In this statement we use the terms “Repak”, “we”, “our” and “us” to refer to Repak Limited, which is a registered company (Companies Registration Office number 242159) and our registered office is at Red Cow Interchange Estate, 1 Ballymount Road, Clondalkin, Dublin 22.
Repak is the data controller responsible for the personal data it collects, uses and stores about you. A data controller is someone who alone or jointly with others, determines the purposes and means of the processing of personal data.
What is personal data?
Personal data is any information relating to an identified or identifiable individual that allows us to identify you. This could include information such as your name, postal address, telephone number, email address or date of birth.
When and how do we collect your personal data?
Direct interactions. You may give us your personal data by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:
- Apply for membership to Repak;
- Create an account on our website;
- Subscribe to our service or publications;
- Request information to be sent to you or signing up to a mail list;
- Enter a competition, promotion or survey;
- Give us feedback or contact us;
- Apply to work with us; or
Reply to a request for the provision of goods or services or solicitation of same.
Publically available sources such as social media and the Companies Registration Office.
Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with services). In this case, we may have to cancel a service you have with us but we will notify you if this is the case at the time.
The purpose and legal basis for processing your personal data
Under data protection law we are only permitted to use your personal data if we have a legal basis for doing so. We rely on the following legal bases to use your personal data:
a) To enter into and perform a contract with you
We may use your personal data in order to enter into a contract with you or to provide you with a service that you have requested from us.
b) To comply with a legal obligation
We are required to use your personal data to comply with certain legal and regulatory obligations to which we are subject.
c) For our legitimate interests
We may use your personal data for the purposes of carrying out activities that are in our legitimate interests (or those of a third party). When we use your personal data in this way, we ensure that there is a fair balance between our legitimate interest and your fundamental rights and freedoms.
In more limited circumstances we may also rely on the following legal bases:
- Where we need to protect your vital interests (or someone else’s vital interests); or
- Where your personal data is needed in the public interest or for official purposes.
d) With your consent
We may send you information by post, text, email and/or phone from time to time about waste reducing activities, campaigns and initiatives where you have consented to us contacting you in this way. You can withdraw this consent at any time free of charge by following the opt-out links on any such communications sent to you.
e) To recruit staff
Categories of personal data we collect and process and how we use it
We have set out below, in table format, a description of the ways we use your personal data, and which of the legal bases we rely on to do so.
Purpose/activity for which it is used
Lawful basis for processing
To register your business as a member and administer such membership
Performance of a contract with you
To process and administer your membership application including:
(a) Managing payments, fees and charges
(b) Collecting and recovering money owed to us
Performance of a contract with you
Necessary for our legitimate interests (to recover debts due to us)
To manage our relationship with you which will include asking you to leave a review or take a survey
Performance of a contract with you
Necessary for our legitimate interest (to keep our records updated; to assess how users engage with our services)
To enable you to partake in a campaign, prize draw, competition or complete a survey
Necessary for our legitimate interests (to assess how users engage with our services; to raise awareness and generate interest in our waste-reducing activities, campaigns and initiatives)
To administer, secure and protect our business and our website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)
Necessary for our legitimate interest (for the running of our business; provision of administration and IT services and network security; to prevent fraud)
Necessary to comply with a legal obligation
To deliver relevant website content to you, measure or understand the effectiveness of the content we serve and to allow you to participate in interactive features of our website when you choose to do so
Necessary for our legitimate interests (to assess how users engage with our services; to develop our services; to grow our business and to inform our marketing strategy)
To use data analytics to improve our website, services, marketing, member relationships and experiences
Necessary for our legitimate interests (to keep our website updated and relevant; to develop our business; to inform our marketing strategy)
To respond to any queries or other communications you submit to us
Necessary for our legitimate interest.
To create a candidate profile for you if you are a prospective employee
Necessary for our legitimate interest.
We do not collect special categories of personal data about you. Special categories of personal data include details about your and health, race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation and political opinions.
Your Personal Data and Other Parties
Third Party Service Providers
In order for us to fulfil our duties and our contract with you we may share your personal data with third party product and service providers and sub-contractors that perform services and functions at our direction and on our behalf. Such third party service providers include auditors, accountants, legal and tax advisers, communication services, financial and banking services, insurers, professional advisors, IT service providers, security service providers and administrative services providers.
We also may share your personal data with analytics and search engine providers that assist us in the improvement and optimisation of our website.
An Garda Síochána, government or quasi-government bodies, courts and tribunals
We may share your personal data with these organisations and bodies where required to do so by law.
Data Retention Periods
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect of our relationship with you.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
Transfers outside the European Economic Area
We do not transfer your personal data to countries outside the European Economic Area.
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
You have a number of rights under data protection law in relation to how we use your personal data. These include the right, free of charge, to:
1. Be informed about the personal data we hold about you and how we use that information.
2. Obtain access to personal data we hold on you.
3. Have any personal data that we hold about you which you believe is incorrect, incomplete or inaccurate, updated or corrected.
4. Have your personal data erased in the following circumstances:
a. If Repak is continuing to process personal data beyond the period when it is necessary to do so for the purpose for which it was originally collected.
b. If Repak is relying on consent as the legal basis for processing and you withdraw consent.
c. If Repak is relying on legitimate interests as the legal basis for processing and you object to this processing and there is no overriding compelling ground which enables us continue with the processing.
d. If the personal data has been processed unlawfully.
e. If it is necessary to delete the personal data to comply with a legal obligation.
5. Have our processing of your personal data restricted where you consider that:
a. The personal data is inaccurate.
b. The processing is unlawful and you oppose erasure and request restriction instead.
c. Where we no longer need the personal data but you require us to keep it to enable you to establish, exercise or defend a claim.
d. Where you have raised an objection to our use of your personal data.
6. Object to our processing of your personal data where we are relying on legitimate interests or exercise of a public interest task to make the processing lawful. If you raise an objection we will carry out an assessment to determine whether we have an overriding legitimate ground which entitles us to continue to process your personal data.
7. Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only apples to automated information which you initially provided consent for us to use or where we use the information to perform a contract with you.
Where our processing of your information is based on your consent to such processing, you have the right to withdraw that consent at any time but any processing that we carried out before you withdraw your consent remains lawful.
These rights are in some circumstances limited by data protection law. If you wish to exercise any of these rights, you can contact us using the details below. We will endeavour to respond to your request within one month. If we are unable to deal with your request within one month we may extend this period by a further two months and we will explain why.
Complaints and contact details
You have the right to make a complaint at any time to the Data Protection Commission (DPC), the Irish supervisory authority for data protection issues (www.dataprotection.ie), by post to Data Protection Commission, Canal House, Station Road, Portarlington, Co Laois R32 AP23 or by emailing firstname.lastname@example.org. We would, however, appreciate the opportunity to deal with your concerns before you approach the DPC so please feel free to contact us in the first instance.
(a) By emailing us at email@example.com;
(b) By writing to us at Red Cow Interchange Estate, 1 Ballymount Road, Clondalkin, Dublin 22; or
(c) By telephone, on +353 (0)1 4670190
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.