Website Privacy Notice
In this privacy notice, you can read more about how Carton Bros., (“Carton Bros.”, “we,” “us” or “our”) may process your personal data when you are visiting and using the services provided at www.cartonbros.ie. Carton Bros. is the data controller of any processing of your personal data.
What personal data do we process?
We collect personal data when you, (i) sign up for information on new job openings, and/or (ii) file a complaint or request contact with us. Such personal data will include your name, contact details and other information that you voluntarily provide to us.
Purpose, legal ground and storage period
We will only use your personal data for the purposes, and on the legal grounds, as set out below. We will not use your personal data for any purpose that is incompatible with the below purposes. Further, we will only use your personal data during the period as set out in the right column, after such which period your personal data will be erased.
| Purpose of processing | Legal ground for processing | Storage period |
|---|---|---|
| Direct marketing. When you sign up for news, invites and/or offers (direct marketing), we will process your personal data to provide the services as requested by you. | The processing is necessary for our legitimate interests to maintain good customer relations. | If you opt-out or unsubscribe from our direct marketing, we will no longer process your personal data for this purpose.
We will also erase your personal data unless there is another legal ground for keeping your data. |
| Information. When you sign up to receive information on new job openings, we will process your personal data to provide the services as requested by you. | The processing is necessary for our legitimate interests to maintain good relations with potential employees. | If you opt-out or unsubscribe from our email subscription services, we will no longer process your personal data for this purpose.
We will also erase your personal data unless there is another legal ground for keeping your data. |
| Competitions. If you enter a Carton Bros. competition, we will process your contact details for the purposes of administering the competition and, should you win, administering the award including delivering of the prize to you and publishing your name and location (not address) in our publicity materials. You may withdraw from the competition at any time | The processing is necessary for our performance of the contract with you (i.e. your request to participate in the competition). The publishing of your name and location as a winner in our publicity materials is necessary for our legitimate interests to promote our brand and our competitions and maintain good customer relations. | We will erase your data, within one month after the competition has ended, unless there is another legal ground for keeping your data. |
| Contact requests, complaints and/or general enquiries. When you contact us in order to file a complaint or request contact, we will process your personal data (i.e. name, contact details and/or other information you provide) to be able to assist you with the relevant matter. | The processing is necessary for our legitimate interests to maintain good customer relations. | We will erase your data, within one month after the relevant matter has been finally resolved. |
Please note that the above storage periods do not apply to the extent Carton Bros. is required to retain your personal data (partly or in full) under the applicable mandatory law (e.g. accounting laws).
Who do we share your personal data with?
Only the people who need to process personal data for the purposes mentioned above have access to your personal data.
We may need to share your personal data with our group companies. We further may need to allow our suppliers and sub-suppliers access to your personal data when they perform services on our behalf, mainly to provide support and maintenance of IT systems, storage services and marketing.
Any transfer of data outside the EU/EEA is made in line with data protection laws. Our international transfers of personal data (including transfers to our group companies and suppliers outside the EU/EEA) are based on the EU Commission’s standard contractual clauses. The standard contractual clauses may be found here. In addition, for transfers to some of our suppliers in the U.S., the recipient is certified under the EU-U.S. Privacy Shield administered by the U.S. Department of Commerce’s International Trade Administration (can be found here www.privacyshield.gov).
Who else gets your personal information?
To help us provide our services, we may share your personal information with a third party who provide email marketing services to Carton Bros..
This third party (Poppulo) can only use the personal information we share in order to provide their email marketing services to Carton Bros. customers.
If you have asked to receive information about our products and services, your email address will be provided to Poppulo, who publish marketing materials on our behalf, and will use it only for that purpose. For more details on how Poppulo uses your personal information on our behalf, please visit: www.poppulo.com/privacy-saas-platform
Your personal information is not shared with anyone else. It is not transferred outside the European Union.
Your rights
You are entitled to the following rights under applicable laws:
- The right to access: you may at any time request to access your personal data. Upon request, we will provide a copy of your personal data in a commonly used electronic form.
- The right to rectification: you are entitled to obtain rectification of inaccurate personal data and to have incomplete personal data completed.
- The right to erasure (“right to be forgotten”): under certain circumstances (including processing on the basis of your consent), you may request us to delete your User Data. Please note that this right is not unconditional. Therefore, an attempt to invoke the right might not lead to an action from us.
- The right to object: to certain processing activities conducted by us in relation to your personal data, such as our processing of your personal data based on our legitimate interest. The right to object also applies to the processing of your personal data for direct marketing purposes.
- The right to the restriction of processing: you may under certain circumstances request from us to restrict the processing of your personal data. Please note that this right is not unconditional. Therefore, an attempt to invoke the right might not lead to an action from us.
- The right to data portability: you are entitled to receive your personal data (or have your personal data directly transmitted to another data controller) in a structured, commonly used and machine-readable format.
Finally, you also have the right to lodge a complaint with the supervisory authority, which in Ireland is the Data Protection Commissioner.
Cookies
As part of our approach to providing personalized services on our website, we use cookies to store and sometimes track information about you. A cookie is a small data file sent to your browser from a web server and stored on your hard drive that allows easier access the next time the same page is visited. For example, a cookie is sent when you create a user account.
If you do not want your personal information to be stored by cookies, you can configure your browser so that it notifies you whenever a cookie is received. This way you can decide each time to accept cookies or not. However, the use of cookies may be necessary to provide certain features and choosing to reject cookies may reduce the functionality of our website. Your browser should include precise instructions explaining how to control the acceptance of cookies.
To be transparent, we have summarized the cookies used on our website below.
Supplier: Google Analytics
Type: First Party Persistent
Purpose: Used to distinguish users
Storage time: 2 years
Stored data: A client ID
Sharing: None
Supplier: Google Analytics
Type: First Party Persistent
Purpose: Used to distinguish users
Storage time: 24 hours
Stored data: A client ID
Sharing: None
Supplier: Google Analytics
Type: First Party Persistent
Purpose: Used to throttle request rate.
Storage time: I minute
Stored data: A client ID
Sharing: None
Supplier: Facebook
Type: Third Party Persistent
Purpose: Allows control over the “Follow us on Facebook” and “Like” buttons
Storage time: 90 days
Stored data: Contains userid
Sharing: None
Data security
We employ appropriate technical and organizational security measures to help protect your personal data against loss and to guard against access by unauthorized persons. Appropriate security measures we have taken include implementing secure private connections, traceability, disaster recovery and access limitations. We regularly review our security policies and procedures to ensure our systems are secure and protected.
Contact information
If you have any questions relating to our handling of your personal data or our use of cookies or if you would like to invoke any of your rights under applicable privacy legislation, please contact us at [email protected].
Changes to this website privacy notice
If we change how we handle your personal data or how we use cookies, we will promptly update this website privacy notice and publish it on this website.
Last updated: 05-10-2018