership with the club or purchase a ticket for a match

. Legitimate Interest such legitimate interest includes to process personal information for operational or organisational purposes. In order to rely on this lawful basis a balancing exercise will be completed to assess and demonstrate that such processing does not negatively impact your, the data subjects, fundamental right to privacy.

. Consent: by obtaining your demonstrable consent for example by a written statement or ticking a box. Where a child is below the age of 16, adequate consent can only be provided by the parent/guardian of that child.

. Vital Interest: the processing is necessary to protect you or a third parties life/welfare or to mitigate against a potential risk/threat/harm to an individual. Processing of personal data based on the vital interest of another natural person should in principle take place only where the processing cannot be manifestly based on another legal basis.

. Public interest the processing is necessary to complete a task which is carried out in the public interest (eg notification in relation to the outbreak of disease).

Outlined below is why EO will process your personal information along with the relevant legal basis:

 

Outlined below is why the GAA will process your personal information along with the relevant legal basis. 

Name, date of birth, contact information, player/membership status is processed as it is necessary in order to register and administer your membership with your club. Performance of a contract

Where the registration is for a person under the age of 16, EO will rely on consent from the persons parent or guardian in order to process their personal information.

Name, player/membership status, team name, information relating to conduct and play is processed for the purpose of team sheets, referee reports, disciplinary matters, sanctions and permits. Performance of a Contract

Name and contact information is processed in order to facilitate ticket sales. Performance of a Contract Contact information is processed to keep you informed of EO events and fundraisers. Consent

Where CCTV is in place in and around EO for security and health and safety purposes. The use of CCTV is indicated by signage on the grounds. Legitimate Interest

Contact information and any other personal information you choose to disclose is processed to respond to any queries or complaints you may have. Performance of a Contract 

Personal information is processed to perform data analytics and statistical analysis to allow the EO to understand and to support club, county and provincial needs. Aggregate reports are used for this purpose where individuals are not identifiable. Legitimate Interest 

Contact information is processed to book attendance to  purchase tickets to special events e.g. Cul Camps, Easter, Halloween events etc. Performance of a Contract

Outlined below is why the GAA will process your personal information along with the relevant legal basis.

 We will process your personal information, where you choose to upload a photo or another image of your likeness to your Foireann profile. In order to do this, we may request access to your device’s camera or photo library to enable image capture or selection. All collected images are stored securely and treated with the utmost confidentiality. We implement industry-standard security measures to protect against unauthorized access, disclosure, alteration, or destruction of your images. Consent

Player/match official/team management name, contact information, medical data, and loss of wages data (if applicable) is processed to administer injury claims through the GAA Injury Benefit Fund and to record injuries. Consent

Player name, address history (previous and current), contact information, membership ID and club details are processed in order to administer a transfer request and in order to become a member of the Association in general. Performance of a Contract

Player health data to include cardiac health and concussion data is processed for player welfare and wellbeing. Vital Interests

Referee name, contact information, health data will be processed for health screening services. Consent

Education and training information of individuals, for example players, match officials, coaches and those involved in the running of their club/county team is processed to track completion and retained on the GAA’s Learning Management System. Legitimate Interest

EO may utilise GPS wearables for players which collect raw data to estimate certain metrics to include: Total Distance, High Metabolic Load Distance, High Speed Running, Maximum Heart Rate. Explicit Consent

Name, contact information and detail of concern/complaint is processed to comply with the mandatory Safeguarding of Children obligations. Legal Obligation

Education and training data is processed to keep record of learning qualifications such as safeguard training, vetting status or accreditation. Legal Obligation

The personal information you provide when you enter a competition through any of our social media channels is processed and assessed by us to fulfil that purpose. Consent

 Social media profile/handle will be processed when you engage with an EO social media channel. Contract Execution

The GDPR affords a number of rights to individuals and these rights allow you to exercise meaningful control over the way in which you personal information is processed. These rights may be executed free of charge,. In certain exceptional circumstances a reasonable fee may be charged, or EO may refuse to act on the request

Once your identity has been verified EO will begin the process of responding to your request without delay and within 30 calendar days of receipt of the request.

These periods may be extended in exceptional circumstances and we will inform you where the extended period applies to you along with an explanation of the reasons for the extension.

The GDPR allows for the following Rights under Chapter III:

A) Access to your personal information: This Right allows you to request and obtain a copy of the personal information also known as a Data Subject Access Request (“DSAR”) , EO process about you as well as other supplementary information such as:

- the purposes of processing

The categories of personal information concerned;

The recipients of your personal information

The period for which your personal information will be stored

The existence of your right to lodge a complaint to the Data Protection Commission

The source of your personal information

B) Correct your personal information: This right allows you to correct/rectify inaccurate personal information concerning you or instruct completion of incomplete personal information taking into account the purposes of the processing.

C) Restrict your personal information: This right allows you to request the restriction of your personal information in certain circumstances. This includes if you dispute the accuracy of information held, you can request that we restrict processing this information while your complaint is being examined or where we no longer need your personal information for the purposes of processing but you require the data in relation to a legal claim

D)Delete your personal information: This right allows you to request deletion of your personal information in certain circumstances such as the personal information is no longer needed in relation to the purposes for which it was initially collected or the personal information has been unlawfully collected and processed.

We are  not under any obligation to rectify or delete your personal information where to do so would:

Prevent us from meeting our contractual obligations to you or

Where EO is required or permitted to process your personal information for legal purposes or otherwise in accordance with our legal obligations

E) Request your personal information is transferred (Or ported) electronically: This right allows you to request we provide you with your personal information in a structured, commonly used and machine-readable format.

The individual may also request this data is transferred from one data controller (such as EO) to another. This right is restricted to where we process personal information under the lawful basis of consent or contract execution only.

F) withdraw your consent: where your personal information is processed based on the law basis of consent, you may invoke your right to withdraw this consent at any time. Withdrawing our consent will not effect the lawfulness of the personal information processed prior to consent withdrawal.

G) Object to your personal information being used for certain purposes: This right allows you to raise an objection if you disagree with the way in which EO processes personal information. This right is restricted to where we rely on legitimate interest as the lawful basis to perform such processing. Upon receipt of an objection EO will assess the nature of the objection and whether we can demonstrate our legitimate interest to proceed with the processing.

 

Access to you personal information within EO is restricted to those who need it for a specific purpose, relevant to the performance of their duties in the organisation. EO also sometimes uses third parties who provide important functions and based on our instruction. We will at all time s ensure appropriate security and confidentiality measures are in place prior to exchanging any personal information with third parties. An example of such third parties includes service providers who:

. assist in the management of membership, registration and administer player transfers;

. provide IT security, hosting, ticket sales and system administration services;

. provide registration services capture expression of interest for GAA events;

. provide EO with performance management services and platforms to contact volunteers;

. send EO communications to include marketing (where consent is provided) and service messages;

. provide customer management services and databases;

. facilitate the payment of expenses;

.conduct research on behalf of the GAA;

. provide professional services such as legal, health screening, research, call centre, insurance, payroll services.

Our website may include links to third party websites and applications. By clicking on those links or enabling those connections, it may allow third parties to collect or share data about you. EO do not control these third-party websites and are not responsible for their privacy practices.

As noted above, EO uses a number of third party service providers and some of these may be based outside the EEA. The EEA includes all member states of the EU with the addition of Iceland, Lichtenstein and Norway. Where we process/transfer personal information outside the EEA, we will ensure measures are implemented to ensure all personal data is protected. These measures will include the following data transfer mechanisms:

.that country provides an adequate level of protection for personal information as set down by the European Commission; or

. the transfer is made under a legally binding agreement which covers EU requirements for the transfer of personal information to data processors outside of the EEA such as the model contractual clauses approved by the European Commission; or

. Binding Corporate Rules; or

. Such other approved mechanism or model approved by the European Commission.

The length of time EO retains y our personal information depends on the nature and purpose of the data being processed. For example, we will retain your personal information to provide you with a product or service you requested, to comply with a legal obligation or statutory order or to protect enforce and defend our rights and property.

In certain circumstances your personal information may be retained for longer than your relationship with EO. This may be as there is an ongoing claim or EO are obliged to retain the data following receipt of a statutory order.

Where EO no longer needs your personal information and the retention period has passed, the personal information will be deleted or anonymised which means that your personal information is stripped of all identifying characteristics.

If you do not EO processed your personal information in line with this Privacy Statement, please contact us in the first instance at childrensofficer.erinsown.cork@camogie.ie

As is your right and where you are dissatisfied with any aspect of EO processing of your personal information, you may make a complaint to the Data Protection Commission

Address: 21 Fitzwilliam Square North, Dublin 2, D02 RD28

Phone: +353 57 868 4800

Email: info@dataprotection.ie

Website: www.dataprotection.ie

7. Cookies information may be sent to your computer in the form of an internet “cookie” to allow EO servers to monitor your requirements. The cookie is stored on your computer. The EO server may request that your computer return a cookie to it.

 

8. Current agreed retention periods:

Physical documentation regarding Vetting Application – maximum of 6 months. This is destroyed confidentially every July and January. 

Foireann will process the relevant information in line with vetting requirements and on a legal basis.

Membership information will be retained for as long as membership subsists

Transfer/resigned membership information will be retained for a period of 6 years and following this will be expunged