Data Protection Notice and Policy


DATA PROTECTION NOTICE - UPDATED 04 NOVEMBER 2020

The Institute of Bankers in Ireland (trading as IOB) takes privacy and the protection of our member, student and designate data very seriously. In this notice, we explain how we collect your personal information, how we use it and how you can interact with us about it.

Who are we?

When we talk about “IOB”, or “us” or “we” in this notice, we are talking about IOB.

Data Protection Officer

Our Data Protection Officer oversees how we collect, use, share and protect your information to ensure your rights are fulfilled. You may contact our Data Protection Officer at [email protected] or by writing to: Data Protection Officer, IOB, 1 North Wall Quay, Dublin 1.

How we collect information about you

We collect personal information from you, for example when you become a member; register to an educational programme; apply for information on our products and services; apply for a designation/CPD scheme or express an interest in one of our programmes or a programme offered in association with one of our educational partners. We also collect information through our websites, social media and our CCTV footage. We will sometimes record phone conversations and we will always let you know when we do this. Our websites use ‘cookie’ technology. A cookie is a little piece of text that our server places on your device when you visit any of our websites or applications. They help us make the sites work better for you. When you apply to us for products and services and during the time you avail of these, we may verify your identity. We may do this by sending and receiving information about you, to and from third parties including your employer.

How we keep your information safe

We use technical and organisational measures to protect your personal information from unauthorised access, to maintain data accuracy and to help ensure the appropriate use of your personal information. These security measures include encryption of your personal information, firewalls, intrusion detection systems, 24/7 physical protection of facilities where your personal information is stored, background checks for personnel that access physical facilities, and strong security procedures across all service operations. We use strong encryption algorithms for the transmission and storage of your information. When you contact us to ask about your information, we may ask you to identify yourself. This is to help protect your information.

How long we keep your information for

How long we hold your information depends on the nature of the information and the purposes for which it is processed. We determine appropriate retention periods which meet our academic, legal and regulatory obligations. We hold your information while you are a member, student or designate and for a period of time after that. We do not hold it for longer than necessary. If the purpose for which the information was obtained has ceased and the personal information is no longer required, the personal data will be deleted or anonymised (i.e. all identifying characteristics are removed).

Meeting our academic, legal and regulatory obligations

To meet our academic, regulatory and legal obligations, we collect some of your personal information, verify it, keep it up-to-date through regular checks, and delete it once we no longer have to keep it. We may also gather information about you from third parties to help us meet our obligations. If you do not provide the information we need, or help us keep it up-to-date, we may not be able to provide you with our products and services.

To use your information lawfully, we rely on one or more of the following legal bases:

Consent

Sometimes we need your explicit consent to use your personal information. When we use sensitive personal information about you, such as health data, for example when you request a maternity leave pro-rata adjustment, we may ask for your consent. Before you give your consent, we tell you what information we collect and what we use it for. You can withdraw your consent at any time by contacting us.

Direct Marketing

We would like to make you aware of products and services which may be of interest to you. We may do this by phone, post, email, text or through other digital media. You can decide how much direct marketing you want to accept when you apply for new products and services. You can make changes to your marketing preferences at any time via "My Details" section on the "MyInstitute" website at iob.ie or by contacting us directly at: Phone: + 353 1 6116500 Email: [email protected]

How we use your information

We use information about you to:

To provide our products and services under the terms and conditions we agree between us, we need to collect and use personal information about you. If you do not provide this personal information, we may not be able to provide you with our products and services.

Your information and third parties

Sometimes we share your information with trusted third parties. For example, we share information with:

Your personal information rights

When your personal information is handled by IOB in relation to a product or service, you are entitled to rely on a number of rights. These rights allow you to exercise control over the way in which your personal information is processed, subject to applicable exemptions. For example, we may help you in:

Accessing your personal information: You can ask us for a copy of the personal information we hold about you.

Correcting and Updating your personal information: If you believe that any personal information we hold about you is inaccurate or out of date, you can look for the information to be corrected at any time.

Withdrawing consent: You can change your mind wherever you give us your consent, such as for direct marketing, or using your sensitive information, such as medical or biometric data.

Restricting our use of your personal information: You have the right to restrict our use of your personal information in certain circumstances, such as where our use of it is not compliant with applicable law.

Objecting to our use of your personal information: You have the right to object to us using your personal information, where we are doing so based on this being necessary for the performance of a task carried out in the public interest or for the purposes of a legitimate interest. Where you exercise this right to object, we will be obliged to stop using your personal information in that way, unless there are compelling legitimate grounds for us to continue to do so, despite your objection.

Not to be subject to automated decision making: You have a right (subject to limited exceptions) not to be subject to a decision based solely on automated processing of information, including profiling, which produced significant legal effects concerning you or otherwise significantly affects you.

Deleting your information (your right to be forgotten): You may ask us to delete your personal information.

Moving your information in electronic form (your right to Portability): You may request (in certain cases) that your personal information is transferred to you or another organisation in digital form.

How to exercise your rights

You may execute any of these rights free of charge. You may do so by contacting us:

Phone: + 353 1 6116500 Email: [email protected]

When you contact us to ask about your information, we may ask you to identify yourself. This is to help protect your information. Once we are satisfied that we have effectively verified your identity, we will respond to the majority of requests without undue delay and within a one month period (i.e. 30 calendar days) of receipt of the request. IOB will action your request to have your personal information corrected within 10 calendar days. These periods may be extended in exceptional circumstances and we will inform you where the extended period applies to you along with an explanation of the reasons for the extension.

International transfers of data

We sometimes need to share your information with organisations which are located or who undertake processing outside the European Economic Area (EEA) to help us provide you with our products and services. Some educational programmes/partners, for example, are provided/located outside the EEA. This may mean that some personal information may be processed in countries such as India, Singapore or the United States. We expect the same standard of data protection is applied outside of the EEA to these transfers and the use of the information, to ensure your rights are protected and will only transfer personal information to a country or territory outside of the EEA: (a) if that country provides an adequate level of protection for personal information as set down by the European Commission or (b) where the transfer is made under a legally binding agreement which covers the EU requirements for the transfer of personal information to recipients outside of the EEA, such as the model contractual clauses approved for this purpose by the European Commission, or (c) where there is an alternative basis for engaging in the transfer that is compliant with applicable laws. For more information about the European Commission’s decisions on the adequacy of the protection of personal information in countries outside the EEA, please visit: ec.europa.eu/info/law/lawtopic/data-protection_en

For more information about IOB’s arrangement regarding transfers of personal information outside EEA you can contact us by phone or email via the details set out below.  

Making a complaint

If you have a complaint about the use of your personal information, please let a member of staff know, giving them the opportunity to correct things as quickly as possible. If you wish to make a complaint you may do so in writing and by email [email protected]. Please be assured that all complaints received will be fully investigated. We ask that you supply as much information as possible to help our staff resolve your complaint quickly.

You may also contact the Data Protection Commission in Ireland to lodge a complaint (details below).

Data Protection Commission 21 Fitzwilliam South, Dublin 2, D02 RD28 Web: dataprotection.ie Email: [email protected]

Data Protection Policy

IOB, as a provider of Professional Education, CPD (Continuing Professional Development) and Membership Services to the financial services sector in Ireland and beyond, processes personal data for a variety of purposes relating to its members, employees, service providers and other third-parties involved with the organisation. IOB is therefore a data controller, and in some cases a data processor, and is subject to data protection legislation and regulation. IOB's Data Protection policy (available here) sets out data protection requirements which must be complied with by anyone who processes personal data for or on behalf of IOB.

Updates to this notice and policy

We keep this notice and policy under regular review and will make changes from time-to-time, particularly when we change how we use your information, and change our technology and products or services. We will inform you of material changes to the contents of this Data Protection Notice, through a notification posted on our website or through other communication channels.