Irish Forestry Unit Trust - Privacy Policy

May 2021

Throughout this document, “IForUT”, “we”, “us”, “our” and “ours” refer the Irish Forestry Unit Trust and / or Irish Forestry Unit Trust Forestry Management Ltd as appropriate.

About Our Privacy Policy

This privacy policy aims to give you information on how IForUT collects and processes your personal data, including any data you may provide when you access our main website (www.iforut.ie) or other websites controlled by us, when you enquire about our Forestry Operations or for Stakeholder Consultation regarding forest certification, when you are in contact with us in relation to Forestry Sales and/or purchases, when you purchase a product or service from us, and through your dealings with our staff and contract forest managers. If you are a Customer, this Privacy Policy supplements any data protection provisions contained in our contract with you and is not intended to override them.

Our website includes any webpage containing this domain name, including any page that is enabled for use by a mobile device or any webpage redirected from another domain name (the “Website") and is are operated by Irish Forestry Unit Trust, Unit 5, Woodford Court, Woodford Business Park, Santry, Dublin 17. The website is not intended for children and we do not knowingly collect data relating to children.

It is important that you read this privacy policy together with any other privacy policy or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy policy supplements the other notices and is not intended to override them.
By providing your personal data and/or using the website, you acknowledge the collection and use of your data as outlined below. This version of our Privacy Policy was last updated on 10/03/2021.

This Privacy Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us and your rights in relation to your personal data. Please read the following carefully to understand our views and practices regarding your personal data, how we will treat it and your data protection rights

Personal Data We Collect and Process

In your dealings with us or when using our website, we will collect and gather the following categories of personal data:

Identity Data such as first name, surname, gender, date of birth.
Contact Data such as address, e-mail address, telephone number.
Financial Data: such as for Customers and Suppliers: bank details, VAT number, information about payments to and from you and other details of products you have purchased from us.
Any other personal information that you have provided directly to us
Interactions Data: information about your interactions with us, including correspondence and phone calls between us and you
Technical Data such as internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access the Website.
Usage Data such as information about how you use the website.

We may collect the data described above directly from you (e.g. where you contact us with queries in relation to our operations) or from public registers such as the Land Registry and the Registry of Deeds.

Changes to the Privacy Policy and your duty to inform us of any changes to your Personal Data

Any changes we make to this privacy policy in the future will be posted on our website. Please check back frequently to see any updates or changes to this privacy policy.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us

We will only use your personal data for legitimate business purposes and when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

Where we are required to contact you regarding relevant forest operations or stakeholder consultation for forest certification purposes
Where we need to perform a contract (e.g. the Terms of Use) we are about to enter into or have entered into with you.
Where it is necessary for our legitimate interests (or those of a third party appointed by us) and your interests and fundamental rights do not override those interests.
Where we need to comply with a legal or regulatory obligation.

Recipients of Data

We may disclose your personal data to various recipients in connection with the above purposes, including to:

third parties who we engage to provide services to us in connection with our operations, such as forest managers, professional advisers, auditors and outsourced service providers;
entities that regulate or have jurisdiction over IForUT. We will disclose your personal data in order to comply with any legal obligation, if we are ordered to do so by a court of competent jurisdiction, law enforcement, regulatory or administrative authorities or in order to enforce or apply our Terms and Conditions and other agreements, or to protect the rights, property, or safety of IForUT, our Customers, Website users or others. This includes exchanging personal data with third parties for the purposes of fraud protection and credit risk reduction.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our Service Providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes in connection with our conduct of business and in accordance with our instructions. Unless prevented by applicable law, we will notify you when your personal data may be provided to third parties in ways other than explained above, and you may have the option to prevent such sharing at the time that we notify you.

Consent

Generally we do not rely on consent as a legal basis for processing your personal data. You have the right to withdraw your consent at any time by contacting us.

Sensitive Personal Data

We do not request from you and we request you do not provide any special categories/sensitive personal data (e.g. personal data relating to racial or ethnic origin, political or religious opinions, membership of a trade union, physical or mental health or condition or sexual life or orientation). This type of personal data is subject to special protections under EU law.

If You Fail To Provide Personal Data

Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

How Long Will You Use My Personal Data For?

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Your Legal Rights

You have a number of rights under data protection law in relation to how we use your personal information. You have the right, free of charge, to:

check what type of personal data we hold about you and what we do with that information (you are also entitled to receive a copy of this information);
have any inaccurate personal data which we hold about you updated or corrected;
erase personal information we hold about you;
stop us from using your personal information in certain cases, including if you believe that the personal information we hold about you is inaccurate or our use of your information is unlawful. If you exercise this right, we will store your personal information and will not carry out any other processing until the issue is resolved;
object to us using your personal information where we rely on our legitimate interests to use your information. We will stop using your personal information unless we can demonstrate an overriding legitimate grounds for the continued processing of this information; and
receive certain aspects of your personal information in a structured, commonly used and machine-readable format and to have that information transferred to you or another data controller.

These rights are in some circumstances limited by data protection legislation. If you wish to exercise any of these rights please contact us using the contact details contained on our website. We will endeavour to respond to your request within one month. If we are unable to deal with your request within one month we may extend this period by a further two months and we will explain why.

You also have the right to lodge a complaint to the office of the Data Protection Commission. Please visit www.dataprotection.ie for more information.

Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.