INVESTMENT FIRM PRIVACY NOTICE
This Data Protection Notice ("Notice") sets out the basis on which the Investor Compensation Company D.A.C. (“ICCL”, “we” or “us”) of c/o Central Bank of Ireland, PO Box 11517, Spencer Dock North Wall Quay, Dublin 1 uses any personal data we collect about you. The ICCL collects information about investment firms which, in limited circumstances, may include personal data relating to staff, officers and partners associated with a firm.
This personal data is collected directly from investment firms in their engagement with the ICCL (for example by filling in forms or by corresponding with us by telephone, post, email or otherwise) and also from the Central Bank of Ireland, the insurance undertaking to whom your firm is tied and approved professional bodies from time to time. We will also collect your personal data through your interaction with our website, https://www.investorcompensation.ie (for example, we will automatically collect data about your equipment, browsing actions and patterns).
The Investor Compensation Company D.A.C. will be a controller (for the purpose of applicable data protection law) in respect of any personal data it collects.
It is important that you read this privacy notice together with any other privacy notice or fair processing policy we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy notice supplements other notices and privacy policies and is not intended to override them.
We will collect, use, store and process the following categories of personal data.
Firm Data (including certain personnel details):
In certain cases (e.g. where the firm is a sole trader), the details we collect about a firm either through our website or through your engagement with us (such as firm name, email address and phone number) will constitute personal data. We will also publish details of the authorised status of firms on the Contributor Database.
Authorised Contact & Officer Details:
We collect details of the name, email address and contact telephone number of the main contact within the firm.
In limited circumstances, we may also collect contact details of staff, officers and partners associated with a firm.
If you opt to pay by direct debit, we will collect details of the account holder name(s), the account address, the name of the authorised signatory, BIC and IBAN.
Where levy payments are made over the phone or through the payment card function in myICCL, we collect the amounts owed and discharged, the payee's name and email address and the payment type and details of the card used to effect the payment (such as card-holder name, card number, expiry date and CCV number).
Where you submit queries or messages to ICCL through the contact form on our website or by telephone, we collect details of your name, email address, phone number and message.
We collect information about your computer browser including your IP address and other information derived from cookies used on our website. Please see our Cookies Policy for further information.
Aggregate and Anonymous Data:
We also collect, use and share aggregated data such as statistical data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.
In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes.
HOW & WHY WE PROCESS YOUR PERSONAL INFORMATION
We will use your personal information to correspond with you or in performance of our statutory duties or to provide you with our services (particularly those services available through our website) such as:
- registering for and managing your firm's myICCL Account;
- signing up to receive e-invoicing;
- paying levies by direct debit or by card;
- adding or updating your firm data on the public Contributor Database;
- maintaining our internal database of contributing, defaulting and non-performing investment firms;
- corresponding with you including notifying you of changes to our services or privacy notice or asking you for your feedback on our services or recording our communications with you; and
- to deal with any requests and/or queries which we receive from you and to keep a record of your correspondence with us.
We will also use your personal information to determine the level of contributions payable, to collect payments, to maintain our databases of contributing, defaulting and non-performing investment firms and as otherwise necessary for the performance of the ICCL's duties under the Investor Compensation Act 1998.
We will also use personal information to conduct market research surveys and to provide you with updates, news and statistics relating to ICCL and the investor compensation unless you opt out of receiving these communications.
The ICCL will also anonymise and aggregate data which it receives for its business purposes which may include the sharing of such anonymised data with third parties.
Who we share your data with
Service Providers, Agents & Insurance Providers
We will share your personal data with: (i) our service providers (e.g. website and IT support providers) in order to ensure the security and maintenance of our website and our systems to provide you with the various services available through our website; (ii) our payment processors; and (iii) our agents and insurance providers.
Central Bank of Ireland
We will share your personal data with: (i) our service providers (e.g. website and IT support providers) in order to ensure the security and maintenance of our website and our systems to provide you with the various services available through our website; (ii) our payment processors; and (iii) our agents and insurance providers
In the event that the Central Bank of Ireland determines that a firm is unable to meet its obligations to clients, we may disclose relevant personal data of the authorised contact, officers, staff and partners of the firm to the appointed administrator.
Legal Obligation & Enforcement of Rights
We may also disclose your personal data: (i) where we have a legal obligation to do so (please see below for further information); (ii) to enforce our website terms & conditions or other agreements or to protect our rights; (iii) to protect the safety of users of our website or others.
We will process your data in order to comply with our legal obligations under the Investor Compensation Act 1998, including our obligation to set up and maintain compensation funds.
We may disclose your personal information to third parties such as the Central Bank of Ireland, your firm's approved professional body and/or the insurance undertaking to whom your firm is tied in order to comply with EU or EU Member State law (including the Investor Compensation Act 1998).
We maintain and publish the Contributor Database to enable investors to check whether the firm with which they are investing (or have invested) is a member of the Investor Compensation Scheme.
We process certain personal data on the basis of our legitimate interests, such as in pursuit of our business or security interests. We will process your personal data to test and improve the effectiveness of our website and to monitor metrics such as numbers of visitors, traffic data and demographic patterns and to provide you with access to your firm's myICCL Account (where applicable). We also rely on our legitimate interests to use your personal data in order to respond to your enquiries.
We keep a record of your personal data for a period of 7 years from the date that your firm ceases to be authorised.
Where your information is processed and stored
Your personal information will be stored and processed in Ireland and may also be processed in any other country where ICCL or its service providers maintain facilities. In the event of international transfers, we will ensure the safe transfer of your personal data which will usually be by either: (i) using standard contractual clauses approved by the European Commission; or (ii) adopting or using other equivalent and appropriate safeguards. If you would like more information about international transfers and the mechanism which we use to safeguard your data, please contact us using the details set out below ("Contacting Us").
We are committed to keeping your information safe and secure and we have implemented and will maintain appropriate technical and organisational security measures to prevent loss of or unauthorised access to your information. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
Usernames and Passwords:
Where ICCL has given you (or where you have chosen) a password or username which enables you to access certain parts of our website, you are responsible for keeping this password or username confidential. We ask you not to share this information with anyone except other representatives of your firm who are authorised to access restricted areas of our website.
Some of the pages on our website contain hypertext links to websites which are not maintained by ICCL. You are reminded that the terms and/or privacy statements of such third-party websites will apply to you as a user of such websites. In addition, such websites may not have the same privacy standards that ICCL maintains. We do not accept any responsibility or liability for the policies and standards of third parties. Please check the relevant policies before you submit any personal information to these websites.
The table below sets out the rights which you have to address any concerns or queries with us about our processing of your personal information:
Right of Access:
You are entitled to ascertain what type of personal data ICCL holds about you and what we do with that information. You are also entitled to receive a copy of this information.
Right to Rectification:
You have a right to have any inaccurate personal data which we hold about you updated or corrected.
Right to Restrict Use:
You have a right to stop ICCL from using your personal information in certain cases, including if you believe that the personal information we hold about you is inaccurate or our use of your information is unlawful. If you validly exercise this right, we will store your personal information and will not carry out any other processing until the issue is resolved.
Right to Object:
Where we rely on public interest or our legitimate interest to use your personal information, you have a right to object to this use. We will desist from processing your personal information unless we can demonstrate an overriding legitimate grounds for the continued processing of your personal information.
Right to Erasure:
In certain circumstances, you may also have your personal information deleted, for example if you exercise your right to object (see above) and ICCL does not have any overriding reason to process your personal information or if ICCL no longer requires your personal information for the purposes set out in this notice.
For any queries relating to this privacy notice or more general data protection queries, please contact us at firstname.lastname@example.org or alternatively by post at The Investor Compensation Company D.A.C., c/o Central Bank of Ireland, PO Box 11517, Spencer Dock, North Wall Quay, Dublin 1.
If you are not satisfied with any response you receive from us or have any further issue relating to the manner in which we handle your personal information, you can make a complaint to the Data Protection Commission in Ireland (the “DPC”). For more information, please see www.dataprotection.ie.
We would, however, appreciate the chance to deal with your concerns before you approach the DPC, so please contact us in the first instance.
CHANGES TO THIS NOTICE
ICCL may occasionally update this privacy notice to reflect changes in its business or to comply with applicable law and regulations. If there are material changes to this privacy notice concerning how ICCL uses your personal data, we will notify you by either prominently posting a notice of such changes on our website before they take effect or by directly sending you a notification to the email address attached to your myICCL Account.