GDPR Privacy Notice

1. Introduction

Castlerock Homes ("we", "us", or "our") is committed to protecting your personal data and respecting your privacy rights. This Privacy Notice explains how we collect, use, store, and protect your personal information in accordance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and the Data Protection Act 2018 as implemented in Ireland.

This notice applies to all personal data we process about our employees, contractors, suppliers, and other individuals in connection with our construction and property development business operations.

2. Data Controller

Castlerock Homes is the data controller responsible for your personal data. For any queries or concerns about how we handle your data, please contact us using the details provided in Section 11 of this notice.

3. Personal Data We Collect

We may collect and process the following categories of personal data:

3.1 Identity and Contact Information

• Full name, date of birth, and gender
• Contact details (email address, phone number, postal address)
• PPS Number (for employment and payroll purposes)
• Emergency contact details

3.2 Employment and Financial Information

• Employment records, job title, and work history
• Bank account details for payroll processing
• Salary, wages, and payment information
• Tax and National Insurance details
• Time and attendance records (timesheets)
• Leave records and entitlements

3.3 Health and Safety Information

• Safe Pass certification and expiry dates
• Health and safety training records
• Accident reports and incident records
• Medical information relevant to workplace safety

3.4 Technical and System Data

• Login credentials and access logs
• IP addresses and device information
• System usage and activity logs

4. How We Use Your Personal Data

We use your personal data for the following purposes:

4.1 Employment and Payroll Management

• Processing payroll and making payments
• Managing employment contracts and benefits
• Recording attendance and leave
• Performance management and development

4.2 Legal and Regulatory Compliance

• Complying with employment law and tax obligations
• Meeting health and safety regulations
• Maintaining Safe Pass and certification records
• Responding to legal claims or regulatory investigations

4.3 Business Operations

• Managing purchase orders and supplier relationships
• Project planning and site management
• Financial reporting and cost tracking
• Audit and quality assurance

4.4 System Security and Administration

• Maintaining system security and preventing fraud
• User access management and authentication
• System backup and disaster recovery

5. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contractual necessity: Processing is necessary to perform our employment or supplier contracts
• Legal obligation: We must process your data to comply with employment law, tax law, and health and safety regulations
• Legitimate interests: Processing is necessary for our legitimate business interests, such as preventing fraud and maintaining system security
• Consent: Where you have given explicit consent for specific processing activities

6. Data Sharing and Disclosure

We may share your personal data with the following categories of recipients:

• Revenue Commissioners: For tax and PAYE/PRSI purposes
• Banks and financial institutions: For payroll processing
• Health and Safety Authority (HSA): For compliance and incident reporting
• Pension providers and insurers: For employee benefits administration
• IT service providers: For system hosting, maintenance, and support
• Professional advisors: Including legal, accounting, and audit services
• Regulatory authorities: When required by law

We do not sell or rent your personal data to third parties for marketing purposes.

7. International Data Transfers

Your personal data is primarily stored and processed within the European Economic Area (EEA). If we transfer your data outside the EEA, we will ensure appropriate safeguards are in place, such as:

• EU-approved Standard Contractual Clauses
• Adequacy decisions by the European Commission
• Binding Corporate Rules or other approved mechanisms

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with legal obligations:

• Employment records: 6 years after employment ends (as required by Irish employment law)
• Payroll and tax records: 6 years (as required by Revenue Commissioners)
• Health and safety records: Up to 40 years for certain types of injuries or exposure (as required by HSA)
• Audit logs: 2 years for operational purposes
• Purchase order records: 6 years from date of last transaction

After the retention period expires, we will securely delete or anonymize your personal data.

9. Your Rights Under GDPR

You have the following rights in relation to your personal data:

9.1 Right of Access

You can request a copy of the personal data we hold about you.

9.2 Right to Rectification

You can request that we correct any inaccurate or incomplete personal data.

9.3 Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal data in certain circumstances, subject to legal retention requirements.

9.4 Right to Restrict Processing

You can request that we limit how we use your personal data in certain situations.

9.5 Right to Data Portability

You can request a copy of your personal data in a structured, machine-readable format.

9.6 Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

9.7 Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that produce legal effects.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Role-based access controls and authentication
• Regular security audits and vulnerability assessments
• Secure backup and disaster recovery procedures
• Staff training on data protection and security
• Incident response and breach notification procedures

While we strive to protect your personal data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but will notify you and the Data Protection Commission in the event of a data breach where required by law.

11. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Notice or how we handle your personal data, please contact us:

12. Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with the Data Protection Commission (DPC), Ireland's supervisory authority for data protection:

13. Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the updated notice on our system and updating the "Last Updated" date below.

Last Updated: February 11, 2026