SAR Group Client Data Privacy Statement

To provide our services, we may collect and process some of your personal information. This gives you more detail about what we do with it. It also lets you know your rights.

This statement relates to the information we may collect and process as the data controller when:

• a prospective client engages with us in advance of becoming a client;
• a prospective client becomes a client; and
• we provide our services to you

We will not always be the controller of that personal information, but sometimes we may be.

Where the personal information comes from

The personal information we collect may have come directly from you (for example, through an enquiry form, on a business card or through some other connection). In other cases, the personal information may have been gathered from someone else (for example, LinkedIn), or provided to us by the client or prospective client.

The type of personal data we may not collect from you but in respect of which may be the data controller includes:

• name
• email or other messaging address
• business you work for
• job title and role
• telephone number
• other publicly available information (including from web searches and professional social media sites)

What we use your personal information for

Business Development and Enquiries

When you make enquiries about our products and services, including through an e-mail request, any other request we contact you (whether implied or explicit), or in response to any contact we make with you, we will use this information, and any other information you provide as part of the request or in subsequent communications, so we can:

• respond to, progress and/or manage your enquiries and requests;
• provide you with information about the SAR Group for business development purposes; and
• where relevant conduct pre-contract discussions and negotiations.

Your personal information is processed in this way for our legitimate business interests, which means the interests of SAR Group in conducting and managing our business but, most importantly, to give you the best service and products we can.

How long do we keep this personal information?

If you do not become a client, we will keep this information for a period of five years after the date we first contact you.

Provision of products and services

When we provide our services, we may process your personal information. This is particularly the case if you are a private client, sole trader or a partnership, where the processing of your personal information is required in order to provide our services to you.

Unless otherwise stated in this Data Privacy Statement, any personal information you give us when providing our services to you will be used for:

• providing those services to you (or the business you work for) in accordance with our contract;
• meeting our legal obligations, in particular (but not exclusively) to the Revenue Commissioners;

Certain personal information, including contact details (such as email addresses and telephone numbers) is also used to:

• manage our relationship with you (or the business you work for) so we can meet our contractual obligations; and
• for our legitimate interests in conducting and managing our business.

How long do we keep this personal information?

Personal information that is provided to, or generated by, us during the provision of our services will be kept for a period of seven years after you (or the business you work for) ceases to become a client.

Products and services information

If you have asked to receive information about our products and services (for example by subscribing to receive information from us), you have specifically consented to your email address being used to send you information, including marketing information, about our:

• our business; and
• the products and services we provide.

You can at any time withdraw your consent to our processing of your personal information for these purposes by unsubscribing, writing to us, or emailing us at [email protected]

If you (or the business you work for) are (or have been) a client, we use your personal information to send you information related to:

• our products and services;
• business practices and developments relevant to your business or activities.

Your personal information is processed in this way for our legitimate business interests, which means the interests of SAR Group in conducting and managing our business but, most importantly, to give you the best advice, service and products we can.

Other uses

Your personal information will also be processed:

• to manage your personal data in accordance with this privacy notice; and
• to comply with our data protection and other legal obligations.

Legitimate interests

When we process your personal information for our legitimate interests, we make sure we have considered and balanced the potential impact on you. We will never use your personal information in a way that is detrimental to your interests.

Where we process your personal information for purposes we consider to be in our legitimate interest, you have the right to object to this processing. You may exercise this right by writing to us at our address or by emailing us at [email protected] . If you do object, this may affect our ability to provide our products and services to you.

Who else gets your personal information?

To help us provide our services, we may share your personal information with third parties who provide services to SAR Group, specifically information technology and information services providers.

These third parties can only use the personal information we share in order to provide their services to us or to support our processing of your personal information in the manner set out in this statement.

Your personal information may be shared with third parties in accordance with your written and verified instructions, or in accordance with legal obligations imposed upon us.

Your personal information is not shared with anyone else. It is not transferred outside the European Union.

What are your rights?

Accessing, deleting, rectifying and moving your personal information

You have the right to:

• access your personal information;
• require us to delete it;
• rectify any personal information we hold that is incorrect; and/or
• have your personal information transmitted to another data controller.

If you want to exercise these rights, please let us know in writing. You will need to provide sufficient information to verify and complete your request. We will complete your request within thirty days, subject to any legal or other requirements that requires us not to complete your request, in which case we shall inform you of this where we are permitted to do so.

Lodging a complaint

You can at any time complain about our processing of your personal information with your local data protection authority. SAR Group’s supervisory authority is:

Data Protection Commissioner, Canal House, Station Road, Portarlington, R32 AP23, Co. Laois, Ireland

www.dataprotection.ie

How do you contact us?

The data controller is MCR Outsourcing Ltd

You can write to us at: SAR Group, Unit 1 The Capel Building, Strand Street Little, Smithfield, Dublin 7

You can email us at: [email protected]