ESF+ Data Privacy Notice

Introduction 

Skillnet Ireland CLG ("Skillnet", "we", "us") is the controller of the personal data described in this notice. Our registered office is at 5th Floor, Q House, 76 Furze Road, Dublin 4, D04 W2W2, Ireland.  

This Data Privacy Notice provides you (the data subject) with information about why and how we process your data for the ESF+ Training Programme. It complies with our obligations and your rights, as set out in our website Data Protection Statement. 

The ESF+ Programme is managed through the Department of Further and Higher Education, Research, Innovation and Science (“DFHERIS, “the Managing Authority”) under the Common Provisions Regulation (EU) 2021/1060 and the ESF+ Regulation (EU) 2021/1057, as well as Ireland’s ESF+ Operational Programme for 2021-2027 (EIST) (referred to as ‘funding obligations’). 

Training programmes funded under ESF+ are required to collect data on participants taking part, which is reported to the EU Commission through the Managing Authority. The information is used to monitor the performance of the programmes and ensure they are successful. 

Data Processing Activities

Data Processing Activities explains why we collect your data, our lawful basis for processing this data and how long we will store it. Skillnet Ireland processes personal data for the purposes set out in this data privacy notice and for any other purposes specifically permitted by the DPAs (or when applicable, the GDPR) or as required by law.  

What personal data we collect 

We collect and process the following categories of personal data: 

Special Category Data

We are required to collect specialcategory data (e.g. health or ethnicity) as part of our contractual obligations. However, you can choose not to share this information with us. Any special category data we may collect is used for statistical and research purposes only and is not used to determine eligibility to participate in the course. 

Age-Specific Data Collection and Child Protection

Skillnet Ireland only collects and processes personal data from individuals aged 16 years and older. In accordance with Article 8 of the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, the organisation does not knowingly collect data from children under the age of 16. Where data is collected from individuals aged 16 to 18, Skillnet Ireland ensures that:  

• The processing is necessary for the performance of a task carried out in the public interest and/or under a legitimate interest basis, as defined in Article 6(1)(e) and 6(1)(f) of the GDPR.  
• Additional safeguards are in place to protect the rights and freedoms of these young data subjects, including clear and accessible privacy information, the right to object, and the right to erasure.  
• No profiling, automated decision-making, or marketing communications are directed at individuals under 18.  
• Data is collected via secure channels and stored in compliance with Skillnet Ireland’s data retention and anonymisation policies.  

This approach ensures compliance with both EU and Irish data protection law and reflects Skillnet Ireland’s commitment to safeguarding the personal data of all trainees, including those aged 16–18.  

Lawful basis for collecting and processing personal data 

Under the ESF+ programme, the lawful basis for processing your personal data is ‘legal obligation’ and ‘consent’. 

Who collects your data 

Under the ESF_ programme, Skillnet Networks, or training providers acting on their behalf, will collect and store your personal data for the purpose of enrolling you in their Course.  

After you have completed the training programme, the Skillnet Network or a third party acting on their behalf, may contact you using the contact details provided to collect feedback about the course and any resulting benefits that might have resulted from their participation.  

Why we collect your data 

Skillnet Ireland is mandated by DFHERIS to effectively monitor the performance of the training programmes funded or partially funded by Skillnet Ireland. We regularly perform compliance reviews, evaluations of the training programmes, and quality assurance and attendance at training verifications. We need to collect personal information to effectively carry out our everyday business functions and activities, to comply with relevant laws, and to provide our services.  

The Skillnet Network collects your data to enrol you on the training programme and to issue you with a certificate of completion, your data will also be shared with the Trainer or course provider or accrediting body and agreed third party processors. In certain instances, your data may be shared with third parties for the purpose of collecting post-course feedback from you.  

Who will see or access your data 

To manage ESF+ Programme and reporting on programme outcomes, your personal data will be shared with the training provider (if different to the Skillnet Network) a restricted number of Skillnet Network employees and relevant Skillnet Ireland employees.  

At regular intervals, the data collected will be shared in an anonymised or aggregated format with the Department of Further and Higher Education, Research, Innovation & Science, (DFHERIS) for the purpose of tracking the performance of the programme and to drawdown additional funding.  

Those who access your data can only do so for the purpose of managing ESF+ Programme and complying with the funding guidelines. The information you share with us will not be published in a way risks your identity and only shared with the agreed programme partners for course management, reporting and funding purposes, and to assess the success of the ESF+ Programme. Your data will not be disclosed to any other third parties without your knowledge or consent.  

How long we keep your data 

When you share your data with us, we will store your personal data only for as long as necessary for the purposes and legal basis set out at the time of collection. In line with our retention policy, the information you share with us will be held securely for 5 years from the date of your last interaction with us, at which time it will be anonymised. 

Security of your personal data 

Your personal data will be stored securely in line your permissions as set out at the time of collection and will not be shared with other third parties without your consent. The Skillnet Network will store your data in a secure server, with restricted access. They will upload your data to the Sonrai database, which is managed by Skillnet Ireland.  

Sonrai is a secure, cloud-based platform that complies with ISO 27001 standards and is hosted within the EU. Access to Sonrai is role-based and restricted to authorised personnel only. All data transfers are encrypted in transit and at rest, and regular audits are conducted to ensure compliance with data protection and cybersecurity best practices.  

Links to other sites 

From time to time our website, social media posts or emails may contain links to and from other websites. Please note that if you follow a link to any of those websites, those websites have their own privacy policies, and we do not accept any responsibility or liability for those policies. Please check those policies before you submit any personal data to those websites. 

Accessibility, Equality & Human Rights 

Skillnet Ireland is committed to providing information in accessible formats, promoting equality of opportunity and respecting the fundamental right to data protection.  This notice is written in plain English, follows the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA, and is available in HTML, tagged PDF, large‑print and other formats on request. We carry out an equality‑and‑human‑rights impact assessment (s.42 IHREC Act 2014) every year.

Glossary of key terms 

• Controller – an organisation that decides why and how personal data are processed. 
• Processor – an organisation that collects or processes personal data on behalf of the controller.  
• Sub-processor – an organisation that may collect, access or process data on behalf of the processor. 
• GDPR – The EU General Data Protection Regulation (2016/679). 
• Personal data – Any information relating to an identified or identifiable person. 
• Processing – Anything done with personal data, from collection to deletion. 
• Programme – A training initiative funded or supported by Skillnet Ireland. 

Appendix 

Data Processing Activities and Lawful basis