Punchestown Racecourse Privacy Notice

PUNCHESTOWN RACECOURSE PRIVACY NOTICE

BACKGROUND:

Punchestown Racecourse understands that your privacy is important to you and that you care about how your personal data is used. We respect and value the privacy of all of our members, customers, and individuals and will only collect and use personal data in ways that are described here, and in a way that is consistent with our obligations and your rights under the law. We want to ensure that you enjoy our events and fixtures and that we use any data to make sure that you have the best possible experience of our amenities.

1. Information About Us

Punchestown Racecourse.

Punchestown Racecourse is a registered company under company number 269232

Registered address: Punchestown, Naas, Co Kildare. W91 VCX4

Main trading address: Punchestown, Naas, Co Kildare. W91 VCX4

VAT number: IE8269232S.

Data Compliance Officer: Leona Hughes.

Email address: info@punchestown.com

Telephone number: 00353 (45) 897704

2. What Does This Notice Cover?

This Privacy Information explains how we use your personal data: how it is collected, how it is held, and how it is processed. It also explains your rights under the law relating to your personal data.

3. What Is Personal Data?

Personal data is defined by the General Data Protection Regulation (EU Regulation 2016/679) (the “GDPR”) and the Data Protection Act 2018 (collectively, “the Data Protection Legislation”) as ‘any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier’.

Personal data is, in simpler terms, any information about you that enables you to be identified. Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.

The personal data that we use is set out in Part 5, below.

4. What Are My Rights?

Under the Data Protection Legislation, you have the following rights, which we will always work to uphold:

a) The right to be informed about our collection and use of your personal data. This Privacy Notice should tell you everything you need to know, but you can always contact us to find out more or to ask any questions using the details in Part 11.

b) The right to access the personal data we hold about you. Part 10 will tell you how to do this.

c) The right to have your personal data rectified if any of your personal data held by us is inaccurate or incomplete. Please contact us using the details in Part 11 to find out more.

d) The right to be forgotten, i.e. the right to ask us to delete or otherwise dispose of any of your personal data that we hold. Please contact us using the details in Part 11 to find out more.

e) The right to restrict (i.e. prevent) the processing of your personal data.

f) The right to object to us using your personal data for a particular purpose or purposes.

g) The right to withdraw consent. This means that, if we are relying on your consent as the legal basis for using your personal data, you are free to withdraw that consent at any time.

h) The right to data portability. This means that, if you have provided personal data to us directly, we are using it with your consent or for the performance of a contract, and that data is processed using automated means, you can ask us for a copy of that personal data to re-use with another service or business in many cases.

i) Part 6 of this privacy notice explains more about how Punchestown may use your personal data, including automated decision-making and/or profiling.

For more information about our use of your personal data or exercising your rights as outlined above, please contact us using the details provided in Part 11.

It is important that your personal data is kept accurate and up-to-date. If any of the personal data we hold about you changes, please keep us informed as long as we have that data.

Further information about your rights can also be obtained from the Office of the Data Protection Commissioner.

If you have any cause for complaint about our use of your personal data, you have the right to lodge a complaint with the Office of the Data Protection Commissioner. We would welcome the opportunity to resolve your concerns ourselves, however, so please contact us first, using the details in Part 11.

5. What Personal Data Do You Collect and How?

We will collect personal data from a number of sources. These include:

– Directly from you: when you set up an account with us, purchase services from us, complete forms we provide to you, make a report or notification about our services, contact us by phone, email, or communicate with us directly in some other way (such as social media).

– Our website: we also collect information about how you use our website.

– Third party data: we collect some names and address details from third parties. For example when running competitions in conjunction with trusted stakeholders such as sponsors or partners. This information is used for communicating about forthcoming events.

– Your Personal Details

Your privacy is important to us and as such we will not release your personal details to any organisation outside Punchestown Racecourse for their mailing or marketing purposes. We do however reserve the right to disclose this information in the circumstances set out below under ‘Who has access to your personal data’. We treat your personal information as confidential and as such it is held on a secure server.

Punchestown Racecourse collects both personal and anonymous data when you send us information or visit our website. In general, you may visit the website without telling us who you are or revealing any personally identifiable information about yourself. However, when we do collect data it falls within the categories outlined below:

We collect the following types of personal data from you:

Contact details: This is personal data that can identify you as an individual. These include, title, first name, surname, postal address, email address and telephone number, and in some cases date of birth. Please note this information is not collected unless it is provided voluntarily for registration or participation in any available online interactive activities, for example by entering a competition.

Purchase and payment details: When purchasing an item through the Punchestown Racecourse this is processed by our ticketing providers, Future Ticketing. Future Ticketing process all admission & hospitality tickets as well as Punchestown Club Memberships.

We keep a record of your name, address, telephone, email, IP address and ticket transaction details when you make a booking with us. No credit card details are stored by either Punchestown Racecourse or Future Ticketing as all payments processed are done so through our validated and secure payments provider, Realex.

We collect the following type of anonymised data from you:

Device Event Information: This is anonymous data that will not identify you as a person, but with each of your visits to our website we automatically collect the following information: IP address of device(s) used, crashes, system activity, hardware settings, browser type, browser language, operating system, device type, the date and time of your request and referral, location in terms of country and telephone code. We also collect the web pages you have viewed, domain type, search terms and the URL you came from. The data is collected to measure the number of visits, average time spent on the website and pages viewed etc. This information is used to measure the use of Punchestown Racecourse.ie and improve the content and online services.

6. How do we use your Personal Data?

In the below description, we describe:

 the purposes for which we collect your personal data;

 the categories of personal data we process for that purpose;

 the legal basis that allows us to process your personal data; and how long we will keep your personal data for.

(i) Provisions of the Service

Purpose of processing: We use your information to communicate with you and to carry out actions you request on the site, such as requesting transactions. This is also for internal business administration and operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes.

Categories of data processed: We use your personal information relevant for carrying out the actions you request as well as for internal business administration and operations.

Legal basis of processing: Our legal basis for collecting this information from you is that it is in our legitimate interest to use your personal information to ensure we are providing you with a service that is the best and most relevant for you as well as to respond to any requests you make or feedback provided about the service that we deliver.

Data storage period: We review data annually to ensure that it is still relevant and necessary. Data shall be kept for no longer than is necessary for the purposes for which it is being processed or as prescribed by statute.

(ii) Understand the Website User Journey and Make Improvements

Purpose of processing: By monitoring and analysing trends it allows us to better understand how users interact with our website, which in turn helps us improve your experience. For example by adding new features we think you will enjoy or making existing ones easier to use.

Categories of data processed: Domain name, operating system, browser, IP address of device(s) used, crashes, system activity, hardware settings, browser type, browser language, operating system, device type, the date and time of your request and referral, location in terms of country and telephone code, the web pages you have viewed, domain type, search terms and the URL you came from.

Legal basis of processing: Our legal basis for processing this information is that it is in our legitimate interest to improve your website experience.

Data storage period: We review data annually to ensure that it is still relevant and necessary. Data shall be kept for no longer than is necessary for the purposes for which it is being processed or as prescribed by statute.

(iii) To Fulfil Prizes

Purpose of processing: When you have entered a competition, if you win a prize we will use the information you have provided us with to inform you of this.

Categories of data processed: We use your contact and address details.

Legal basis of processing: Our legal basis for processing this information is based on your consent to be contacted about a competition prize. You can remove your consent at any time via contacting us via email on info@punchestown.com.

(iv) To Respond to Specific Requests from Visitors

Purpose of processing: Our service contains various user interfaces, which allow visitors to request more information about our products and services, contact information may be used to get back to you and obtain further details.

Categories of data processed: We use your personal information relevant for carrying out the actions you request.

Legal basis of processing: Our legal basis for collecting this information from you is that it is in our legitimate interest to use your personal information to ensure we are responding to your specific request in a way that is the best and most relevant for you.

Surveys

Purpose of processing: Surveys may be sent to you requesting anonymous feedback regarding our products and services to better understand the needs and profiles of our visitors.

Categories of data processed: We use your contact details, and specifically your email address.

Legal basis of processing: Our legal basis for processing this information is based on your consent to receive communications from us by email and to participate in surveys. When you have opted in to receive communications from us by email and you volunteer to participate, we may collect personal information about you to administer the survey and analyse these results. We will let you know how we will use the information at the time we collect the information. If you have provided consent, you can remove your consent at any time via contacting us via our website at http://www.Punchestown Racecourse.ie/about-us/contact/

(v) Marketing and Profiling

Purpose of processing: In general we promote and market products to you to provide you with information about other events or opportunities that are similar to those you have already purchased, special offers or other products or services we feel may be of interest to you.

If you do not wish to receive these solicitations from us using your personal identifiable information, please notify us. You can change your preference regarding the use of your information at any time, either by emailing us to info@punchestown.com or calling our office on 00353 (45) 897704 and stating your request. You can also opt-out of our mailing system at any stage by simply hitting the unsubscribe button. Both the website and the telephone ticket booking process require you to ‘opt-in’ to receive marketing information. If you unsubscribe to marketing emails, you will continue to receive service (informative) emails.

Categories of data processed: We use your contact details and your transaction history with us.

Legal basis of processing: Our legal basis for processing this information is based on your consent to be subject to profiling and receive marketing communications from us. You can remove your consent at any time via contacting us, via our website at http://www.Punchestown Racecourse.ie/about-us/contact/

(vi) Security

Purpose of processing: We may process your data to protect the security or integrity of our website when necessary, detect and prevent fraudulent transactions and other illegal activities, fight spam, protect the rights and property of Punchestown Racecourse.

Categories of data processed: We use your personal information relevant to protecting the security or integrity of our website.

Legal basis of processing: Our legal basis for processing this information is that it is in our legitimate interest to protect the security or integrity of our website.

7. How do You get my Consent?

Where our use of your personal information requires your consent, you can provide consent:

– At the time we collect your information following the instructions provided; or

– By informing us using the contact details set out in this Policy.

You can choose how we can get in touch with you at the time you provide us with the personal information as well as being able to change this by contacting us. You may withdraw your consent at any time. You will not suffer any detriment for withdrawing your consent. If you withdraw your consent, this will not make processing which we undertook before you withdrew your consent unlawful.

8. How Long Will You Keep My Personal Data?

We will not keep your personal data for any longer than is necessary in light of the reason(s) for which it was first collected. We review data annually to ensure that it is still relevant and necessary.

9. How and Where Do You Store or Transfer My Personal Data?

We will only store or transfer your personal data within Ireland and the European Economic Area (the “EEA”). The EEA consists of all EU member states, plus Norway, Iceland, and Liechtenstein. This means that your personal data will be fully protected under the Data Protection Legislation, GDPR, and/or to equivalent standards by law.

10. Do You Share My Personal Data?

Our staff: your personal data will be accessed by our staff but only where this is necessary for their job role.

Other service providers and advisors: such as companies that support our IT, help us analyse the data we hold, process payments, send communications to our customers, provide us with legal or financial advice and help us deliver our services to you.

In some instances, on behalf of sponsors, we will contact you with offers on their behalf but we do not share your data with any third parties for marketing purposes. For instance, we will share your contact and purchase details with catering partners, who support us in the aggregation, reporting and analysis of the data we receive to enable us to promote relevant marketing and product information to our customers. We also share your contact details with catering partners who are assisting us in the organisation of the event.

The government or our regulators: where we are required to do so by law or to assist with their investigations or initiatives, including the Data Protection Commissioner.

Gardaí and law enforcement: to assist with the investigation and prevention of crime.

We will never sell your personal information on to any third parties. Unless otherwise disclosed during the collection, personally identifiable information that we may have collected in connection with visitors to this site is retained by Punchestown Racecourse.ie to help us communicate our products and services to you.

Punchestown Racecourse does not transfer or otherwise disclose this personally identifiable information outside this company, except where disclosure is required by law;

11. What About Cookies and Other Websites?

A technology called “cookies” may be used to provide you with tailored information. A “cookie” is a tiny element of data that a website can send to your browser, which may then be stored on your hard drive so we can recognize you when you return. You may be able to set your browser to notify you when you receive a cookie. Our cookies collect the operating system and browser that a visitor is using. The cookie settings

on this website are set to ‘allow all cookies’ to give you the very best experience. If you continue without changing these settings, you consent to this.

Other Websites

www.punchestown.com may display advertisements from third parties and other content that links to third party websites. We cannot control or be held responsible for third parties’ content or privacy practices. Please read their privacy policies to find out how they collect and process your personal information. This Policy applies solely to personal information collected by us through our website.

12. What are my Rights under The Data Protection Policy?

You have the following rights in relation to the personal information we hold about you:

– Your right of access

If you ask us, we will confirm whether we are processing your personal information and, if so, provide you with a copy of that personal information.

– Your right to rectification

If the personal information we hold about you is inaccurate or incomplete, you are entitled to have it rectified.

– Your right to erasure

You can ask us to delete or remove your personal information where there is no good reason for us continuing to process it, you withdraw your consent, we are unlawfully holding your personal data or we should erase your personal data to comply with applicable EU law. If we have shared your personal information with our analysts, referenced in ‘Who has access to personal data’ above, we will let them know about the erasure where possible.

– Your right to restrict processing

You can ask us to ‘block’ or suppress the processing of your personal information, for example, where you contest the accuracy of that personal information or object to us processing it. If we have shared your personal information with others, we will let them know about the restriction where possible.

– Your right to data portability

You have the right to obtain personal information you have provided us with (in a structured, commonly used and machine readable format) and to reuse it elsewhere or ask us to transfer this to a third party of your choice.

– Your right to object

You can ask us to stop processing your personal information, and we will do so, if we are:

– relying on our own or someone else’s legitimate interests to process your personal information except if we can demonstrate compelling legal grounds for the processing;

– processing your personal information for direct marketing; or

– processing your personal information for research unless such processing is necessary for the performance of a task carried out in the public interest.

– Your rights in relation to automated decision-making and profiling

Automated-decision making is when a company uses software to make decisions based on information that has been programmed into software. With automated decision-making, there is usually no human involvement in the decision making process.

Profiling is where algorithms and software are used to analyse personal characteristics to identify trends in behaviour or choices.

You have the right not to be subject to a decision when it is based on automatic processing, including profiling, and it produces a legal effect or similarly significantly affects you unless such profiling is necessary for entering into, or the performance of, a contract between you and us. The purpose, categories, legal basis and retention period of such data is detailed above.

– Your right to lodge a complaint with the supervisory authority

If you have a concern about any aspect of our privacy practices, including the way we have handled your personal information, you can report it to the Data Protection Commissioner. You can find details about how to do this on the website here: https://www.dataprotection.ie/docs/Making-a-Complaint-to-the-Data-Protection-Commissioner/r/18.htm

13. What About Direct Marketing?

Depending on the marketing preferences that you indicated to us at the time we collect your personal data, we may contact you via postal letter, telephone or electronic means for the purposes indicated to you at the time.

If you have previously indicated to us that you are happy to receive marketing information for the purposes described above but change your mind, you can opt-out. If you do not wish to receive these solicitations from us using your personal

identifiable information, please notify us.

You can change your preference regarding the use of your information at any time, either by emailing us at info@punchestown.com or by calling the Punchestown Racecourse office on 00353 (45) 897704.

Both the website and the telephone ticket booking process require you to ‘opt-in’ to receive marketing information. If you unsubscribe to marketing emails, you will continue to receive service (informative) emails.

14. How Can I Access My Personal Data?

If you want to know what personal data we have about you, you can ask us for details of that personal data and for a copy of it (where any such personal data is held). This is known as a “subject access request”.

All subject access requests should be made in writing and sent to the email address or postal address shown at end of Part 15. To make this as easy as possible for you, a Subject Access Request Form is available for you to use(please see below). You do not have to use this form, but it is the easiest way to tell us everything we need to know to respond to your request as quickly as possible.

There is not normally any charge for a subject access request. If your request is ‘manifestly unfounded or excessive’ (for example, if you make repetitive requests) a fee may be charged to cover our administrative costs in responding.

We will respond to your subject access request within 30 working days of receiving it. Normally, we aim to provide a complete response, including a copy of your personal data within that time. In some cases, however, particularly if your request is more complex, more time may be required up to a maximum of three months from the date we receive your request. You will be kept fully informed of our progress.

15. How Do I Contact You?

To contact us about anything to do with your personal data and data protection, including to make a subject access request, please use the attached data access request form and send it to:

Email address: info@punchestown.com

Telephone number: 00353 (45) 897704

Postal Address: Punchestown Racecourse, Naas, Co. Kildare.

16. Changes to this Privacy Notice

We may change this Privacy Notice from time to time. This may be necessary, for example, if the law changes, or if we change our business in a way that affects personal data protection. Any changes will be made available on our website. This Privacy Notice was last updated on 1st January 2019.

Subject Access Request Form

Request for Access to Personal Data under the General Data Protection Regulation (GDPR) 2018

Please complete all parts. Part 1 – Details of Data Subject (person making request) Please use block capitals

Full Name: ________________________________________________________________________________________

Address: __________________________________________________________________________________________

__________________________________________________________________________________________

Eircode: _____________________________________________________________________________

Contact Phone Number: ____________________________________________________________

Email Address (where applicable): _______

Cookie	Duration	Description
cookielawinfo-checbox-analytics	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checbox-functional	11 months	The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checbox-others	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-necessary	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-performance	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy	11 months	The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.