Privacy Policy

1
Document Title Privacy Policy
Version V 3.0
Owner DPO Team
Approved by DPO Team
Next Review March 2023
Date 01 March 2022
PRIVACY POLICY
2
Table of Contents
1 General ...................................................................................................................................3
1.1 Servisource Information .........................................................................................................3
1.2 Legislation...............................................................................................................................3
1.3 Queries and Complaints .........................................................................................................3
1.4 Breaches .................................................................................................................................4
2 How Does Servisource Collect Information? ............................................................................4
3 What Does Servisource Use Information For?..........................................................................5
3.1 Process, Purpose, and Lawful Basis ........................................................................................5
4 Who Does Servisource Share Information With? .....................................................................7
4.1 Other Third Parties .................................................................................................................8
4.2 Government Departments, Bodies or Agencies .....................................................................8
4.3 International Transfers ...........................................................................................................8
5 What Type of Information is Collected?...................................................................................8
6 How Long Does Servisource Retain Information?.....................................................................9
7 What Are Your Rights? ............................................................................................................9
7.1 Where do I send requests?.....................................................................................................9
7.2 How long will a request take?...............................................................................................10
7.3 Right of Access......................................................................................................................10
7.4 Right to Rectification ............................................................................................................10
7.5 Right to be Forgotten............................................................................................................10
7.6 Right to Restriction ...............................................................................................................11
7.7 Right to Data Portability .......................................................................................................12
7.8 Right to Object......................................................................................................................12
3
1 General
Servisource Recruitment Limited (‘Servisource’) is committed to protecting all personal,
special, and criminal categories of data held on you.
Servisource is part of the Cpl Group of companies and for data protection purposes, is the
controller and responsible for your personal data.
Servisource Recruitment Limited consists of the following brands and companies, referred
to as ‘Servisource’ throughout this Privacy Notice:
 Recruit Island
 Myhomecare
 Allied Admissions
 Servisource Training
 Servisource Healthcare
 Servisource Occupational Health
As such, Servisource wants you, the ‘data subject’, to understand how Servisource collects,
uses, stores, and shares your personal data. Servisource also wants you understand what
rights you can invoke to help you to protect your privacy. In this regard, it is important that
you read this Privacy Notice and understand how Servisource uses your personal data. Please
note that Servisource reserves the right to update this Privacy Notice as required. The most
recent version of this document can be found on Servisource’s website through the following
link: https://servisource.ie/privacy-policy/
1.1 Servisource Information
Servisource is a leading international supplier of high quality and innovative healthcare
solutions. Servisource provides innovative workforce managed services solutions and
managed staffing solutions to clients.
If you wish to locate further information on Servisource, you can find this on the Servisource
website through the following link: https://servisource.ie/
1.2 Legislation
All personal data processed by Servisource is done so in accordance with the General Data
Protection Regulation (GDPR) and the Data Protection Act 2018.
1.3 Queries and Complaints
If you are unhappy with the way Servisource handles your personal data and wish to
complain, or if you simply want further information about the way your personal data will be
used, please contact Servisource at the below:
Data Protection Officer
Servisource Healthcare
83 Merrion Square
Dublin 2,
Ireland
4
Telephone: +353 01 473 0474
Email: dataprivacy@cpl.com
You have the right to lodge a complaint with the Data Protection Commission. To contact
the Data Protection Commission, please use the following details:
Data Protection Commission
21 Fitzwilliam Square South
Dublin 2
D02 RD28
Ireland
Telephone: +353 (0)761 104 800
Telephone: +353 (0)57 868 4800
Email: info@dataprotection.ie
1.4 Breaches
Servisource will take all appropriate technical and organisational steps to safeguard your
personal data. In the unlikely event of a data breach, Servisource will contact you in line with
Servisource’s legal obligations.
2 How Does Servisource Collect Information?
Servisource collects personal data to enable the provision of services to support the
Servisource purpose. The following non-exhaustive methods of data collection are an
indication of ways in which Servisource may obtain your information:
 Obtain personal data directly from you;
 Personal data that Servisource receives from other sources; and
 When entering Servisource’s premises, you will be recorded on CCTV surveillance and the
Visitor Sign In tablet/book for security purposes.
It is important that the personal data you provide Servisource is up to date and accurate. As
outlined in Section 7.4 of this notice, if personal data Servisource holds on you is inaccurate
or incomplete, please contact Servisource and Servisource will update the information.
5
3 What Does Servisource Use Information For?
3.1 Process, Purpose, and Lawful Basis
Servisource uses personal data collected to fulfil Servisource’s obligations to provide
recruitment services and to enable the provision of services to support Servisource’s purpose.
Servisource uses personal data for any of the following purposes:
Process Purpose Lawful Basis
Health Screening To detect non symptomatic
disease for employees in the
workplace.
Processing is necessary to
assess, subject to data subject
safeguards, the working
capacity of the data subject.
To carry out obligations and
exercise rights under
employment law.
Background Checks/
Pre-employment
background checks
To verify if the data subject is
qualified and eligible for certain
positions for various companies
worldwide.
Processing is necessary for
compliance with a legal
obligation to which
Servisource is subject.
Covid-19 PCR and
antigen testing
To detect Covid-19 virus. Processing is necessary in
order ensure that test results
are reported to relevant
stakeholders for monitoring
and surveillance purposes and
to investigate cases, thus
preventing spread of infection
and further cases.
This processing applies to all
private testing services who
are, therefore, legally obliged
to report positive Covid-19
cases to the relevant
authorities.
Corporate wellness
and workplace wellbeing
To provide health and wellness
seminars/ webinars for
employees in the workplace.
The processing is necessary for
the performance of contract to
which the data subject is party.
6
Occupational
medicals (preemployment
medicals, fitness to
work medicals)
To manage the data subject’s
personal information on behalf
of various companies
Processing is necessary for the
performance of a contract to
which the data subject is party.
Medical Information To manage the data subject’s
absences, to manage sick pay in
accordance with the contract of
employment, and to manage the
fitness to work of data subjects.
Processing is necessary to
assess, subject to data subject
safeguards, the working
capacity of the data subject.
To carry out obligations and
exercise rights under
employment law.
Regulatory
Compliance
To comply with financial
regulations and any other
relevant laws and regulations.
Processing is necessary for
compliance with a legal
obligation to which
Servisource is subject.
Processing is necessary for the
performance of a contract to
which the data subject is party
or in order to take steps at the
request of the data subject
prior to entering into a
contract.
Third Party
Data Sharing
To allow Servisource to conduct
and carry out functions with
third party service providers that
enable Servisource to deliver
services.
Processing is necessary for the
performance of a contract to
which the data subject is party
or in order to take steps at the
request of the data subject
prior to entering into a
contract.
Back-ups To store personal data and make
back-ups of that data in case of
emergencies and for disaster
recovery purposes.
Processing is necessary for
compliance with a legal
obligation to which the
Servisource is subject.
Evidence Submissions To gather information for
dispute resolution services and
legal proceedings.
Processing is necessary for
compliance with a legal
obligation to which the
Servisource is subject.
7
Transfer of
Information for
Parties Legal
Proceedings
To allow parties to commence
legal proceedings.
Processing is necessary for
compliance with a legal
obligation to which the
Servisource is subject.
CCTV systems For the security, health, and
safety of individuals on
Servisource premises.
Processing is based on
legitimate interest and is
necessary for compliance with
a legal obligation to which the
Servisource is subject.
Accidents and
Incidents
To enable Servisource to comply
with employee record keeping
obligation pursuant to the
Safety, Health, and Welfare Act
2005.
Processing is necessary for
compliance with a legal
obligation to which the
Servisource is subject.
4 Who Does Servisource Share Information With?
Servisource may share personal data with other parties in the course of Servisource’s duties.
When this is done, Servisource adheres to the following principles:
 The transfer is based on a legal obligation, the performance of a contract, or explicit
consent.
 Where data is transferred to another party, Servisource ensures appropriate technical and
organisational safeguards are used to protect your personal data.
 Where Servisource engages a third party to provide a service to Servisource, Servisource
ensures the provider has taken appropriate technical and organisational measures to
process, store, and safeguard your personal data.
 Servisource, as a Data Controller, will not sell your data to any third party and will take all
appropriate steps to ensure the security of your data in dealings with third parties.
 The occupation health department functions and stores information through the AMS
(Advanced Medical Services) website. It’s a cloud-based website and complies with all of
Servisource’ s data protection policies and procedures.
While the parties Servisource engage may change occasionally, Servisource believe it is
important you are aware of the types of parties Servisource shares data with. The categories
and types of third parties outlined below is a non-exhaustive list but provides an indication of
the parties Servisource shares data with.
8
4.1 Other Third Parties
Third parties for the purposes of internal and external audits, carrying out research, general
practitioners, and or third parties who may improve Servisource’s processes and services
(such as consultants).
4.2 Government Departments, Bodies or Agencies
Servisource is legally obligated to share personal data with state actors which is outlined in
the Data Protection Act 2018.
Recipients of this data include Government departments, agencies, bodies, investigatory
bodies, local authorities, the Gardaí and the HSE
4.3 International Transfers
Where personal data is transferred outside the European Economic Area, Servisource use
safeguards known as Standard Contractual Clauses (SCCs).
5 What Type of Information is Collected?
To fulfil Servisource’s mandate and perform tasks as outlined in this statement, Servisource
needs to collect various types of personal data.
While the type of personal data may change occasionally, Servisource believes it is important
you are aware of the types of data Servisource gathers and uses. The following table is a nonexhaustive
list and provides an indication of the categories and types of data Servisource uses
to perform Servisource’s tasks.
Please note that information listed under one category may be used for the performance of
a task or in relation to activities under another heading or as outlined under Section 3.
Category Type of Data
Patient/ Individual  Name, education, date of birth, phone number, address, email
address, work experience, next of kin, bank details, PPS
number and training records, doctor/ GP, passport number,
family details, employee ID, CCTV footage, lifestyle and social
circumstances, disciplinary documents such as incident reports
and complaints.
 Medical data, medical history questionnaire, health screening,
health diagnosis, blood test results and immunisations, health
/ medical declarations.
Employees  First name, last name, date of birth, address, contact details,
9
email address, family details, financial, tax, pension,
remuneration details, performance details, visual images
details, employee ID, CCTV footage, lifestyle and social
circumstances, education, and training details, grievance and
disciplinary documents such as incident reports and
complaints.
 Special data such as medical checks, medical records, sick leave
details.
 Criminal data such as garda vetting documents.
Other
Stakeholders
 Contact details, first name last name, email address, images,
bank details and payment details.
6 How Long Does Servisource Retain Information?
Servisource has developed a record retention schedule for all the personal data Servisource
holds. Each retention period varies dependent on the nature and the purpose of the
processing.
The main factors which determine retention periods are as follows:
1. How long it is required to perform the task;
2. Any legal requirements to hold onto the data;
3. Any pending legal actions.
If you would like to see a copy of the Retention Policy, please contact the DPO at
dataprivacy@cpl.com
7 What Are Your Rights?
As a data subject, you will have the following rights as outlined in this section 7. However,
restrictions may apply in certain situations.
7.1 Where do I send requests?
Please send all your requests to the contact details provided in Section 1, with as much detail
as possible about your requirements to allow Servisource to deal with your request efficiently.
To answer your request, Servisource may ask you to provide identification for verification
purposes.
10
7.2 How long will a request take?
Upon receipt of a request, Servisource will have 30 days to provide an answer with an
extension of two further months if required. If Servisource requires more time to deal with
your request, Servisource will notify you of the delay and the reasons behind it within 30 days
of the receipt of the request. If Servisource refuses your request, Servisource will also notify
you within 30 days of the receipt of the request accompanied by the reasons for the refusal.
Servisource will not charge a fee for any requests, provided Servisource does not consider
them to be unjustified or excessive. If Servisource considers these to be unjustified or
excessive, Servisource may charge a reasonable fee (also applicable for multiple copies) or
refuse the request.
You are entitled to contact the Data Protection Commission if Servisource refuses your
request.
7.3 Right of Access
You have a right to know what personal data Servisource hold on you, why Servisource holds
the data, and how Servisource is processing your personal data.
When submitting your request, please provide Servisource with information to help verify
your identity and provide as much detail as possible to help Servisource understand the
information you wish to access (i.e. date range, subject of the request) and email
dataprivacy@cpl.com. You can also request access to your personal data through our website
on: https://servisource.ie/subject-access-request/
Please note that an access request is free of charge, however, where Servisource determines
a request to be unjustified or excessive, Servisource may charge you a reasonable fee.
7.4 Right to Rectification
You have a right to request that Servisource information held on you is up to date and
accurate.
Where information is inaccurate or incomplete, Servisource encourage you to contact
Servisource to have this information rectified. Upon receipt of request, Servisource will
ensure that the personal data is rectified and as up to date as is reasonably possible.
7.5 Right to be Forgotten
You have the right to seek the erasure of your personal data in the following circumstances:
 The personal data is no longer required for the purposes for which is was obtained;
 Where data is being processed on the basis of consent, you withdraw consent to the
processing and no other lawful basis exists;
 The personal data is being unlawfully processed;
11
 You object to the processing of personal data and there are no overriding legitimate
grounds for the processing;
 Your personal data requires deletion in line with legal requirements.
However, Servisource will be unable to fulfil an erasure request if the processing of personal
data is necessary for the following:
 Exercising the right of freedom of expression and information;
 Compliance with a legal obligation or for the performance of a task carried out in public
interest;
 Reasons of public interest in the area of public health;
 Archiving or statistical purposes in the public interest;
 The establishment, exercise, or defence of legal claims;
Please note that the where the legal basis for Servisource’s processing of personal data is on
the basis of a legal obligation, some processing in relation to your data may not be subject to
the right to erasure.
To determine your request for erasure, Servisource will carry out an assessment of the
justification for the retaining your personal data where a legal requirement applies and
contact you if Servisource is unable to fulfil your request.
Please be aware that in some circumstances Servisource may need to retain some information
to ensure all your preferences are properly respected. For example, Servisource cannot erase
all information about you where you have also asked Servisource not to send you marketing
material. Otherwise, Servisource would delete your preference not to receive marketing
material.
7.6 Right to Restriction
You have the right to restrict the extent of personal data processed by Servisource in
circumstances where:
 You believe the personal data is not accurate (restriction period will exist until Servisource
updates your information);
 The processing of the personal data is unlawful, but you wish to restrict the processing of
data rather than erase it;
 Where the personal data is no longer required by Servisource, but you require retention
of the information for the establishment, exercise, or defence of a legal claim;
 You have a pending objection to the processing of the personal data;
12
When processing is restricted, your personal data will only be processed: with your consent;
for the establishment, exercise or defence of legal claims; for the protection of the rights of
other people; or for reasons important to public interest.
Servisource will contact you confirm where the request for restriction is fulfilled and will only
lift the restriction after Servisource has informed you that Servisource is doing so.
7.7 Right to Data Portability
You have the right to the provision of all personal data held in relation to you in a structured,
commonly used and machine-readable format where:
 Processing is completed on the basis a contract;
 Processing is completed based on consent by the you;
 Processing is carried out by automated means.
You may also request that Servisource sends this personal data to another data controller
where technically feasible.
7.8 Right to Object
You have the right to object to the processing of your personal data; however, the processing
must have been undertaken on the basis of public interest or legitimate interest by
Servisource.
If you wish to object to the processing of data, please contact Servisource with your request.
Servisource will then stop the processing of personal data unless it is required for legal
proceedings.