RDS Privacy Policy

Introduction

This is the Privacy Policy of the Royal Dublin Society, which is referred to as the “RDS”, "Society", “us” or “we” throughout this Privacy Policy. The RDS is a registered charity (number 20002008, CHY number 1325) with an address at: Merrion Road, Ballsbridge, Dublin 4, D04 AK83.

The Society was founded in 1731 to support Ireland to thrive economically and culturally. Funded by our commercial operations, the RDS continues this mission today through our philanthropic work programme that spans across science, the arts, agriculture, business and equestrianism.

The Data Controller of your Personal Data under this policy and for the purposes of Data Protection Law is the RDS. The Data Protection Officer of the RDS can be contacted regarding privacy matters at privacy@rds.ie

The purpose of this Policy is to explain and ensure transparency in relation to the following points: what personal data we process; why we process data; how we process data; how we keep data safe and secure; the legal basis for processing data; how long we retain data for as well as the rights people have in relation to their personal data.

 

Lawful Basis for Processing your Data

The RDS processes Personal Data only where a lawful basis exists under Data Protection Law. Depending on the circumstances, processing may be necessary for:

• the performance of a contract;
• compliance with a legal obligation;
• the pursuit of the legitimate interests of the RDS or a third party;
• the protection of the vital interests of an individual; or
• where required, your consent.

The lawful basis applicable to particular processing activities is described throughout this Policy.

 

Information/Personal Data (“Data”) we may collect from you

We collect Data from you which you volunteer when you provide such Data to us, or via our services with which you interact. We may also be given other Data relating to you by other persons, or we may obtain such other Data about you as may be provided to us in the course of our legitimate business activities.

We collect and process the following categories of personal data:

• Identity Data: name, date of birth, nationality
• Contact Data: address, email, phone number
• Financial Data: payment details
• Event Data: booking details, participation records
• Professional Data: employer, role, memberships
• Media Data: photographs, video, CCTV
• Technical Data: IP address, device data, app usage
• Fundraising Data: donation history, engagement indicators
• Special Category Data (where applicable):
  • health data (e.g. allergies)
• Criminal Data (where required by law):
  • Garda vetting information

 

We may also process other data, which is not personal data.

 

RDS WiFi

When you access our website or WiFi facilities, your device’s browser provides us with information such as your IP address, browser type, access time and referring URL which is collected and used to compile statistical data. This information may be used to help us to improve our website and the services we offer, and to offer services to you. When you use our WiFi service, you may be invited to consent to receiving marketing communications from the RDS. Access to the WiFi service is not conditional upon providing such consent.

 

Special Categories of Data

The RDS may process Special Categories of Personal Data, including health information, disability information, safeguarding information and Garda Vetting related information where necessary for:

• compliance with employment and social protection law obligations;
• safeguarding children and vulnerable persons;
• health and safety requirements;
• insurance administration;
• the protection of the vital interests of individuals; or
• where applicable, on the basis of explicit consent.

Such Personal Data will be processed only where an appropriate condition under Article 9 GDPR and applicable Irish law applies.

 

Security and where we store your Data

We are committed to protecting the security and confidentiality of your Data. We use appropriate technological and organisational security measures to protect against unauthorised or unlawful access to or use of personal data and against accidental loss, destruction or damage. We will continue to revise policies and implement additional security features as new technologies become available.

The transmission of information via the internet is not completely secure and may involve the transfer of data to countries outside of the European Economic Area (EEA). This occurs typically through use of cloud solutions for web hosting, email hosting or proprietary software solutions delivered to us through the Cloud. We do not however authorise any third party to use your Data for their own purposes without the appropriate authority.

Where Personal Data is transferred outside the European Economic Area, the RDS will ensure that such transfers are protected by appropriate safeguards in accordance with Chapter V of the GDPR, including adequacy decisions adopted by the European Commission, Standard Contractual Clauses approved by the European Commission, or other legally recognised transfer mechanisms.

 

Data Breach

The GDPR obliges Data Controllers to notify the Data Protection Commission and affected data subjects in the case of certain types of personal data security breaches. Any Data Breaches identified in respect of Personal Data controlled by the RDS will be dealt with in accordance with Data Protection Law and the RDS’s Data Breach Procedure.

 

Data Processors

The RDS will engage carefully chosen service providers to perform certain services on its behalf which may involve the Processing of Personal Data. To the extent that such processing is undertaken based on the instructions of the RDS and gives rise to a Data Controller and Data Processor relationship, the RDS will ensure that such relationship is governed by a contract which includes the data protection provisions prescribed by Data Protection Law.

Categories of recipients with whom the RDS may share Personal Data include:

• event management providers;
• ticketing providers;
• payment processors;
• cloud hosting and IT service providers;
• marketing and communications providers;
• insurers;
• professional advisers;
• regulatory authorities;
• law enforcement agencies; and
• other third parties where required by law or necessary for the provision of services.

The RDS will also act as a Data Processor in certain situations when Processing Personal Data for and on behalf of third parties such as our clients who book events with us. Where the RDS acts a Data Processor, we will ensure that such relationship is governed by a contract which includes the data protection provisions prescribed by Data Protection Law.

 

Uses made of your Data

We use your Data that we hold to:

Provide you with information, products or services which you have requested from us and, where permitted by applicable law, send direct marketing communications where you have consented or where another lawful basis applies.

carry out our obligations arising from any contracts entered into between you and us;

in our legitimate interest of advertising our services, provide details of any loyalty scheme or promotion;

comply with legislation; and/or notify you about changes to our services.

 

Processing Activities

The following processing activities are carried out for the purposes of a legitimate interest pursued by the Society:

 

RDS Events: In order for us to achieve our charitable aims and objectives, we organise and run a number of RDS Foundation events annually. These include the Dublin Horse Show, the RDS Visual Arts Awards and the RDS Agricultural Awards, among others.  We keep a record of your participation at our events as an attendee, presenter or participant.

 

Members: To send you information about Member events, RDS Elections and Notices of the Stated Annual General Meeting, and other member-related events.

 

Attendees: If you register for or purchase tickets for an RDS event and you are a Member, we will access the information in your Member account to provide you with information and services associated with the event. If you are not a Member and you register for one of our events, we will collect your name and contact information, which we will store in our database(s) and use to provide you with information and services associated with the event.

 

Presenters: If you are a presenter at one of our events, we will collect information about you including your name, employer and contact information, and we may also collect information provided by event attendees who evaluated your performance as a presenter.

 

Participants: When you submit an application/entry/project to an RDS event, you provide us with your Data. We use this information to keep a record of your participation and to correspond with you in relation to your application/entry/project and for the administration and management of our event. Appropriate data may be shared with relevant people associated with our events including: members of judging panels, RDS Committees, attendees and other participants at events.

 

Videography and Photography: The RDS is a public place and a reduced expectation of privacy applies when you are on the RDS campus. Therefore, when you attend an event at the RDS you may be photographed and/or filmed/recorded by the RDS or by any third party authorised by the RDS. The images resulting from the photography, videography or recordings, and any reproductions or adaptations of same, may be used for promotion, publicity and/or other purposes to assist the RDS in the provision of its chartable aims.

Appropriate data may also be shared publicly for communications purposes on digital platforms (including social platforms), and through publications, media (including newspapers, television and radio), and advertisements.

When we intend to record or photograph an event, we will inform you of this fact via our Public Announcement system. Clear visible signage will also be placed around the area(s) where the event is taking place.

Individuals may object to the processing of their Personal Data for these purposes by contacting the RDS Data Protection Officer at privacy@rds.ie  The RDS will consider any such objection in accordance with Data Protection Law and will assess whether compelling legitimate grounds exist for continuing the processing.

 

Volunteers: If you volunteer for the RDS, for example, if you act as a judge or steward at an RDS Event, you provide us with your Data. If you’re a volunteer then we may collect information about you (e.g. references, criminal records checks, details of emergency contacts, medical conditions etc.). This information will be retained for legal or contractual reasons, to protect us (including in the event of an insurance or legal claim) and for safeguarding purposes.

 

Children’s data: We collect personal data relating to children who attend our events and process it in a way which is appropriate to the age of the children.  Where consent is required in relation to processing the Personal Data of children, the RDS will seek consent from a parent or legal guardian in accordance with applicable Data Protection Law.

Our events have specific rules about whether children can participate and we will make sure advertising for those events is age appropriate.

 

Employment: Processing of employees’ personal data for employment purposes including payroll administration, general personnel administration and RDS management.

 

In connection with a job application or related inquiry, you may provide us with personal information including a resume, cover letter, or similar employment-related materials. This information will be used for the purpose of processing and responding to your application for current and future career opportunities.

 

CCTV: The Society employs CCTV for the security of its staff, visitors and property. To ensure the security and safety of visitors and staff, the RDS uses CCTV located throughout its premises covering buildings, internal spaces, car parks, roads, pathways and grounds. The RDS CCTV system is implemented in a proportionate manner as necessary for the legitimate interest of the security of staff, and visitors including visitors to the RDS premises (to protect their vital interests) and to protect RDS property against theft or pilferage.

Images are not stored beyond a period of one month, except where incidents or accidents have been identified in which case such footage is retained specifically in the context of an investigation of that issue. CCTV footage is not disclosed to third parties except where disclosure is required by law (such as for the purpose of preventing, detecting or investigating alleged offences) and in such instances disclosure is based on a valid request. Signage indicating that CCTV is in use is displayed prominently throughout the RDS sites.

The CCTV system is operated in accordance with the provisions of the Society’s CCTV Policy & Procedure.

 

Fundraising & Philanthropy: We work to secure philanthropic support for the Society’s Foundation Programme. In order to do this, we maintain a database that contains Data collected by the Society during the course of its relationships with Members and other sponsors. The majority of the information we hold is obtained directly from you, but there may be some additional data which we have been obtained from publicly available sources, such as publicly available websites, professional profiles, published directories, media publications, or information lawfully provided by third parties.

Unless you have requested otherwise, this Data will be used and processed for a range of engagement activities and programmes. This processing is carried out to assist us in securing funds for the provision of our charitable aims

 

Business Contact and Customer Relationship Management: We collect and maintain information about our Customers and Clients, which may include company name, business contact name and title, phone number, email and other contact details. We may also collect billing address, financial account, credit card information, order details, subscription and license information, and usage details.

 

Maintenance of “do not contact” lists (suppression lists): If you ask the RDS not to contact you by email at a certain email address, the RDS will retain a copy of that email address on its “master do not send” list in order to comply with your no-contact request.

 

Provision of Services: We may compile and process your information to help us understand trends in our customer behaviour and to understand our risks better, including for providing management information, operational and data risk management.

 

Marketing: We may use your identity, contact, transactional history, profile data and communications data to form a view on what we think you may like, or what may be of interest to you, and to send you details of upcoming events, products, offers and news which may be relevant for you. You may opt-out of receiving such emails by following the instructions in each promotional email we send you. In addition, if at any time you wish not to receive future communications, or you wish to have your name deleted from our mailing lists, please contact us at privacy@rds.ie

 

Testimonials: We collect and display personal testimonials of satisfied clients and users in addition to other endorsements for marketing purposes. With your consent, we may post your testimonial along with your name. If you wish to update or delete your testimonial, please contact privacy@rds.ie

 

Competitions

When you enter a competition, we will make use of and process the personal data you provide in connection with the competition to administer the Competition, and to contact you in respect of advertising, marketing, promotional and publicity material and any other items which will be set out in the terms and conditions of the competition.

The information you provide may be shared with Sponsors and Partners where necessary for the administration of the competition. Any transfer of Personal Data outside the European Economic Area shall be subject to appropriate safeguards in accordance with Chapter V GDPR.

 

Garda Vetting

As stipulated in the National Vetting Bureau (Children and Vulnerable Persons) Act 2012 all RDS staff, volunteers, voluntary officers and other individuals who provide services to the RDS and who interact with children or vulnerable persons must be vetted by An Garda Síochána.

Garda Vetting is a procedure through which An Garda Síochána is asked, with a person’s permission, to disclose any information held on Garda file. The vetting process requires the provision of verified proof of identify and proof of address by all vetting candidates and, subsequently, checks by An Gardaí Síochána of their records.

The purpose for processing your Data in this context is that it is necessary to comply with our legal obligations under the National Vetting Bureau (Children and Vulnerable Persons) Act 2012.

 

Social Media promotions and competitions

We may use your data to send you information relating to our services, events and products which may be of interest to you. If you do not want us to use your data in this way, please notify us to that effect at privacy@rds.ie

 

Data Retention

The RDS retains Personal Data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, regulatory, contractual, accounting and reporting obligations. Retention periods vary depending on the nature of the data and the purpose for which it is processed. Where Personal Data is no longer required, it will be securely deleted or anonymised.

Data Type	Retention Period
Event records	7 years
Financial data	7 years
CCTV	31 days
Marketing data	Until withdrawal of consent
Recruitment data	12–24 months

 

 

Disclosure of your information

We may disclose your Data to third parties who provide a service to us or in the event that we sell or buy any business or assets, in which case we may disclose your Data to the prospective seller or buyer of such business or assets or if we are under a duty to disclose or share your Data in order to comply with any legal obligation, or to protect our rights, property, or safety of staff or customers. Currently we disclose your Data to the following providers.

Where Personal Data is transferred outside the European Economic Area, the RDS will ensure that such transfers are protected by appropriate safeguards in accordance with Chapter V of the GDPR, including adequacy decisions adopted by the European Commission, Standard Contractual Clauses approved by the European Commission, or other legally recognised transfer mechanisms.

 

Miscellaneous

We do not conduct profiling.

Where we process your Data based only on your consent, you may withdraw your consent at any time by contacting us at privacy@rds.ie

You have the right to bring a complaint to a supervisory authority if you have any complaints about the processing of your Data. In Ireland, the Data Protection Commission is the supervisory authority and their website is: www.dataprotection.ie

In circumstances where the provision of your Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, we will advise you at the point of collecting your Data whether the Data is a required field, and the consequences of not providing the Data.

Where your Data is not provided by you, we will set out what the categories of Data are and where we obtained the Data from.

 

Payments

We may need to collect the following information, as it is necessary for the adequate performance of the contract with you and to comply with applicable law (such as anti-money laundering regulations).

When you make payments, we require certain financial information (like your bank account or credit card information) in order to process payments and comply with applicable law.

Identity Verification and Other Information. We may require identity verification information, in order to comply with applicable law.

How we use the payment data collected:

• Enable you to pay for our products and services.
• Detect and prevent fraud, abuse, security incidents, and other harmful activity.
• Conduct security investigations and risk assessments.
• Conduct checks against databases and other information sources.
• Comply with legal obligations (such as anti-money laundering regulations).
• Enforce our payment terms.

We process this information in our legitimate interest in providing goods and services and where it is necessary for the performance of the contract with you and to comply with applicable laws. 

 

Postal Marketing

We may market to you by post. If you wish to be removed from our list (opt-out), at any time, you can do so by contacting us at the address at the bottom of each communication you receive from us.

 

Digital Marketing

If you are not a customer, you may still opt to receive electronic or telephonic marketing communications from us which we consider may be of interest to you. You will be asked to opt-in if you wish to receive these. If you wish to be removed from our list (opt-out), at any time, you can do so by clicking on the unsubscribe link at the bottom of each communication you receive from us.  You can also opt out by contacting the Data Protection Officer at privacy@rds.ie

 

Your rights

You have rights under EU law and Irish law in relation to the processing of your Personal Data by the RDS. These rights can be stated as follows:

 

• Right to access data relating to you (‘access right’)
• Right to be informed about the processing of your data (‘right to information’)
• Right to rectify/correct data relating to you (‘right to rectification’)
• Right to object to processing of data relating to you (‘right to object’)
• Right to restrict the processing of data relating to you (‘right to restriction’)
• Right to erase/delete data relating to you (i.e. the “right to erasure”)
• Right to ‘port’ certain data relating to you from one organisation to another (‘right to data portability’)
• Right to not be subject to decisions based solely on automated processing, including profiling

 

In addition to the distinct legal rights set out above, there are some additional rights. Where processing is based on consent, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal. You have the right to object at any time to the processing of Personal Data for direct marketing purposes. Finally, you have the right to lodge a complaint with the Data Protection Commission where you believe your Personal Data has been processed in breach of Data Protection Law.

 

Other Websites

Our website contains links to other websites. This privacy policy only applies to RDS websites so when you link to other websites you should read their own privacy policies. Please that we do not accept any responsibility or liability for those policies.

 

Changes to this policy

We reserve the right to change this Policy from time to time in our sole discretion. If we make any changes, we will post those changes here so that you can see what information we gather, how we might use Data and in what circumstances we may disclose it. Any material changes to this Policy will be notified through our website or by other appropriate means. Where required by law, we will obtain your consent to such changes.

 

Contact Us

Questions, comments, requests and complaints regarding this Policy and the information we process are welcome and should be addressed to the Registrar or Data Protection Officer by email: privacy@rds.ie or by telephone: +353 1 240 7200 All requests will be dealt with promptly, efficiently and within the legally prescribed timeframe.

 

Schedule 1 - Data Protection Notice for Wired Network Access

 

This Data Protection Notice together with any disclaimers sets out the basis on which any personal data we collect from you or that you provide to us, or that is provided to us relating to you in the course of providing you with access to our wired network ("Data for Network Access") by any means will be processed. Please read the following carefully to understand our use of Data for Network Access. Please note that the Statement relates only to living individuals in relation to personal data relating directly to themselves, and not to persons in any other capacity.

 

This Data for Network Access will be processed by the Royal Dublin Society of Ballsbridge, Dublin 4 (registered charity number 20002008) (the "RDS").

 

The RDS will process certain Data for Network Access about you in the course of providing you with access to its wired network so that you may access the internet.  The RDS will be the controller of this Data for Network Access. The Data for Network Access which the RDS will process is the IP address of your connected device.

 

The Basis and Purposes for this Processing

The RDS processes this personal data on the basis of pursuing the following purposes which are in its legitimate interests:

 

to facilitate full monitoring of usage and to ensure that you abide by the Network Access Terms and do not use your access to the RDS' wired network for any of the purposes noted in the "Inappropriate Use" section of the Network Access Terms;

to ensure connectivity to our network;

to troubleshoot network issues;

to monitor network performance; and

to comply with applicable laws, regulations or requests of law enforcement agencies.

The RDS has determined that this processing is necessary to pursue these purposes and has carefully considered the impact of these processing activities on your fundamental rights and freedoms.  The RDS will not process such Data for Network Access where its legitimate interests are outweighed by the impact on your rights and freedoms (unless otherwise required or permitted by law).

 

Disclosure, Security and Retention of Data for Network Access

The RDS may disclose some or all of this Data for Network Access to regulatory authorities and law enforcement agencies; and trusted third party ICT service providers.

The RDS stores and processes this Data for Network Access on servers located within the European Economic Area (the "EEA"). The RDS shall only transfer this Data for Network Access outside the EEA where the European Commission has decided that the third country in question ensures an adequate level of protection in line with EU data protection standards or there are appropriate safeguards in place to protect this personal data. 

 

Once the RDS has received your personal data, it shall use strictly maintained physical, electronic and procedural safeguards to prevent unauthorised access.

 

Generally the RDS shall only retain this personal data for as long as you avail of access to the wired network but in certain circumstances it may hold your personal data for a longer period, for example, if it is processing an ongoing claim or believes in good faith that the law or a relevant regulator may reasonably in its view expect or require it to preserve this Data for Network Access.

 

Contacting the RDS about your Data for Network Access

If you have questions or concerns about the way your Data for Network Access is being processed by the RDS, you may contact the RDS by sending an email to privacy@rds.ie.

 

Glossary

In this Privacy Policy, the terms below have the following meaning:

 

"Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed.

 

"Data Controller" means the entity which, alone or jointly with others, determines the purposes and means of the processing of Personal Data.

 

"Data Processor" means the party that Processes Personal Data on behalf of the Data Controller and on their documented instructions.

 

"Data Protection Law" means the General Data Protection Regulation (No 2016/679) ("GDPR") and the Data Protection Acts 1988 to 2018 and any other laws which apply to the RDS in relation to the Processing of Personal Data.

 

"European Economic Area" or "EEA" means the member states of the European Union together with Iceland, Liechtenstein and Norway.

 

"Personal Data" is any information relating to a living individual which allows the identification of that individual. Personal Data can include a name, an identification number, details about an individual’s location, or any other information that is specific to that individual.

 

"Processing" means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. "Process" and "Processing" are interpreted accordingly.

 

"Special Categories of Personal Data" are types of Personal Data that reveal any of the following information relating to an individual: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership. "Special Categories" of Personal Data also include the Processing of genetic data, biometric data (or example, fingerprints or facial images), health data, data concerning sex life or sexual orientation and any Personal Data relating to criminal convictions or offences.