M50 Concession Limited
This Privacy Statement provides information about the ways in which M50 Concession Limited processes the personal information provided to us.
Who we are?
M50 Concession Limited (hereinafter referred to as ‘M50CL’ is the company in charge of the operation and maintenance of the M50 motorway in Dublin, Ireland. In 2007, the Irish Government awarded M50 Concession Ltd the 35-year concession contract to construct, finance and operate the M50 road Network. M50CL’s shareholders are Globalvia Inversiones, a major worldwide infrastructure developer and operator (www.globalvia.com), and DIF, an independent fund management company (www.dif.eu).
We are committed to lawfully and fairly processing personal data in order to protect the rights and freedoms of, including but not limited to, the Board of Management, staff, contractors, third parties who correspond with us and visitors to our premises or website in relation to personal data processing.
‘Personal Data’ means any information relating to an identified or identifiable person (‘Data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
‘Special Categories of Data’ include personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.
Key Principles of Data Protection
The key principles under data protection law are lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality, and accountability. (Article 5 of the GDPR). Under the General Data Protection Regulation (GDPR) Regulation (EU) 2016/657) (hereinafter referred to as ‘GDPR’) these principles and the rights of Data Subjects set out below have been enhanced.
The right to be informed (Articles 12 – 14 of the GDPR);
The right to access information (Article 15 of the GDPR);
The right to rectification (Articles 16 & 19 of the GDPR);
The right to erasure (Articles 17 & 19 of the GDPR);
The right to data portability (Article 20 of the GDPR);
The right to object to processing of personal data (Article 21 of the GDPR);
The right of restriction (Article 18 of the GDPR) and,
Rights in relation to automated decision making, including profiling (Article 22 of the GDPR).
Personal Data We May Collect and process
M50CL may collect the following data:
1. Employee Records
M50CL may collect the following data:-
(a) Personal Data
• Name, address, contact details and date of birth
• PPS number educational records or previous employment history
• Original records of job application and appointment, interview records and references
• Records of appointments to promotion posts
• Details of approved absences (career breaks, parental leave, study leave etc.)
• Records of in-service courses attended
• Details of complaints or grievances including consultations or competency discussions, action/improvement/evaluation plans and records of progress. Note: a record of grievances may be maintained which is distinct from and separate to individual personnel files
• Superannuation and pension documentation
• Salary, payroll and bank details
• CCTV recordings according to our CCTV Policy
• Information received from CV referees or from perusal of LinkedIn or other employment agency sites
• Personal data may also be gathered as evidence for disciplinary action or termination.
(b) Special Categories
M50 Concession Limited may also hold some or all of the following sensitive data about its employees:
Sensitive data such as private medical information not related to work performance or absenteeism, trade union membership or family status, for example, is not normally sought by M50CL. Details of any offence committed or alleged to have been committed, any proceedings for an offence or Gardaí vetting may be required to be processed in accordance with employment law;
2. Stakeholders and Board of Management Records
M50CL may collect the following data:-
• Names, addresses and contact details of Stakeholders and members of the Board of Management:
• Records in relation to appointments to the Stakeholder/Board
• Minutes of meetings and correspondence which may include references to particular individuals
• Travel expenses paid, PPS Number, tax and bank details
3. Third Party Records
M50CL collects and processed in the normal operation of its business including data supplied by creditors, debtors, contractors (some of whom are sole traders, Local Authorities and members of the public including, but not limited to:
• Names, addresses, telephone numbers, email addresses,
• PPS Numbers, tax details, bank details and payment arrangements
• Insurance Records
• Any personal data e.g. CV’s used for procurement purposes
• And, any other records required by statutory obligations or to enable M50CL to conduct its business.
• Credit rating applications
Legal basis and purposes for which Data are collected
M50CL collect personal data for compliance with legal obligations such as to provide responses to enquiries and complaints, for due diligence and reporting obligations in managing our business and supporting our legitimate interests provided such interests are not overridden by your interests and rights; for the management and administration of Company business now and into the future, where such processing is necessary for the performance of a contract to which the data subject is party e.g. to facilitate the payment of staff, to facilitate pension payments in the future, human resources management, and for compliance with legislation relevant to the M50CL including employment law.
For M50CL’s legitimate interests such as the protection of property and staff, the protection of the IT network and the protection of facilities (where this is documented to not affect the rights and freedoms of the data subject(s) in any significant way) and the legitimate interests of M50CL’s client.
To enable the Committee and Board of Management to operate in accordance other applicable legislation and to maintain a record of appointments and decisions. To facilitate the payment of members expenses.
Will your information be transferred abroad?
Your information will not be transferred abroad. However, as M50 Concession is a sister company to Globalvia, it may be required we may transfer your personal data to other group companies within the EEA for purposes connected with your employment or the management of the company’s business. Your data will never be transferred or used for any marketing or profiting purposes.
Security and Retention
M50 Concession Limited stores all personal information in controlled access, centralised databases (including computerised and manual files) in the M50 Concession Limited Head Offices. The company will take appropriate security measures against unauthorised access to, or alteration, disclosure or destruction of the data and against their accidental loss or destruction. The company acknowledges that high standards of security are essential for processing all personal information.
Personal Data is retained for no longer than is necessary for the purpose for which it was obtained by us, or as required contractually or permitted for legal, regulatory, fraud prevention and legitimate business purposes including, if relevant, to deal with any claim or dispute that might arise in connection with the provision of our services. M50CL uses a standard retention period framework in this regard. We may retain aggregated or anonymised data (which is not treated as Personal Data under this privacy notice) for longer. See Data Retention Policy for more details on our retention period.
How is your information shared?
Your information may be disclosed to third parties where we are legally obliged to do so or where our employment contract requires or permits us to do so. For example, we pass on certain information to our external payroll provider, pension and health insurance providers and the company clinic.
M50CL will not disclose or subscribe to any automated processing or use of your data nor use your data for marketing or profiling purposes.
Links to Third Party Websites
Our website may contain links that permit you to link to other websites. When you click on one of those links you are connecting to another website. M50 Concession Limited has no responsibility or liability for, or control over, those other websites or their collection, use and disclosure of your personal information. We encourage you to read the privacy policies of those other websites before you submit any personal information to them if and when prompted to.
Changes to the Privacy Statement
Any changes to this Privacy Statement will be communicated to you and the most recent version will be available on our website: M50concession.com. If you would like to be included on a mailing list to receive revised versions, please contact us.
Enquiries, Questions and further details
If you have any enquiries about this Privacy Statement please contact our Data Protection Representative by email at: info@M50concession.com
Right to Complain
If for any reason you are not satisfied with our response to your enquiry you have a right to complain to the Data Protection Commission through the contact details below:
The Office of the Data Protection Commission
Phone: (+353) 57 8684800
Lo Call Number: 1890 252 231
Fax: (+353) 57 868 4757
Post: 21 Fitzwilliam Square, Dublin 2, D02 RD28, Ireland.