Bob Sweeney – Ireland's Premier Parts & Vehicle Recovery Specialists

Autotowing Ltd., / Bob Sweeney Privacy Notice

Autotowing Ltd. - Privacy Notice

Reader Information	Title: Privacy Notice
Purpose:	To outline the approved Autotowing Ltd. management’s approach to be followed in relation to Privacy Notice
Author:	Bob Sweeney
Publication date:	23/12/2019, last reviewed on 01/03/2024.
Target Audience:	All Directors, management, staff, service providers, and third parties, Customer, Suppliers and third parties that have access to Autotowing Ltd.’s information.
Superseded Documents:	All other Privacy Notices.
Review Date:	01/03/2025
Contact Details:	Autotowing Ltd. at Coolready, Castleconnell, Co. Limerick - E-mail b ob@autotwing.ie

Privacy Notice

Autotowing Ltd. are committed to safeguarding the privacy of your personal data. Please read the following Privacy Notice to understand how we collect and use your personal data, for example when you contact us, visit our website, or seek to avail of our services. The Data Controller is Autotowing Ltd., we can be contacted through bob@autotwing.ie or through our registered office, which is located at Coolready, Castleconnell, Co. Limerick. Please note that whenever you provide us with your personal data, that processing it involves the collection, recording, organising, structuring, storing, adaptation, alteration, retrieving, consulting, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

What Personal data do we collect?

Autotowing Ltd. may collect personal data such as your name and e-mail address through our website interface on https://www.autotowing.ie/ or through completion of Business form(s), e-mail communication, or other means of communication or contact that we may have with you. A full list of the personal data that we process is listed in the appendix attached to this Privacy Notice. We also collect personal data (images) throughout CCTV system in operation in the environs of the school premises. The CCTV Policy published on the website provides further information on the processing of personal data through the CCTV system.

How we use your personal data

If you provide personal data to us, we will process that information and use it for the purposes outlined in the Appendix and in accordance with the terms and references within this Privacy Notice.

Obligation to provide personal data

You are not obliged to provide your personal data to Autotowing Ltd., you may provide your name, address, contact details or e-mail address (as applicable) as a point of contact. The purpose of collecting / processing your personal data is outlined in the Appendix attached to this Privacy Notice which outlines the categories of personal data processed in aiding the delivery of our services etc. Failure to provide personal data will create difficulties in delivering our services. The provision of personal or special category data is required mainly in relation to aiding the provision of goods/ products / services supplied by business.

Explanation as to how the personal data could not possibly be processed by any other means.

Failure to provide personal or special category data may create difficulties in delivering our services. In such event we would have no other means of processing your requirements.

Sharing / Recipients of your personal data

When you provide Autotowing Ltd. with your personal data, that data will be used, processed or stored in Autotowing Ltd. We share your personal or special category data with the undermentioned.

Customer Personal Data is shared with Autotowing Ltd., administration staff / employees, Department of Environment, Insurance Companies, Revenue Commissioners, County Council’s, and An Garda Siochána as applicable.

Employees Personal Data is shared with Autotowing Ltd., administration Staff / employees, Department of Environment, Insurance Companies, Revenue Commissioners, County Council’s, and An Garda Siochána as applicable.

Creditor’s Personal Data is shared with Directors, management, administration, staff, finance department, Revenue Commissioners, and Accountant

Covid-19 Personal Data is shared with Management, Administration Staff, Department of Health, HSE Contracting Tracing Officials, Insurance Company’.

Autotowing Ltd. will not share or pass on your personal data to any other persons or third parties, third countries or international organisations other than those specified above unless you specifically request this.

In the event that we receive requests from government departments, agencies or other official bodies, we will only disclose your information, if and to the extent that we believe we are legally required to do so (for example, but without limitation, upon receipt of a court order, warrant, subpoena or equivalent). Except as set out above, we will not disclose your personal data save where we need to do so in order to enforce our rights.

If we are compelled to share your personal data, we take all reasonable steps to ensure that it is treated securely and in accordance with this Privacy Notice.

Transfer to third country

The GDPR and Data Protection Acts require that Autotowing Ltd. specify whether or not it transfers personal data to any third country or international organisation.

Autotowing Ltd does not transfer any personal data to any international organisation or third country.

Period of retention of personal data

Personal data provided to Autotowing Ltd. will be retained for a period of time depending on the purpose of collecting / processing of each category of personal data or for a period as required by relevant legislation.

1. The schedule for the retention of each category of data is listed opposite each category of data in the Appendix to this Privacy Notice.

The retention period for business documents in relation to Revenue records is available at https://www.revenue.ie/en/vat/vat-records-invoices-and-credit-notes/vat-records-to-be-kept/how-long-do-you-keep-records-for.aspx
CCTV recordings are recorded over after a period of 30 days unless downloaded in accordance with the principals of the GDPR, bearing in mind the purpose and legal basis for such further processing of personal data.

Covid-19 Pandemic

Processing Personal Data in relation to Covid-19 - Autotowing Ltd. as well as public, private and voluntary organisations are taking necessary steps to contain the spread and mitigate the effects of Covid-19. Some of the risk mitigations implemented involve the processing of personal data and special category data of data subjects such as name, address, workplace, travel details, Covid-19 health related information and status, telephone number, position of employment, etc.

Lawful basis for Processing - This personal data and special category data is processed in accordance with the terms of 'Article 9(2)(i) of the GDPR, Section 53 of the Data Protection Act 2018, the Safety, Health and Welfare at work Act 2005 (as amended) in relation to the prevention of the spread of Covid-19 virus as the processing of such personal data and special category data is necessary and proportionate in relation to the response to Covid-19 and the information processed is in line with the direction / guidance of the public health authorities.

Retention Period - Personal data processed under the requirements of the prevention of the spread of Covid-19 in business will be deleted after a period of four weeks.

Questionnaires - The implementation of questionnaires and contract tracing logs for visitors and contractors to business were considered and implemented in mitigating risks to, staff, and customer including vulnerable persons within the business along with available information, categories of personal data, and special category data as mentioned in the guidance provided by the Public Health Authority.

Sharing of Covid-19 related Persona Data / Special Category Data -

Personal data / special category data processed in relation to the prevention of Covid-19 virus will be shared with the directors, management, staff, Administration Staff, Department of Health, HSE Contracting Tracing Officials, Insurance Company as applicable. The personal data identifying a data subject will not be shared within Autotowing Ltd., the only information that will be shared in the event of a suspected or confirmed case of Covid-19 in the business is that there has been a case or suspected case of Covid-19 in the business etc. along with details of any other mitigating factors that will be implemented. The name of any affected individual will not be disclosed other than to the appropriate authorities and those mentioned above as applicable to each case. All personal and special category data processed in relation to the prevention of the spread of Covid-19 will be treated in confidence.

The categories of personal and special category data processed under the Covid-19 Pandemic is outlined in the Appendix at the rear of this privacy notice.

Product and service-related data

If you avail of our services or are employed by Autotowing Ltd., we may collect and process your personal and special categories of data as is outlined in the Appendix attached to this document.

In order to continuously provide our services, it may be necessary for us to collect and process certain information relating to you. The information we collect / process may include personal and or special category data as is outlined in the Appendix attached to this Privacy Notice.

We are committed to safeguarding the privacy of your personal and special category data and we will never share this outside of those mentioned above.

Notice of Data Subject Rights

Right of Access
The data subject has the rights to obtain from Autotowing Ltd. (Controller) confirmation as to whether or not personal data concerning him or her is being processed and where such personal data is being processed, he / she will have the right to access their personal data and ascertain the purpose of any processing, the categories of personal data concerned, the recipients or categories of recipient to whom the personal data has been or will be disclosed, in particular any recipients in third countries or international organisations, the period for which the personal data will be retained or stored or if not possible the criterial used to determine that period, the right to request from the controller rectification or erasure of their personal data or restriction of processing of personal data concerning the data subject or their right to object to such processing, the right to lodge a complaint to the supervisory authority (Data Protection Commissioner), in the event that the personal data was not collected from the data subject any available information as to their source and the existence of any automated decision-making profiling and at least in such events meaningful information about the logic involved as well as the significance and the envisaged consequences of such processing for the data subject. In the event of personal data being transferred to a third country or to an international organisation the data subject has the right to be informed of the appropriate safeguards relating to the transfer. The data subject also has the right to obtain a copy of the personal data undergoing processing from the controller. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form. The right to obtain a copy or further copies of personal data being processed shall not adversely affect the rights and freedoms of others. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs.

Right to Rectification

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Right to erasure (‘right to be forgotten’)

The data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall be obliged to erase their personal data without undue delay where one of the following grounds applies:

(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

(b) the data subject withdraws consent to the processing of his or her personal data for one or more specific purposes, or where the European Union or Member State law prohibit the consenting by data subjects to the processing of special categories of personal data and where there is no other legal ground for the processing;

(c) the data subject objects to the processing on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her based on the grounds that processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child (except where processing is carried out by public authorities in the performance of their tasks) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing of their personal data for direct marketing purposes including profiling for direct marketing purposes .

(d) the personal data has been unlawfully processed;

(e) the personal data has to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;

(f) the personal data has been collected in relation to the offer of information society services from a child under the age of 16 years of age and the consent for the processing of that child’s personal information has not been given or authorised by the holder of parental responsibility over the child .

The above requirements in relation to the right to erasure shall not apply to the extent that processing is necessary:

(a) for exercising the right of freedom of expression and information;

(b) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(c) when processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation is for reasons of public interest in the area of public health or where such data is processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies.

(d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subjected to the appropriate safeguards being put in place in accordance with this regulation, protecting the rights and freedoms of the data subject by the putting in place technical and organisational measures to ensure respect for the principle of data minimisation, which may include pseudonymisation; provided such purposes can be fulfilled in that manner or where further purposes for processing of such data does not permit or no longer permits the identification of data subjects, then those purposes shall be fulfilled in that manner so as to render impossible or seriously impair the achievements of the objectives of that processing or

(e) for the establishment, exercise or defence of legal claims.

Right to restriction of processing
The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:

(a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.

(b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

(c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;

(d) the data subject has objected to processing on grounds relating to his or her particular situation, to processing of personal data concerning him or her which is based on the fact that processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or where processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child, with the exception of processing carried out by public authorities in the performance of their tasks; pending the verification whether the legitimate grounds of the controller override those of the data subject.

Where processing has been restricted under the above conditions, such personal data shall, with the exception of storage, only be processed with the data subject's consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

A data subject who has obtained restriction of processing pursuant to the above-mentioned conditions shall be informed by the controller before the restriction of processing is lifted.

Right to notification obligation regarding rectification or erasure of personal data or restriction of processing. The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with their right to rectification, erasure, and restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.

Right to data portability
1. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes or the data subject has given explicit consent to the processing of personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation may not be lifted by the data subject; if the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to above may not be lifted by the data subject or on a contract where the processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract ; and

(b) the processing is carried out by automated means.

2. In exercising his or her right to data portability, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

3. The exercise of the right to data portability shall be without prejudice to the data subject’s right to erasure Article 17. which shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

4. provided that the right of data portability of a data subject shall not adversely affect the rights and freedoms of others.

Right to object
1. The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; or where processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child or (processing carried out by public authorities in the performance of their tasks) including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

2. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

3. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

4. This right to object should be brought to the notice of the data subject at the very first communication and shall be presented clearly and separately from any other information.

5. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications.

6. Where personal data are processed for scientific or historical research purposes or statistical purposes Article 89(1), the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

Right to withdraw consent

Where the processing is based on the data subject having given consent to the processing of his or her personal data for one or more specific purposes except where Union or Member State law provide that the prohibition the right to withdraw his or her consent may not be lifted by the data subject; or where consent to processing of his or her personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation the data subject has the right to withdraw the consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Time frame to respond to requests

If you exercise any of your rights under the General Data Protection Regulations such as access to and rectification or erasure of personal data or the exercise of the right to object, Autotowing Ltd. (the Controller) is obliged to respond to requests without undue delay and at the latest within one month and if Autotowing Ltd. failed to comply with your requests, Autotowing Ltd. must give you reasons why.

Mechanisms for the right to request from the controller, access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability are available through Autotowing Ltd.

How a Data Subjects may verify the accuracy or request to amend their personal data? A data subject may verify that their personal data submitted to Autotowing Ltd. is accurate by double checking their data that they entered before submitting the details to Autotowing Ltd. In the event of any inaccuracy being discovered in any e-mails or other communications the data subject may send an e-mail to Autotowing Ltd. at bob@autotwing.ie informing us of the inaccuracy and the relevant corrections required. Autotowing Ltd. will rectify any inaccurate data highlighted.

How to exercise your data subject rights?

Similarly, if a data subject wishes to request their personal data to be deleted, or wishes to request the portability of their personal data or to access their personal data, withdraw their consent to the processing of same, the data subject may e-mail Autotowing Ltd. at bob@autotwing.ie and request it. However, the data subject should note that the personal data that is processed under ‘legal obligation’ cannot be deleted until the required period of retention has expired, which is listed in the attached appendix. Regarding the consent withdraw, if the data subject consented to more than one form of processing, the data subject should clarify if the withdrawal is in respect of all processing of their personal data or in respect of one or more purposes of processing their personal data.

The controller is obliged to respond to a data subject request without undue delay and in any event within one month and where the controller does not comply with the request the controller is required to give reasons for such non-compliance.

Right of Data Subject to lodge a complaint with the Supervisory Authority

The data subject has the right to lodge a complaint with the supervisory if he or she feel that any of their rights under the General Data Protection Regulations have been infringed and the data subject also has a right to seek judicial remedy to any such infringement.

The Data Commissioner in Ireland may be contacted by

Telephone	+353 57 8684800 +353 (0)761 104 800
Fax	+353 57 868 4757
E-mail	info@dataprotection.ie
Postal Address	Data Protection Commission Canal House Station Road Portarlington R32 AP23 Co. Laois.
	Dublin Office 21 Fitzwilliam Square Dublin 2 D02 RD28 Ireland.

Right to an effective judicial remedy against a controller or processor

Each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with the GDPR.

Right to Representation of data subjects

Each data subject shall have the right to mandate a not-for profit body, organisation or association properly constituted in accordance with the law and that is active in the field of the protection of data subject's rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf.

Right to Representation of data subjects

Right to compensation

Any person who has suffered material or non-material damage as a result of an infringement of the GDPR shall have the right to receive compensation from the controller or processor for the damage suffered.

Security of Personal Data

Autotowing Ltd. endeavour to hold all personal data securely in accordance with our internal security procedures and applicable laws. Autotowing Ltd. will protection of your personal data and prevent any unauthorised access to it or unauthorised use of your personal data.

Unfortunately, no data transmission over the Internet or any other network can be guaranteed as 100% secure. As a result, while we strive to protect your personal data, we cannot ensure and do not warrant the security of any information you transmit to us, and this information is transmitted at your own risk.

Risks & Safeguard

The greatest risk to personal data is that of unlawful access. Autotowing Ltd. has addressed and mitigated such potential risk by the implementation of technical and organisational measures to protect personal data it processes.

Rules in relation to the processing of personal data

The terms and conditions in relation to the processing of personal data are set out in the implemented GDPR Policies and procedures designed to protect personal data during it processing by Autotowing Ltd.

Contact Details of Autotowing Ltd.

Telephone: (061 )377496

Postal Address: Coolready, Castleconnell, Co. Limerick

Email: b ob@autotwing.ie

Website: https://www.autotowing.ie/

If you wish to request any information about your personal data or believe that we are holding incorrect personal data on you, please contact bob@autotwing.ie

Provision of the contents of Privacy Notice Orally

If a data subject wishes to receive the information contained in this privacy notice orally, the information in this privacy notice will be so provided orally. In order to arrange for this to occur the data subject will be required to make this request via an e-mail to bob@autotwing.ie while providing a contact phone number and a suitable time for the delivery of the information contained within this document to the intended recipient or by phoning the business on (061 )377496 and requesting same. Arrangements will then be made for a member of Autotowing Ltd. to phone the intended recipient and provide all the contents of Autotowing Ltd.’s Privacy Notice to him or her orally and we will also ascertain that the recipient understands the information that has been provided to them.

Browsing our Website

Every time you connect to our website, our Cookies operate as outlined hereunder in the list of cookies used by our business. The purpose of cookies is listed hereunder.

Cookies

Autotowing Ltd. use Cookies^{^[1]} as are listed hereunder.

Cookies	Domain Name	Purpose
SL_C_23361dd035530_DOMAIN	.autotowing.ie	Temporary cookie used to detect the base domain. This cookie is removed as soon as the domain is detected.
SL_C-23361dd035530_KEY	Autotowing.ie	(Smartlook) This is the project key, specific to each project that you add to your Smartlook dashboard – expires 2 years
SL_CC23361dd035530_SID	Autotowing.ie	(Smartlook) This is the session ID, that is assigned to each new session that is being recorded – expires 2 years
SL_C_23361dd035530_VID	Autotowing.ie	(Smartlook) This is the visitor ID, assigned to each new visitor. There can be various SIDs under one VID – expires 2 years
_ga	Autotowing.ie	Used by Google to distinguish visitors to the site– expires 2 years
_ga_001K7LM90V	.autotowing.ie
-gat	Autotowing.ie
-gid	Autotowing.ie	A Unique ID used by Google to generate statistical data on how the visitor uses the website – expires 24 hours
_hjIncludedInSessionSample_680640	.autotowing.ie
_hjSessionUser_680640	Autotowing.ie
_hjSession_680640	Autotowing.ie
_hjTLDTest	Autotowing.ie
Twk_uuid_5a85b495d7591465c707b465	Autotowing.ie
PHPSESSID	www.autotowing.ie	The PHPSESSID cookie enables websites to establish a user session and to pass data via a temporary cookie, which is commonly referred to as a session cookie.
TawkConnectionTime	www.autotowing.ie	This cookie remembers the end user so that past chat conversations can be identified to improve service.

Managing cookies in your browser
Use the tools and options in your web browser if you do not wish to receive a cookie. You can easily delete and manage cookies that have been installed in the cookie folder of your browser by following the instructions provided by your particular browser manufacturer.
You may consult your device documentation for information on how to disable cookies.

To learn more about cookies you can visit http://www.allaboutcookies.org / which has a comprehensive guide on cookies and on how to restrict / delete them for most common browsers.

Third party Websites and Links Please note that you may have cookies placed on your computer by third parties’ websites that refer you to our website. Please review the privacy policies of each of their websites you visit to better understand their privacy practices. We would like to inform you that anytime you click on links (including advertising banners), which take you to third party websites, you will be subject to the third parties ‘privacy policies’.

While our website may contain links to other sites operated by third parties, we do not control such other sites and are not responsible for their content, their privacy policies or their use of personal data including any personal or financial information collected by third party’s payment processors to process payments in relation the business. Our inclusion of such links does not imply any endorsement of the content of such sites or of their owners or operators except as stated on our website. Any information submitted by you directly to these third parties is subject to that third party’s privacy policy.

Automated Decision Making (Profiling)

No Data Profiling occurs during the processing of personal or special category of data by the Autotowing Ltd.

Under the GDPR you have the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affecting you, however, this shall not apply if a decision is necessary for entering into or performance of a contract between you and the data controller, or is authorised by European Union or Member State law or where you have given explicit consent for such processing.

If your personal data was subjected to automated decision-making, including profiling you are entitled to be notified of the existence of such processing and information about the logic involved as well as any significance and the envisaged consequences of such processing for you as well as the right to obtain human intervention on the part of the controller in such processing, the right to express your point of view and the right to contest the decision.

Where decisions are based solely on automated processing, including profiling, the controller will ensure that they are not to be based on special categories of personal data unless they are processed under a contract, member state law, explicit consent or in the public interests and that suitable measures are in place to safeguard the data subject's rights and freedoms and legitimate interests.

Account management
Autotowing Ltd. may use your contact details
i. providing account management,
ii. maintaining our business accounts and records.

Market Research and Surveys

Autotowing Ltd. Does not engage in market research or surveys.

Email Communications

Autotowing Ltd. adhere to the following guidelines in relation to our email communications:
• emails will clearly identify us as the sender.
• emails sent for marketing purposes (if you consented to receiving same) will include an option to unsubscribe from future email messages.
• you may unsubscribe from our mailing lists, with the exception of any emails regarding legal notices, or invoicing etc.
• any third parties who send emails on our behalf will be required to comply with legislative requirements on unsolicited emails and the use of personal data.
• We send emails from our email addresses at: bob@autotwing.ie

If you receive an email which claims to come from us but does not, use this domain, or if you are suspicious that an email may not be approved by us, then please send a copy of the email to bob@autotwing.ie so we can investigate.

Links

This Privacy Notice applies to personal data collected by Autotowing Ltd. If an email or website contains links to a third-party site, please be aware that we are not responsible for the content or privacy practices of such site. We encourage our users to be aware when they leave our Site, and to read the Privacy Notice of other sites that collect personal data.

Notification of changes

We reserve the right to amend or vary this Privacy Notice at any time and the revised Notice will apply from the date posted on the website. Autotowing Ltd. will provide a link to our Privacy Notice on all electronic correspondences in order to keep you abreast of the contents of this Notice. Data Subjects will be notified of the changes made.

Reviews of Autotowing Ltd. compliance with the GDPR
Reviews of Autotowing Ltd. compliance with the General Data Protection Regulations and Data Protection Acts will be conducted yearly.

Appendix “A”

Customer Personal and Special Category Data and Purpose of Processing

Category	Personal (P) / Special (S)	Purpose of Processing of Data	Duration of Retention of Data	Lawful Basis of Processing Personal Data
Customer’s Forename	P	Identification of customer.	Digital Accounts Package retained for a period of 4 years, a manual hard copy of records is retained 7 years for revenue regulations, digital data automatically deleted after 4 years.	Legal Obligation dismantling vehicles, Contractual Obligation payment of fines, returning vehicles / property, legitimate interest for other customers business.
Customer’s Surname	P	Identification customer.	Digital Accounts Package retained for a period of 4 years, a manual hard copy of records is retained 7 years for revenue regulations, digital data automatically deleted after 4 years.	Legal Obligation dismantling vehicles, Contractual Obligation payment of fines, returning vehicles / property, legitimate interest for other customers business.
Customer’s Address	P	Identification of customer and communication purposes.	Digital Accounts Package retained for a period of 4 years, a manual hard copy of records is retained 7 years for revenue regulations, digital data automatically deleted after 4 years.	Legal Obligation dismantling vehicles, Contractual Obligation payment of fines, returning vehicles / property, legitimate interest for other customers business.
Insurance Policy Number	P	Required for the purpose of identifying the vehicle for the purpose of insurance companies and or payment of services provided.	Digital Accounts Package retained for a period of 4 years, a manual hard copy of records is retained 7 years for revenue regulations, digital data automatically deleted after 4 years.	Legitimate interest in relation to towing of vehicles, returning vehicles / property towed by Autotowing Ltd.
CCTV Recording	P	CCTV systems are installed internally and externally in the business for the purpose of enhancing security of the business, and its associated equipment, to deter crime and anti-social behaviour, to Assist in the investigation, detection and prosecution of offences, to monitor areas in which cash and or goods are handled, to maintain good order and to provide a safe environment for all staff, Customers, visitors and the general public and for verification purposes and dispute-resolution, particularly in circumstances where there is a dispute as the facts and the recordings may be capable Of resolving that dispute, for the taking and defence of litigation, as well as for the purpose of creating a mindfulness among the occupants, that at any one time a surveillance security system is In operation in the external environs of the premises during both daylight and night time hours each day.	CCTV recordings / images will not be retained for longer than 30 days, unless required as part of a criminal investigation or court proceedings (criminal or civil) or other bona fide use as approved by the Controller.	‘Legitimate Interests’
Customer’s Eircode	P	Identification of customer.	Digital Accounts Package retained for a period of 4 years, a manual hard copy of records is retained 7 years for revenue regulations, digital data automatically deleted after 4 years.	Legal Obligation dismantling vehicles, Contractual Obligation payment of fines, returning vehicles / property, legitimate interest for other customers business.
Customer’s Telephone number	P	Communication with customer.	Digital Accounts Package retained for a period of 4 years, a manual hard copy of records is retained 7 years for revenue regulations, digital data automatically deleted after 4 years.	Legitimate interest’ in respect of customers who requires the towing of vehicles by Bob Sweeney and Autotowing Ltd.
Customer’s e-mail address	P	Processed for communication with customer and forwarding of records in relation to dismantling of a vehicle.	Digital Accounts Package retained for a period of 4 years, a manual hard copy of records is retained 7 years for revenue regulations, digital data automatically deleted after 4 years.	Legal Obligation in respect of dismantling of a vehicle and legitimate interests for communication.
Vehicle Registration Number	P	Processed for the identification, towing, dismantling, payment of a fine, releasing of seized vehicles, returning of property, technical examination, revenue requirements (as applicable).	Digital Accounts Package retained for a period of 4 years, a manual hard copy of records is retained 7 years for revenue regulations, digital data automatically deleted after 4 years.	Legal Obligation dismantling vehicles, Contractual Obligation payment of fines, returning vehicles / property, legitimate interest for other customers business.
Signature of Customer	P	Required for the purpose of identification, verification and receipt purposes.	Digital Accounts Package retained for a period of 4 years, a manual hard copy of records is retained 7 years for revenue regulations, digital data automatically deleted after 4 years.	Legal Obligation dismantling vehicles, Contractual Obligation payment of fines, returning vehicles / property, legitimate interest for other customers business.
Customer’s Photograph	P	Required for the purpose of identifying persons removing items from or collection of vehicles and as proof of ownership as applicable.	Digital Accounts Package retained for a period of 4 years, a manual hard copy of records is retained 7 years for revenue regulations, digital data automatically deleted after 4 years.	Contractual Obligation for returning of seized vehicles / property seized by the Gardai’, and ‘legitimate interest’ in respect of the returning of vehicles / property towed by Autotowing Ltd.
Proof of Identity (driving licence / passport)	P	Required for the purpose of identifying persons removing items from vehicle or collection of vehicles as well as proof of ownership as applicable.	Digital Accounts Package retained for a period of 4 years, a manual hard copy of records is retained 7 years for revenue regulations, digital data automatically deleted after 4 years.	Legitimate interest in respect of customers vehicles, and contractual for returning seized vehicles / property on behalf of the Gardai.
Telephone Voice Recordings	P	Recording telephone to and from Autotowing Ltd.’s landlines for training, verification, proof of contractual agreements.	All telephone to and from Bob Sweeney & Autotowing Ltd. landlines are recorded for training, verification, proof of contractual agreements.	Retained for the period of 3 months where it is then recorded over
Records of reports to Garda Siochána, Department of Environment and or Insurance companies under mandatory reporting legislation or contractual requirements	P	For the purpose of complying with both legal and contractual obligations.	Digital Accounts Package retains customers details for 4 years, a manual hard copy of records are retained for 7 years due to revenue regulations, digital data automatically deleted after 4 years.	Legal Obligation for dismantling of vehicles, ‘Contractual Obligation for the payment of a fine or returning seized vehicles / property seized by Gardai or vehicles owned by insurance companies.
Name & Address of Owner of Vehicle / or Person Paying Fine / Charges	P	Processed for the purpose of recording details of owner, or of person making payment for contractual and revenue purposes	Retain for 7 years (Current Year plus 6 years in relation to Revenue Regulations).	‘Contract’
Car Make and Type	P	Processed for records purposes, identification, dismantling, financial, revenue and managerial.	Retain for 7 years (Current Year plus 6 years in relation to Revenue Regulations).	‘Legal Obligation in relation to vehicle dismantling and ‘Contract’ in relation to payment of fines, charges and the returning of vehicle / property

Appendix “B”

Employee’s Personal and Special Category Data and Purpose of Processing

Category	Personal(P) / Special (S)	Purpose of Processing	Duration of Retention of Data	Lawful Basis for Processing Personal Data
NAME	P	Processed in relation to the Revenue regulations concerning Pay, Pensions etc. communication and the management and administration of the business.	Retained for current year plus six years as required by Revenue Regulations.	‘Legal Obligation’
ADDRESS	P	Processed in relation to the Revenue regulations concerning Pay, Pensions etc. communication and the management and administration of the business.	Retained for current year plus six years as required by Revenue Regulations.	‘Legal Obligation’
PHONE NUMBER	P	Communication purposes in relation to business transaction(s)	Retained for period of business relationship and two years after last transaction with customer	‘Legitimate Interests’
E-MAIL ADDRESS	P	Communication purposes in relation to business transaction(s)	Retained for period of business relationship and two years after last transaction with customer	‘Legitimate Interests’
PPS. NO.	P	Processed in relation to the Revenue regulations concerning Pay, Pensions etc. communication and the management and administration of the business.	Retained for current year plus six years as required by Revenue Regulations.	‘Legal Obligation’
CONTRACT OF EMPLOYMENT	P	Processed in relation to the Revenue regulations concerning Pay, Pensions, employment law etc. employment law and the management and administration of the business.	Retain for duration of employment plus retain for 7 years (Current year plus 6 years in accordance with Revenue Regulations).	‘Legal Obligation’
EMPLOYEE’S NUMBER OF HOURS WORKED	P	Processed in relation to the Revenue regulations concerning Pay, Pensions etc. the working times act and the management and administration of the business.	Retain for duration of employment plus retain for 7 years (Current year plus 6 years in accordance with Revenue Regulations).	‘Legal Obligation’
EMPLOYEE’S DETAILS OF APPROVED ABSENCES SUCH AS LEAVE, JOB SHARING, CAREER BREAK, MATERNITY LEAVE, PARENTAL LEAVE	S	Processed in relation to the Revenue regulations concerning Pay, Pensions etc. and the management and administration of the business.	Processed in relation to the Revenue regulations concerning Pay, Pensions etc. and the management and administration of the business.	‘Legal Obligation’
EMPLOYEE’S DETAILS OF PATERNITY LEAVE	S	Processed in relation to the Revenue regulations concerning Pay, Pensions etc. and the management and administration of the business.	Retain for 2 years following retirement/resignation or the duration of employment plus Retain for 7 years (Current year plus 6 years in accordance with Revenue Regulations).	‘Legal Obligation’
EMPLOYEE’S DETAILS OF FORCE MAJEURE LEAVE, CARERS LEAVE.	S	Processed in relation to the Revenue regulations concerning Pay, Pensions etc. and the management and administration of the business.	Must be kept for 8 years - statutory requirement Parental Leave Act 1998 or for the duration of employment plus 7 years (Revenue Regulations).	‘Legal Obligation’
EMPLOYEE’S RECORD OF SICKNESS ABSENCE RECORDS / CERTIFICATES	S	Processed in relation to the Revenue regulations concerning Pay, Pensions etc. and the management and administration of the business.	Retain for 7 years (Revenue Regulations) Ir relating to sickness / absence / accident/ injury/ incident do not destroy.	‘Legal Obligation’
EMPLOYEE’S RECORDS OF WORKING TIME ACT (ATTENDANCE HOURS, HOLIDAYS, BREAKS)	P	Processed in relation to the Revenue regulations concerning Pay, Pensions, Working time Act etc. and the management and administration of the business.	Retain for 7 years (Current year plus 6 years in accordance with Revenue Regulations). There is a statutory requirement to retain for 3 years	‘Legal Obligation’
EMPLOYEE’S PENSION CALCULATION, PENSIONS INCREASES, SALARY CLAIM FORMS	P	Processed in relation to the Revenue regulations concerning Pay, Pensions etc. and the management and administration of the business.	Duration of employment + Retain for 7 years (Current year plus 6 years in accordance with Revenue Regulations) or for the life of employee / former employee (whichever is the longer).	‘Legal Obligation’
CCTV RECORDING	P	CCTV systems are installed internally and externally in the business for the purpose of enhancing security of the business, and its associated equipment, to deter crime and anti-social behaviour, to Assist in the investigation, detection and prosecution of offences, to monitor areas in which cash and or goods are handled, to maintain good order and to provide a safe environment for all staff, Customers, visitors and the general public and for verification purposes and dispute-resolution, particularly in circumstances where there is a dispute as the facts and the recordings may be capable Of resolving that dispute, for the taking and defence of litigation, as well as for the purpose of creating a mindfulness among the occupants, that at any one time a surveillance security system is In operation in the external environs of the premises during both daylight and night time hours each day.	CCTV recordings / images will not be retained for longer than 30 days, unless required as part of a criminal investigation or court proceedings (criminal or civil) or other bona fide use as approved by the Controller.	‘Legitimate Interests’
FINANCIAL RECORDS - PAYROLL, TAXATION,	P	Processed in relation to the Revenue regulations concerning Financial Records, Pay, Pensions etc.	Revenue Commissioners require that records be kept for current year plus six years after the end of the tax year.	Legal Obligation’
INVOICES/BACK-UP RECORDS/ RECEIPTS	P	Processed in relation to the Revenue regulations concerning Financial Records, Pay, Pensions etc.	Retain for 7 years (Current year plus 6 years in accordance with Revenue Regulations).	‘Legal Obligation’
RECORDS OF ANY SERIOUS INJURIES/ ACCIDENTS ETC	P	Processed for health and safety regulations and insurance purposes	Retain for 7 years (Current year plus 6 years in accordance with Revenue Regulations).	‘Legitimate Interests’
EMPLOYEE’S SIGNATURE	P	Processed in relation to the purpose that the relevant form signed refers to.	Record to be retained for the duration that the relevant form that the employee has signed is required to be retained for.	‘Legitimate Interests’ and ‘Legal Obligation’ as applicable.
EMPLOYEE’S BANK DETAILS	P	Processed in relation to the purpose payment of wages and expenses.	Retain for 7 years (Current year plus 6 years in accordance with Revenue Regulations).	‘Legal Obligation’
COPY OF EMPLOYEE’S DRIVING LICENCE	P	Processed for the purpose of proof of qualification to drive and for the obtaining of insurance in respect of the use of vehicles within the business.	Record to be retained for the duration of employment / insurance cover for vehicles used in connection with the business.	‘Legal Obligation’

Appendix “C”

Creditor’s Personal and Special Category Data and Purpose of Processing

Category	Personal(P) / Special (S)	Purpose of Processing	Duration of Retention of Data	Lawful Basis for Processing Personal Data
Creditor’s Name & Address	P	Processed for the purpose of administration and management of the business’s financial affairs, payment of invoices, keeping of accounts, audits and in accordance with Revenue regulations.	Retain for duration of business relationship, plus 7 years (Current Year plus 6 years in relation to Revenue Regulations).	‘‘Legal Obligation’
Creditor’s Contact Details	P	Processed for the purpose of administration and management of the business’s financial affairs, payment of invoices, keeping of accounts, audits and in accordance with Revenue regulations.	Retain for duration of business relationship, plus 7 years (Current Year plus 6 years in relation to Revenue Regulations).	‘‘Legal Obligation’
Creditor’s PPS Number & Tax Details	P	Processed for the purpose of administration and management of the business’s financial affairs, payment of invoices, keeping of accounts, audits and in accordance with Revenue regulations.	Retain for duration of business relationship, plus 7 years (Current Year plus 6 years in relation to Revenue Regulations).	‘‘Legal Obligation’
Creditor’s Bank Details and Finance Payment Records, Revenue Particulars	P	Processed for the purpose of administration and management of the business’s financial affairs, payment of invoices, keeping of accounts, audits and in accordance with Revenue regulations.	Retain for duration of business relationship, plus 7 years (Current Year plus 6 years in relation to Revenue Regulations).	‘‘Legal Obligation’

Covid-19 Personal and Special Category Data and Purpose of Processing

Category	Personal(P) / Special (S)	Purpose of Processing	Duration of Retention of Data	Lawful Basis for Processing Personal Data
Name	P	This information is processed in relation to the provision of healthcare and the management of public health issues in relation to the Covid-19 Pandemic.	Record to be retained for 4 weeks.	Article 9(2)(i) of the GDPR, Section 53 of the Data Protection Act 2018, Safety, Health and Welfare at work Act 2005 (as amended) in respect of the Covid-19 Pandemic.
Address	P	This information is processed in relation to the provision of healthcare and the management of public health issues in relation to the Covid-19 Pandemic.	Record to be retained for 4 weeks.	Article 9(2)(i) of the GDPR, Section 53 of the Data Protection Act 2018, Safety, Health and Welfare at work Act 2005 (as amended) in respect of the Covid-19 Pandemic.
Details of Attendance (date, times) and any contact tracing related details.	P	This information is processed in relation to the provision of healthcare and the management of public health issues in relation to the Covid-19 Pandemic.	Record to be retained for 4 weeks.	Article 9(2)(i) of the GDPR, Section 53 of the Data Protection Act 2018, Safety, Health and Welfare at work Act 2005 (as amended) in respect of the Covid-19 Pandemic.
Telephone number	P	This information is processed in relation to the provision of healthcare and the management of public health issues in relation to the Covid-19 Pandemic.	Record to be retained for 4 weeks.	Article 9(2)(i) of the GDPR, Section 53 of the Data Protection Act 2018, Safety, Health and Welfare at work Act 2005 (as amended) in respect of the Covid-19 Pandemic.
Health Information or concerns re symptoms or diagnosis of Covid-19 virus	S	This information is processed in relation to the provision of healthcare and the management of public health issues in relation to the Covid-19 Pandemic.	Record to be retained for 4 weeks.	Article 9(2)(i) of the GDPR, Section 53 of the Data Protection Act 2018, Safety, Health and Welfare at work Act 2005 (as amended) in respect of the Covid-19 Pandemic.
Details of any close contact of a confirmed or suspected case of Covid-19	S	This information is processed in relation to the provision of healthcare and the management of public health issues in relation to the Covid-19 Pandemic.	Record to be retained for 4 weeks.	Article 9(2)(i) of the GDPR, Section 53 of the Data Protection Act 2018, Safety, Health and Welfare at work Act 2005 (as amended) in respect of the Covid-19 Pandemic.
If advised by Dr to Cocoon	S	This information is processed in relation to the provision of healthcare and the management of public health issues in relation to the Covid-19 Pandemic.	Record to be retained for 4 weeks.	Article 9(2)(i) of the GDPR, Section 53 of the Data Protection Act 2018, Safety, Health and Welfare at work Act 2005 (as amended) in respect of the Covid-19 Pandemic.
If advised by Dr to self-isolate	S	This information is processed in relation to the provision of healthcare and the management of public health issues in relation to the Covid-19 Pandemic.	Record to be retained for 4 weeks.	Article 9(2)(i) of the GDPR, Section 53 of the Data Protection Act 2018, Safety, Health and Welfare at work Act 2005 (as amended) in respect of the Covid-19 Pandemic.
Position of Employment	P	This information is processed in relation to the provision of healthcare and the management of public health issues in relation to the Covid-19 Pandemic.	Record to be retained for 4 weeks.	Article 9(2)(i) of the GDPR, Section 53 of the Data Protection Act 2018, Safety, Health and Welfare at work Act 2005 (as amended) in respect of the Covid-19 Pandemic.
Confirmation of completion of Return-to-Work induction Covid-19 training	P	This information is processed in relation to the provision of healthcare and the management of public health issues in relation to the Covid-19 Pandemic.	Record to be retained for 4 weeks.	Article 9(2)(i) of the GDPR, Section 53 of the Data Protection Act 2018, Safety, Health and Welfare at work Act 2005 (as amended) in respect of the Covid-19 Pandemic.
Travel Details	P	This information is processed in relation to the provision of healthcare and the management of public health issues in relation to the Covid-19 Pandemic.	Record to be retained for 4 weeks.	Article 9(2)(i) of the GDPR, Section 53 of the Data Protection Act 2018, Safety, Health and Welfare at work Act 2005 (as amended) in respect of the Covid-19 Pandemic.
Signature of Person	P	This information is processed in relation to the provision of healthcare and the management of public health issues in relation to the Covid-19 Pandemic.	Record to be retained for 4 weeks.	Article 9(2)(i) of the GDPR, Section 53 of the Data Protection Act 2018, Safety, Health and Welfare at work Act 2005 (as amended) in respect of the Covid-19 Pandemic.

^{^[1]} A cookie is a piece of text that gets entered into the memory of your browser by a website, allowing the website to store information on your machine and later retrieve it. Cookies can also enable the tracking and targeting of the interests of users to enhance the onsite experience.

PHPSESSID

www.autotowing.ie

The PHPSESSID cookie enables websites to establish a user session and to pass data via a temporary cookie, which is commonly referred to as a session cookie.

TawkConnectionTime