Client Privacy Statement

1 About Us

Sensori Privacy Notice refers (together with our Cookies Policy) to our commitment to our compliance to data protection legislation including the Irish Data Protection Act, the EU General Data Protection Regulation and UK Data Protection Act 2018.

Throughout this document “we”, “us”, “our” and “ours” refers to Sensori. This Data Protection Statement applies to the following companies in the Sensori group of companies:

Sensori FM
Lenmac Mechanical Services

References to “Sensori” herein shall mean the specific Sensori company you are contracted to provide a service to. Other companies in the Sensori group of companies will have their own separate Privacy Notices.

2 Our Contact details

If you have any questions about the Privacy Notice or the way in which your Personal Data is being used by us, please contact:

Address:
Plaza 211,
Blanchardstown Corporate Park 2,
Dublin 15,
D15 AP2
Ph: 01 882 1627
Email: gdpr@sensorifm.com

3 The Purpose of this Privacy Notice

This Privacy Notice describes our approach to data protection and sets out the basis on which any Personal Data we collect from you, or that you provide to us, will be used by us where we are controllers of that Personal Data for the purposes of the GDPR. Please read this Privacy Notice carefully to understand our views and practices regarding the Personal Data we collect and how we will treat it.

4 Amendments to this Privacy Notice

Where changes to this Privacy Notice occur, the updated version will be published on our website. In some cases, we may provide you with additional notice of changes to this Privacy Notice, such as via email. We will always provide you with any notice in advance of the changes taking effect where we consider the changes to be material on the website.

Current version: 1.01 – New format and updated content as part of Sensori’s commitment to continuous improvements in data protection.

5 Who does this Privacy Notice apply to

We collect and process your personal data only when such data is necessary for the Data Centre Operations, Facilities Management and associated services for our clients.

We process personal data of the following groups of individuals where it is necessary:

Contractor’s and subcontractors, their employees on site
Clients or potential client
Suppliers
Regulators and auditors
Ad hoc site visitors

Sensori are the “Data Controllers” for the personal information we process, unless otherwise stated.

6 What types of personal data do we collect?

You directly provide us with most of the personal data we collect on behalf of your employees. We collect personal data and process data for:

Submission of a tender
Submission of a request for tender
When registering online using the Company portal and also when you enter a site of Sensori by clocking in & out on system deemed necessary when arriving on site
New customer account form
Provide your training and accreditation records as required for your role
Enter a site (Client, Regulator and audit or Visitor) and attendance is recorded on our access controls systems
In the event of an accident or incident
Use or view our systems or website via your browser’s cookies

7 Personal data we collect for Clients (and its employees associated with our service), Suppliers, Regulators, Auditors & Ad hoc site visitors

As part of our services, we need to obtain and process personal data as required where necessary to provide our services such as:

7.1 Contact Details

Full Name
Contact Number
Eircode/Postal Code
Email Address (may be email address of an administrator for the client)
Relevant Employee’s, contact information
Signatures

7.2 Induction form

First name/Surname
Contact Number
Trade/Occupation
Emergency contact details
Medical declaration

If you are between the age of 16 and 18 years old, written parental consent is required, health & safety restrictions are applicable.

If you are over the age of 65, health & safety restrictions may apply.

7.3 Special Categories of Data

Medical health data for accidents
Work related incidents or accidents (including near misses)

7.4 Acquisitions due diligence

Directors published information from Company’s Registered Office
Credit checks

7.4.1 New Client Account Form

Trading Name
Legal Name
Registered Address
Business Address (Where different from registered address)
Contact details (email/phone number)
Website address
Company Registered Number
Sole Traders Information – Name, Address, Date of Birth
Trade references
Signature

7.5 Digital Identifiers

Profile Images via photos and or videos
Access Controls on site to include biometrics (fingerprint/facial recognition where required)
Image captured via CCTV
People counting via camera/systems
Number plate recognition

8 When do we collect sensitive personal data?

Sensitive data is known as special categories of personal data in Data Protection law. Special categories of personal data are defined by the GDPR “as processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation”.

We may collect the following special categories of data where necessary:

Health data is captured for the purpose of Health and Safety in the following situations:
- When registering as a contractor (and their employees) on a site, you are required to state if you are aware of any medical condition that you may have, which could mitigate against your safe completion of any reasonable task assigned to you and about which Sensori should be made aware of for Health and safety purposes.
- In the event of an incident or accident
Nationality: To assist with interpreters (when required) and to ensure work visas are in place for non-EU/EEA.

We will process special categories of personal data in the following circumstances:

Where we need to carry out our “legal obligations” including but not limited to Health and Safety
Where it is needed in the “public interest” (for example a pandemic and required by law), and in line with our data protection policy

Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) or you are incapacitated to give your consent, or where you have already made the information public.

9 Our legal basis for processing personal data

We process all Personal Data lawfully and in accordance with the requirements of the law. The GDPR sets out the legal grounds for processing Personal Data.

Where necessary, Sensori collect and process your Personal Data, under one of the following legal bases:

9.1 Consent

Where you have explicitly agreed to us processing your information for a specific reason such as:

Photograph and or video for publication at events, progress updates on a specific project and for auditing purposes
Use of work/personal number for business contact purposes
To contact the nominated person, provided at induction, in the case of an emergency
Cookie (see cookie policy)

Where the legal basis of consent is relied upon for processing of any personal data, you will be presented with an option to agree or disagree with the collection and the use or disclosure of the personal data.

You can withdraw the consent provided by you at any time by contacting us by emailing gdpr@sensorifm.com

9.2 Contract

When processing is necessary for the performance of a contract with you (or by you) or to take steps at your request prior to entering a contract.

We will collect your personal data to consider your tender for services requested by or for Sensori.

Where you entered a contract with Sensori and it is necessary to process your personal data for the administration of the services you provide us with as a contractor, or where we provide you with services as a client.

9.3 Compliance

When the processing is necessary for compliance with a legal obligation, we have such as:

keeping records for revenue or tax purposes
providing information to a public body or law enforcement agency
we may be required to process certain data to carry out our obligations under health, safety legislation, Construction Irish Federation (CIF) requirements & Sectoral Employment Orders (SEO)
we may also disclose your information if required to do so by law or another binding request
we are required by law to process that data to ensure we meet our ‘anti-money laundering’ obligations

9.4 Legitimate interest

We have a legitimate interest to process your data in certain circumstances for our business reasons where we always respect your interests and fundamental rights. Processing of your personal data may be necessary for the purposes of a legitimate interest pursued by us for any of the following:

Use of CCTV on our sites to safeguard the health, safety, and security of all resources
Conduct Workers Satisfaction Surveys to provide to ensure the health and safety is always maintained
Use of your personal data to operate Sensori’s business on a day-to-day basis
To ensure minimum relevant training requirements are adhered to prior to site access
Enhance the training of our workforce
To establish, exercise and safeguard our rights, (including where necessary to take enforcement action) and to respond to claims made against Sensori
To safeguard the safety and security of all individuals on site under our responsibility, IT systems and devices, property, buildings, information located or stored on the premises, and assets, and those of service providers, consultants, and advisors that assist Sensori in carrying out its functions
In the prevention and detection of fraud
Photos and videos for Quality, Environment, Health and Safely audits and progress reporting on jobs

10 What happens if you do not provide us with the data if legal basis is consent or contract

Where lawful basis is a statutory or contractual requirement, if an individual is obliged to provide the personal data, failure to provide this information may result in us being unable to conduct services with you and your organisation.

11 What is the purpose(s) for processing your data?

You agree that any data you provide to us will be true, complete, and accurate in all respects and you agree to notify us immediately of any changes to it. We will only collect personal information from or about you which is necessary for the following purposes:

11.1 General

To provide this website to you and respond to your queries
To comply with all relevant law
To manage your safety and security while you are on our premises and sites
To facilitate the prevention, detection and investigation of crime and the apprehension or prosecution of offenders
To investigate, exercise or defend legal claims or other claims of a similar nature
To manage any disputes, should they arise

11.2 Client

We will only collect personal information from or about you which is necessary to:

Provide our services to you
Set up and administer your account with us
Maintain our relationship with you and investigate any queries, complaints, disputes or accidents
Contact you for direct marketing purposes, to the extent only that same is permissible under applicable law
Provide you with information relating to our services, to the extent only that same is permissible under applicable law
To communicate with you, including to respond to information requests/enquiries submitted and/or to the extent that same is permissible under applicable law, to obtain your feedback on our services
To notify you about changes to contracted services relevant to you
To obtain credit references, credit checks and for debt collection, fraud detection and prevention and risk management purposes
To ensure health & safety regulations to include restrictions are met in keeping with age categories. If you are under the age of 18 or over 65, you must disclose this to the Company by ticking the appropriate box in the Company induction form
To obtain your feedback on services

11.3 Suppliers

Potential outsourced service providers

To assess the tender
Identify suitable providers for the service

Outsourced service providers – Directors and employees of the company

Set up, avail of your services, contact you and administer our account as a customer with you

11.4 New Contractor

Assess the suitability of the company to ensure it has the technical and financial stability to provide the services per the tender, this will include assessing the directors of the company

11.5 On Site

To manage the delivery of services of each Contractors employee throughout their tenure of the contract
To record the current relevant training records, qualifications and accreditations of each contractor and provide any project and/or site-specific training
Training and valid accreditation certifications will be monitored throughout the project to ensure any gaps are addressed immediately and updated certifications provided
To ensure you are medically fit to conduct the services per your contract
To ensure contact details of contractor’s employees are available if required
To manage the health, safety, and security of all contractors during provision of service on site
Garda Vetting where required by the Client
To conduct regular audits on compliance on site
To ensure an emergency contact can be contacted if required
To ensure all access on site is recorded correctly and monitored for health and safety
To safeguard the IT Network (where Sensori system access is provided)
To make reasonable adjustments for disabled Contractors employees
For health and safety restrictions that are applicable to age specific age categories
To effectively monitor safety conduct, attendance, and performance, take actions where necessary

12 When do we receive your personal data from a third party

Where is it necessary, we may receive your data indirectly from the following sources:

An employer who has been awarded a contract with Sensori
A client who has been awarded a contract with Sensori (where you are a sub-contractor of Sensori)
Another member of the workforce in the event of an incident or accident
Public information e.g. social media (LinkedIn)
Site management or supervisors in the event of any performance recording
Client due diligence as part of a credit check by way of credit safe, vision & D&B

13 What you need to do when you provide us with other individuals information data

If you are providing personal information on behalf of a third party, you must ensure that the third party receives a copy of this Privacy Notice before their personal information is shared with us. Before you disclose personal information to us about another person, you should be sure that you have their agreement to do so. For example, but not limited to:

Providing emergency contract details
As a contractor, providing your employee details
As a client, providing your employee details

You do not need to provide this Privacy Notice in the following situations:

The individual already has the information
Obtaining or disclosure such information is expressly laid down in the law to which Sensori must comply and which provides appropriate measures to protect the individual’s legitimate interests
Where the personal data must remain confidential subject to an obligation of professional secrecy regulated by law

14 How we protect your personal data?

We will take all steps reasonably necessary to ensure that all Personal Data is treated securely in accordance with this Privacy Notice and the relevant law, including the GDPR.

We have put in place appropriate technical and organisational procedures to safeguard and secure the Personal Data we process.

We collect this data in a transparent way and only with the full knowledge of interested parties. Once this information is available to us, the following rules apply.

Our data will be:

Accurate and kept up to date
Collected fairly and for lawful purposes only
Processed by us based on either a valid contract, consent, legal compliance, or legitimate interest
Protected against any unauthorised access or illegal processing by internal or external parties

Our data will not be:

Communicated to any unauthorised internal or external parties
Stored for longer than required for the purpose obtained
Transferred to organisations, states, or countries outside the European Economic Area without adequate safeguards being put in place as required under Data Protection Law

Our commitment to protect your data:

Restrict and monitor access to sensitive data
Develop transparent data collection procedures
Train employees in data protection and security measures
Build secure networks to protect online data from cyberattacks
Establish clear procedures for reporting privacy breaches or data misuse
Establish data protection practices (document shredding, secure locks, data encryption, frequent backups, access authorisation etc.)

15 How we use Automated Processing or “Analytics”

In the future we may automated decision making systems, when introduced such systems we will inform you in advance.

16 Disclosure of your personal data

Your personal information may also be processed by other organisations on our behalf for the purposes outlined above.

In some circumstances where necessary we may disclose your information with a third party. These circumstances and third parties are outlined below:

Our clients and their representatives
Approved Outsourced third-party providers, such as IT Service Providers, legal advisors, business advisors, couriers, shredding company, security company, printing company, CCTV company, administration services, other outsourced providers, internal and external auditors, insurers, recruitment agents, or subcontractors.
Training providers and training accreditation bodies.
Construction federation
Possible successors
Statutory and regulatory bodies as legally required including but not limited to Enforcement bodies, An Garda Siochana or police force, Data Protection Commission, Information Commissioners Office, the courts, fraud prevention agencies or other bodies;
Medical professionals in the event of an accident where you are incapacitated to give your consent
Our parent company John Sisk and Sons

17 How long will we hold your personal data?

We will only retain personal data for as long as necessary for the purposes for which it was collected as required by law or regulatory guidance to which we are subject or to defend any legal actions.

18 Processing your information outside the EEA

Some of third parties we share your personal data with may reside outside the European Economic Area (which currently comprises the Member states of the European Union plus Norway, Iceland, and Liechtenstein). If we do this, your information will be treated to the same standards adopted in Ireland and include the following data protection transfer mechanisms:

Model Clauses (also known as Standard Contractual Clauses) are standard clauses in our contracts with our service providers to ensure that any personal data leaving the EEA will be transferred in compliance with EU data-protection law. Copies of our current Model Clauses are available on request.
EU-US Privacy framework.
Transfers to countries outside the EEA which have an adequate level of protection as approved by the European Commission (such as the United Kingdom).
Transfers permitted in specific situations where a derogation applies as set out in Article 49 of the GDPR. For example, where it is necessary to transfer information to a non-EEA country to perform our contract with you.

19 Your Rights

19.1 Erasure

19.1.1 When have I the right to all my personal data being deleted by Sensori?

You have the right to have your personal data deleted without undue delay if:

The personal data is no longer necessary in relation to the purpose(s) for which it was collected/processed
You are withdrawing consent and where there is no other legal ground for the processing
You object to the processing and there are no overriding legitimate grounds for the processing
The personal data has been unlawfully processed
The personal data must be erased so that we comply with legal obligation
The personal data has been collected in relation to the offer of information society services with a child

19.1.2 What happens if Sensori has made my personal data public?

If we have made your personal data public, we, taking account of available technology and the cost of implementation, will take reasonable steps, including technical measures, to inform those who are processing your personal data that you have requested the erasure.

19.1.3 What happens if Sensori has disclosed my personal to third parties?

Where we have disclosed your personal data in question to third parties, we will inform them of your request for erasure where possible. We will also confirm to you details of relevant third parties to whom the data has been disclosed where appropriate.

19.2 Data portability

19.2.1 When can I receive my personal data in machine readable format from Sensori?

You will receive your personal data concerning you in a structured, commonly used, and machine-readable format if:

processing is based on consent or contract and
processing is carried out by automated means

19.2.2 Would Sensori transfer the personal data to another service provider if I requested this?

We can transfer this data to another company selected by you on your written instruction where it is technically feasible taking account of the available technology and the feasible cost of transfer proportionate to the service, we provide to you.

19.2.3 Under what circumstances can Sensori refuse?

You will not be able to obtain, or have transferred in machine-readable format, your personal data if we are processing this data in the public interest or in the exercise of official authority vested in us.

19.2.4 Will Sensori provide me with my personal data if the file contains the personal data of others?

We will only provide you with your personal data, ensuring we protect the rights and freedoms of others. Where personal data of another person may be on the same files as yours, we will redact the full details of the other person.

19.3 Automated individual decision making

19.3.1 What are my rights in respect of automated decision making?

Sensori does not have any automated decision-making processes. Where any such processes are introduced, we will provide you with the relevant information required under the “General Data Protection Regulation”.

19.4 Object

19.4.1 Have I already been informed about my right to object?

We have informed you of your right to object prior to us collecting any of your personal data as stated in our privacy statement.

19.4.2 When can I object to Sensori processing my personal data?

You can object on grounds relating to your situation, at any time to processing of personal data concerning you which is based on one of the following lawful basis:

public interest or
legitimate interest, including profiling based on those provisions

Sensori will stop processing your personal data unless:

we can demonstrate compelling legitimate grounds for the processing, which override your interests, rights, and freedoms
the processing is for the establishment, exercise, or defence of legal claims

19.4.3 What are my rights to object for direct marketing purposes?

Where your personal data is processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

Where you object to processing for direct marketing purposes, we will no longer process this data for such purposes.

19.4.4 What are my rights to object in the use of information society services?

In the context of the use of information society services, you may exercise your right to object by automated means using technical specifications.

19.5 Restrict processing

19.5.1 When can I restrict processing?

You may have processing of your personal data restricted:

While we are verifying the accuracy of your personal data which you have contested
If you choose restricted processing over erasure where processing is unlawful
If we no longer need the personal data for its original purpose but are required to hold the personal data for defence of legal claims
Where you have objected to the processing (where it was necessary for the performance of a public interest task or purpose of legitimate interests), and we are considering whether our legitimate grounds override.

19.5.2 What if Sensori has provided my personal data to third parties?

Where we have disclosed your personal data in question to third parties, we will inform them about the restriction on the processing, unless it is impossible or involves disproportionate effort to do so.

19.5.3 How will I know if the restriction is lifted by Sensori and/or relevant third parties?

We will inform on an individual basis when a restriction on processing has been lifted.

19.6 Rectification

19.6.1 What can I do if Sensori is holding incorrect personal data about me?

Where you suspect that data, we hold about you is inaccurate, we will on demand rectify any inaccuracies without undue delay and provide confirmation of same.

19.6.2 What happens if Sensori has disclosed my personal data to third parties?

Where we have disclosed inaccurate personal data to third parties, we will inform them and request confirmation that rectification has occurred. We will also provide you with details of the third parties to whom your personal data has been disclosed.

19.7 Withdraw consent

19.7.1 Under what circumstances could I withdraw consent?

You can withdraw consent if we are processing your personal data based on your consent.

19.7.2 When can I withdraw consent?

You can withdraw consent at any time.

19.7.3 If I withdraw consent what happens to my current data?

Any processing based on your consent will cease upon the withdrawal of that consent. Your withdrawal will not affect any processing of personal data prior to your withdrawal of consent, or any processing which is not based on your consent.

19.8 Lodge a complaint

19.8.1 Can I lodge a complaint with the Data Protection Commission?

You can lodge a complaint with the Data Protection Commission in respect of any processing by or on behalf of Sensori of personal data relating to you.

19.8.2 How do I lodge a complaint?

Making a complaint is simple and free. All you need to do is write to the Data Protection Commission giving details about the matter. You should clearly identify the organisation or individual you are complaining about. You should also outline the steps you have taken to have your concerns dealt with by the organisation, and what sort of response you received from them. Please also provide copies of any letters between you and the organisation, as well as supporting evidence/material.

19.8.3 What happens after I make the complaint?

The relevant data commission will then take the matter up with Sensori on your behalf.

19.9 Access your data

19.9.1 When do I have the right to access my personal data from Sensori?

Where Sensori process any personal data relating to you, you have the right to obtain confirmation of same from us, and to have access to your data.

19.9.2 What information will Sensori provide to me?

If we are processing your personal data, you are entitled to access a copy of all such personal data processed by us subject to a verification process to ensure we are communicating with the correct person. We will provide any of the following information:

why we are processing your personal data
the types of personal data concerned
the third parties or categories of third parties to whom the personal data have been or will be disclosed. We will inform you if any of the third parties are outside the European Economic Area (EEA) or international organisations
how your personal data is safeguarded where we provide your personal data outside the European Economic Area or to an international organisation
the length of time we will hold your data or if not possible, the criteria used to determine that period
your rights to:
- request any changes to inaccurate personal data held by us
- have your personal data deleted on all our systems
- restriction of processing of personal data concerning you
- to object to such processing
- data portability
your right to lodge a complaint with the relevant Data Protection Authority:
info@dataprotection.ie (EU)
https://ico.org.uk/global/contact-us/ (UK)
where we have collected your personal data from a third party, we will provide you with the information as to our source of your personal data
any automated decision-making, including profiling which includes your personal data. We will provide you with meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you

19.9.3 What Information is not provided?

Business Information pertaining to your role as an employee
If we do not provide you with your personal data, we have an obligation to give reasons why this personal data is being withheld.

19.9.4 How long will it take to receive my personal data from Sensori?

We will provide you with a copy of the personal data we are currently processing within one month of request. In rare situations if we are unable to provide you with the data within one month, we will notify you, within one month of your valid request, explaining the reason for the delay and will commit to delivery within a further two months.

19.9.5 How much will it cost me to receive my personal data?

We will not charge for providing your personal data unless we believe the request is excessive and the cost of providing your data is disproportionate to your services provided.

19.9.6 Can I request additional copies of my personal data?

If you require additional copies, we will charge €20 to cover our administrative costs.

19.9.7 Can I receive my personal data electronically?

You can request your personal data by electronic means, and we will provide your personal data in a commonly used electronic form if technically feasible.

19.9.8 What will Sensori do if another person’s personal data is shared with my personal data?

20 Contact details for the relevant Supervisory authorities:

20.1 Ireland

Data Protection Commission
Online form: https://forms.dataprotection.ie/contact
Address:
21 Fitzwilliam Square South,
Dublin 2,
Ireland
D02 RD28
Contact number: +353 578 684 800 or +353 761 104 800

Cookie	Duration	Description
cookielawinfo-checkbox-analytics	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional	11 months	The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy	11 months	The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.