Data Privacy Notice - Enda O’ Brien Financial Services

Data Privacy Notice – 1st December 2021

This is your guide to how personal data is managed by

Enda O’Brien Mortgages Limited, trading as Enda O’Brien Financial Planning. Please read it carefully.

Data privacy is taken very seriously at Enda O’Brien Mortgages Limited, trading as Enda O’Brien Financial Planning. It is important that you know exactly what we do with the personal information you and others provide to us, why we gather it and what it means to you. This document outlines our approach to Data Privacy to fulfil our obligations under the General Data Protection Regulation (2018). We also welcome it as an opportunity to reassure you of the importance we place on keeping your personal data secure, and of the strict guidelines we apply to its use. We want you to be clear on:

Who we are
The information we collect about you
When and how we collect information about you
How we use your information
Who we share your information with
How long we hold your information
Implications of not providing information
The legal basis for using your information
How we keep your data safe
Processing your information outside the EEA
How to exercise your information rights (including the right to object) 12. How to contact us and/or our Data Protection Officer
Changes to this notice

Enda O’Brien Mortgages Limited, trading as Enda O’Brien Financial Planning complies with the requirements of the General Data Protection Regulation 2018 and the Irish Data Protection Act 2018. The data which you provide to us will be held on a computer database and paper files for the purpose of arranging transactions on your behalf. The data will be processed only in ways compatible with the purposes for which it was given and as within this Privacy Notice.

Please contact us at enda@endaobrien.com if you have any concerns about your personal data. You have the right at any time to request a copy of any ‘personal data’ (within the meaning of the GDPR) that our office holds about you and to have any inaccuracies in that information corrected.

Who we are

Enda O’Brien Mortgages Limited, trading as Enda O’Brien Financial Planning is a financial broker specialising in providing financial advice to people throughout Ireland. Our GDPR owner and data protection representatives can be contacted directly here:

Enda O’Brien
enda@endaobrien.com
087 823 3425

When we refer to ‘we’ it is Enda O’Brien Mortgages Limited, trading as Enda O’Brien Financial Planning. Please read this Statement carefully as this sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us.

The information we collect about you

There are a number of reasons for gathering information about you. For instance, we need to know how to get in touch with you, we need to be certain of your identity and we need to understand your financial circumstances, so we can offer you products and services and give you the best possible customer experience. The information we collect falls into various categories.

Identity & contact information

Name, date of birth, copies of ID, contact details, PPS number (or foreign equivalent), security details to protect identity, nationality, home status and address, email address, work and personal phone numbers, marital status, family details, tax residency and tax related information.

Financial details/circumstances

Bank account details, credit/debit card details, application processing and administration records, your employment status and employment details of your partner, credit data from credit registers, credit agency performance data, life assurance, pension and investment details, transaction details, financial needs/attitudes, contact outcomes, authorised signatories details, information relating to power of attorney arrangements.

Marital status and/or financial associations

If you are married or are financially linked to another person in the context of a particular product or service, a financial association may be created between your records and their records, including any previous and subsequent names used by you (for example, if you apply jointly or one is guaranteeing the debts of another). This means that we may treat your financial affairs as affecting each other. These links will remain on your and their files until you or they break that link. We may make searches on all joint applicants, and evidence of that search will be left on all applicants’ records.

Information you provide us about others or others provide us about you If you give us information about someone else (for example, information about a spouse or financial associate provided during the course of a joint application with that person), or someone gives us information about you, we may add it to any personal information we already hold and we will use it in the ways described in this Data Privacy Notice. Before you disclose information to us about another person, you should be sure that you have their agreement to do so. You should also show them this Data Privacy Notice. You need to ensure they confirm that they know you are sharing their personal information with us for the purposes described in this Data Privacy Notice.
Sensitive categories of data

We may hold information about you which includes sensitive personal data, such as health or criminal conviction information. We will only hold this data when we need to for the purposes of the product or services, we provide to you or where we have a legal obligation to do so. Examples of when we use this type of data include:

o Medical information, for example, where you apply for life insurance, mortgage protection or investment products.

o If you have criminal convictions, we may process this information in the context of completing an insurance policy.

o Information about you provided by others If you give us information about someone else, or someone gives us information about you, (for example, where another person provides your information to us during the course of a joint application), we may add it to any personal information we already hold and use it in the ways described in this Data Privacy Notice.

Information which you have consented to us using

o Your agreement to allow us contact you through certain channels to offer you relevant products and services.

o Information from online activities.

▪ We collect information about your internet activity using technology known as cookies, which can often be controlled through internet browsers. For detailed information on the cookies we use and the purposes for which we use them, see our Cookie Policy, which is available on our website.

▪ We collect information about your internet browser settings or otherwise Internet Protocol (IP) and other relevant information to help us identify your geographic location when providing you with our services.

Other personal information

o Telephone and image recordings.

o CCTV images at our offices (but only for security reasons and to help prevent fraud or crime).

o Information in relation to data access, correction, restriction, deletion, porting requests and complaints.

Sometimes we may collect and use your information even though you are not a customer of ours

For example, you may be a beneficiary, director or representative of one of our customers, or you may be in the process of making an application for an Enda O’Brien Mortgages Limited, trading as Enda O’Brien Financial Planning product or service. In other cases, your own circumstances may have a material impact on the ability of our customer to perform their obligations to us, and we will need to consider these. If so, we will apply the principles outlined in this Data Privacy Notice when dealing with your information.

When and how we collect information about you

Enda O’Brien Mortgages Limited, trading as Enda O’Brien Financial Planning will process (collect, store and use) the information you provide in a manner compatible with the EU’s General Data Protection Regulation. We will endeavour to keep your information accurate and up to date, and not keep it for longer than is necessary.

As you use our services, apply for products, make enquiries and engage with us, information is gathered about you. We may also collect information about you from other people and other parties, for example, when you are named in an insurance policy application, from credit rating agencies and from sources where you have chosen to make your information publicly available, such as social media sites.

When we collect information about you:

When you ask us to provide you with certain products and services. For example, insurance or investment products may require us to collect relevant health information from you.
When you use our website and online services provided by us and visit our offices. • When you or others give us information verbally or in writing. This information may be on application forms, in records of your transactions with us or if you make a complaint. • When you use our products or services, including making transactions on your account, we gather details about who you get money from, who you pay money to, how much the payments are for and when the payments are made.
From information publicly available about you – for example in trade directories, online forums, websites, Facebook, Twitter, YouTube or other social media. When you make information about yourself publicly available on your social media accounts or where you choose to make information available to us through your social media account, and where it is appropriate for us to use it, this information can help enable us to do things like:

improve our service (for example, identifying common service issues), 2. personalise your online experience with us
contact you through the social media services, and
enable you to share your experience and content via social media services. • From your online activities with third parties where you have given us your consent (for example, by consenting to our use of certain cookies or other location tracking technologies).

From credit reference agencies, credit registration agencies, fraud prevention agencies or public agencies such as property registration authorities, the Companies Registration Office or judgement registries.

Please note: If you apply for or hold a financial product in joint names, you should only give personal information about someone else (for example, a joint applicant, guarantor or dependant) with their permission.

How we use your information

Whether we are using it to confirm your identity, to help in the processing of an application for a product or service or to improve your experiences with us, your information is always handled with care and the principles outlined in this Data Privacy Notice are always applied. We use your information:

To provide our products and services to you, and to fulfil our contract with you To provide our products and services to you and perform our contract with you, we use your information to:

o Establish your eligibility for our products and services.

o Manage and administer your accounts, policies, benefits or other products and services that we or our partners may provide you with.

o Process your applications for financial services.

o Contact you by post, phone, text message, email, social media, fax, or other means, but not in a way contrary to your instructions to us or contrary to law. o Monitor and record our conversations when we speak on the telephone (for

example, to check your instructions to us, to analyse, to assess and improve customer service and for training and quality purposes).

o Manage and respond to a complaint or appeal.

To manage our business for our legitimate interests

To manage our business we may use your information to:

Engage agencies to trace you (for example, where the address you have provided is no longer accurate and Enda O’Brien Mortgages Limited, trading as Enda O’Brien Financial Planning needs to provide you with legal documentation).
Provide service information, to improve our service quality and for training purposes

▪ We may gather information about your interactions with us.

Conduct marketing activities

▪ For example, running competitions, promotions and direct marketing (provided that you have not objected to us using your details in this way), and research, including customer surveys, analytics and related activities.

To run our business on a day to day basis including to:
Carry out strategic planning and business portfolio management.
Compile and process your information for audit, statistical or research purposes (including, in some instances, making your data anonymous) in order to help us understand trends in our customer behaviour and to understand our risks better, including for providing management information, operational and data risk management.
Protect our business, reputation, resources and equipment, manage network and information security (for example, developing, testing and auditing our websites and other systems, dealing with accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the

related services) and prevent and detect fraud, dishonesty and other crimes (for

example, to prevent someone trying to steal your identity), including using CCTV at our premises.

Manage and administer Enda O’Brien Mortgages Limited, trading as Enda O’Brien Financial Planning legal and compliance affairs, including compliance with regulatory guidance and voluntary codes of practice to which we have committed.
Enable Enda O’Brien Mortgages Limited, trading as Enda O’Brien Financial Planning to access your information for internal administrative purposes, audit, prudential, statistical or research purposes (including making your data anonymous) to help us understand trends in customer behaviour, for helping us to understand our risks better and for the purposes set out in this Data Privacy Notice (but not for the purposes of direct marketing where you have objected to this).
To buy and/or sell assets Enda O’Brien Mortgages Limited, trading as Enda O’Brien Financial Planning:
Members of Enda O’Brien Mortgages Limited, trading as Enda O’Brien Financial Planning may in the future wish to sell, transfer or merge part or all of its business or assets or to buy a new business or the assets of another business or enter into a merger with another business. If so, we may disclose your personal information under strict duties of confidentiality to a potential buyer, transferee, merger partner or seller and their advisers, so long as they agree to keep it confidential and to use it only to consider the possible transaction. If the transaction goes ahead, the buyers, transferee or merger partner may use or disclose your personal information in the same way as set out in this Data Privacy Notice.
Facilitate a potential or actual transfer of any loan or product provided to you or in connection with a securitisation or other funding arrangement.
To comply with our legal and regulatory obligations
We need to use your information to comply with legal and regulatory obligations including: Complying with your information rights.
Providing you with statutory and regulatory information and statements. • Establishing your identity, residence and tax status in order to comply with law and regulation concerning taxation and the prevention of money laundering, fraud and terrorist financing
We are required by law to screen applications that are made to us to ensure we are complying with the international fight against terrorism and other criminal activities. As a result, we may need to disclose information to government and other statutory bodies.
Preparing returns to regulators and relevant authorities including preparing income tax, capital gains tax, capital acquisition tax and other revenue returns. • Reporting to and, where relevant, conducting searches on other industry registers.
Complying with binding requests from regulatory bodies, including the Central Bank of Ireland.
Complying with binding production orders or search warrants, and orders relating to requests for mutual legal assistance in criminal matters received from foreign law enforcement agencies/prosecutors.
For other reasons where a statutory reason exists we do so, including use of your Personal Public Service (PPS) number (or foreign equivalent).
Complying with court orders arising in civil or criminal proceedings. • Performing a task carried out in the public interest.
Where you have given us permission (which you may withdraw at any time) Where you have given us permission (which you can withdraw at any time) we may: • Send electronic messages to you about product and service offers from Enda

O’Brien Mortgages Limited, trading as Enda O’Brien Financial Planning and/or our selected and trusted partners.

Share your data with third parties so that they may send you electronic messaging about their products and offers.
Use cookies in accordance with our Cookie Policy.
Use special categories of data, or sensitive data.
Use information you have made public and combine with this with the activities outlined above. When we ask for your consent, we will provide you with more information on how we will use your data in reliance on that consent, including in relation to third parties we would like your consent to share your data with.

Who we share your information with

We only share your information with a select number of individuals and companies, and only as necessary. Sharing can occur in the following circumstances and/or with the following persons:

Your authorised representatives:
These include your attorney (under a Power of Attorney) and any other party authorised by you to receive your personal data.
Third parties we need to share your information with in order to facilitate payments you have requested and those you ask us to share your information with.
When you apply to us for financial advice, services or products.
We will pass your details on to the relevant providers with your written consent. • We may request information relating to your health for underwriting and claims administration purposes.
We may disclose your information to our agents and other insurers and third parties for administration, regulatory, customer care and service purposes, and to investigate or prevent fraud.
When you use a joint product.
If you open or hold a joint account or product, this may mean that your personal data will be shared with the other applicant. For example, transactions made by you will be seen by your joint account holder, and you will see their transactions.
Guarantors.
We will share your information with any person or entity which guarantees your obligations to us (for example, if a parent guarantees your mortgage or an entity provides a guarantee as part of a statutory scheme) or gives us an indemnity concerning these obligations.
Companies that provide support services for the purposes of protecting our legitimate interests.
Your personal information remains protected when our service providers use it. We only permit service providers to use your information in accordance with our instructions, and we ensure that they have appropriate measures in place to protect your information.
Our service providers include marketing and market research companies, analytics companies, investment companies, IT and telecommunication service providers, software development contractors, data processors, computer maintenance contractors, printing companies, property contractors, document storage and destruction companies, custodians and providers of administration services, archiving services suppliers, debt collection agencies, budgeting and advice agencies, tracing agencies, receivers, liquidators, examiners, official Assignee for Bankruptcy and equivalent in other jurisdictions, auditors and consultants, including legal advisors.
We may also share information with the following third parties to help us manage our business for our legitimate interests:
Insurers/re-insurers and insurance bureaus.
Trade associations and professional bodies, non-statutory bodies and members of trade association.
Pension fund administrators, trustees of collective investment undertakings and pensions trustees.
Persons making an enquiry or complaint.
Healthcare professionals and medical consultants.
Business partners and joint ventures. In such cases, we, our business partners or those involved in the joint venture will let you know that your information is being shared and who it is being shared with.
Statutory and regulatory bodies (including central and local government) and law enforcement authorities.
These include the courts and those appointed by the courts, government departments, statutory and regulatory bodies in all jurisdictions where Enda O’Brien Mortgages Limited, trading as Enda O’Brien Financial Planning operates including: the Central Bank of Ireland, the Data Protection Commission, the Financial Services and Pensions Ombudsman, An Garda Síochána/police authorities/enforcement agencies, Revenue Commissioners, Criminal Assets Bureau, US, EU and other designated authorities in connection with combating financial and other serious crime, NAMA and its agents or other parties designated by or agreed with NAMA or designated under the relevant legislation,

police forces and security organisations, ombudsmen and regulatory authorities, as well as fraud prevention agencies.

Credit reference/rating agencies, including The Irish Credit Bureau.
Third parties in connection with a sale or purchase of assets by a member of Enda O’Brien Mortgages Limited, trading as Enda O’Brien Financial Planning. • Those who are interested in or participating in buying or selling assets of Enda O’Brien Mortgages Limited, trading as Enda O’Brien Financial Planning or in connection with a funding arrangement for Enda O’Brien Mortgages Limited, trading as Enda O’Brien Financial Planning.
Correspondent banks and other financial institutions engaged to supply status opinions in accordance with banking practice.
Where you cannot be found or you become insolvent.

o In certain contracts of insurance where, for whatever reason, you cannot be found or you become insolvent, or the court finds it just and equitable to so order, then your rights under the contract may be transferred to and vested in the third party even though they are not a party to the contract of insurance. The third party has a right to recover from the insurer the amount of any loss suffered by them. Where the third party reasonably believes that you as policyholder have incurred a liability the third party may be entitled to seek and obtain information from the insurer or from any other person who is able to provide it concerning:

▪ the existence of the insurance contract,

▪ who the insurer is,

▪ the terms of the contract, and

▪ whether the insurer has informed the insured person that the insurer intends to refuse liability under the contract.

How long we hold your information

The length of time we hold your data depends on a number of factors, such as regulatory rules and the type of financial product we have provided to you. Those factors include: • The regulatory rules contained in laws and regulations or set by authorities like the

Central Bank of Ireland, for example, in the Consumer Protection Code. • The type of financial product we have provided to you.

Whether you and us are in a legal or some other type of dispute with another person or each other.
The type of data we hold about you.
Whether you or a regulatory authority asks us to keep it for a valid reason. • Whether we use your data for long-term statistical modelling, provided that such modelling does not affect any decision we make about you.

As a general rule, we keep your information for a specified period after the date on which a transaction has completed or you cease to be a customer. In most cases this period is six (6) years.

Implications of not providing information

Sharing information with us is in both your interest and ours.

We need your information in order to:

o Provide our products and services to you and fulfil our contract with you. o Manage our business for our legitimate interests.

o Comply with our legal obligations.

o Of course, you can choose not to share information, but doing so may limit the services we are able to provide to you.

o We may not be able to provide you with certain products and services that you request. We may not be able to continue to provide you with or renew existing products and services.

o We may not be able to assess your suitability for a product or service, or, where relevant, give you a recommendation to provide you with an Enda O’Brien Mortgages Limited, trading as Enda O’Brien Financial Planning financial product or service.

o When we request information, we will tell you if providing it is a contractual requirement or not, and whether or not we need it to comply with our legal obligations.

The legal basis for using your information

In order for us to provide you with financial advice, services or products, Enda O’Brien Mortgages Limited, trading as Enda O’Brien Financial Planning need to collect personal data to provide you with financial advice, services or products. Our reason for processing your data under the GDPR is:

Legal basis – Enda O’Brien Mortgages Limited, trading as Enda O’Brien Financial Planning needs to process your data as this is necessary in relation to forming a contract of insurance to which the individual has/will enter into or because the individual has asked for something to be done so they can enter into a contract to be provided with financial advice, services or products.

In any event, Enda O’Brien Mortgages Limited, trading as Enda O’Brien Financial Planning are committed to ensuring that the information we collect and use is appropriate for this purpose and does not constitute an invasion of your privacy.

How we keep your data safe

We use technical and organisational measures to protect your personal information from unauthorised access, to maintain data accuracy and to help ensure the appropriate use of your personal information. These security measures include encryption of your personal information, 24/7 physical protection of facilities where your personal information is stored, background checks for personnel that access physical facilities, and strong security procedures across all service operations. We use strong encryption algorithms for the transmission and storage of your information. When you contact us to ask about your information, we may ask you to identify yourself. This is to help protect your information.

Processing your information outside the EEA

Your information is stored on secure systems within Enda O’Brien Mortgages Limited, trading as Enda O’Brien Financial Planning premises and with providers of secure information storage. We may transfer or allow the transfer of information about you and your products and services with us to our service providers and other organisations outside the European Economic Area (EEA), but only if they agree to act solely on our instructions and protect your information to the same standard that applies in the EEA.

Using companies to process your information outside the EEA.

Some of our service providers, for example IT, telecommunication, credit reference agencies, payment processors, custodians and providers of administration services, tracing agents and contractors are based outside of the EEA. Where we authorise the processing/ transfer of your personal information outside of the EEA, we require your personal information to be protected to at least Irish standards and include the following data protection transfer mechanisms:

o Adherence to the EU/US Privacy Shield. You can find more information on the EU/US Privacy Shield at www.privacyshield.gov including a list of all organisations that have signed up to the EU/US Privacy Shield framework. Please contact us for further details on any transfers of personal information by Enda O’Brien Mortgages Limited, trading as Enda O’Brien Financial Planning to entities in the US.

How to exercise your information rights (including the right to object)

Providing and holding personal information comes with significant rights on your part and significant obligations on ours. You have several rights in relation to how we use your information. If you make your request electronically, we will, where possible, provide the relevant information electronically unless you ask us otherwise:

You have the right to:

Right of access – you have the right to request a copy of the information that we hold about you.
Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.
Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.
Right of portability – you have the right to have the data we hold about you transferred to another organisation.
Right to object – you have the right to object to certain types of processing such as direct marketing.
Right to object to automated processing, including profiling – you also have the right to be subject to the legal effects of automated processing or profiling. We use profiling to establish a customer’s attitude to investment risk to the product/service/advice being provided. We have calculators which calculate the customers’ attitude to various levels

of risk having answered a series of questions. You will be notified in order to complete a Risk Profiling questionnaire and will also be notified of the results. We do not share this information with third party providers but will make recommendations taking the results into account.

Right to judicial review – in the event that Organisation Name refuses your request under rights of access, we will provide you with a reason as to why.
Withdraw consent at any time, where any processing is based on consent – if you withdraw your consent, it will not affect the lawfulness of processing based on your consent before its withdrawal.

We are obliged to respond without undue delay. In most instances, we will respond within one calendar month. If we are unable to deal with your request fully within a calendar month (due to the complexity or number of requests), we may extend this period by a further two calendar months. Should this be necessary, we will explain the reasons why. If you make your request electronically, we will, where possible, provide the relevant information electronically unless you ask us otherwise.

You have the right to complain to the Data Protection Commission. You can contact the Office of the Data Protection Commissioner at:

Web: www.dataprotection.ie/docs/Contact-us/b/11.html

Telephone: +353 (0)761 104 800 or Lo Call Number 1890 252 231

Fax: +353 57 868 4757

E-mail: info@dataprotection.ie

Postal Address: Data Protection Commission, Canal House, Station Road, Portarlington, R32 AP23, Co. Laois.

How to contact us and/or our Data Protection Officer

Your privacy is important to us. If you have any comments or questions regarding this statement, please contact us on 087 823 3425 or email enda@endaobrien.com. Privacy policy statement changes Enda O’Brien Mortgages Limited, trading as Enda O’Brien Financial Planning may change this privacy policy from time to time. When such a change is made, we will post a revised version online. Changes will be effective from the point at which they are posted. It is your responsibility to review this privacy policy periodically so you are aware of any changes. By using our services, you agree to this privacy policy.

Changes to this notice

We will update this Data Privacy Notice from time to time. When such a change is made, we will post a revised version online. Changes will be effective from the point at which they are posted. It is your responsibility to review this privacy policy periodically, so you are aware of any changes. By using our services, you agree to this privacy policy.

This privacy policy was last reviewed on 1st December 2021.

Enda O’Brien Mortgages Limited, trading as Enda O’Brien Financial Planning is regulated by the Central Bank of Ireland.