Constituency.ie Logo

Privacy Policy

This Privacy Policy explains how personal data is processed, protected, and managed across the Platform in accordance with GDPR and the Irish Data Protection Act 2018.

Table of Contents

1. Data Controller Identification and Regulatory Basis

Processing of personal data in connection with the Platform is carried out in accordance with Regulation (EU) 2016/679 ("GDPR") and the Irish Data Protection Act 2018.

1.1. Citizen Case Content

For Citizen Case Content submitted to, assigned to, accessed by, or handled by a Representative through the Platform, the relevant Representative acts as Data Controller and determines the purposes and means of processing that Citizen Case Content. Philoware Limited trading as Constituency acts as Data Processor for such Citizen Case Content and processes it only to host, transmit, secure, maintain, support, and technically facilitate the Platform, and only on the Representative's documented instructions, except where processing is required by applicable law.

1.2. Representative Account Data and Website Visitor Data

For Representative account registration data, platform administration data, analytics data, contact form submissions, IP logs, and system security logs, Philoware Limited trading as Constituency acts as Data Controller such that it independently determines the purposes and means of processing such data for account administration, cybersecurity, fraud prevention, regulatory compliance, and platform performance monitoring. For avoidance of doubt, Constituency acts as Data Controller for personal data it determines and processes for its own limited purposes, including representative account administration, citizen account administration, platform administration, website visitor data, cookie consent records, security logs, support requests, abuse prevention, fraud prevention, legal compliance, service improvement, analytics, and platform performance monitoring.

2. Categories of Personal Data

Collection of the following data is limited to what is technically necessary to operate, secure, and improve the Platform and is not used for behavioural advertising, viz:

2.1. Citizen Case Content

The following categories of personal data may be collected when a Citizen submits a Case: full name; email address; residential address or constituency location; telephone number (if voluntarily provided); case narrative content; attachments such as correspondence, photographs or supporting documents; information relating to public services; and any personal data voluntarily disclosed by the Citizen within the Case. Philoware Limited (T/A Constituency) does not independently determine the content of such data and does not repurpose it. Constituency will not use Citizen Case Content for behavioural advertising, unrelated marketing, political profiling, sale of personal data, training of unrelated artificial intelligence systems, or any purpose unrelated to providing, securing, maintaining, supporting, improving the reliability of, or complying with legal obligations relating to the Platform.

2.2. Representative Account Data

The following information may be collected by Constituency: Full name; official email address; official title; constituency affiliation; login credentials (hashed password and authentication tokens); IP address at registration; two-factor authentication data; and system access logs.

2.3. Website Visitor Data

The following information may be collected by Constituency: IP address; browser type and version; device type; operating system; pages visited; timestamps; referring URLs; cookie identifiers; and analytics event data collected through privacy-compliant analytics tools.

3. Purpose Limitation, Data Minimisation and Retention

Each Controller identified in Section 1 shall ensure that personal data is collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes, in accordance with applicable laws.

3.1. Citizen Case Content

For Citizen Case Contents, case data is processed for the purpose of reviewing, responding to, escalating, forwarding, or otherwise addressing the matter raised by the Citizen in the exercise of official public functions.

3.2. Representative Account and Administrative Data

For Representative Account and Administrative Data, account data is processed to create and manage user accounts, authenticate access, prevent unauthorised access, maintain audit trails, ensure cybersecurity, comply with statutory obligations, and respond to regulatory requests.

3.3. Website Visitor Data

For Website Visitor Data, it is processed to monitor website functionality, detect security threats, maintain system stability, and generate aggregated analytics reports.

4. Export and External Processing of Case Data

Where a Representative exports, downloads, transmits, stores, prints, forwards, discloses, or otherwise uses Citizen Case Content outside the Platform, that activity constitutes independent processing by the Representative as Data Controller. The Representative is solely responsible for ensuring that such processing has a lawful basis, is limited to a lawful and compatible purpose, is kept secure, is retained only for as long as necessary, and is disclosed only to recipients who may lawfully receive it.

5. Data Retention Periods

In accordance with Storage Limitation Principle under existing laws, the following are the data retention periods:

5.1. Citizen Case Content

Retention is determined by the Representative acting as Controller. In the absence of a specific statutory retention obligation, Case data will not be retained longer than seven (7) years from closure of the Case, unless required for legal proceedings or statutory compliance.

5.2. Representative Account Data

Representative account data shall be retained for the duration of the account and for seven (7) years thereafter for audit, regulatory, and limitation period.

5.3. Security Logs and Technical Logs

System logs, access logs, and IP logs are retained for twelve (12) months for cybersecurity and incident investigation purposes, unless required for longer retention in connection with an identified security incident.

5.4. Analytics Data

Analytics data is retained in aggregated or pseudonymised form for up to twenty-four (24) months.

6. Transparency and Information at Collection

Where personal data is collected directly from Citizens through the Platform interface, this Privacy Policy is made available at the point of submission. When a Representative receives personal data indirectly, such as in the case of walk-in submissions in relation with the specific terms under the Terms of Service, the Representative is responsible for compliance, including informing the individual about the processing of their data. This includes providing information for: (i) the identity and contact details of the Controller; (ii) the purposes and legal basis of processing; (iii) the categories of personal data concerned; (iv) any recipients or categories of recipients; (v) the applicable retention period; (vi) the individual's data protection rights; (vii) the right to lodge a complaint with a supervisory authority; and (viii) the source of the personal data. Philoware Limited (T/A Constituency) acts solely as a Data Processor and, where required under its contract with the Representative, will assist the Representative in meeting such transparency obligations.

7. Data Subject Rights

Citizens have the following rights: ● Right of access to obtain confirmation and a copy of personal data. ● Right to rectification of inaccurate data. ● Right to erasure. ● Right to restriction of processing. ● Right to data portability where processing is based on contract or consent. ● Right to object to processing based on legitimate interests or public task. ● Right not to be subject to solely automated decisions producing legal or similarly significant effects. Requests concerning Citizen Case Content must be addressed to the relevant Representative as Data Controller. All requests will be responded to within one (1) month.

8. Data Protection Officer and Contact Details

Philoware Limited may be contacted at: Philoware Limited trading as Constituency PhilHQ, Foxford, Co. Mayo, Ireland F26PP40 Email: info@constituency.ie Data Protection Contact: dpo@constituency.ie Where the Representative acts as Controller, the Citizen should contact the Representative directly using the official contact details provided in the Case interface.

9. International Data Transfers

Where personal data is transferred outside the European Economic Area (EEA), such transfers will take place only where appropriate safeguards are in place to ensure that the data continues to receive a level of protection equivalent to that required under EU data protection law. This includes transfers to countries formally recognised as providing an adequate level of protection, or transfers made subject to approved contractual safeguards. Any third-party service providers engaged by Philoware Limited (T/A Constituency) are contractually required to implement appropriate technical and organisational measures to protect personal data in accordance with applicable data protection laws.

10. Automated Decision-Making and Profiling

The Platform does not conduct automated decision-making that produces legal or similarly significant effects in respect of Citizen Case Content. Technical filtering tools are used solely for spam detection, abuse prevention, and cybersecurity monitoring.

11. Security Breach, Notification, and Supervisory Authority

Philoware Limited (T/A Constituency) implements encryption in transit (TLS), role-based access controls, multi-factor authentication, encrypted storage, access logging, and periodic security reviews. Where a personal data breach affects Citizen Case Content processed by Constituency on behalf of a Representative, Constituency will notify the Representative without undue delay and, where operationally feasible, within twenty-four (24) hours after becoming aware of the breach. The Representative, as Data Controller, remains responsible for assessing whether notification to the Data Protection Commission or affected data subjects is required. Constituency will provide reasonable assistance and relevant information available to it. Data subjects have the right to lodge a complaint with: Data Protection Commission 21 Fitzwilliam Square South Dublin 2, D02 RD28, Ireland Website: https://www.dataprotection.ie

12. Post-Resolution Confidentiality of Data

Upon resolution of a Case, its treatment shall depend on its classification at the time of submission. Personal data contained in Private Cases shall remain confidential and shall not be disclosed, published, or made publicly accessible by the Platform, except where the data subject has provided explicit consent or where disclosure is required by applicable law, legal process, or statutory obligation. Personal data contained in Public Cases may remain accessible following resolution and may continue to be indexed, archived, or disseminated by third parties beyond the control of the Platform, and may be retained or displayed for transparency, civic engagement, or informational purposes, subject to applicable law and the exercise of data subject rights. The Platform may use anonymised or aggregated information derived from Cases for statistical, operational, or service improvement purposes, provided that no individual is identifiable. Nothing in this Section shall restrict disclosure required for compliance with legal obligations or for the establishment, exercise, or defence of legal claims.
Constituency.ie - The Heart of The Community