Legal basis for processing

We process your personal data based on the following lawful basis:

(1) Consent: We will only process your data for marketing purposes with your consent. For processing activities for which we rely on consent as a basis for processing, you have the right to withdraw that consent at any time.

(2) Contract: We may process the data you provide while fulfilling our obligations under a contract e.g. during the provision of training services to you.

(3) Statutory: Some processing activities are required by law e.g. Revenue reporting.
For processing activities that are based on a statutory or contractual requirement, you may request your data not be processed for that purpose. However, this is not an absolute right and may be over-ridden by our statutory obligations. In other cases, requesting that data should not be processed for a particular purpose may prevent us from executing a contract or delivering a service to you.

Your rights

Under data protection law, data subjects have certain rights. Subject to certain restrictions, which are set out below, you can exercise these rights in relation to your personal data we process.

1. The right to be informed about the processing of your personal data
2. The right to access your personal data
3. The right to rectification of your personal data
4. The right to erasure of your personal data
5. The right to data portability
6. The right to object to processing of your personal data
7. The right to restrict processing of your personal data
8. Rights in relation to automated decision making, including profiling
9. You have the right to complain to the Irish Data Protection Commission (www.dataprotection.ie) and to seek compensation through the courts

Restriction of data subject rights in certain circumstances

Article 23 of the GDPR allows for data subject rights to be restricted in certain circumstances. In addition, the 2018 Act contains certain provisions dealing with the restriction of rights of data subjects, in particular Sections 59, 60 and 61, which give further effect to the provisions of Article 23. Further information can be found here.

Who we share your information with

We do not share your information with third parties other than those set out in this policy. We may share your information in the following circumstances:

• Service providers: We may need to share personal information with our service providers, such as where necessary to provide our services to you. If there has been a breach of our terms of use, we may also share personal information with our legal advisors. All of our service providers will be obliged to keep your personal information safe and secure.
• Positive2Work is a data processor for Skillnet Ireland with whom it has a Data Processing Agreement which dictates how, when and where trainee data can be processed.
• We will share your course bookings with our trainers (service providers) and Skillnet Ireland (our funder and data controller)
• Business Transfer: Where some or all of our company and/or its assets may potentially be or have been acquired, we may need to transfer your personal information to the new or prospective owners.
• Legal and safety: In certain instances, we may share information where we reasonably believe that it is necessary for legal reasons, to defend our legal rights, to enforce our terms of use or to protect our rights, property, users, customers or the safety of any person. For example, we may provide personal information where ordered by a court to do so.
• Other: We will share your information with a third party other than a service provider where you have given your consent for us to do so.

Where we store personal information

We generally store personal information on servers located inside the European Economic Area. However, in certain cases it may be necessary for us to transfer certain information to servers located outside of the EU. It is important to be aware that the privacy protections in certain jurisdictions may not be equivalent to those in Europe but we will only transfer your information outside the EEA where permitted by law and ensuring that it is subject to appropriate protections.

Data Retention

Positive2Work Skillnet retains personal data for a range of periods as set out in our Data Protection Policy.