TimeBank Ireland
Compare versions
Changes between version 1.0 and version 2.0.
- Added
- +
- Removed
−
− Our Commitment to Your Privacy hOUR Timebank Ireland is committed to protecting your privacy and ensuring your personal data is handled responsibly in accordance with the General Data Protection Regulation (GDPR) and the Irish Data Protection Acts 1988-2018.
+ This Privacy Notice explains how hOUR Timebank CLG collects and uses personal data when you visit our website, apply to join or use the timebank, act as a referee, attend an event, volunteer or otherwise interact with us.
− This policy explains what information we collect, why we collect it, how we use it, and your rights regarding your personal data.
+ It also explains your data protection rights and how to exercise them.We aim to use personal data only where it is needed, to keep it secure, and to be clear about who can see it and why.Controller: hOUR Timebank CLGRegistered address: 21 Páirc Goodman, Skibbereen, Co.
− We believe in transparency and user control.
+ Cork, P81 AK26, IrelandGeneral privacy contact: [email protected] Protection Officer: Nikita Serkevich, [email protected]: https://hour-timebank.ieRegistered Charity Number: 20162023CRO Number: 6083271.
− 1.
+ Who We ArehOUR Timebank CLG, also referred to as “hOUR Timebank”, “Timebank Ireland”, “hTB”, “we”, “us” or “our”, is a Company Limited by Guarantee and a registered Irish charity.We operate a community timebanking platform through which members can offer and request services, communicate with each other, and record time-credit exchanges.For personal data processing that we determine, hOUR Timebank CLG is the data controller under the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Data Protection Act 2018.2.
− Data Controller The data controller responsible for your personal data is: Legal Name: hOUR Timebank CLG (Company Limited by Guarantee) Registered Business Name: Timebank Ireland Charity Registration: RCN 20162023 (Charities Regulator) Registered Address: 21 Páirc Goodman, Skibbereen, Co.
+ Who This Notice Applies ToThis notice applies to personal data relating to:current and prospective members;people named as character referees by prospective members;volunteers, trustees/directors and people carrying out roles on behalf of hOUR Timebank;people who attend our events or activities;people who contact us, make enquiries, complaints or rights requests;website visitors and platform users; andrepresentatives of partner organisations, suppliers, funders and other organisations with which we work.3.
− Cork, P81 AK26, Ireland Data Protection Contact: [email protected] If you are a member of a Partner Organisation using our platform, that organisation may also be a data controller for data they collect directly from you.
+ Personal Data We Collect3.1 Membership applications and accountsWhen you apply to join or create an account, we may collect:your name and contact details, such as email address and telephone number;your address or general location where required for local membership administration or community matching;account identifiers and authentication information — we store a secure password hash rather than your plain-text password;your profile description, interests, skills, offers and requests;a profile photograph if you choose to provide one;membership application, verification and administration information; andthe names and contact details of character referees where references form part of the membership process.3.2 Use of the timebank platformWhen you use the platform, we may process:offers, requests and exchange information;time-credit balances and transaction history;messages and communications sent through the platform;member feedback, complaints, dispute or support records where applicable;account status, login history and security events; andrecords needed to investigate misuse, protect members, resolve disputes or keep the platform secure.3.3 Website and technical informationWhen you visit our website or use the platform, our systems may automatically record limited technical information such as your IP address, browser and device information, date and time of access, requested pages, authentication events and server/security logs.We use this information to operate, secure and troubleshoot our services.3.4 Facebook Group informationWe operate a private Facebook Group as an optional channel for member communication, community updates and arranging timebank exchanges.If you join or participate in the group, we may process information made available to us through Facebook, including your Facebook name/profile, group membership, posts, comments, offers and requests, and other information you choose to share in the group.Where an exchange arranged through Facebook needs to be recorded in the official timebank system, we may record the relevant exchange information in our own platform.Use of the Facebook Group is optional.
− 2.
+ Members can also arrange exchanges through the hOUR Timebank website or through the Exchange Broker.3.5 Events, photographs and communicationsIf you attend an event, we may process your name, attendance or related communications where needed to organise the event.We will use identifiable photographs for optional publicity or similar non-essential purposes only where an appropriate lawful basis applies.
− Information We Collect We collect only the information necessary to provide our timebanking services: Data TypePurpose Account InformationName, email address, password (encrypted) — Required to create and manage your account Profile DetailsBio, skills, location, photo — Helps connect you with community members Contact InformationPhone number (optional), address — For arranging exchanges if you choose to share Activity DataExchanges, messages, time credits — Essential for platform functionality Device InformationBrowser type, IP address, device type — Used for security and troubleshooting 3.
+ Where we ask for consent, participation is voluntary and you may withdraw that consent for future use.3.6 Garda Vetting informationWhere Garda Vetting is legally required or appropriate for a relevant role or activity, vetting is processed through the applicable National Vetting Bureau process.Cork Volunteer Centre may act as the liaison or intermediary for the vetting process.
− Legal Basis for Processing Under GDPR, we process your personal data based on the following legal grounds: Contract Performance: Processing necessary to provide our timebanking services to you Consent: Where you have given explicit consent (e.g., marketing communications) Legitimate Interests: Improving our services, preventing fraud, and ensuring platform security Legal Obligation: Complying with Irish and EU legal requirements 4.
+ hOUR Timebank may receive the vetting disclosure or outcome relevant to the role.Depending on the disclosure, this may state that no criminal record or specified information exists, or may contain criminal record or specified information lawfully disclosed under the National Vetting Bureau (Children and Vulnerable Persons) Acts 2012 to 2016.Garda Vetting information is highly restricted and is used only for the relevant safeguarding, suitability and legal purposes.4.
− How We Use Your Data Your data is used exclusively for the following purposes: Service Delivery: Facilitating time exchanges and community connections Communication: Sending important updates, notifications, and messages from other members Security: Protecting your account and preventing fraud or abuse Improvement: Analysing usage patterns to enhance platform features (anonymised) Legal Compliance: Meeting regulatory requirements under Irish and EU law Charitable Reporting: Aggregated, anonymised statistics for charity reporting purposes We do not sell your personal data to third parties.
+ Where We Get Personal Data FromMost personal data is provided directly by you, for example when you register, update your profile, send a message, record an exchange or contact us.We may also obtain personal data from:another member, where information about you is necessarily included in an exchange, message, complaint or support request;Meta/Facebook, where you join or interact with our private Facebook Group and Facebook makes your profile information, group membership or group activity available to hOUR Timebank as group administrator;a prospective member who names you as a character referee;Cork Volunteer Centre, the National Vetting Bureau or another authorised vetting intermediary where Garda Vetting applies;a partner organisation where you join or participate through that organisation;our service providers, where they generate security, delivery or technical records on our behalf; andpublic authorities or other lawful sources where necessary for legal, safeguarding, fraud-prevention or governance purposes.4.1 If someone names you as a character refereeIf a prospective member gives us your name and contact details as a character referee, we did not obtain that information directly from you.We use it only to contact you and, where appropriate, obtain a reference for the applicant.
− Your information is never shared with advertisers or data brokers.
+ Our lawful basis is our legitimate interest in assessing applications and maintaining a safe and trusted community.We do not use referee contact details for marketing or unrelated purposes.We will provide or link you to this privacy information when we first contact you and will retain referee information only for as long as reasonably necessary for the membership decision, any related query or complaint, and applicable legal or safeguarding needs.5.
− 5.
+ Why We Use Personal Data and Our Lawful BasesWe do not rely on a single blanket consent given at registration.
− Data Sharing We may share your data with: Other Members: Your profile information is visible to verified members to facilitate exchanges Partner Organisations: If you join a specific community, that organisation's coordinators can see your membership details Service Providers: Trusted providers who help us operate the platform (hosting, email delivery) under strict data processing agreements Legal Authorities: When required by law or to protect our legal rights All service providers are bound by GDPR-compliant data processing agreements.
+ The lawful basis depends on the purpose for which the information is used.Creating and managing membership/accounts and providing requested platform functions: account, contact, profile, exchange, time-credit and messaging information.
− 6.
+ We rely on Article 6(1)(b) GDPR where processing is necessary to provide the service you request or to take steps at your request before membership.Operating and administering the timebank community: membership administration, offers and requests, support, communications and limited account information.
− How We Protect Your Data We implement robust security measures: Encryption: All data is encrypted in transit (TLS/HTTPS) and at rest Secure Passwords: Passwords are hashed using industry-standard algorithms Access Controls: Strict internal policies limit who can access your data Regular Audits: We conduct security reviews and update our practices accordingly EU-Based Hosting: Your data is stored within the European Union 7.
+ We rely on Article 6(1)(f) GDPR and our legitimate interests in operating an effective community service, coordinating membership and supporting members.Operating the private Facebook Group: Facebook profile information, group membership, posts, comments and exchange-related information that members choose to share in the group.
− Your GDPR Rights Under GDPR, you have the following rights: Right of Access: Request a copy of all personal data we hold about you Right to Rectification: Correct any inaccurate or incomplete information Right to Erasure: Request deletion of your data ("right to be forgotten") Right to Restrict: Limit how we process your data in certain circumstances Right to Portability: Receive your data in a structured, machine-readable format Right to Object: Object to processing based on legitimate interests To exercise any of these rights, contact us at [email protected].
+ We rely on Article 6(1)(f) GDPR and our legitimate interests in providing members with an optional community communication channel, facilitating exchanges, administering group membership and maintaining a safe and effective timebank community.Protecting members, preventing misuse and securing the platform: security logs, account activity, complaints, disputes and incident information.
− We will respond within one month.
+ We rely on our legitimate interests in safety, fraud and abuse prevention, network and information security, and protecting our legal rights.Checking character references: referee contact details and reference information.
− 8.
+ We rely on our legitimate interests in assessing applications and supporting community trust and safety.Complying with company, charity, tax, safeguarding and other legal requirements: governance, financial, statutory and safeguarding information.
− Cookies & Tracking We use cookies to enhance your experience: Essential Cookies: Required for login, security, and basic functionality Preference Cookies: Remember your settings like theme preference Analytics Cookies: Help us understand how people use the platform (anonymised) We do not use advertising cookies or tracking pixels.
+ We rely on Article 6(1)(c) GDPR where processing is necessary to comply with a legal obligation.Garda Vetting: vetting disclosures or outcomes and related suitability information.
− 9.
+ Processing is based on an applicable Article 6 lawful basis together with Article 10 GDPR and applicable Irish law, including the National Vetting Bureau legislation, as relevant to the role.Optional photographs and other genuinely optional uses for which we ask permission: where we expressly rely on consent, the lawful basis is Article 6(1)(a) GDPR.
− Data Retention Active Accounts: Data is kept while your account remains active Inactive Accounts: Accounts inactive for 24 months may be anonymised after notice Deleted Accounts: Personal data is removed within 30 days of deletion Transaction Records: May be retained for up to 7 years for legal/charity reporting 10.
+ You may withdraw consent at any time for future processing.Legal claims and regulatory matters: relevant account, exchange, communication, incident or governance information may be processed where necessary to establish, exercise or defend legal claims or respond to regulators or competent authorities.Where we rely on legitimate interests, we consider whether the processing is necessary and balance our interests against the rights and interests of the people affected.6.
− International Data Transfers Your data is primarily stored within the European Union.
+ What You Have to ProvideSome information is necessary to create and administer a membership account or provide a requested feature.Mandatory fields should be identified during the registration or application process.
− If we need to transfer data outside the EU/EEA, we ensure appropriate safeguards (SCCs, adequacy decisions).
+ If you do not provide information that is necessary for membership, account security, eligibility or a requested service, we may be unable to approve the application, create the account or provide that service.Other information, such as optional profile details, profile photographs or optional contact information, is voluntary.Choosing not to provide optional data should not prevent you from using core features unless that information is genuinely needed for a particular exchange or activity.7.
− 11.
+ What Other Members Can SeeTimebanking depends on members being able to identify suitable offers, requests and people with whom to exchange time.Certain profile and activity information is therefore visible to other registered members as part of the service.Depending on the feature, this may include your:name;profile description;general location or neighbourhood;profile photograph;skills;offers and requests; andinformation about timebank activity intended to be shared within the member community.We do not make private contact details or exact home-address information broadly visible by default.Where contact details or an address are needed to arrange a particular exchange, they are shared only to the extent necessary and, where possible, under the member’s control.Please avoid putting sensitive information in public or broadly visible profile fields.Messages sent through the platform are intended for the relevant participants.
− Children's Privacy Our platform is intended for users aged 18 years and older.
+ Authorised hOUR Timebank personnel may access messages where reasonably necessary to:provide support;investigate a complaint or suspected misuse;protect members;comply with law; ormaintain the security and integrity of the service.8.
− We do not knowingly collect data from anyone under 18.
+ Who We Share Personal Data WithWe do not sell, rent or trade personal data and we do not share member data with advertisers or data brokers.Where necessary and lawful, we may share personal data with:other registered members, as described above;Meta/Facebook, where you choose to use our private Facebook Group.
− 12.
+ Facebook is operated independently by Meta and processes information about your Facebook account and use of its platform for purposes determined by Meta;Cork Volunteer Centre and the National Vetting Bureau process where Garda Vetting applies;partner organisations involved in a particular community or membership arrangement;service providers that help us operate the website and platform, such as hosting, infrastructure, email delivery, data storage and backup, IT support and security providers;professional advisers such as accountants, auditors, insurers or solicitors where necessary;funders, researchers or public bodies using aggregated or genuinely anonymised information where individuals are not identifiable; andAn Garda Síochána, Tusla, the HSE, the Charities Regulator, the Data Protection Commission, courts or other competent authorities where disclosure is required or permitted by law.hOUR Timebank is the controller for the purposes for which we operate and administer our private Facebook Group, including managing membership, moderating group activity and using relevant information to facilitate timebank exchanges.Meta independently determines how it operates the Facebook platform and processes Facebook account, usage, security, personalisation and other platform data.
− Complaints You may lodge a complaint with the Data Protection Commission: Address: 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland Website: www.dataprotection.ie 13.
+ For the ordinary use of our private Facebook Group, we currently treat hOUR Timebank and Meta as separate controllers for their respective processing activities.
− Changes to This Policy We may update this Privacy Policy to reflect changes in our practices.
+ Meta is not treated as a data processor acting solely on hOUR Timebank's instructions.If we introduce Facebook or Meta functionality that involves jointly determining particular processing with Meta, we will reassess the controller relationship and comply with Article 26 GDPR where applicable.Further information about hOUR Timebank's use of Facebook is provided in our Facebook Group Privacy Information, available within the private group.Where a service provider processes personal data on our behalf, we require an appropriate data processing agreement and confidentiality and security obligations.We only give service providers the data and access reasonably necessary for their role.Administrative notifications contain only the personal data necessary for the recipient to act.
− We will notify you via email or platform notification for significant changes.
+ Where authorised administrators can securely access the relevant information in the platform, we aim not to duplicate personal data into email notifications merely for convenience.9.
− Contact Us For privacy questions: [email protected]
+ Partner OrganisationsSome members may join or participate through a partner organisation or a specific community supported by another organisation.The data protection role of that organisation depends on what it actually does with the data.A partner organisation may be:a separate controller for information it collects and uses for its own purposes;a joint controller with hOUR Timebank where both organisations jointly determine particular purposes and essential means of processing; ora processor acting only on documented instructions.Where a partner organisation has access to or receives your personal data, we will provide additional information where needed so that you understand:which organisation is involved;what information it receives;why it receives it; andthe applicable controller arrangement.10.
+ International TransfersSome organisations involved in providing services or platforms used by hOUR Timebank, or their service providers and sub-processors, may store, access or otherwise process personal data outside the European Economic Area (“EEA”).
+ This may include international processing associated with third-party platforms such as Facebook.Where hOUR Timebank is responsible for a restricted international transfer, we will ensure that an appropriate GDPR transfer mechanism is available, such as:an adequacy decision;the European Commission’s Standard Contractual Clauses; oranother lawful transfer mechanism.Where Meta independently transfers personal data processed through Facebook, those transfers are governed by Meta's own data protection arrangements and transfer mechanisms.
+ Information about Meta's international transfers is available in Meta's privacy information.Where appropriate, we also assess supplementary safeguards.You may contact us for further information about safeguards relevant to your personal data.11.
+ How Long We Keep Personal DataWe keep personal data only for as long as it is needed for the purpose for which it was collected.We take account of legal requirements, disputes or complaints, safeguarding, security and the establishment or defence of legal claims.Active member accounts and profiles: retained while your membership/account is active and the information is needed to provide the service.After membership ends: we hide or deactivate your profile promptly.
+ Personal data that is no longer needed is deleted or irreversibly anonymised after the applicable closure period.
+ Limited information may be kept longer where needed for disputes, safeguarding, fraud or abuse prevention, legal claims or another documented purpose.Exchange and time-credit records: retained while needed to maintain accurate balances and transaction history, resolve disputes and protect the integrity of the timebank.
+ After membership ends, identifiable records are retained only where a continuing purpose justifies them.Messages, support and complaint records: retained for as long as needed to provide support, resolve the issue and meet any legitimate safeguarding, security or legal-claim need.Character referee data: retained only for as long as reasonably necessary for the membership decision, any related query or complaint, and applicable legal or safeguarding needs, after which it is deleted or minimised.Garda Vetting information: restricted and retained only for the relevant vetting and safeguarding purpose.
+ Where hOUR Timebank follows a three-year vetting cycle, records are reviewed at the end of that cycle and are not retained longer without a documented need or legal requirement.Financial and accounting records: retained for at least six years after the end of the relevant financial year where required by applicable company or accounting law, and longer where another legal requirement applies.Board and statutory governance records: retained for periods required by company and charity law.
+ Certain formal minutes, registers and governance records may be retained permanently.Security logs: retained for a proportionate period based on their security purpose and risk.
+ Relevant logs may be retained longer where an incident or investigation requires it.A general seven-year retention period does not automatically apply to all former-member information.12.
+ Cookies and Similar TechnologiesAt the date of this notice, our website is intended to use only cookies or similar technologies that are strictly necessary to provide the website or platform, or to carry out communications requested by the user, such as session, authentication or security functions.Strictly necessary cookies do not require consent under the applicable Irish ePrivacy rules, although we still provide information about their use.We do not currently use advertising, behavioural-tracking or analytics cookies.If we introduce analytics, marketing or other non-essential cookies or similar technologies, we will:update our information;obtain valid consent before setting or accessing them where consent is required; andallow users to withdraw or change their consent.We provide or maintain appropriate cookie information on our website so visitors can understand the cookies in use, their purposes and their duration.This section concerns cookies and similar technologies used on hOUR Timebank's own website and platform.
+ Facebook may use cookies and similar technologies when you use Facebook or interact with our private Facebook Group.
+ Those technologies are controlled by Meta and are described in Meta's own privacy and cookie information.13.
+ Automated Decision-Making and ProfilingWe do not currently use solely automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR.We do not use member profiles for advertising profiling or sell them to data brokers.If this changes, we will update this notice and provide the information required by law before the relevant processing begins.14.
+ Your Data Protection RightsDepending on the circumstances and the lawful basis used, you may have the right to:access your personal data and receive a copy of it;have inaccurate or incomplete personal data corrected;ask us to erase personal data where the legal conditions for erasure apply;ask us to restrict processing in certain circumstances;receive certain personal data in a structured, commonly used and machine-readable format and have it transmitted to another controller where the right to portability applies;object to processing based on legitimate interests;object at any time to direct marketing if we ever use your personal data for that purpose;withdraw consent at any time where we rely on consent, without affecting processing that was lawful before withdrawal; andraise a concern with the Data Protection Commission.To exercise a right, contact us at [email protected] do not need to use a particular form or legal wording.We normally respond within one month.
+ GDPR permits an extension in certain complex cases.
+ If an extension applies, we will inform you within the initial one-month period.We may ask for proportionate information to verify your identity where we have reasonable doubts about who is making the request.Some rights are not absolute.
+ If we cannot comply fully with a request, we will explain the reason where the law allows us to do so.15.
+ How We Protect Personal DataWe use technical and organisational measures appropriate to the nature of the information and the risks involved.These include, as appropriate:access restrictions;account authentication;secure password hashing;encryption in transit;secure storage and backups;confidentiality requirements;access reviews;incident response arrangements; andsecure disposal of records.No system can be guaranteed to be completely secure.
+ We therefore review and improve our controls as the platform, risks and technology change.16.
+ ChildrenThe timebank platform is intended for users aged 18 and over.We do not knowingly create ordinary member accounts for children.If we become aware that a child’s personal data has been collected outside an approved safeguarding arrangement, we will assess the situation and take appropriate steps, including deletion where required.Any future service or activity specifically involving children would require separate safeguarding and data-protection assessment and appropriate privacy information before it is introduced.17.
+ Personal Data BreachesIf a personal data breach occurs, we assess the likely impact on the people affected and take steps to contain and address it.Where GDPR requires notification, we will notify the Data Protection Commission without undue delay and, where feasible, within 72 hours of becoming aware of the breach.Where a breach is likely to result in a high risk to individuals, we will also notify affected individuals without undue delay unless a legal exception applies.18.
+ Complaints and the Data Protection CommissionIf you have a concern about how we use your personal data, we encourage you to contact us or our Data Protection Officer first so that we can try to resolve it.You also have the right to raise a concern or lodge a complaint with the Irish Data Protection Commission:Data Protection Commission6 Pembroke RowDublin 2D02 X963IrelandWebsite: https://www.dataprotection.ieThe DPC provides an online contact and complaint form on its website.19.
+ Changes to This Privacy NoticeWe may update this Privacy Notice to reflect changes in our services, technology, legal requirements or how we use personal data.The current version will be published on our website with its revision date.Where a change materially affects how we use existing personal data or your choices, we will take appropriate steps to bring the change to your attention before or when it takes effect, as required by law.20.
+ Contact UsFor privacy questions, rights requests or concerns about this notice:hOUR Timebank CLG21 Páirc GoodmanSkibbereen, Co.
+ CorkP81 AK26IrelandEmail: [email protected]: https://hour-timebank.ieFor the Data Protection Officer, contact Nikita Serkevich at [email protected].