The Young Friends of the Earth (YFoE) Website
This statement relates to our privacy practices in connection with this website. We are not responsible for the content or privacy practices of other websites. Any external links to other websites are clearly identifiable as such. Some technical terms used in this statement are explained at the end of this page.
Young Friends of the Earth is committed to keeping your data safe.
We will only store and process your personal data in accordance with the relevant Irish and EU data protection legislation (including the General Date Protection Regulation - GDPR - you may have heard of recently).
You can opt-out of any communications you are getting from us at any time.
You can make a request about your data at any time using this form.
Our full data protection policy follows below (PDF here).
YFoE fully respects your right to privacy, and will not collect any personal information about you on this website without your clear permission. Any personal information which you volunteer will be treated with the highest standards of security and confidentiality, strictly in accordance with the Data Protection Acts, 1988 & 2003.
If you discover we hold inaccurate information about you, you can request YFoE to correct that information. Such a request must be in writing.
In certain circumstance you may also request that data which you have supplied via the website be deleted. If you wish to request a deletion, you would generally be expected to identify some contravention of data protection law in the manner in which this office processes the data concerned.
Young Friends of the Earth’s Data Protection Policy
This document provides a concise policy regarding the data protection obligations of Young Friends of the Earth and is part of Young Friends of the Earth’s commitment to data protection by design and default.
Young Friends of the Earth is a data controller with reference to the personal data which it manages, processes and stores.
Young Friends of the Earth’s commitment to data protection
Young Friends of the Earth is committed to keeping personal data safe, and in particular is commited to privacy and data protection in respect of the rights of data subjects. Young Friends of the Earth Ireland is committed to retaining transparency and accountability in data use and management.
Purpose of this Policy
As a data controller, Young Friends of the Earth and its members (hereafter referred-to collectively as Young Friends of the Earth) must comply with the data protection Principles set out in the relevant Irish and EU legislation.
This Policy applies to all personal data collected, processed and stored by Young Friends of the Earth in the course of its activities. This Policy is designed to ensure Young Friends of the Earth’s compliance with the following legislation:
- The European General Data Protection Regulation (GDPR)
- The EU Electronic Communications Regulations (2011)
The GDPR confers rights on individuals as well as additional responsibilities on those persons and organisations processing personal data and Young Friends of the Earth will ensure that all policies and activities are done in compliance with this legislation.
For the purpose of this Policy:
'Personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person
'Processing' means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
'Controller' means the natural or legal person which, alone or jointly with others, determines the purposes and means of the processing of personal data;
'Processor' means a natural or legal person, which processes personal data on behalf of the controller;
'Consent' of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
'Supervisory authority' means the Irish Data Protection Commissioner, as an independent public authority established by Ireland pursuant to Article 51 of the GDPR.
Young Friends of the Earth’s use of personal data
Young Friends of the Earth, as a data controller, collects, processes and stores personal and occaisionally sensitive personal data on an ongoing basis. Young Friends of the Earth collects data about its members, volunteers, funding partners and programme participants who come into contact with the organisation through our community-based activism and campaigning work. We process personal data for the following reasons:
- The operations, monitoring and evaluation of our work, including youth outreach, public campaigning, advocacy, and communications work
- Keeping in touch with members and informing them of upcoming events and campaigns
- Health and safety reasons when organising residential trips
- Compliance with statutory obligations
- The organisation and facilitation of campaign actions.
This Policy applies to all data collected, both manually and automated, held by Young Friends of the Earth. This includes electronic and paper records.
The Data Protection Policy is maintained and approved by Young Friends of the Earth’s Data Protection Committee. Further comments or questions on the content of this Policy should be directed to the Data Protection Committee. Any material changes to this Policy will require approval by the Data Protection Committee.
In its role as a member-based organisation, Young Friends of the Earth will ensure that all members receive awareness raising and training on data protection.
Failure of Young Friends of the Earth members to process personal data in compliance with this Policy will result in cautioning and further training. A serious and continued violation of this Policy will result in disciplinary action.
The Data Protection Principles
The following key Principles are enshrined in EU legislation and are fundamental to Young Friends of the Earth’s Data Protection Policy.
In its capacity as data controller, Young Friends of the Earth ensures that all data shall:
- Be obtained and processed fairly and lawfully
Young Friends of the Earth will only processes personal data in line with one of the lawful basis enshrined in Article 7 of the GDPR. Young Friends of the Earth will fulfil its obligation in this regard by ensuring that:
- Where possible, the informed consent of the data subject will be sought before their data is processed. Young Friends of the Earth will ensure that the request for consent is presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Young Friends of the Earth will also ensure that the data subject is made aware of his or her right to withdraw his or her consent at any time
- Where it is not possible to seek consent, Young Friends of the Earth will ensure that collection of the data is justified under one of the other lawful processing conditions listed in Article 7 of the GDPR (compliance with legal obligation, contractual necessity, vital interests of data subject, public interest, or the legitimate interests of the data controller);
- Where the data processed by Young Friends of the Earth can be considered sensitive personal data, as defined in Article 9 of the GDPR, Young Friends of the Earth will not collect, process and store such data, unless permissible under the exemptions listed in Article 2 (a-j) of the GDPR;
- Where Young Friends of the Earth intends to record activity on video, a Fair Processing Notice will be posted in full view, prior to the recording and purpose, storage and the conditions for viewing the data will be laid out clearly and communicated to staff;
- Processing of the personal data will be carried out only as part of Young Friends of the Earth’s lawful activities, and it will safeguard the rights and freedoms of the data subject;
- The data subject’s personal data will not be disclosed to a third party other than to a party contracted by Young Friends of the Earth and operating on its behalf, or where Young Friends of the Earth is required to do so by law.
- Be obtained only for one or more specified, legitimate purposes
Young Friends of the Earth will obtain data for purposes which are specific, lawful and clearly stated. A data subject will have the right to question the purpose(s) for which Young Friends of the Earth holds their data, and Young Friends of the Earth will be able to clearly state that purpose or purposes.
- Not be further processed in a manner incompatible with the specified purpose(s)
Any use of the data by Young Friends of the Earth will be compatible with the purposes for which the data was acquired and Young Friends of the Earth will take steps to ensure that no personal data will be further processed in a manner that is incompatible with those purposes in line with the principles laid down in Article 5 of the GDPR.
- Be adequate, relevant and not excessive in relation to the purpose(s) for which the data were collected and processed
Young Friends of the Earth will ensure that the data it processes in relation to data subjects is adequate, relevant and limited to what is necessary in relation to the purposes for which the data is collected, in line with the principles laid down in Article 5 of the GDPR. Data which is not relevant to such processing will not be acquired or maintained, in line with the principle of data minimisation.
Young Friends of the Earth shall endeavor to keep the personal data it controls as accurate and up-to-date as possible, in line with the principles laid down in Article 5 of the GDPR, and to correct any inaccuracies as soon as they are discovered.
- Not be kept for longer than is necessary to satisfy the specified purpose(s)
Young Friends of the Earth will ensure that personal data is not kept for longer than what is strictly necessary for the purpose for which the data is processed, in line with the principles laid down in Article 5 of the GDPR.
To fulfil this commitment, Young Friends of the Earth has developed a Data Retention Policy and associated schedule to ensure Young Friends of the Earth fulfills its obligation in regards to retention periods for all categories of personal data processed by the organisation.
Once the respective retention period has elapsed, Young Friends of the Earth undertakes to destroy, erase or otherwise put this data beyond use, in line with its Data Destruction Policy.
- Be kept safe and secure
Young Friends of the Earth will ensure that the personal data it collects will be protected against unauthorised or unlawful processing and against accidental loss, destruction or damage.
In the event of a data breach likely to result in a risk to the rights and freedoms of the data subject or other persons, Young Friends of the Earth will notify the Irish Data Protection Commissioner without undue delay and, where feasible, within 72 hours after having become aware of the breach, in line with Article 33 of the GDPR.
In the event of a data security breach affecting the personal data being processed on behalf of the data controller, the relevant third party processor will notify the data controller without undue delay.
Data subject rights:
Clear and easily accessible communication
Young Friends of the Earth will take appropriate measures to ensure any and all communication with a data subject is conducted in a concise, transparent, intelligible and easily accessible from, using clear and plain language that is easily for the data subject to understand.
Information provided to data subjects
Young Friends of the Earth will ensure that all data subjects will be made aware, at the time their data is being collected, of:
- The identity of the data controller (Young Friends of the Earth and Friends of the Earth Ireland);
- The purpose(s) for which the data is being processed;
- The legitimate interests pursued by the controller (if processing is based on Article 6 (1)(f) of the GDPR)
- The person(s) to whom the data may be disclosed by the data controller;
- Any other information that is necessary so that the processing may be considered fair.
Right of access by data subjects
Upon receipt of a valid, formal request by a data subject in relation to the personal data held by Young Friends of the Earth which relates to them, Young Friends of the Earth will provide the data subject with the following information, free of charge, in line with Article 15 of the GDPR:
- The basis on which the data was obtained.
- The purposes for processing the data.
- The categories of personal data concerned.
- To whom the data has been or will be disclosed.
- Whether the data has been or will be transferred outside of the EU.
- The period for which the data will be stored, or the criteria to be used to determine retention periods.
- Information about the right to make a complaint to the Irish Data Protection Commissioner.
- Information about the right to request rectification or deletion of the data.
- Whether the individual has been subject to automated decision making.
Young Friends of the Earth will ensure that all subject access requests receive a response within 30 days.
Right to rectification and the right to be forgotten
As covered above in point 5 of this Policy, Young Friends of the Earth has put in place processes to ensure the complete and accurate nature of the personal data it collects. However, in the even that a data subject submits a valid request for correction or completion of incorrect or incomplete data, Young Friends of the Earth will ensure that any such data will be rectified or completed without undue delay, in line with Article 16 of the GDPR, and that the data subject is informed of the correct or completion of data.
Young Friends of the Earth will ensure that, upon request of the data subject, and where one of the specific grounds listed in Article 17 of the GDPR applies, all personal data related to the data subject in question is erased without undue delay, and that the data subject is informed of the erasure.
The right to restriction of processing and the right to object
Young Friends of the Earth will put in place processes that ensure respect for a data subject’s right to object or have restriction put in place against processing of their data. Young Friends of the Earth will ensure these processes comply fully with Articles 19 and 21 of the GDPR.
This Policy will be reviewed at least annually by the Data Protection Committee to ensure alignment to appropriate risk management requirements and its continued relevance to current and planned operations, or legal developments and legislative obligations.
Young Friends of the Earth’s headquarters is in Ireland. Should you wish to contact the relevant supervisory authority in relation to a data protection issue involving Young Friends of the Earth, you should contact:
The Irish Data Protection Commissioner
+353 57 8684800
+353 (0)761 104 800
+353 57 868 4757
Data Protection Commissioner Canal House Station Road Portarlington
21 Fitzwilliam Square Dublin 2 D02 RD28 Ireland.
Canal House Station Road Portarlington R32 AP23 Co. Laois
Data Protection Committee contact details:
The Data Protection Policy is maintained and approved by the Young Friends of the Earth Data Protection Committee:
Collection and use of technical information
Glossary of technical terms used
- web browser - The piece of software you use to read web pages. Examples are Google Chrome, Firefox, Microsoft Internet Explorer, Safari and Opera.
- IP address - The identifying details for your computer (or your internet company's computer), expressed in "internet protocol" code (for example 192.168.72.34). Every computer connected to the web has a unique IP address, although the address may not be the same every time a connection is made.
- cookies - Small pieces of information, stored in simple text files, placed on your computer by a web site. Cookies can be read by the web site on your subsequent visits. The information stored in a cookie may relate to your browsing habits on the web page, or a unique identification number so that the web site can "remember" you on your return visit. Generally speaking, cookies do not contain personal information from which you can be identified, unless you have furnished such information to the web site.