1. INTRODUCTION
1.1 The Delany Archive Trust is subject to Data Protection laws, including the General Data Protection Regulation (GDPR) and the Data Protection Acts 1988 to 2018. This Privacy Notice is made available to all persons whose personal data is processed by the Delany Archive. This includes people whose data is in our archival collections, researchers, representatives of Archive partners and their employees, depositors of collections, service providers, members of the archival community, website users, and those who interact with us via social media. The Privacy Notice informs you about categories of personal data that we process, what we use the data for, who we share the data with, how long we retain the data, and your rights. In this Privacy Notice, we, us and our refer to the Delany Archive.
2. CONTROLLER
2.1 The Trustees of the Delany Archive are controllers within the meaning of Data Protection law, however, due to the nature of the Archive’s work and its relationships, other controllers may also be involved. More specific information on this point is available from the Archivist.
3. LEGAL BASIS FOR PROCESSING DATA
3.1 In order to collect, create, store or otherwise process personal data, the Delany Archive must have a legal basis for doing so under Data Protection law. The following table outlines the activities that we undertake requiring the processing of personal data, the types of data involved, and the legal basis we rely on.
| Activities requiring personal data | Types of data | Lawful basis |
|---|---|---|
| Giving researchers physical access to archival collections in our Reading Room and associated permissions | Name, contact details, reader’s ticket number, a record of the documents that researchers order | Our legitimate interests – to safeguard the integrity and security of our collections |
| Answering research queries relating to our archival collections | Name, contact details, information forming the basis of queries, which may include data about other persons e.g. in the context of family history research | Our legitimate interests – to provide a research service |
| Conducting research and developing statistics to better understand the use made of our archival collections | Information about researchers’ research interests | Our legitimate interests – to develop our services in a targeted manner and maintain records of trends. Research is conducted in accordance with safeguards in Data Protection law |
| Managing orders of copies of documents | Name, contact details, payment information | To enable us to properly administer and perform our contracts with researchers |
| Managing applications for permission to publish archival documents | Name, contact details, details of applications, authorisation of responsible person | Our legitimate interests - to enable us to safeguard the integrity of our collections |
| Arranging and managing contracts for the provision of goods and services | Name, contact details, financial data, details of correspondence | To enable us to properly administer and perform our contracts |
| Acquiring archival collections and keep in touch with depositors | Name, contact details, information contained in correspondence, deposit agreement | To enable us to properly administer and perform our contracts |
| Corresponding with Archive partners and associated persons, including Diocesan leadership and parish clergy, leadership and members of congregations, Archive trustees, officials, employees and service providers | Name, contact details, information forming the basis of correspondence | Contract / our legitimate interests – to manage the Archive and provide services for the benefit of Archive partners |
| Reporting to the Charities Regulator and fulfilling recordkeeping obligations set down by the Charities Regulator | Personal data of trustees, including, name, address, gender, position and start date; any other data required to fulfil statutory obligations, including under the Charities Act 2009 | Legal obligation |
| Creating records of meetings of the Archive trustees | Names and subjects under discussion | Our legitimate interests – to create a reliable record of our interests and activities |
| Providing access to our archival collections (For further information, see the sections entitled ‘People in our Collections’ and ‘Safeguards Protecting Personal Data in Archival Collections’ in our Data Protection Policy) | Various types of data, depending on the archival collection in question. Data has been identified as being of enduring value for research | Our legitimate interests – to facilitate public research, historical research purposes |
| Reporting to and communicating with the Revenue Commissioners | Personal data of trustees and other beneficial owners, including, name, address, PPSN or other identifier, identification documents, role. | Legal obligation |
| Communicating with the archival community | Names, contact details, details of correspondence | Our legitimate interests – to keep in touch with colleagues |
| Communicating with users and responding to feedback, complaints, comments or suggestions, including comments made on our social media pages | Contact details, social media account information, details of communications | Our legitimate interests – to communicate with users |
| Undertaking research projects e.g. oral history | Participant contact details, agreement forms, photograph, interview recordings and transcript | Our legitimate interests – to collect and make available oral history, historical research purposes |
4. COMMUNICATING WITH US
4.1 You can communicate with the Delany Archive by email, web form or phone call. The content of emails and web forms is stored automatically. The website includes a general web form whose content is largely dictated by what you decide to share with us. Particularly when sharing other people’s data, we encourage you to supply the minimum data necessary with us.
5. RECIPIENTS OF PERSONAL DATA
5.1 Generally, personal data in the custody of the Delany Archive is processed by the Archivist. For some purposes, due to how the Archive administers its business, it may be necessary for the Archivist to share personal data with other individuals associated with the Archive. All data sharing is done in compliance with Data Protection law and in the least intrusive manner possible, in compliance with the principle of data minimisation. Data sharing is generally indicated in our policies, and if not noted in policies, the Archivist will inform data subjects of such sharing, wherever feasible and/or necessary. Those with whom data sharing is necessary includes, but is not limited to, Archive Trustees, Diocesan leadership, members of the clergy, leadership and members of religious congregations, officers and employees of partners to the Archive, parish employees, and depositors of archival collections.
5.2 Our collections are open for public research and a number of safeguards are in place to protect the privacy of data subjects. See the sections entitled People in Our Collections and Safeguards Protecting Personal Data in Archival Collections in our Data Protection Policy for further information.
5.3 We will ensure that an appropriate contract or arrangement, as appropriate, is in place with processors and controllers.
5.4 We share personal data where required or permitted to by a rule of law or court order, for example, the Charities Regulator in respect of the Archive’s obligations as a registered charity; and An Garda Síochána in respect of the prevention, detection and investigation of crime.
5.5 We share personal data with our service providers, including but not limited to, IT providers, legal advisors and auditors.
5.6 Carlow College, St. Patrick’s is a recipient of some personal data generated in the furtherance of the Archive’s functions as the Archive is based in the College and shares some services.
6. RETENTION OF PERSONAL DATA
6.1 We keep your personal data for no longer than is necessary to fulfil the purposes for which it was collected, taking into account the following criteria:
• We will retain queries from you for a reasonable period in case of further queries from you
• Any laws or regulations that we are required to follow
• Whether we are in a legal dispute with each other or a third party
• The type of information that we hold about you
• Operational importance
• The security and integrity of our archival collections.
7. THIRD COUNTRY TRANSFER
7.1 Generally, personal data processed by the Delany Archive is not transferred outside of the European Union (EU) / European Economic Area (EEA). Where this does occur, we will ensure that an appropriate safeguard is in place. The most likely exception to this general rule is that leadership and members of some Archive partners, including congregational archivists, may be outside the EU/EEA and it is sometimes necessary to share personal data with them.
8. DATA PROTECTION RIGHTS
8.1 Data subjects have the following rights, which are set out in Data Protection laws:
• The right to information about how we process your data
• The right to access the personal data we hold about you
• The right to request the rectification of incorrect or incomplete data
• The right to request the erasure of data, the so-called ‘right to be forgotten’
• The right to restrict processing of data
• The right to object to the processing of data
• The right to data portability, that is, the right to receive your personal data, which you provided to us, and to require the Archive to transfer it to another controller
• The right not to be subject to a decision made solely on automated processing, including profiling.
8.2 Data Protection rights are subject to various exemptions and restrictions, some of which are available to archive services. Further information on these matters is set out in our Data Protection Policy.
8.3 We will seek your consent to process personal data, where necessary. Where processing of personal data is based on consent, you may grant or refuse consent or withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing prior to the withdrawal of consent.
9. FAILURE TO PROVIDE DATA
You may decline to provide us with data in some circumstances. Where there is a statutory or contractual requirement for data, we may not be in a position to enter into or continue a relationship with you.
CONTACT US
Delany Archive Trust,
Carlow College, St Patrick’s,
College Street,
Carlow, R93 A003.
HOW TO MAKE A COMPLAINT
If you are unhappy with the way in which your personal data has been processed, we encourage you to contact us in the first instance. You have the right to complain to the Data Protection Commission:
Data Protection Commission,
Canal House,
Station Road,
Portarlington,
Co. Laois,
R32 AP23.
Version: 2.0
Date: 19 July 2022