Introduction

Your privacy is important to us so we developed this Privacy Notice to explain how we manage and look after your information. The EU General Data Protection Regulation (the “GDPR”) and the Data Protection Act 2018, (together known as Data Protection Legislation), provide individuals with a number of rights. You will be informed what they are in this document.

Throughout this notice, when we say “we” or “Greenergy”, this refers to Inver EnergyLimited and Amber Petroleum Limited, which act as a data controller in respect of your personal data in your capacity as an applicant. The data controller for the purpose of this notice will one of these companies unless otherwise stated below.

Throughout this notice, when we say, “you” or “your”, this refers to you or any authorised person who engages with us on your behalf, such as recruitment agencies you have authorised to liaise with us on your behalf.

Should you wish to contact us, you may do so using the contact detailed set out in the “Who we are” section below.

Scope

This notice applies to personal information relation to your application for full or part-time employment with Greenergy under any of the following contract categories:

Permanent and temporary employees , and fixed-term contractors;
Agency workers, and day-rate, limited company or service contractors or consultants;
Secondees; and
Persons on an internship or industrial placement.

This notice applies to personal information relating to your prospective employment or engagement with Greenergy as data controller, as described below.

This notice explains:

What information we collect about you;
How we will use that information;
Who we will share it with; and
What steps we will take to ensure it stays private and secure.

This Privacy Notice covers all aspects of your interaction with Greenergy, in your capacity as an applicant, including recruitment and pre-employment screening. We may update this policy at any time.

Who we are

Please address letters for the attention of our Data Protection Officer. Our business addresses are

Inver Energy Limited

River House

Blackpool

Cork T23 R5TF

And

Amber Petroleum Limited

Acres

Fermoy

Co. Cork P61 N762

You can contact us by writing to the above address or by emailing us at privacy@greenergy.com.

Why Greenergy collects and processes your personal information

We collect and ask for personal information about you in order to:

identify you;
administer your applicant relationship with us, e.g. schedule interviews, communicate decisions etc.
consider any applications or requests for information or advice made by you;
comply with our legal or regulatory obligations;
protect our legal rights;
pursue our legitimate interests and meet our business needs;
carry out your instructions, e.g. with regards to any benefits selections you make;
manage our relationship with you, including informing you of other roles and services we think may be relevant to you. You may opt out of receiving such notifications.

We also process your personal information for the following purposes:

For services, system development and insurance, audit and administrative purposes.
For security, staff vetting or business continuity; and

What personal information do we process?

We will collect and process your personal information in line with relevant regulations and law. The information may relate to any of the roles you apply for, currently hold or have held in the past, both within and outside Greenergy.

Examples of the categories of personal information we collect and process at various stages of your relationship with us are provided below. Please note this list is not exhaustive:

Employment stage

Examples of personal information processedApplication and vetting
| Name Contact details (home address, telephone number)Employment history PRSI number or country equivalent passport and other Right to Work documents

On-boarding (following offer of employment) | Bank details Next of Kin and Emergency contact details Beneficiary and dependant details for benefits registration work-related contact information

Special Category data

Certain 'special categories' of more sensitive personal information (such as information about racial/ethnic origin, sexual orientation, political opinions, religious/philosophical beliefs, trade union membership, biometric or genetic data and health data) are given a higher level of protection by data protection laws.

The special categories of more sensitive personal information we may collect, store and use includes, but is not limited to, the following categories of information:

Information about your race or ethnicity:
Information about any criminal, court, and police recordshis may include driving records, including driving licence details ; and
Information about your health, including any medical conditions, medical history, health and sickness records, including results from occupational health assessments.

Health

Following your acceptance of our employment offer and prior to the commencement of your employment, we will ask you to complete a health questionnaire assessed by our occupational healthcare professionals to advise us if any adjustments are needed to the work environment or systems so that you may work effectively.

Once the assessment is complete, we will use it to make any necessary adjustments and it will be placed in your HR file. This data is processed on the basis of the contract between yourself and us. The outcome of this occupational health assessment is shared with Greenergy.

Any data collected and processed as part of any such medical assessment is done so by a third-party provider under the terms of its privacy policy, with whom we will share any relevant personal information, including special category data as may be deemed necessary.

Vetting

Once you accept our employment offer, we will request various information including your name, phone numbers, and email address. We will also request information about your previous experience, education, qualifications, most recent position, current employer, compensation expectations, skills, competencies, right to work information, CV and for answers to questions relevant to the role you have applied for.

We will use the information provided by you and others as detailed above to request, collect and process your personal data as part of our vetting procedures. This will be in order to confirm your identity, employment history and relevant qualifications with respect to a role, to comply with the law and for our legitimate interests to be able to assess and manage our risk.

We collect personal data for vetting through the application and recruitment process directly from applicants by the Greenergy HR team, who will have access to all of this information. Some of this information will also be made available to our hiring managers. Third-party providers may also collect personal data for vetting purposes on our behalf.

The personal information we will typically collect, store, and use for vetting purposes will include the following categories of personal information:

Personal contact details, e.g. name (full current and previous) legal names and alias, title, addresses, telephone numbers and personal email addresses;
Information on next of kin ;
Date of birth and gender;
National insurance number;
Location of employment or workplace;
Recruitment information, e.g. copies of documentation confirming your right to work in theIreland , references and other information included in a CV or cover letter as part of the application process;
Information concerning any qualification you hold, e.g. higher and further education, and professional certifications; and
Employment records, e.g. job titles, work history, working hours, training records and professional memberships.

The vetting checks we perform may include:

Employment / Occupational History Check; (including volunteering) and self-employment history, including employer’s name, period, job title, status, location, duties, performance, compensation, disciplinary or sanctions, supervisor, conduct, reason for leaving, references about you;

We will only use your personal information for the purpose for which we collected it,

Where we collect your personal information from

We may collect information from a range of sources, which may relate to any roles you apply for, currently hold or have held in the past, both within and outside Greenergy, including its wholly-owned subsidiaries. We may also collect information about you when you interact with us, e.g. call us, visit our website or use services we make available to you in your capacity as an employee.

Some of this information will come directly from you, e.g. when you provide documentation to verify your identity or right to work.
Such information may also come from your previous employers, or sources from whom you have asked us to obtain information. We may also obtain personal information from publicly available sources.

The information we collect may include:

Information that you provide to us, e.g.:

Personal and contact details, e.g. current and previous names, gender, date and place of birth, employment history, address, email address, landline and mobile numbers;
Information concerning your identity e.g. photo ID, National Insurance / tax identification number and nationality or pertaining to any qualifications you hold, i.e. higher education;
Health data including medical conditions, confirmation of whether you are able to perform a given position (as applicable), and information on any disabilities you may have; and
Other information about you that you provide when completing forms or communicating with us, whether face-to-face, by phone, email, online or other means.

How we use your information

We will only use your information where we have your consent or another lawful basis for so doing.

How we make decisions about you

Your personal information is not subject to automated decision-making, including profiling. In some circumstances we may anonymise your personal information so that it can no longer be associated with you; in such circumstances we may use such information without further notice to you. Once you are no longer an applicant we will retain and securely destroy your personal information in accordance with our data retention schedule.

Who we may share your information with

We may share your personal information with others where lawful to do so, including where we or they:

Have a public interest or legal duty to do so, e.g. to assist with detecting and preventing fraud, tax evasion and financial crime;
Need to do so in connection with regulatory, tax or withholding reporting, litigation or asserting or defending legal rights and interests;
Have a legitimate business reason for doing so, e.g. to manage risk, verify your identity, or to assess your suitability for roles;
Have asked you for your permission to share it, and you have agreed;
Need to so do in order to provide you with products or service you have requested, e.g. sharing your details with a private health insurance company.

We may share your information for these purposes with others including the following recipients:

Law enforcement, government bodies, courts, dispute resolution bodies and agencies
Regulators (e.g., Information Commissioner’s Office and any regulatory body by which Greenergy is, or becomes regulated), and any party appointed by a regulator to undertake an investigation or audit of our activities;
Agents and sub-contractors who work for us and other Greenergy wholly-owned subsidiaries, including their employees, sub-contractors, service providers, directors and officers);
Your intermediaries;
Tax authorities, trade associations, credit reference agencies;
Legal and professional advisors, including auditors;
Anyone else where we have your consent or as required by law.

We will not share your data for marketing purposes.

The terms of our contracts with third parties include obligations on them in relation to what personal information they can process and what they can do with that information. All our third-party service providers, professional advisers (and other companies associated with Greenergy) are required to take appropriate security measures to protect your personal information in line with our policies.

We do not permit our third-party service providers to use your personal information for their own purposes – they may only process your personal information for specified purposes and in accordance with our instructions.

Tracking or recording what you say or do

Closed Circuit Television (CCTV)

Closed Circuit Television (CCTV) is operated by Greenergy at our company owned filling stations and depotsand these may collect photos and videos or you,. The system operates 24 hours a day, 7 days a week, and is monitored and retained in line with the retention schedule of the specific location.. The processing of your personal information will be carried out to pursue our legitimate interests and in a way that might reasonably be expected as part of running our business and does not materially impact your rights, freedom or interests.

Physical access to premises (door control)

Access in and around buildings is provided, and controlled, by Greenergy. The system operates 24 hours a day, 7 days a week, is monitored, and retained. Physical access is on the basis of role in the Company. The processing is necessary for your safety and security, and for compliance with the Health and Safety at Work Act 1974.

Transfer of personal data outside the European Union (EU)

We are committed to implementing technical and organisational measures that, by default meet the requirements of the data protection legislation and the appropriate level of security. We will not share your personal data with a third-party organisation without a valid business reason, a contract or Data Sharing Agreement in place, or without your consent.

Your information will not be transferred to, or stored in locations outside the European Economic Area (EEA), unless that country or territory can ensure an adequate level of protection in relation to the processing of your personal data. We may need to transfer your information in this way to carry out our contract with you, to fulfill a legal obligation, to protect the public interest and/or for our legitimate interests. In some countries the law might compel us to share certain information, e.g. with tax authorities. Even in these cases, we’ll only share your information with people who have the right to see it.

How we protect your personal information

We use a range of measures to keep your information safe and secure which may include encryption and other forms of security. We require our employees and any third parties working on our behalf to comply with appropriate compliance standards including obligations to protect any information and applying appropriate measures for the use and transfer of information.

We have security measures in place to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, or inappropriately altered or disclosed. In addition, we limit access to your personal information to those who need to process that information for business reasons. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected information security breach and will notify you and any applicable regulator of a suspected breach as appropriate and in accordance with our legal obligations.

How long we will keep your personal information

We retain your data primarily to meet statutory and regulatory obligations. Your data is also retained to enable us to pursue our legitimate business interests in relation to our clients, our current and future requirements. We keep your information in line with our data retention policy.

This enables us to comply with legal and regulatory requirements or use it where we need to for our legitimate purposes such as dealing with any disputes or concerns that may arise. If you have applied for a job and are unsuccessful, we will retain any personal data collected for a period of 6 months from the date we formally notify you of the recruitment outcome. If you are required to complete an online assessment as part of your application, your test results may be valid for future job applications and we will keep them for a period of 6 months, after which your test results will be deleted and subsequent applications may require a new online assessment. For successful applicants, we will retain your data in accordance with legal, regulatory and business requirements as set out in our data retention schedules - all of which you will have full access to upon joining us.

We may need to retain your information for a longer period where we need the information to comply with regulatory or legal requirements or where we may need it for our legitimate purposes, e.g. to help us respond to queries or complaints, fighting fraud and financial crime, responding to requests from regulators, etc. We may destroy, delete or anonymise information more promptly where we no longer require it. We anonymise your personal information so that it can no longer be associated with you; in such circumstances we may use such information without further notice to you. Once you are no longer an applicant, we will retain and securely destroy your personal information for as long as legally required and in accordance with our data retention policy.

We will only use your personal information for the purposes for which we collected it. If we need to use your personal information for an unrelated purpose, we will notify you and seek your agreement or consent, as appropriate.

We will only process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

The HR data retention schedule, policy, and other employee policies are available on request from the HR or Legal teams.

Your responsibilities

Please ensure you inform us of any changes to your personal information. This is in line with your responsibility to ensure that the information you give us is accurate and up to date. The absence or inaccuracy of any records may affect the outcome of your application or we may be prevented from complying with our legal obligations. Certain information must be provided so that we can enter into a contract with you (e.g. your contact details, right to work in the UK and payment details).

Your rights

Data Protection Legislation gives you a number of rights regarding the information we hold about you:

The right to be informed: our obligation to provide fair processing information;
The right of access to the information we hold about you, and to obtain information about how we process it, including right of access to their personal information, called a Data Subject Access Request (”DSAR ”);
The right to rectification allows you to request that we rectify your information if is inaccurate or incomplete
The right to erasure allows you to request the deletion or removal of your personal data where there is no compelling reason for its continued processing. We may continue to process your information if we have another legitimate reason or legal obligation for doing so;
The right to restrict processing allows you to ‘block’ or suppress processing of personal data in certain circumstances;
The right to data portability: in some circumstances, the right to receive certain information you have provided to us in an electronic format and/or request that we transmit it to a third-party;
The right to object to, and to request that we restrict, our processing of your information in some circumstances. Again, there may be situations where you object to, or ask us to restrict, our processing of your information but we are entitled to continue processing your information and / or to refuse that request.

Requests, complaints or queries

We try to meet the highest standards when processing personal information, and take any requests, complaints or queries we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate.

This Privacy Notice does not provide exhaustive detail of all aspects of our processing of personal information. However, we are happy to provide any additional information or explanation needed. If you want to make a query, request, or a complaint about the way we have processed your personal information you can contact us directly at the details set out above.

Alternatively you have the right to lodge a complaint with the Data Pprotection Commision Commissioner’s Office (DPC). The IDPC is the Irish regulator that oversees data protection law.

Changes to this privacy notice

Our Privacy Notices are reviewed regularly, and we will host the most updated versions on relevant internal and external webpages for employee and applicant reference, when appropriate. Where an update to a Privacy Notice results in a change, this will be clearly identified by reference to the date of the notice.