This Visitor Data Protection Notice is issued by Science Foundation Ireland (“SFI”, “we”, “our” or “us”).
The purpose of this notice is to provide you with details of the uses we make of information we collect from you in connection with the COVID-19 pandemic and to provide you with comfort that any information which you provide to us will be kept confidential and in full compliance with applicable data protection law including the General Data Protection Regulation and the Data Protection Act 2018 (“Data Protection Law”).
Please rest assured that we take our confidentiality obligations and our responsibilities under Data Protection Law very seriously.
1. What information do we collect?
Prior to visiting SFI’s offices, you will be asked to complete a COVID-19 Visitor questionnaire (the “Visitor Questionnaire”).
This will involve providing us with your name, mobile number, the name of your company, the SFI staff member that you are visiting and the date of the visit. In addition, you will also be asked to answer certain questions in relation to COVID-19, including whether you have any symptoms, or have been diagnosed with, COVID-19 or whether you have been advised by a doctor to self-isolate or cocoon etc.
2. Purpose of processing and legal bases
The personal data that you provide to us in the Visitor Questionnaire will be used by us (i) to determine whether you are permitted to visit our offices, (ii) to help us to track and address any potential exposure to COVID-19 among our visitors and employees and (iii) to help to maintain the health of our employees and visitors and the safety of our work place.
The legal bases on which we collect, process and transfer your information in the manner described above are as follows:
(a) where the processing is necessary to comply with our legal and regulatory obligations in connection with health and safety (including our obligations under the Safety, Health and Welfare at Work Act 2005); and
(b) where the processing is necessary for the performance of tasks which we carry out in the public interest or in the exercise of official authority vested in SFI.
As the personal data which you provide to us in the Visitor Questionnaire may include health data, which is a special category of data under Data Protection Law, the legal bases on which we collect and process such health data in the manner described above are as follows:
(a) where such processing is necessary to comply with our obligations or exercise our rights under employment and social security and social protection law (including the Safety, Health and Welfare at Work Act 2005); and
(b) where such processing is required for reasons of public interest in the area of public health, including protecting against serious cross border threats to health.
3. Recipients of data
Subject to compliance with confidentiality requirements, and only where strictly necessary, we may disclose your personal data to our third party service providers (e.g. our legal advisors in respect of a claim that is made against us). We may also disclose your personal data to competent regulatory authorities and other bodies as requested or required by law.
We will retain your personal data for so long as is reasonably necessary, including to comply with our obligations under applicable law and, if relevant, to deal with any claim or dispute that might arise.
In the case of data collected via the Visitor Questionnaire, we expect to retain this data for only 28 days, following which the data is then deleted.
5. Necessity of provision of certain information and consequences
6. Your rights and how to update your information
You have the following rights, in certain circumstances and subject to certain restrictions, in relation to your personal data:
(a) the right to access your personal data;
(b) the right to request the rectification and/or erasure of your personal data;
(c) the right to restrict the use of your personal data;
(d) the right to object to the processing of your personal data, where we are processing it based on this being necessary for the purposes of our, or of a third party’s legitimate interests;
(e) the right to receive your personal data, which you provided to us, in a structured, commonly used and machine-readable format or to require us to transmit that data to another controller, where we are processing the data based on your consent of that this is necessary for the performance of a contract with you.
In order to exercise any of the rights set out above, please contact us at firstname.lastname@example.org.