Schedule: Data Protection Act 2018 Compliance

The Terms and Conditions are the contract between you and Local Shop Hub ("us", "we", etc). By visiting or using Our Website, you agree to be bound by them.

Local Shop Hub is a registered business name in Ireland. Registration number is 722524.

1. Definitions

In this Schedule, the following words shall have the following meanings:

"Act" means the Data Protection Act 2018.

"Associate" means any corporate or other forms of organisation or any individual person with whom you have an association which does, or could, entail the transfer of personal data to us for processing.

"Directive" means Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA.

"DPC" means the Data Protection Commission

"the Data Protection Regulations" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).

"the Law" means all or any of:
(a) the Data Protection Regulations,
(b) the Act,
(c) the Data Protection Act 1988,
(d) the Data Protection Act 2003,
(e) regulations made under the Act,
(f) Directive.

"data controller", "data processor", “sub-processor”, "data subjects", "personal data", "process", "processed" and "processing" shall have the meanings respectively, as defined in the Act.

In this agreement, “personal data”, is limited to data which comes into our hands in some way connected to this agreement.

2. Data Protection

2.1 The obligations described in this Schedule are in addition to our obligations under the Law.

2.2 To enable us to provide the Services under this agreement, you authorise us to process personal data on your behalf.

2.3 We both agree that you and your Associates are data controllers, and we are your data processor in relation to personal data.

2.4 Details of the anticipated processing activities are set out at Appendix 1 to this Schedule.

3. How we shall process data

We shall at all times comply with the provisions and obligations imposed by the Law and, in particular, shall:

3.1 process personal data only to the extent necessary to provide the Services;

3.2 ensure that every person processing personal data under this agreement does so strictly on a need-to-know basis, has received training on their obligations relating to handling of personal data and is bound by confidentiality obligations no less stringent than our confidentiality obligations under this agreement;

3.3 in order to use commonly accepted international communications and money transfer protocols, it will be necessary to use sub-contractors for certain service provision. We shall not necessarily be aware of the identity of every organisation involved in the train of communications. When that happens, we accept full responsibility for our compliance with the Law.

3.4 subject to the exceptions mentioned in the last previous sub-paragraph, we will not use subcontractors for personal data processing under this agreement without your prior written consent.

3.5 wherever possible, enter into a written contract with each such sub-processor, which includes the same obligations on the sub-processor as those imposed on us by You under this agreement.

3.6 subject to the other provisions of this Schedule, not process personal data or permit any third party to process personal data outside of the European Economic Area (EEA) unless:

3.6.1 EU standard contractual clauses approved by the European Commission or the DPC are entered into between you or your relevant Associate as data exporter, and the relevant recipient of the personal data as data importer; or

3.6.2 the recipient of the personal data has entered into a data processing agreement with you; or

3.6.3 the recipient of the personal data is regulated within the United States of America solely by the U.S. Department of Commerce, is certified under the EU/US Privacy Shield framework, and continues to be certified for the period within which it processes the personal data; or

3.6.4 the recipient of the personal data has entered into binding corporate rules, which are valid in respect of the processing of personal data under this agreement and have been approved by the European Commission or the DPC; or

3.6.5 the transfer is to a recipient located within a jurisdiction whose law relating to the processing of personal data has been approved by the European Commission or the DPC (subject to any applicable restrictions).

3.7 have in place at all times appropriate technical and organisational measures to ensure a level of security appropriate to the risk presented by processing the personal data, to prevent accidental, unauthorised or unlawful destruction, loss, alteration, or access to personal data, including as a minimum whatever security measures you notify and instruct us to use. Examples of such measures are:

3.7.1 the pseudonymisation and encryption of personal data;

3.7.2 the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; and

3.7.3 a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of processing;

3.8 maintain a written record of all categories of processing activities carried out on your behalf and when you ask, copy it to you. The record shall contain:

3.8.1 Our name and contact details and (where applicable) those of our approved sub-processors and details of their respective data protection officers;

3.8.2 the categories of personal data, data subjects and processing activities carried out on behalf of you and your Associates;

3.8.3 where applicable, transfers of personal data to a third country (i.e. non-EU Member State) or an international organisation, including identification of that third country and documentation evidencing implementation of suitable safeguards; and

3.8.4 a general description of the technical and organisational security measures we have installed as referred to in Article 32(1) of the Data Protection Regulations;

3.9 when you ask, give to you or to the DPC, access to our employees, data processing facilities, procedures, and records to inspect and audit compliance with the Law and the terms of this agreement. We shall (and shall ensure any sub-processor shall) give all reasonable cooperation and assistance.

3.10 immediately tell you (and in any event within 24 hours) after becoming aware of any actual or suspected unlawful destruction, loss, alteration, disclosure of, or access to, personal data transmitted, stored or otherwise processed by you or any sub-processor under this agreement;

3.11 provide reasonable assistance to you in:

3.11.1 responding to data subject's requests to exercise their rights under the Act;

3.11.2 responding to communications received from the DPC relating to the processing of personal data under this agreement, including notifying You immediately of any such communication;

3.11.3 taking measures to address data security incidents, including, where appropriate, measures to mitigate their possible adverse effects;

3.11.4 promptly upon your request, transfer personal data to a third party in compliance with a request from a data subject to exercise their right to data portability;

3.11.5 make available to you on request all information necessary to demonstrate compliance with the obligations set out in this Schedule; and

3.11.6 at your request (no more than once in every calendar year) complete and return without delay your information security and data protection questionnaires.

4. What are your rights in connection with personal data?

In accordance with Data Protection laws, you have the right to:

1. Request access to your personal data. This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
2. Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
3. Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no legitimate reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below).
4. Withdraw your consent and opt-out from our communications. We will honour your opt-out within 14 days. Please note that you cannot unsubscribe from service-related messages if you remain a customer.
5. Object to processing of your personal data, for example, if we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this basis.
6. Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
7. Request the transfer of your personal data (right to data portability).

If you want to exercise any of the above rights, please email our Privacy Team at [email protected]. We are committed to resolve complaints about our collection or use of your personal information.

If you are located in the EU, you also have the right to lodge a complaint to your data protection authority.

5. Post termination

5.1 Upon termination of this agreement, we and any sub-processor shall:

5.1.1 physically destroy all copies of media upon which any personal data was supplied and any further copies made by us;

5.1.2 return all personal data stored in hard copy to you;

5.1.3 delete all personal data stored in soft copy, by some method which prevents future re-activation of that data;

5.2 Where we or our sub-processor is required to retain personal data in order to comply with applicable law, we will tell you and will retain such personal data only in our capacity as a data processor and shall comply with our obligations as a data processor, as far as applicable law permits.

6. Warranty and acceptance of liability

6.1 We represent and warrant that the information provided in any response to any request by you shall be complete, true and accurate, and will not misrepresent our business or practices in respect of our ability to comply with the Law and our obligations under this agreement.

6.2 If any act or omission of ours or our sub-processors results in data transmitted or processed under this agreement being lost or degraded so as to be unusable, then we shall be liable to you for the cost of reconstituting the data and/or yours and your Associate's costs in recreating such data.

Appendix 1 to Schedule

Data Processing Activities

What we may process in each category

1. We shall process this basic personal data

1.1 Name
1.2 Address
1.3 Email address
1.4 Phone number
1.5 Location(s) submitted by you, to provide relevant search results for you. Please note that we do NOT track and process your exact physical location might be sent by your device.
1.6 Your Favourite Businesses, products, Basket items etc. submitted by you
1.7 Technical information relating to electronic communication, which is personal information only when associated with the name or identity of the data subject

2 We shall process the data of these data subjects

Data of buyers, so far as their data is required in order to satisfy our obligations under this contract and comply with the Law.

3 This is why and how we shall process personal data

3.1 Our processing of personal data will be limited to such activity as is reasonably required to satisfy our obligations under this contract.

3.2 We shall not make contact with any data subject nor seek additional data from any other source.

4 Retention period

4.1 We may retain personal data, along with much other data, for six years, for these reasons:

4.1.1 for accounting and taxation purposes;

4.1.2 to provide evidence if required in connection with a legal claim;

4.1.3 for any other reason where the law provides a six years limitation period;

4.2 If any event occurs which requires us lawfully to continue to retain data beyond that period, then we may do so.

Last updated: 19th April 2023