DATA PRIVACY ADDENDUM FOR CONTRACT TRACING

About this Addendum

This Addendum explains how and why your personal data is processed by the Eversheds Sutherland network of law firms (also referred to as “ Eversheds Sutherland ”, “ ES ” “ we ”, “ our ” and “ us ”). Eversheds Sutherland is collecting data, including personal data relating to Clients and Visitors, as part of our response to COVID-19 and in accordance with guidance issued by the Health and Safety Executive (NI) (the “ HSE ”), and the Public Health Agency (the “ PHA ”). The purpose for which we are collecting this data is for contact tracing and in order to protect you, our Clients and Visitors, our contacts and the employees and Partners of Eversheds Sutherland.

Eversheds Sutherland is a "Controller" in relation to its use of your personal data, which is collected by the Eversheds Sutherland. "Controller" is a legal term – it means that we make decisions about how and why we use your personal data and, because of this, we are responsible for making sure it is used in accordance with applicable data protection laws.

Our aim is to be clear and transparent about the personal data which is collected and how this data is used.

In the following paragraphs we set out information in relation to the following:

What types of personal data do we collect and where do we get it from?
Purpose for processing personal data;
How long do we keep your personal data for;
Who do we share your personal data with and why;
Where is your personal data transferred to;
What are your privacy rights and how can you exercise them;
How do we keep your personal data secure;
Secondary processing of your personal data; and
Changes to this privacy notice.

In this Addendum, when we talk about personal data we mean any information that relates to an identifiable natural person – in this case, you.

You should read this Addendum, so that you know what personal data we collect about you, what we do with it and how you can exercise your rights in connection with it. This notice is an addendum to our current privacy notice which is available on our website here . You should also read this privacy notice as it might apply to our use of your personal data in specific circumstances from time to time. If you have any questions about this notice, please contact dataprotectionoffice@eversheds-sutherland.ie .

What types of personal data do we collect and where do we get it from?

We collect the following personal data for the purposes of this Addendum:

Purpose for processing personal data:

We are collecting your personal data for contract tracing purposes in line with the measures we are implementing in response to the risks identified by COVID-19. This is in order to protect you, our Clients and Visitors, our contacts and the employees and Partners of Eversheds Sutherland.

More specifically, the personal data collected about you will be used for the following purposes:

To arrange your attendance at our buildings; and
To maintain appropriate records of your interactions for contact tracing purposes.

We must always have a “lawful basis” (i.e. a reason, prescribed by law) for processing your personal data. We are processing the personal data set out in this Addendum for the purposes of us complying with our legal obligation.

How long do we keep your personal data for?

Eversheds Sutherland will only retain your personal data for as long as it is necessary to fulfil the purposes it is being processed for.

This will depend on a number of factors, including:

any laws or regulations that we are required to follow;
whether we are in a legal or other type of dispute with each other or any third party;
the type of information that we hold about you; and
whether we are asked by you or a regulatory authority to keep your personal data for a valid reason.

In this case, we will retain your personal data for 1 month from the date you last attended our buildings and we receive your personal data.

When we no longer need your personal data, we will securely delete or destroy your personal data.

Who do we share your personal data with and why?

We may share your personal data with regulatory bodies such as the Public Health Agency (“PHA”) where we are obliged to make data available as required for the purposes of contact tracing.

The PHA may use your personal data as a “Controller”. They have their own privacy notice, which can be found here and here , and they have their own responsibilities to comply with applicable data protection laws.

Where is your personal data transferred to?

Eversheds Sutherland does not intend to transfer any personal data stored on our IT systems outside of the EEA.

What are your privacy rights and how can you exercise them?

Depending on the circumstances, you may have the right to:

access your personal data and to be provided with certain information in relation to it, such as the purpose for which it is processed, the recipients or categories of recipient to whom it is disclosed and the period for which it will be stored;
require us to correct any inaccuracies in your personal data without undue delay;
require us to erase your personal data;
require us to restrict processing of your personal data;
receive the personal data which you have provided to us, in a machine readable format, where we are processing it on the basis of your consent or because it is necessary for your contract with us and where the processing is automated; and
object to a decision that we make which is based solely on automated processing of your personal data.

Please contact us at dataprotectionoffice@eversheds-sutherland.ie if you would like to exercise any of your privacy rights.

We also encourage you to let us know if you have any concern about how we are processing your personal data so we can try to resolve your concerns. However, if you consider that we are in breach of our obligations under data protection laws, you are always entitled to submit a complaint with your data protection supervisory authority – for contact details see here .

How do we keep your personal data secure?

We will put in place appropriate security measures to protect your personal data from unlawful or unauthorised processing and accidental loss, destruction or damage.

However please note that, in relation to any personal data you submit to us online, we cannoft guarantee the security of data sent to us in this way. Transmission of data over the internet is at your own risk. You are responsible for keeping any passwords you use to access Eversheds Sutherland platforms safe.

Secondary Processing of your personal data

Eversheds Sutherland will not use any personal data collected for the purpose set out above for any other purposes, without first anonymising or pseudonymising the personal data to remove or replace all personal details from the data or contacting the relevant individuals to obtain their consent.

Changes to this Privacy Notice/Addendum

This Addendum may change from time to time and any changes to this Addendum or the current Privacy Notice will be communicated on our website .

Eversheds Sutherland is the name and brand under which the members of Eversheds Sutherland Limited (Eversheds Sutherland (International) LLP and Eversheds Sutherland (US) LLP) and their respective controlled, managed and affiliated firms and the members of Eversheds Sutherland (Europe) Limited (each an "Eversheds Sutherland Entity" and together the "Eversheds Sutherland Entities") provide legal or other services to clients around the world. Eversheds Sutherland Entities are constituted and regulated in accordance with relevant local regulatory and legal requirements and operate in accordance with their locally registered names. The use of the name Eversheds Sutherland, is for description purposes only and does not imply that the Eversheds Sutherland Entities are in a partnership or are part of a global LLP. The responsibility for the provision of services to the client is defined in the terms of engagement between the instructed firm and the client.