In certain cases when processing personal data, RWP is a Data Controller, but in all cases when
processing data under instructions from our clients, we are acting as a Data Processor.
Examples of RWP as a Data Processor include when we provide specialist data processing, mail
production and document hosting for banking, government and SME clients or carry out processing in
relation to our Holmes Analytical Software service.
When acting as a Data Processor, RWP will only do so under contract which will include a Data
Processing Agreement that outlines our obligations and includes all clauses as required under Article
28 GDPR.

In most cases we will collect personal information directly from you when you contact us by phone,
email or any other channels such as in person at events. You may also contact us through our website
or send us a CV or complete a job application where relevant.
We do not usually collect personal data from third party sources. However, we may connect with
clients and contacts via social media networks e.g. LinkedIn. In those circumstances we may have
access to your publicly available details from that source. We do not download that data or integrate
it with our systems.

Cookies

When you visit our website, we may automatically collect technical data about your computer
equipment, browsing actions and preferences. In order to ensure our website functions correctly we
must use certain necessary cookies. Any other tracking cookies will be based on you consenting to the
use of such cookies.
If you follow a link to another website from our website, we are not responsible for the cookies or
content of this third-party site. We advise you to read the Privacy Notice and cookies information on
any websites you visit.

All data processed by RWP is done so in line with the principles of data processing, these are:

• • lawfulness, fairness and transparency – we will always process data lawfully and never
    in a way that would not be expected. We will always be clear, open and honest about how
    the data is used.
  • purpose limitation – we will only use personal data for specific purposes which will be
    clearly defined.
  • data minimisation – we will only collect the minimum amount of data required to carry
    out our services.
  • accuracy – will we always try to ensure the accuracy of data.
  • storage limitation – we apply retention periods to all data.
  • integrity and confidentiality – RWP have appropriate technical and organisational
    measures in place to protect the data we collect, process and store.
  • accountability – we are responsible for and will be able to demonstrate compliance with
    the above principles.

As a Data Controller, RWP will determine the appropriate lawful basis for all processing of personal
data. Where we act as a Data Processor, it will be the obligation of the Data Controller to ensure a
clear lawful basis has been defined for the processing of personal data by RWP.
Below are examples only relating to RWP as a Data Controller:

We are responsible for ensuring that processing does not infringe on your rights as laid down in data
protection legislation. It is important to note that these are not absolute rights and certain restrictions
and exemptions may apply. These rights are:

• The right to access the personal data we hold about you.
• The right to request that we rectify any inaccurate personal data about you.
• The right to request that we erase any personal data we hold about you.
• The right to object to us processing personal data about you such for direct marketing
  purposes.
• The right to ask us to provide your personal data to you in a portable format or, where
  technically feasible, for us to port that personal data to another provider.
• The right to request a restriction of the processing of your personal data.
• The right not to be subject to automated decision making, including profiling.

In any instances where we process your personal data based on your consent, you have the right to
withdraw consent at any time.
You also have the right to make a complaint to the relevant supervisory authority with regard to the
processing of your personal data by us at RWP, this can be done via the following:
IRL: The Data Protection Commission www.dataprotection.ie
UK: The Information Commissioners Office www.ico.org.uk

Data Sharing and Transfers

We may share your personal data internally within the RWP UK and Irish companies. We may also
share your personal data with third parties such as:

• With IT cloud service providers
• Professional service providers such as, legal, accounting, insurance or business advisors

All such parties are bound by a duty of confidentiality and engaged under contract. Where we engage
any other parties to process data on our behalf, we will ensure a Data Processing Agreement is in
place.
In any instances where we transfer personal data, we will ensure appropriate security measures are in
place such as encryption.
For our Irish clients, all data is stored on our systems located in Kildare with backups to the cloud in
data centres located in Ireland or Frankfurt. Data for our UK clients is stored in Belfast. We do not
transfer data of our Irish clients outside of the EU.

RWP will always ensure the ensures the confidentiality, integrity, availability, and resilience of
personal data when in use, transit and storage. We are obliged to protect the data from inadvertent
destruction, amendment, loss, disclosure, corruption, or unlawful processing.
We operate physical, technology and human controls to secure data. These controls are operated
under our Information Security Management System (certified to ISO27001 since 2008).

Personal data collected from clients through the provision of our services will be stored for the
duration of the relationship with a client plus 10 years. Generally, we will store employment data for
the duration of the employment plus 7 years. This is in line with the legal time frame for breach of
contract cases. However, shorter retention periods apply to specific employment data, and we will
adhere to statutory retention periods where applicable.
Where we act as a Data Processor, personal data will be stored as per the instructions of the Data
Controller.

We have appointed a DPO who assists us with all our compliance measures under data protection
legislation. The contact details for our DPO is dpo@rwpierce.ie.

From time to time, we may amend and update this Privacy Notice. Please review this notice each time
you use our website or our services. This notice was last updated in March 2023.