1  General

Covalen is committed to protecting all personal and social categories of data held on you.

As such, Covalen wants you, the ‘data subject’, to understand how Covalen collects, uses, stores, and shares your personal data. Covalen also wants you understand what rights you can invoke to help you to protect your privacy. In this regard, it is important that you read this Privacy Notice and understand how Covalen uses your personal data. Please note Covalen reserves the right to update this Privacy Notice as required. The most recent version of this document can be found on Covalen’s website through the following link: https://covalensolutions.com/terms-conditions

1.1  Covalen Information

Covalen specialises in the provision of managed staffing, managed services, business process outsourcing and consulting and solution design services in the technology, financial services and utilities sector. Covalen is a subsidiary of the Cpl Group. If you wish to locate further information on Covalen, you can find this on the Covalen website through the following link: https://covalensolutions.com/our-company/about-us

1.2  Legislation

All personal data processed by Covalen is done so in accordance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

1.3  Queries and Complaints

If you are unhappy with the way Covalen handles your personal data and wish to complain, or if you simply want further information about the way your personal data will be used, please contact Covalen at the below:

Data Protection Officer

One Haddington Buildings,

Haddington Road,

Dublin 4,

Ireland

D04 X4C9

Telephone: +353 1 255 2090

Email: dataprivacy@cpl.com

You have the right to lodge a complaint with the Data Protection Commission. To contact the Data Protection Commission, please use the following details:

Data Protection Commission

21 Fitzwilliam Square South

Dublin 2

D02 RD28

Ireland

Telephone: +353 (0)761 104 800

Telephone: +353 (0)57 868 4800

Email: info@dataprotection.ie

 

1.4 Breaches

Covalen will take all appropriate technical and organisational steps to safeguard your personal data. In the unlikely event of a data breach, Covalen will contact you in line with Covalen’s legal obligations.

 

2  How Does Covalen Collect Information?

Covalen collects personal data to enable the provision of services to support Covalen’s purpose. The following non-exhaustive methods of data collection are an indication of ways in which Covalen may obtain your information:

• Obtain personal data directly from you;
• Personal data that Covalen receives from other sources; and
• When entering Covalen’s premises, your data will be recorded in the Visitor Sign In tablet/book for security purposes.

It is important that the personal data you provide Covalen is up to date and accurate. As outlined in Section 7.4 of this notice, if personal data Covalen holds on you is inaccurate or incomplete, please contact Covalen and Covalen will update the information.

 

3  What Does Covalen Use Information For?

3.1 Process, Purpose, and Lawful Basis

Covalen uses personal data collected to fulfil Covalen’s obligations to provide Training & Consultancy services and to enable the provision of services to support Covalen’s purpose.

Covalen uses personal data for any of the following purposes:

 

Process	Purpose	Lawful Basis
Pre-Recruitment	To register a prospective data subject’s interest in recruitment for employment.	Processing is necessary in order to take steps at the request of the data subject prior to entering into a contract. The processing is necessary for the exercise of rights and obligations under employment law.
Background Checks	To verify if the data subject is qualified and eligible for certain positions within Covalen.	Processing is necessary for compliance with a legal obligation to which Covalen is subject.
Recruitment and Selection	To complete the recruitment process and assess data subject suitability.	Processing is necessary in order to take steps at the request of the data subject prior to entering into a contract. Processing relates to Covalen’s obligations in employment and for assessing data subject’s work capacity.
Pension	To administer data subjects pension entitlements and to comply with pension rules.	To comply with various pension laws. Processing is necessary for the performance of a contract to which the data subject is party.
Payroll	To enable Covalen to effect payment to its data subjects.	Processing is necessary for the performance of a contract to which the data subject is party.
Personnel File	To comply with employment and revenue laws and to ensure that terms and conditions of employment are adhered to.	Processing is necessary for the performance of a contract to which the data subject is party. To comply with various employment and revenue laws. To protect the vital interests of the data subject in the event of an accident or emergency.
Entitlement to Work	To enable Covalen to achieve compliance with its obligations pursuant to any local legislation governing the entitlement to work.	Processing is necessary for compliance with a legal obligation to which Covalen is subject.
Time and Attendance Records	To enable the data subject to avail of their rights and entitlement pursuant to the Organisation of Working Time Act 1997.	The processing is necessary for the performance of contract to which the data subject is party.
Statutory Entitlement	To enable Covalen to achieve compliance with: Its obligation to the data subject; Record keeping obligations pursuant to a variety of employment law statutes.	The processing is necessary for compliance with legal obligation to which Covalen is subject.
Training Records	To ensure that Covalen is in a position to assess the data subject’s training needs and to capture proof of training.	The processing is necessary for the performance of contract to which the data subject is party.
Performance Details	To manage the data subject’s performance in accordance with relevant Covalen policies.	The processing is necessary for the performance of contract to which the data subject is party.
Grievance and Disciplinary	To ensure the data subject’s complaints are fairly investigated in accordance with Covalen policies.	To comply with Covalen legal obligation to apply fair procedures to any data subject’s investigation. The processing is necessary for the performance of contract to which the data subject is party.
Medical Information	To manage the data subject’s absences, to manage sick pay in accordance with the contract of employment, and to manage the fitness to work of data subjects.	Processing is necessary to assess, subject to data subject safeguards, the working capacity of the data subject. To carry out obligations and exercise rights under employment law.
Making or Receiving Payments	To make or receive any payments in the discharge of normal business functions, dispute settlement, or to carry out any other payment requirements.	Processing is necessary for compliance with various employment and revenue laws.   The processing is necessary for the performance of contract to which the data subject is party.
Wellbeing Survey	To ensure the provision of a service that supports employees in need (i.e. provision of health coaches to support individuals/groups), Also, to work with training team to support in delivering program in a way to supports individuals’ wellbeing.	Processing is based on request of consent which will be taken from the data subject.
Voice of the Customer	To obtain the data subject’s feedback by survey on the Covalen client services, recruitment processes and for research purposes.	Processing is based on request of consent which will be taken from the data subject.
Attracting Talent	To provide support and assistance on recruitment services to data subjects via third party sources, such as LinkedIn and other job sites, from which Covalen obtain personal data.	Processing is based on legitimate interest.
Supporting Talent	To support data subjects in their career guidance and communicate with them directly with useful information, advice, and support materials through email, messaging, or mobile/web notification.	Processing is based on legitimate interests and contractual obligations.
Campaign Images	To obtain the data subject’s photos which are used externally (e.g. Covalen’s website, on social media or even in marketing) for campaign.	Processing is based on request of consent which will be taken from the data subject.
Regulatory Compliance	To comply with financial regulations and any other relevant laws and regulations.	Processing is necessary for compliance with a legal obligation to which Covalen is subject.   Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
Third Party Data Sharing	To allow Covalen to conduct and carry out functions with third party service providers that enable Covalen to deliver services.	Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
Back-ups	To store personal data and make back-ups of that data in case of emergencies and for disaster recovery purposes.	Processing is necessary for compliance with a legal obligation to which Covalen is subject.
Evidence Submissions	To gather information for dispute resolution services and legal proceedings.	Processing is necessary for compliance with a legal obligation to which Covalen is subject.
Transfer of Information for Parties Legal Proceedings	To allow parties to commence legal proceedings.	Processing is necessary for compliance with a legal obligation to which Covalen is subject.
Visitor Logs	For the security, health, and safety of individuals on Covalen premises.	Processing is based on legitimate interest and is necessary for compliance with a legal obligation to which the Covalen is subject.
Accidents and Incidents	To enable Covalen to comply with data subject record keeping obligation pursuant to the Safety, Health, and Welfare Act 2005.	Processing is necessary for compliance with a legal obligation to which Covalen is subject.
B2B Marketing	To provide you with marketing communication	Processing is based on legitimate interests

3.2 Marketing

For marketing purposes, we may reach out to you about our services via email, SMS and phone.

We process information you give to us and information we receive about you from other third-party sources such as event companies and LinkedIn;

• To provide you with the information about services that we offer which are similar to those that you have already purchased or enquired about
• For occasional market research and statistical purposes. You may ‘opt out’ of participating in such market research at any time.

Where we rely on consent for marketing purposes, consent will always be provided in the form of a clear opt-in. You have the right to withdraw your consent at any time using the unsubscribe link on emails/ text messages, alternatively you can contact us using the contact details listed in this Privacy Notice to opt-out of future marketing communications from Covalen.

Where we rely on Legitimate Interest (to develop and grow our business) to communicate with you for marketing purposes. We will always provide you with an option to opt-out at the point of data collection and within each communication thereafter. Additionally, you can use the contact details listed in this Privacy Notice to opt-out of receiving future marketing communications.

4  Who Does Covalen Share Information With?

Covalen may share personal data with other parties in the course of Covalen’s duties. When this is done, Covalen adheres to the following principles:

• The transfer is based on a legal obligation, the performance of a contract, or explicit consent.
• Where data is transferred to another party, Covalen ensures appropriate technical and organisational safeguards are used to protect your personal data.
• Where Covalen engages a third party to provide a service to Covalen, Covalen ensures the provider has taken appropriate technical and organisational measures to process, store, and safeguard your personal data.
• Covalen, as a Data Controller, will not sell your data to any third party and will take all appropriate steps to ensure the security of your data in dealings with third parties.

While the parties Covalen engage may change occasionally, Covalen believe it is important you are aware of the types of parties Covalen shares data with. The categories and types of third parties outlined below is a non-exhaustive list but provides an indication of the parties Covalen shares data with.

4.1 Other Third Parties

Third parties for the purposes of internal and external audits, carrying out research, general practitioners, and or third parties who may improve Covalen’s processes and services (such as consultants).

4.2 Government Departments, Bodies or Agencies

Covalen is legally obligated to share personal data with state actors which is outlined in the Data Protection Act 2018.

Recipients of this data include Government departments, agencies, bodies, investigatory bodies, local authorities, and the Gardaí.

4.3 International Transfers

Where personal data is transferred outside the European Economic Area, Covalen use safeguards known as Standard Contractual Clauses (SCCs).

5  What Type of Information is Collected?

To fulfil Covalen’s mandate and perform tasks as outlined in this statement, Covalen needs to collect various types of personal data.

While the type of personal data may change occasionally, Covalen believes it is important you are aware of the types of data Covalen gathers and uses. The following table is a non-exhaustive list and provides an indication of the categories and types of data Covalen uses to perform Covalen’s tasks.

Please note that information listed under one category may be used for the performance of a task or in relation to activities under another heading or as outlined under Section 3.
 

Category	Type of Data
Candidates	Full name, date of birth, address, personal email address, telephone numbers, cover letters, resume, PPS number, identity card details, work experience, qualifications, education, annual membership details, skills, referee contact details, interview notes, references. Special data such as work eligibility details, GNIB card, passport details, Criminal background check details such as criminal and financial records, technical test results, resiliency scores, psychometric test results, language assessment results, Garda Vetting documentation,
Employees	Full name, date of birth, residential and home addresses, personal email addresses, telephone numbers, cover letters, resume, PPS numbers, work experience, qualifications, annual membership details, education, skills, referee contact details, work eligibility, interview notes, photos and videos, emergency contact names, addresses and telephone numbers, salary increase letters, employee ID, disciplinary minutes of meetings and letters, probation assessment details, 1:1 minutes of meetings, wellness meeting details, start date, finish date, expenses, training records, bank details, pension details, pay details, ergonomic assessments, occupational health assessment details, working from home self-assessment details, time and attendance records, contracts of employment, contract amendment letters, performance and conduct records, redeployment details, and redundancy payment details. Special data such as social security card details, health insurance, back to work form details detailing reason for absence, leave type and date details, accidents/incident reports, information on resiliency and wellbeing, medical conditions and disabilities, medical certificates and details, work eligibility documents such as GNIB, passport details Criminal background check details
Other Stakeholders	Contact details, first name, surname, tax details

6  How Long Does Covalen Retain Information?

Covalen has developed a record retention schedule for all the personal data Covalen holds. Each retention period varies dependent on the nature and the purpose of the processing.

The main factors which determine retention periods are as follows:

1. How long it is required to perform the task;
2. Any legal requirements to hold onto the data;
3. Any pending legal actions.

If you would like to see a copy of the Retention Policy, please contact the DPO at dataprivacy@cpl.com

7  What Are Your Rights?

As a data subject, you will have the following rights as outlined in this section 7. However, restrictions may apply in certain situations.

7.1 Where do I send requests?

Please send all your requests to the contact details provided in Section 1, with as much detail as possible about your requirements to allow Covalen to deal with your request efficiently. To answer your request, Covalen may ask you to provide identification for verification purposes.

7.2 How long will a request take?

Upon receipt of a request, Covalen will have 30 days to provide an answer with an extension of two further months if required. If Covalen requires more time to deal with your request, Covalen will notify you of the delay and the reasons behind it within 30 days of the receipt of the request. If Covalen refuses your request, Covalen will also notify you within 30 days of the receipt of the request accompanied by the reasons for the refusal.

Covalen will not charge a fee for any requests, provided Covalen does not consider them to be unjustified or excessive. If Covalen considers these to be unjustified or excessive, Covalen may charge a reasonable fee (also applicable for multiple copies) or refuse the request.

You are entitled to contact the Data Protection Commission if Covalen refuses your request.

7.3 Right of Access

You have a right to know what personal data Covalen hold on you, why Covalen holds the data, and how Covalen is processing your personal data.

When submitting your request, please provide Covalen with information to help verify your identity and as much detail as possible to help Covalen understand the information you wish to access (i.e. date range, subject of the request) and email dataprivacy@cpl.com

Please note that an access request is free of charge, however, where Covalen determines a request to be unjustified or excessive, Covalen may charge you a reasonable fee.

7.4 Right to Rectification

You have a right to request that Covalen information held on you is up to date and accurate.

Where information is inaccurate or incomplete, Covalen encourage you to contact Covalen to have this information rectified. Upon receipt of request, Covalen will ensure that the personal data is rectified and as up to date as is reasonably possible.

7.5 Right to be Forgotten

You have the right to seek the erasure of your personal data in the following circumstances:

• The personal data is no longer required for the purposes for which is was obtained;
• Where data is being processed on the basis of consent, you withdraw consent to the processing and no other lawful basis exists;
• The personal data is being unlawfully processed;
• You object to the processing of personal data and there are no overriding legitimate grounds for the processing;
• Your personal data requires deletion in line with legal requirements.

However, Covalen will be unable to fulfil an erasure request if the processing of personal data is necessary for the following:

• Exercising the right of freedom of expression and information;
• Compliance with a legal obligation or for the performance of a task carried out in public interest;
• Reasons of public interest in the area of public health;
• Archiving or statistical purposes in the public interest;
• The establishment, exercise, or defence of legal claims;

Please note that the where the legal basis for Covalen’s processing of personal data is on the basis of a legal obligation, some processing in relation to your data may not be subject to the right to erasure.

To determine your request for erasure, Covalen will carry out an assessment of the justification for the retaining your personal data where a legal requirement applies and contact you if Covalen is unable to fulfil your request.

Please be aware that in some circumstances Covalen may need to retain some information to ensure all your preferences are properly respected. For example, Covalen cannot erase all information about you where you have also asked Covalen not to send you marketing material. Otherwise, Covalen would delete your preference not to receive marketing material.

7.6 Right to Restriction

You have the right to restrict the extent of personal data processed by Covalen in circumstances where:

• You believe the personal data is not accurate (restriction period will exist until Covalen updates your information);
• The processing of the personal data is unlawful, but you wish to restrict the processing of data rather than erase it;
• Where the personal data is no longer required by Covalen, but you require retention of the information for the establishment, exercise, or defence of a legal claim;
• You have a pending objection to the processing of the personal data;

When processing is restricted, your personal data will only be processed: with your consent; for the establishment, exercise or defence of legal claims; for the protection of the rights of other people; or for reasons important to public interest.

Covalen will contact you confirm where the request for restriction is fulfilled and will only lift the restriction after Covalen has informed you that Covalen is doing so.

7.7 Right to Data Portability

You have the right to the provision of all personal data held in relation to you in a structured, commonly used and machine-readable format where:

• Processing is completed on the basis a contract;
• Processing is completed based on consent by the you;
• Processing is carried out by automated means.

You may also request that Covalen sends this personal data to another data controller where technically feasible.

7.8 Right to Object

You have the right to object to the processing of your personal data; however, the processing must have been undertaken on the basis of public interest or legitimate interest by Covalen.

If you wish to object to the processing of data, please contact Covalen with your request. Covalen will then stop the processing of personal data unless it is required for legal proceedings.