Section 1: Introduction
“Personal data” is defined in Article 4(1) of the GDPR:
“(1) ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.
Section 2: Credit
Section: Free documents licensing warning
Optional element. Although you need to retain the credit, you should remove the inline copyright warning from this document before use.
Section 3: How we use your personal data
Article 13(1) of the GDPR provides that:
“(1) Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: … (c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing; (d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party”.
Article 6(1)(f) of the GDPR provides that:
“(1) Processing shall be lawful only if and to the extent that at least one of the following applies: … (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”
Article 14 of the GDPR, which applies where personal information is not obtained from the data subject, provides that information about “the categories of personal data concerned” must be supplied to data subjects.
Article 13 of the GDPR, which applies where personal information is obtained from the data subject, does not include an equivalent provision.
Nonetheless, we have included references to general categories of data in this document, because this facilitates the identification of particular purposes of processing and the legal bases of processing – information which does need to be provided under Article 13.
Section 4: Providing your personal data to others
Article 13(1)(e) of the GDPR requires that where personal data are collected from the data subject, the data controller must provide the data subject with information about “the recipients or categories of recipients of the personal data”.
Equivalent rules for data collected from someone other than the data subject are in Article 14(1)(e).
Section 5: International transfers of your personal data
Article 13(1)(f) of the GDPR requires that data controllers disclose to data subjects “where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 [transfers subject to appropriate safeguards] or 47 [binding corporate rules], or the second subparagraph of Article 49(1) [limited transfers for compelling legitimate interests], reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available”.
Section 6: Retaining and deleting personal data
Article 5(1)(e) of the GDPR sets out the storage limitation, one of the fundamental rules of the regime:
“Personal data shall be: … kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject … “.
Section 7: Amendments
If there are any changes to this document we will notify you by email.
Section 8: Your rights
Article 13(2) of the GDPR provides that, where personal data is collected from a data subject, certain information about data subject rights must be provided:
“In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing: … (b) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability; (c) where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal; …”.
Similar provisions are set out in Article 14 in relation to personal data which is not collected from the relevant data subject.
The right to access is set out in Article 15 of the GDPR.
The right to rectification is set out in Article 16 of the GDPR.
The right to erasure (or right to be forgotten) is set out in Article 17 of the GDPR, and must be notified to data subjects under Articles 13(2)(b), 14(2)(c) and 15(1)(e) of the GDPR.
Consider modifying the highlighted circumstances and exclusions, depending upon what will be most relevant to your processing.
Article 18(1) of the GDPR states:
“The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies: (a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data; (b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; (c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; (d) the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.
The right to object to processing is detailed in Article 21 of the GDPR, and must be notified to data subjects under Articles 21(4), 13(2)(b) and 14(2)(c).
Article 21(3) of the GDPR states:
“Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.”
This right is set out in Article 21(6) of the GDPR.
The right to data portability is set out in full in Article 20 of the GDPR, and must be notified to data subjects under Articles 13(2)(b) and 14(2)(c).
The right to lodge a complaint with a supervisory authority is set out in Article 77 of the GDPR, and must be notified to data subjects under Articles 13(2)(d), 14(2)(e) and 15(1)(f).
Article 7(3) of the GDPR sets out the right of withdrawal. The right must be notified to data subjects under Articles 13(2)(c) and 14(2)(d). See also Article 17(1)(b).
Section 9: About cookies
What Are Cookies
For more general information on cookies see the Wikipedia article on HTTP Cookies.
You can prevent the setting of cookies by adjusting the settings on your browser (see your browser Help for how to do this). Be aware that disabling cookies will affect the functionality of this and many other websites that you visit. Disabling cookies will usually result in also disabling certain functionality and features of this site. Therefore it is recommended that you do not disable cookies.
The Cookies We Set
- Forms related cookies
When you submit data to through a form such as those found on contact pages or comment forms cookies may be set to remember your user details for future correspondence.
- Site preferences cookies
In order to provide you with a great experience on this site we provide the functionality to set your preferences for how this site runs when you use it. In order to remember your preferences we need to set cookies so that this information can be called whenever you interact with a page is affected by your preferences.
Third Party Cookies
- This site uses Google Analytics which is one of the most widespread and trusted analytics solution on the web for helping us to understand how you use the site and ways that we can improve your experience. These cookies may track things such as how long you spend on the site and the pages that you visit so we can continue to produce engaging content.
For more information on Google Analytics cookies, see the official Google Analytics page.
- From time to time we test new features and make subtle changes to the way that the site is delivered. When we are still testing new features these cookies may be used to ensure that you receive a consistent experience whilst on the site whilst ensuring we understand which optimisations our users appreciate the most.
Hopefully that has clarified things for you and as was previously mentioned if there is something that you aren’t sure whether you need or not it’s usually safer to leave cookies enabled in case it does interact with one of the features you use on our site.
However if you are still looking for more information then you can contact us through one of our preferred contact methods:
- Email: email@example.com
Section 13: Our details
Irish companies must provide their corporate names, their registration numbers, their place of registration and their registered office address on their websites (although not necessarily in this document).
Sole traders and partnerships that carry on a business in the Ireland under a “business name” (i.e. a name which is not the name of the trader/names of the partners or certain other specified classes of name) must also make certain website disclosures: (i) in the case of a sole trader, the individual’s name; (ii) in the case of a partnership, the name of each member of the partnership; and (iii) in either case, in relation to each person named, an address in the Ireland at which service of any document relating in any way to the business will be effective. All websites covered by the Electronic Commerce (EC Directive) Regulations 2002 must provide a geographic address (not a PO Box number) and an email address. All website operators covered by the Provision of Services Regulations 2009 must also provide a telephone number.
This website is under the name of Ballyhoura Hostel
This website is operated by Seamus Nunan
Ballyhoura Hostel, West End, Kilfinane, County Limerick, Republic of Ireland
Business owner is Seamus Nunan
Ballyhoura Hostel, West End, Kilfinane, County Limerick, Republic of Ireland
Section 14: Data protection officer
Data Protection Officer is Seamus Nunan
Some data controllers and data processors will have an obligation to appoint a data protection officer (DPO). The basic obligation is set out in Article 37(1) of the GDPR:
“(1) The controller and the processor shall designate a data protection officer in any case where: (a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity; (b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or (c) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 and personal data relating to criminal convictions and offences referred to in Article 10.”
Article 13(1)(b) of the GDPR provides that:
“(1) Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information … (b) the contact details of the data protection officer, where applicable”.
See also Article 14(1)(b).