Introduction
The General Data Protection Regulation (GDPR) come into force on the 25th May 2018 and provides one framework data protection law for Europe, representing a significant harmonisation of data protection requirements and standards across the EU.
Who we are and what we do
Midwest Corporate Services Limited of Suite A2, No. 1 Charlotte Quay, Limerick, V94TW5E are company formation agents and providers of independent company secretarial services to individuals, businesses and other service providers and hold a large depository of client personal data as well as employee data. As such, we have a duty to comply with the GDPR provisions whenever we process your personal data.
What is the purpose of this statement?
This Data Protection Compliance and Privacy Statement is in compliance with the data protection standards and obligations as set out in both the GDPR to inform you, amongst other things, about the reasons for us collecting your personal data, the specific uses it will be put to, your rights in relation to your personal data and how long we will retain your personal data.
What do we do with your personal data and the legal basis for processing your data.
Under data protection law we are required to ensure that there is an appropriate legal basis for the processing of your personal data, and we are required to let you know what that legal basis is.
For past, current and/or potential clients who view and interact with our website, we process data:
• to respond to your query when sent through our ‘contact us’ form;
• to sign up to our newsletter when you request subscription through our website;
• in order to market the services of our firm;
• to provide you with legal updates and newsletters to which you have subscribed
The legal basis for this processing is our legitimate interest in the administration and operation of our services as well as our legitimate interest in marketing and promoting our services. You can opt out of receiving any such communication at any time by direct request.
Information obtained from third parties acting on your behalf.
Where personal data has not been obtained from you directly, we will provide you with the identity and contact details of the third party who provided us with your personal data and the categories of personal data obtained including any publicly accessed data.
Who do we share your personal data with?
Service Providers – We rely on trusted third parties to help us run our business and to provide us with specialised services. These include legal advisors, accountants, financial advisors and consultants, IT support services and practice management system provider. Where our service providers have access to your personal data, we ensure they are subject to the appropriate safeguards. They may only process this data for the purpose of providing us with their services, and no other purposes.
Regulators – In certain circumstances we are obliged to provide information to a regulator or certain law enforcement agencies. This may be in the form, for example, of an audit by Revenue.
Transfers outside of the European Economic Area (EEA)
In the exceptional circumstance that may require us to transfer your personal data outside of the EEA to a country which is not recognised by the European Commission as providing an equivalent level of protection for personal data as is provided for in the EEA, please rest assured that we will ensure that appropriate measures are in place to protect your personal data and to comply with our obligations under applicable data protection law. This may mean that we enter into contracts in the form approved by the European Commission, or we ensure that the company to which we transfer your personal data has agreed to abide by the approved transfer mechanism, such as the EU-US Privacy Shield framework.
Retention of personal data
Midwest Corporate Services Limited will retain your personal data for the duration of the engagement of our services on your behalf and in accordance with requirements under law and/or any regulating authorities’ policies. This statement operates on the principle that we keep personal data for no longer than is necessary for the purpose for which we collected it. It is also kept in accordance with any legal requirements that are imposed on us. As we work in a highly regulated industry, we may have certain statutory and regulatory obligations to retain personal data for set periods of time, most notably, the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 requires that customer due diligence records are maintained for five years after the end of the relevant business relationship.
Your rights
You have various rights under data protection law, subject to certain exemptions, in connection with our processing of your personal data:
• Right to access the data – you have the right to request a copy of the personal data that we hold about you, together with other information about our processing of that personal data.
• Right to rectification – you have the right to request that any inaccurate data that is held about you is corrected, or if we have incomplete information you may request that we update the information such that it is complete.
• Right to erasure – you have the right to request us to delete personal data that we hold about you. This is sometimes referred to as the right to be forgotten
• Right to restriction of processing or to object or withdraw consent to processing – you have the right to request that we no longer process your personal data for particular purposes, or to object or withdraw your consent to our processing of your personal data for particular purposes.
• Right to data portability – you have the right to request us to provide you, or a third party, with a copy of your personal data in a structured, commonly used machine readable format.
In order to exercise any of the above rights, please contact us using the contact details set out below.
Requirement to process personal data
You may browse our website without providing us with any personal data and this will not affect your ability to view our website.
If you do not provide us with your information for the purposes described above, we cannot send your our newsletter, respond to your queries sent through our contact us form or liaise with you on matters.
Automated decision-making and profiling
We do not use any personal data for the purpose of automated decision-making or profiling.
Questions and Complaints
If you have any queries or complaints in connection with our processing of your personal data, you can get in touch with us using the following contact details:
• Post:
John McShane
Midwest Corporate Services Limited
Suite A2,
No. 1 Charlotte Quay
Limerick.
• Email: john.mcshane@midwestcorporate.com
• Tel: 061 - 404864
You also have the right to lodge a complaint with the Data Protection Commission if you are unhappy with our processing of your personal data. Details of how to lodge a complaint can be found on the dataprotection.ie website, or you can call the Data Protection Commission on 1890 252 231.
