Privacy Policy

LOBO LEASING LIMITED

PRIVACY POLICY

1. Introduction

• This is the Privacy Policy of the Lobo Leasing Limited, (“Lobo Leasing") which is referred to as the “Company”, “us” or “we” throughout this Privacy Policy. This Privacy Policy provides details of the way in which we Process Personal Data in line with our obligations under Data Protection Law.
• Capitalised terms used in this Privacy Policy are defined in the Glossary in Annex I.

1. Background and Purpose

• The purpose of this Privacy Policy is to explain what Personal Data we Process and how and why we Process it. In addition, this Privacy Policy outlines our duties and responsibilities regarding the protection of such Personal Data. The manner in which we Process data will evolve over time and we will update this Policy from time to time to reflect changing practices.
• In addition, in order to meet our transparency obligations under Data Protection Law, we will incorporate this Privacy Policy by reference into various points of data capture used by us.

1. The Company as a Data Controller

• The Company will act as a Data Controller in respect of Personal Data provided to us by various individuals in connection with the operation and administration of the Company. Such individuals will generally include the following:

• customers;
• employees;
• suppliers;
• website visitors; and
• business partners.

• Personal Data is processed by the Company for the following purposes:

‍

4. The Company and Data Processors

• The Company willl engage certain service providers to perform certain services on its behalf which may involve the Processing of Personal Data. To the extent that such Processing is undertaken based on the instructions of the Company and gives rise to a Data Controller and Data Processor relationship, the Company will ensure that such relationship is governed by a contract which includes the data protection provisions prescribed by Data Protection Law.

4. Record Keeping

• As part of our record keeping obligations under Art. 30 GDPR, the Company retains a record of the Processing activities under its responsibility. This comprises the following:

6. Special Categories of Data

• The Company processes Special Categories of Data (“SCD”) in certain circumstances, such as the ordinary course of employee administration. The Company shall Process such SCD in accordance with Data Protection Law.

6. Individual Data Subject Rights

• Data Protection Law provide certain rights in favour of data subjects. The rights in question are as follows (the “Data Subject Rights”):

• The right of a data subject to receive detailed information on the processing (by virtue of the transparency obligations on the Controller);
• The right of access to Personal Data;
• The right to rectify or erase Personal Data (right to be forgotten);
• The right to restrict Processing;
• The right of data portability;
• The right of objection; and
• The right to object to automated decision making, including profiling, and where the Company relies on its legitimate interests to Process your Personal Data (for example, for marketing purposes) ;

• These Data Subject Rights will be exercisable by you subject to limitations as provided for under Data Protection Law. You may make a request to the Company to exercise any of the Data Subject Rights by contacting the Company’s General Counsel or Chief Executive Officer. Your request will be dealt with in accordance with Data Protection Law.

6. Data Security and Data Breach

• We have technical and organisational measures in place to protect Personal Data from unlawful or unauthorised destruction, loss, change, disclosure, acquisition or access. Personal Data are held securely using a range of security measures including, as appropriate, physical measures such as locked filing cabinets, IT measures such as encryption, and restricted access through approvals and passwords. For more information on security measures see Annex III.
• The GDPR obliges Data Controllers to notify the Data Protection Commission and affected data subjects in the case of certain types of personal data security breaches. Any Data Breaches identified in respect of Personal Data controlled by the Company will be dealt with in accordance with Data Protection Law and the Company’s Data Breach Procedure.

6. Disclosing Personal Data

• From time to time, we may disclose Personal Data to third parties, or allow third parties to access Personal Data which we Process (for example where a law enforcement agency or regulatory authority submits a valid request for access to Personal Data).
• We may also disclose Personal Data to: (a) selected third parties including our lawyers; financial and tax advisors and other professional advisors and (b) service providers, such as payroll and marketing companies and (c) our shareholders or investors or select business partners who have a need to know such Personal Data.

6. Data Retention

• We will keep Personal Data only for as long as the retention of such Personal Data is deemed necessary for the purposes for which that Personal Data are Processed (as described in this Privacy Policy).

6. Data Transfers outside the EEA

• The Company transfers some Personal Data to countries outside the European Economic Area. If such transfer occurs, the Company will ensure that such processing of your Personal Data is in compliance with Data Protection Law and, in particular, that appropriate measures are in place such as entering into Model Contractual Clauses (as published by the European Commission) or ensuring that the recipient is Privacy Shield certified, if appropriate. If you require more information on the means of transfer of your data or would like a copy of the relevant safeguards, please contact the Company’s General Counsel or Chief Executive Officer.

12. Cookies

• Cookies are small text files that may be placed on your browser when you visit our website (the “Site”). Cookies are used primarily for administrative purposes, to improve your experience with our Site. For instance, when you return to the Site after logging in, cookies provide information to the Site, including personal data, so that the Site will remember who you are.  Our Site uses cookies primarily to capture anonymous analytics used to improve our Site experience and performance. This includes compiling statistical information concerning, among other things, the frequency of use of our Site, the pages visited, and the length of each visit, as well as information about your computer, operating system, browser, language and country.  We do not use cookies to store any personal data that could be read or understood by others.
• Using the settings of your Internet browser, you can choose to have your computer warn you each time a cookie is being sent, or you can choose to turn off all cookies. Consult your browser Help menu to learn the correct way to modify your cookies.  If you choose to turn off cookies, you may not have access to certain features of our Site.  You may at any time delete any cookies set by using the relevant option of your Internet browser or by deleting the cookies on your hard drive.

• We use the following cookies:

13. Further Information/Complaints Procedure

• For further information about this Privacy Policy and/or the Processing of your Personal Data by or on behalf of the Company please contact Company’s General Counsel or Chief Executive Officer. While you may make a complaint in respect of our compliance with Data Protection Law to the Irish Data Protection Commission, we request that you contact Company’s General Counsel or Chief Executive Officer in the first instance to give us the opportunity to address any concerns that you may have.

Date: May 2018 

ANNEX I

Glossary

In this Privacy Policy, the terms below have the following meaning:

“Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed.

“Data Controller” means the entity which, alone or jointly with others, determines the purposes and means of the processing of Personal Data.

“Data Processor” means the party that Processes Personal Data on behalf of the Data Controller.

“Data Protection Law” means the General Data Protection Regulation (No 2016/679) (“GDPR”) and the Data Protection Act 2018 and any other laws which apply to the Company in relation to the Processing of Personal Data.

“European Economic Area” or “EEA” means Austria, Belgium, Bulgaria, Croatia, Republic of Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, the UK, Iceland, Liechtenstein, and Norway.

“Personal Data” is any information relating to a living individual which allows the identification of that individual. Personal Data can include:

• a name, an identification number;
• details about an individual’s location; or
• any other information that is specific to that individual.

“Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. “Process” and “Processing” are interpreted accordingly.

“Special Categories of Personal Data” are types of Personal Data that reveal any of the following information relating to an individual: racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership. Special Categories of Personal Data also include the Processing of genetic data, biometric data (for example, fingerprints or facial images), health data, data concerning sex life or sexual orientation and any Personal Data relating to criminal convictions or offences.

ANNEX II

Types of Personal Data