Data Protection Privacy Notice
1. What is Personal Data?
Personal data is data about a living individual who can be identified from that data. The processing of personal data is governed by the EU General Data Protection Regulation (EU) 2016/679 and the Data Protection Acts 1988-2018.
2. Who are we?
2into3 (Ireland) Ltd (company no: 419462) is the data controller (contact details below) which means that 2into3 decides how your personal data is processed and for what purposes.
2into3 provides Advisory, Funding and Talent Management services to nonprofits, corporates, state organisations and philanthropists. 2into3 is committed to protecting your privacy and we have appropriate policies and procedures in place to process and protect any personal data that we hold about you.
3. How do we process your data?
2into3 complies with its legal obligations by using personal data only for specified, lawful purposes; by not collecting or retaining excessive amounts of data; by keeping personal data up to date; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.
In addition to personal data that you provide directly to us we may also process other publicly available data from services such as online recruitment platforms to which you have uploaded personal data.
4. What is the legal basis for processing your personal data?
Depending on how and why you engage with 2into3 we may use your personal data for the purposes set out in the following table which also sets out the legal basis(es) for processing your data:
| Purpose | Legal Basis |
| Recruitment of staff on behalf of clients | Performance of a contract (Article 6(1)(b)) GDPR |
| Delivery of projects on behalf of clients e.g. strategy development or grant support where personal data, including special categories of personal data, may be processed when canvassing views and opinions or undertaking quality and risk management reviews | Consent (Article 6(1)(a) GDPR
2into3’s legitimate interests (Article 6(1)(f) GDPR Explicit consent (Article 9(2)(a) GDPR |
| Recruitment and employment of staff | Performance of a contract
Occupational health, working capacity of employee (Article 9(2)(h)) GDPR |
| Administering and promoting 2into3’s services, events, news and activities | Legitimate interests |
| Ensuring the security and safety of visitors, staff and property (CCTV) | Legitimate interests |
5. Sharing your personal data
In certain circumstances, we need to share personal data in pursuit of our legitimate interests, for example the use of processors who audit our accounts, manage communications, conduct customer surveys or perform other tasks on our behalf and store your data.
Where we engage such processors, the processing is the subject of a Data Processor Agreement which includes safeguards to protect your personal data.
6. International Transfer
Personal data is stored either within the European Economic Area or countries whose data protection regimes have been designated as adequate by the European Commission. Where it is necessary to transfer personal data to a country other than described above e.g. where we are recruiting for clients in such a country, data will only be transferred with the explicit consent of the data subject as provided for in the derogations in Article 49 of the GDPR.
7. How long do we keep your data?
We keep personal data only for periods set out in our Data Retention Schedule and do not maintain data for longer than is absolutely required for the purposes set out in the table above.
8. Your rights and your personal data
You have the following rights with respect to your personal data:
- To access and request a copy of your personal data, which 2into3 holds about you.
- To request your personal data is erased where it is no longer necessary or lawful for 2into3 to retain such data.
- To request a restriction is placed on further processing of your personal data where there is a dispute in relation to the accuracy or processing
- To request that 2into3 correct any personal data if it is found to be inaccurate, incomplete or out-of-date.
- To object to the processing of personal data by 2into3.
- To request that 2into3 provides you with a copy of personal data that you have provided and, in certain circumstances, to transmit that data directly to another data controller.
You also have the right to lodge a complaint with the Data Protection Commission should you be unhappy about any aspect of 2into3’s handling of your personal data or any request to us.
9. Contact Details
To exercise all relevant rights or submit a query or a complaint please in the first instance contact the Data Protection Coordinator at:
2into3
The Academy
Pearse Street
Dublin D02 YX88
Tel: 01 – 574-0022 | Email: privacy@2into3.ie
10. Complaints
You have the right to make a complaint to the Data Protection Commission which you can contact by phone: 1800 437 737; via website www.dataprotection.ie or by writing to: The Data Protection Commission, 21 Fitzwilliam Square South, D02 RD28.
