Data Privacy Notice for Community Organisations

The purpose of the processing

he Social Inclusion and Community Activation Programme (SICAP) 2024 – 2028 provides funding to tackle poverty and social exclusion through local engagement and partnerships between disadvantaged individuals, community organisations and public sector agencies.
Administered by Pobal, the Social Inclusion and Community Activation Programme (SICAP) is co – funded by the Irish Government, through the Department of Rural and Community Development, and the European Union through the European Social Fund Plus under the Employment, Inclusion, Skills and Training (EIST) Programme 2021 – 2027

The Controllers:

The Joint Controllers for the delivery of

Name Address Contact
Department of Rural and CommunityDevelopment Data Protection Officer
Trinity Point, 10 – 11 Leinster Street South, Dublin 2		 dataprotectionunit@drcd.gov.ie
ESF Managing Authority Data Compliance & Support
Section
Department of Education
Cornamaddy, Athlone, Co. Westmeath N37 X659		 dpo@dfheris.gov.ie, esfdata@dfheris.gov.ie
Your Local Community Development Committee Galway City Partnership
3 The Plaza Offices, Headford Rd, Galway		 info@gcp.ie
The Joint Controllers have engaged Pobal as a Data Processor to manage applications and administer the fund.

What is the Lawful Basis relied upon:

The Controllers rely on Public Task under legislation as the lawful basis, operating under Regulation(EU) (2021/1056) within the framework of the EU Cohesion policy. 

Where is personal data processed:

All data is processed withi n the EEA or countries with holding and EY Adequacy ruling.

Whose personal data is processed:

The data processed by the Joint Controller, and by Pobal under written instruction, include that ofindividuals representing the Programme Implementer.

What personal data is processed:

The implementation of the scheme was designed to ensure the minimum amount of personal data todeliver the scheme effectively will be processed. 

The types of personal data that will be processedrelated to the individualsrepresenting a community organisation include:
  • Name, and contact details, organisation represented.
  • No Special Category Data (such as health data) is expected to be processed.
Other non – personal data includes: Organisation address and Eircode, date established and information about the organisation e.g. what type of service it provides, who the organisation supports, number of staff/volunteers, the types of supports provided

How long will the personal data be retained:

The defined retention period for personal data processed is seven years from the end of the programme.

Who has access to the personal data:

Staff charged with delivering the scheme within the Controllers’ organisations and Pobal, the Processor, will have access on a need only basis.
Auditors shall also have access for the purposes of ensuring the fund is administered in accordance with the fund’s rules and legislation.
Reports of the scheme, including the use of statistics, will also be produced but these shall utilise aggregated and anonymised data.

Is the data secure:

Systems used by the Controllers, and Pobal as the scheme administrator, have implemented technical and organisational measures to industry standard to secure any personal data processed.
Data is encrypted at rest and in transit.

Your rights if your personal data is processed:

As a data subject under the GDPR, you have a range of rights in relation to the processing of yourpersonal data:

  • The right to be informed about whether and why your data is processed and by whom
  • The right of access to your personal data held by and on behalf of the Data Controllers.
  • The right to rectification if the data held is incorrect.
  • The right to erasure/right “to be forgotten” though this right is not absolute and there may legal requirements for the Controllers to continue to hold your personal data.
  • The right to restrict processing such as when there is no longer a requirement to process the data or when it is believed to be unlawful to do so.
  • The right to object.
  • Rights in relation to automated decision making and profiling.
  • The right to withdraw consent if consent has been relied upon for the processing of your data.
  • The right to lodge a complaint with a Supervisory Authority
As the Controllers are established in Ireland, the lead Supervisory Authority is:

The Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, D02 RD28

Their website: www.dataprotection.ie provides useful information on understanding your rights and howto exercise them.

To contact the Controllers, or Pobal as the scheme administrator, to enquire about the processing of your personal data, you can use the postal addresses provided above or email: