Privacy Notice

This Privacy Notice explains how personal data is collected, used, stored and disclosed in connection with Subcontract.ie. Subcontract.ie is a business-to-business platform designed to connect businesses seeking subcontracting capacity with independent subcontracting businesses interested in defined packages of work.

For the purposes of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Data Protection Act 2018, the data controller is The Painting Professionals Ltd, 10 Rye River Crescent, Leixlip, Co. Kildare, Ireland, trading through the Subcontract.ie service.

Privacy enquiries should be sent to privacy@subcontract.ie. References to “Subcontract.ie”, “we”, “us” or “our” refer to The Painting Professionals Ltd in its capacity as operator of the Subcontract.ie service.

Subcontract.ie is designed around business-to-business introductions. We aim to collect only the personal data reasonably required to:

• operate the platform;
• create and manage accounts;
• publish anonymous business profiles where authorised;
• facilitate subcontracting opportunities and introductions;
• process payments;
• communicate with users;
• maintain platform security;
• comply with legal obligations; and
• improve and administer the service.

We do not intend to operate Subcontract.ie as a public database of personal contact information. Where profiles or subcontract opportunities are displayed publicly or to other users, identifying information is restricted in accordance with the platform’s anonymity and introduction processes.

Depending on how you interact with Subcontract.ie, we may process the following categories of information.

3.1 Account and contact information

• name;
• business name;
• trading name;
• business email address;
• telephone number;
• business address;
• county or service area;
• job title or role;
• company registration information;
• VAT information; and
• account identifiers.

3.2 Subcontracting business profile information

• trade and specialisms;
• counties or geographical areas covered;
• years of experience;
• business or crew capacity;
• availability;
• typical project experience;
• qualifications or registrations you declare;
• insurance status you declare;
• safety documentation status you declare;
• tax-clearance status you declare; and
• details of relevant previous projects.

Unless expressly stated otherwise, information described as “declared” has been supplied by the subcontracting business and has not been independently verified by Subcontract.ie.

3.3 Work-package information

• trade required;
• project type;
• general location;
• scope of works;
• quantities;
• programme;
• start and completion dates;
• package value;
• materials and plant responsibilities;
• relevant qualifications;
• safety requirements;
• project documentation where supported by the platform; and
• information relating to expressions of interest and introductions.

We aim to prevent the identity of the requesting business from being publicly disclosed before the appropriate introduction stage.

3.4 Previous-project information

• project type;
• county or region;
• year;
• scope undertaken;
• approximate value band;
• role undertaken; and
• relevant quantities.

We discourage users from entering unnecessary personal information about previous customers or reference contacts into public profiles. Reference contact information may be exchanged directly between businesses at the due-diligence stage rather than being publicly displayed.

3.5 Payment and transaction information

• transaction reference;
• amount;
• VAT;
• payment date;
• payment status;
• invoice information;
• Stripe customer or payment identifiers; and
• refund information.

Payment-card information is intended to be processed by our payment provider rather than stored directly by Subcontract.ie.

3.6 Communications

• customer-service enquiries;
• complaints;
• introduction enquiries;
• volume-account enquiries;
• privacy requests;
• emails;
• correspondence; and
• relevant administrative notes.

3.7 Technical and security information

• IP address;
• browser type;
• device information;
• login activity;
• security events;
• session information;
• authentication information; and
• website usage information.

Where cookies or similar technologies are used, further information will be provided in our Cookie Notice and cookie-preference controls.

Subcontract.ie may identify businesses that appear to provide relevant subcontracting services using publicly available sources, including business websites, publicly available business directories, professional or trade directories, company registers, search engines, publicly available business social-media pages and other legitimate public business sources.

Where this results in the processing of personal data, we may record limited information necessary to identify and contact the relevant business, such as:

• business name;
• publicly advertised business email address;
• publicly advertised business telephone number;
• trade;
• website;
• location; and
• source from which the information was obtained.

A business identified in this manner is treated as a prospect and is not represented as a registered or approved member of Subcontract.ie unless it subsequently registers or otherwise agrees to participate. We do not intend to publish prospect businesses as available subcontractors without appropriate authorisation.

We process personal data only where we have an appropriate lawful basis under data-protection law.

5.1 Providing the service

We process account, profile, work-package, matching, introduction and transaction information where necessary to provide the services requested by users and to take steps at a user’s request before entering into a contractual relationship. Lawful basis: performance of a contract or steps taken prior to entering into a contract.

5.2 Account administration

We use personal data to create accounts, authenticate users, maintain profiles, manage enquiries, provide service communications, administer introductions and provide customer support. Lawful basis: performance of a contract and our legitimate interests in administering the platform.

5.3 Matching subcontract opportunities

We may use trade, specialism, location, service area, availability, capacity, experience and stated project requirements to identify potentially relevant opportunities or subcontracting businesses. Lawful basis: performance of the requested service and our legitimate interests in operating an effective business-to-business matching service.

Subcontract.ie does not intend to make legally significant decisions about users solely through automated processing. The requesting business remains responsible for deciding which subcontracting business it wishes to consider or appoint.

5.4 Anonymous subcontractor directory

A subcontracting business may choose to permit an anonymous version of its profile to appear in the Available Subcontractors directory. Where we rely on consent for this publication, the consent may be withdrawn at any time. Withdrawal will prevent future publication but will not affect processing that was lawful before withdrawal. Lawful basis: consent.

5.5 Payments and financial administration

We process transaction information to receive payments, issue invoices, administer refunds, maintain accounting records and meet tax and financial-record obligations. Lawful basis: performance of contract and compliance with legal obligations.

5.6 Security and fraud prevention

We may process account, technical and transactional information to protect accounts, investigate suspected misuse, prevent fraud, enforce our terms, secure our systems and protect Subcontract.ie and its users. Lawful basis: our legitimate interests in maintaining a secure and trustworthy service and, where applicable, compliance with legal obligations.

5.7 Legal claims and regulatory compliance

We may retain or use information where reasonably necessary to establish, exercise or defend legal claims, respond to lawful requests, comply with court orders, comply with regulatory obligations or cooperate with competent authorities. Lawful basis: legal obligation and/or legitimate interests.

5.8 Improving the service

We may analyse appropriate usage and operational information to improve website functionality, customer experience, matching processes, security and service performance. Where possible, we use aggregated or anonymised information. Lawful basis: our legitimate interests in improving and developing the service.

Where we rely on legitimate interests, those interests may include:

• operating and developing Subcontract.ie;
• facilitating relevant business-to-business introductions;
• maintaining a useful network of subcontracting businesses;
• protecting our systems and users;
• preventing fraud and misuse;
• maintaining appropriate business records;
• responding to enquiries;
• understanding how the service is used; and
• promoting our services in circumstances permitted by law.

Where required, we consider whether those interests are overridden by the rights and freedoms of the individual concerned. You have the right to object to certain processing carried out on the basis of legitimate interests.

We may send information about Subcontract.ie where permitted by applicable data-protection and electronic-marketing law. Where consent is required, we will seek appropriate consent. Where electronic marketing to a business contact is otherwise permitted by law, we will respect any request not to receive further marketing.

Every marketing communication will provide an appropriate method of opting out. You may object to direct marketing at any time. Once an objection is received, we will stop using the relevant personal data for direct-marketing purposes. We may retain a minimal suppression record so that a person or business that has opted out is not inadvertently added to a future marketing list.

Opting out of marketing does not prevent us from sending necessary service communications relating to an account, payment, introduction, security issue or other transaction.

Subcontract.ie is designed to protect identifying business information during the initial matching process. An anonymous subcontractor profile may contain trade, specialism, general service area, experience, crew capacity, availability, relevant previous-project information and declared documentation status.

It will not ordinarily display the business’s direct contact information before the appropriate introduction process. Similarly, a requesting business may publish a work opportunity without publicly displaying its business name, contact person’s identity, telephone number, email address or exact project address. Information may be released when the relevant introduction conditions have been met.

Subcontract.ie may allow subcontracting businesses to declare that they hold certain documentation, registrations or qualifications, such as Public Liability insurance, Employers Liability insurance, a Safety Statement, tax clearance, Safe Pass, relevant trade registration, relevant qualifications and other safety or competence documentation.

Unless expressly stated otherwise, these are self-declarations. Subcontract.ie does not represent that such documentation has been independently verified merely because the relevant status appears on a profile. The business considering appointment of a subcontractor is responsible for obtaining and verifying appropriate original or current documentary evidence before entering into a subcontract.

We may share personal data where reasonably necessary with:

Other platform users

Where an introduction takes place, appropriate contact and business information may be disclosed to the relevant requesting business or subcontracting business.

Payment providers

Payment and transaction information may be processed by payment-service providers such as Stripe.

Technology and service providers

We may use third-party providers for hosting, databases, authentication, email delivery, website infrastructure, analytics, security, error monitoring, customer communications and technical support. Those providers may process personal data only to the extent required for their role and subject to applicable contractual and legal protections.

Professional advisers

Information may be disclosed where necessary to solicitors, accountants, insurers, auditors and other professional advisers.

Authorities and regulators

We may disclose information where required by law or where reasonably necessary to respond to Revenue, courts, regulators, law-enforcement authorities or other competent public authorities.

Corporate transactions

If ownership or operation of Subcontract.ie is transferred, restructured or sold, relevant personal data may be disclosed as part of that transaction, subject to applicable data-protection requirements. We do not sell personal data to advertisers.

Some service providers used by Subcontract.ie may process or access personal data outside the European Economic Area (“EEA”). Where personal data is transferred outside the EEA, we will take steps required by Chapter V of the GDPR. Depending on the destination and provider, these safeguards may include a European Commission adequacy decision, approved Standard Contractual Clauses, supplementary safeguards where appropriate, or another lawful transfer mechanism permitted by the GDPR.

Further information about relevant transfer safeguards may be requested by contacting privacy@subcontract.ie.

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and for any subsequent legitimate or legal requirement. Our current retention approach is:

Active accounts

Account and profile information is normally retained while the account remains active.

Closed accounts

Information that is no longer required will be deleted or anonymised following account closure, subject to legal, financial, security, dispute and record-keeping requirements.

Financial and transaction records

Financial, tax and accounting records may generally be retained for at least six years, or for any longer period required by applicable law, an investigation, audit or legal proceeding.

Introduction and transaction records

Records relating to paid introductions and related transactions may be retained for up to six years where reasonably necessary for contractual records, disputes, legal claims, accounting or regulatory purposes.

Prospect information

Prospect information obtained from public business sources will normally be reviewed after 12 months where no relationship has developed and deleted or minimised where there is no continuing lawful reason to retain it.

Marketing preferences

Marketing consent and objection records may be retained for as long as necessary to demonstrate compliance. A minimal suppression record may be retained where necessary to ensure that an opt-out continues to be respected.

Customer-support information

Routine enquiries will be retained only for as long as reasonably necessary. Information connected with a transaction, complaint, dispute or legal matter may be retained for a longer period where appropriate.

Security information

Technical and security logs are retained for periods proportionate to their security and operational purpose.

Where a dispute, investigation, legal hold or regulatory matter exists, relevant records may be retained beyond their ordinary retention period until the matter has been concluded.

Registered users may request deletion of their account. Where an account deletion request is accepted, we will remove the account from active use, remove applicable public profile information, stop active matching, stop marketing communications, delete personal data that is no longer required and anonymise information where appropriate.

Account deletion does not necessarily result in the immediate deletion of every record. We may retain information where necessary for tax or accounting obligations, legal claims, fraud prevention, transaction records, dispute resolution, regulatory obligations or enforcement of our agreements. Where information must be retained, access will be restricted to the extent appropriate.

Subject to the conditions and limitations contained in applicable law, you may have the right to:

Access

Request confirmation of whether we process your personal data and obtain a copy of that data.

Rectification

Ask us to correct inaccurate or incomplete personal data.

Erasure

Ask us to erase personal data where the legal conditions for erasure are satisfied. The right to erasure is not absolute and may not apply where information must be retained for legal or other permitted reasons.

Restriction

Ask us to restrict processing in certain circumstances.

Object

Object to processing based on legitimate interests in certain circumstances. You have an absolute right to object to processing for direct-marketing purposes.

Data portability

Where applicable, receive certain personal data you provided to us in a structured, commonly used and machine-readable format.

Withdraw consent

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Complain

You have the right to raise a concern with the Irish Data Protection Commission if you believe that your personal data has been processed in breach of applicable data-protection law.

Requests relating to personal data should be sent to The Painting Professionals Ltd / Subcontract.ie, 10 Rye River Crescent, Leixlip, Co. Kildare, Ireland, or by email to privacy@subcontract.ie.

Please describe the request sufficiently clearly to allow us to identify the information concerned. We may request reasonable information to verify identity before disclosing or changing personal data. We will respond within the periods required by applicable data-protection law.

There will ordinarily be no charge for exercising a data-protection right. A reasonable fee may be charged, or a request may be refused, only where permitted by applicable law, including where a request is manifestly unfounded or excessive.

We would encourage you to contact us first if you have a concern about how we use personal data so that we have an opportunity to address it.

You also have the right to contact the Data Protection Commission, Ireland. Website: www.dataprotection.ie. Email: info@dataprotection.ie. You may use the Data Protection Commission’s online complaint process where appropriate.

Subcontract.ie may use cookies and similar technologies for purposes including authentication, security, maintaining user sessions, preferences, website functionality, analytics and performance measurement. Strictly necessary technologies may operate without optional consent where permitted by law.

Non-essential cookies or similar technologies requiring consent will not be activated until the required consent has been obtained. Users will be provided with controls to accept applicable cookies, reject non-essential cookies and manage cookie preferences. Further information will be provided in the Subcontract.ie Cookie Notice.

We take appropriate technical and organisational measures designed to protect personal data against accidental loss, unauthorised access, unlawful disclosure, alteration, misuse and destruction. Measures may include authentication controls, restricted administrator permissions, server-side access controls, secure payment processing, security logging, encryption where appropriate, access management and regular review of system security.

No internet-based system can be guaranteed to be completely secure. Users are responsible for maintaining the confidentiality of their own account credentials.

Where a personal-data breach occurs, we will assess the nature and level of risk arising from the incident. Where required by applicable law, we will notify the Data Protection Commission and/or affected individuals within the applicable statutory periods. We maintain internal procedures for investigating, documenting and responding to personal-data breaches.

If you provide personal information concerning another individual, for example a colleague or reference contact, you are responsible for ensuring that you are entitled to provide that information and that the individual has been appropriately informed where required. Do not provide unnecessary personal information about other individuals through Subcontract.ie.

Subcontract.ie is a business-to-business service and is not intended for children. Users creating accounts must be at least 18 years old and authorised to act on behalf of the relevant business. We do not knowingly seek to collect personal data relating to children through the ordinary operation of the platform.

Subcontract.ie may use information including trade, location, availability, capacity and experience to identify potentially relevant subcontracting opportunities or businesses. Such matching is intended to assist users in identifying relevant opportunities.

Subcontract.ie does not intend to use automated matching to make final decisions about whether a business receives a subcontract, whether a subcontractor is competent, whether a business should be appointed or the terms on which the parties contract. Those decisions remain with the businesses involved.

Subcontract.ie may contain links to third-party websites. We are not responsible for the privacy practices of independent third-party websites. Users should review the relevant third party’s own privacy information before providing personal data.

We may update this Privacy Notice where the service changes, our processing activities change, new providers are introduced, legal requirements change or privacy practices are updated. The current version will be published on Subcontract.ie with its effective date. Where a change materially affects how personal data is processed, we will provide additional notice where appropriate. Previous versions may be retained for audit and accountability purposes.

For questions, requests or concerns relating to privacy or personal data, contact The Painting Professionals Ltd, operator of Subcontract.ie, 10 Rye River Crescent, Leixlip, Co. Kildare, Ireland. Privacy email: privacy@subcontract.ie.