Privacy Statement

Privacy Statement

At De Borda Institute we take great care to protect the privacy of users of this consultation platform, OpenConsult,  which we refer to as the (“platform”). We process the data you provide when you engage in pubic consultations to the data controllers of this platform.

This Privacy Statement sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. This include circumstances where you choose to complete a survey. This Privacy Statement also informs you as to our obligations and your rights under data protection law.

Who we are

In this Privacy Statement, the terms “APH”, "we", "our" and "us" are used to refer to Aphelion Limited trading as De Borda Institute, Business Barn, Kellystown Lane, Kellystown, Leixlip, Co. Kildare, company number 518067. 

For the purposes of the EU General Data Protection Regulation (EU Regulation 679/2016) (the “GDPR”), we are the data controller with regard to the personal data described in this Privacy Statement.

“Data controllers” are the people who or organisations which determine the purposes for which, and the manner in which, any personal data is processed, who/which make independent decisions in relation to the personal data and/or who/which otherwise control that personal data. 

In particular, we have appointed a Compliance Officer within APH to monitor compliance with our data protection obligations and with this Privacy Statement and related policies. If you have any questions about this policy or about our data protection compliance, please contact us at the below details.

What personal data do we collect?

“Personal data” means any information relating to an identified or identifiable natural person. Personal data can be factual (for example, a name, address or date of birth) or it can be an opinion about that person, their actions and/or behaviour.

Platforms users:

We will collect and process the following personal data from people using the platform:

• Your email address and name
• Consent to receive emails from subscriptions, notifications and messages from our Platforms including date and time of consent;
• Logging acceptance of this Privacy Statement and other applicable terms and conditions;
• Technical Data which include:
  Usernames and passwords;
  Website security roles to allow you to securely perform some limited functions within the Platforms;
  Tracking codes, such as cookies (please see our Cookie Policy here[HG1] );
  Anonymised Internet Protocol (“IP”) addresses used to connect your computer to the Internet;
  Account creation and last log-in date and time;
  Audit of moderation activity on your submission by the data controller;
  
• Usage Data which include:
  ◦ Submissions of ballots

How we collect your personal data

Platforms users:

You will see that we rely on simple consent as our legal basis for some of the processing we have carried out. You may withdraw consent at any time by contacting us at the below details. 

Withdrawal of consent shall be without effect to the lawfulness of processing based on consent before its withdrawal.

Our Platforms and website use cookies. For detailed information on the cookies we use and the purposes for which we use them, see our Cookie Policy here).

How do we process special categories of personal data?

“Special categories" of particularly sensitive personal data require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal data. We may process special categories of personal data in the following circumstances:

In limited circumstances, with your explicit written consent (this relates to information revealing your political opinions).

Where it is needed for statistical purposes and the purposes of the consultations you take part in where such consultations seek an understanding of a participant's underlying perspective on an issue, subject always to appropriate confidentiality safeguards, (this relates to information revealing your political opinions). We will use information revealing your political opinions to analyse shared social perspectives on the political question set out in the public consultation and to contribute the insights from this analysis to the consultation.

We do not need your consent if we use sensitive personal data in the ways described above. In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data in other ways. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of your contract with us that you agree to any request for consent from us. Where you do consent we will only use that personal data in accordance with the terms of your consent.

How long we hold your data

Your personal data will be deleted after 30 days from the close of a ballot

In determining our retention period for categories of personal data we at all times will consider our obligations under the data protection legislation, guidance from the Data Protection Commission, any other specific legislative requirements as well as the amount and nature of the data itself.

Security of your personal data

The transmission of information via the Internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our website/Platforms; any transmission is at your own risk. Once we have received your information, we will take appropriate security measures against unlawful or unauthorised processing of personal data, and against the accidental loss of, or damage to, personal data.

We have put in place procedures and technologies to maintain the security of all personal data from the point of collection to the point of destruction. Personal data is only transferred to a data processor if they agree to comply with those procedures and policies, or if they put in place adequate measures themselves. In addition, we have appropriate written agreements in place with all of our data processors.

We maintain data security by protecting the confidentiality, integrity and availability of the personal data, defined as follows:

Confidentiality means that only people who are authorised to use the data can access it.

Integrity means that personal data should be accurate and suitable for the purpose for which it is processed.

Availability means that authorised users should be able to access the data if they need it for authorised purposes.

We follow strict security procedures in the storage and disclosure of your personal data, and to protect it against accidental loss, destruction or damage.

Where we have given you (or where you have chosen) a password which enables you to access certain parts of our website/Platforms, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

Transferring personal data out of the European Economic Area

There are circumstances in which we may have to transfer your personal data out of the European Economic Area for the purposes of carrying out the services we provide to you, for example for development, software testing purposes or the provision of third-party services. Where the need for such a transfer arises we will always ensure that there are appropriate safeguards in place to protect your personal data such as:

the European Commission has issued a decision confirming that the country to which we transfer the personal data ensures an adequate level of protection for the data subjects' rights and freedoms;

appropriate safeguards are in place such as binding corporate rules (“BCR”), standard contractual clauses approved by the European Commission, an approved code of conduct or a certification mechanism, a copy of which can be obtained from us on request;

you have provided explicit consent to the proposed transfer after being informed of any potential risks; or

the personal data is being transferred to a company in the US which has self-certified its compliance with the EU-US Privacy Shield which has been found by the European Commission to provide an adequate level of protection to the personal data of EU citizens.

Do we share your personal data with anyone else?

We may share your personal data with the following third parties who may occasionally have access to areas of the website/Platforms where your data is stored for the purposes of providing survey services, Platforms services, development, testing and fixing of the Platforms:

Third party survey software providers;

Or as may otherwise arise in the course of our providing of services to you.

We may also share your personal data with the following third parties when conducting survey(s)/public consultation(s) and prize draw(s):

The entity/organisation on behalf of which we are conducting the survey(s)/public consultation(s) and prize draw(s). Please note that personal data revealing your personal opinions might be made public by the entity/organisation on behalf of which the survey/public consultation was conducted; and

Other participants in the prize draw(s) (subject to the provisions of any terms and conditions applicable to the prize draw(s)). Personal data revealing your personal opinions will never be shared with other participants in the survey(s) and/or prize draw(s).

We require all third parties to enter into a data processing agreement with us which complies with our obligations under the GDPR. This agreement requires third parties to have appropriate security systems in place and only to use your personal data on our instructions and in accordance with data protection law. 

We may pass on your details if we are under a duty to disclose or share a data subject's personal data in order to comply with any legal obligation, or in order to enforce or apply any contract with the data subject or other agreements; or to protect our rights, property, or safety of our employees, customers, or others. This includes reporting information about incidents (as appropriate) to the Gardaí and responding to any requirements from the Gardaí to provide information and/or personal data to them for the purposes of them detecting, investigating and/or prosecuting offences or in connection with crime sentencing.

We need to demonstrate accountability for our data protection obligations. This means that we must be able to show how we comply with the data protection rules, and that we have in fact complied with the rules. We do this, among other ways, by our written policies and procedures, by building data protection compliance into our systems and business rules, by internally monitoring our data protection compliance and keeping it under review, and by taking action if our employees or contractors fail to follow the rules. We also have certain obligations in relation to keeping records about our data processing. These record-keeping obligations are under the responsibility of our Compliance Officer.

Automated decision-making

We do not use your personal data to undertake any automated decision-making.

Cookies

For more information on how we use cookies, please see our Cookie Policy here .

Your data protection rights

You have certain rights in relation to your personal information that is processed by us. These rights are listed below. These rights are not absolute and apply subject to certain conditions. Under certain circumstances, by law you have the right to:

Request information about whether we hold personal information about you, and, if so, what that information is and why we are holding/using it;

Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it;

Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected;

Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below);

Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it;

Request transfer of your personal information in an electronic and structured form to you or to another party (commonly known as a right to “data portability”). This enables you to take your data from us in an electronically useable format and to be able to transfer your data to another party in an electronically useable format;

Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes;

Object to automated decision-making including profiling, that is not to be the subject of any automated decision-making by us using your personal information or profiling of you. We do not engage in any automated decision making; and

Withdraw your consent, where we are relying on it to use your personal data.

Some of these rights can be exercised directly on the Platforms via your Personal Account page; My Submissions Page; Manage Consent page; and by checking certain boxes on the consent forms we use when collecting your personal information. These facilitate you keeping your personal details up to date and prevent certain types of processing. 

Otherwise, your rights can be exercised by contacting us at the below details.

With regard to communications, if at any point you wish to review or change your preferences, you can use the ‘opt-out’ or 'unsubscribe' mechanism or other means provided within the communications that you receive from us or by sending an email to pemerson@deborda.org.

In the event that you wish to make a complaint about how your personal data is being processed by us, or how your complaint has been handled, you have the right to lodge a complaint directly with the supervisory authority who can be contacted as follows:

Contact us

You can contact us regarding any queries, complaints or requests to exercise your data protection rights using the details below:

Changes to this policy

We reserve the right to modify this Privacy Statement at any stage. If and when we make changes to our Privacy Statement, any changes will be posted on our website and will be effective when posted. Please continue to check this page to ensure that you are always aware of any changes.