Privacy Policy

1. Who we are

We are the Royal College of Surgeons in Ireland of 123 St Stephen’s Green Dublin DO2 YN77. You can contact us at this address by post or by email at info@rcsi.ie.

Our data protection officer may be contacted by email at dataprotection@rcsi.ie.

2. Why we process your data, the lawful basis for processing your data and with whom we share it

A. For people who view and interact with our website, we process data:

to sign up to newsletters when you request subscription through our website
to personalise services in order to optimise content and offerings which may be relevant and of interest

The legal basis for this processing is our legitimate interest in the administration and operation of academic, research and commercial activities along with our legitimate interest in marketing and promoting RCSI’s academic and research offering. We always include an unsubscribe button in our communications so you can opt out of receiving such communications at any time. RCSI commits to not processing your personal data where these legitimate interests are overridden by your own interests.

B. For people who engage with the institution, students, staff and researchers in a professional capacity through attendance at events and meetings nationally/internationally or those who collaborate for education, research and service, we process data:

to send frequent engagement newsletters, greeting cards or other RCSI corporate materials
to personalise services in order to optimise content and offerings which may be relevant and of interest

C. For our prospective students, we process data:

in order to promote RCSI courses, open evenings, open days and other related RCSI outreach activities
to provide you with updates and notifications to which you have subscribed
to personalise services in order to optimise content and offerings which may be relevant and of interest

The legal basis for the processing of this data is necessary for the purpose of the legitimate interests of RCSI in promoting its courses and programmes. We may share your personal data with an external marketing and recruitment partner for the purposes of supporting your application. We always include an unsubscribe button in our communications, so you can opt out of receiving such communications at any time.

D. For job applicants to RCSI, we process data:

to conduct recruitment in an orderly, efficient and accountable manner
to deliver recruitment services in a consistent and equitable manner
to facilitate the efficient handling of enquiries concerning recruitment records
to meet legislative and regulatory requirements, including archival, data access requests, audit, and oversight activities
to ensure that adequate records are kept of all recruitment activities
to personalise services in order to optimise content and offerings which may be relevant and of interest.

The legal basis for the processing of this data is necessary for the purpose of the legitimate interests of RCSI in recruiting new staff. Please see the privacy notice in the job advertisement for further information about how we process applicant data. We may share the information you provide in your application with our contracted recruiter in order to make a shortlist of candidates. This recruiter is not permitted to use this data other than on our behalf. We may also send you emails about your application through our email service provider.

In some instances, we may combine other information with personal data, such as deriving geographical location from your IP address and combine website browsing data about your usage of RCSI services with your name. If we combine other information with personal data, we will treat the combined information as personal data.

We will retain this data for the period of time and as per the rationale documented in our Retention Policy.

3. Transfers of data outside the European Economic Area

If we transfer personal data relating to our academic and/or research endeavours to a service provider located in a country outside the EEA, we shall safeguard the transfer of this personal data by ensuring that we have European Commission approved standard contractual clauses in place with the provider.

4. Your rights relating to personal data

You have the following rights under the General Data Protection Regulation (GDPR), in certain circumstances and subject to certain exemptions, in relation to your personal data:

right to access the data – you have the right to request a copy of the personal data that we hold about you, together with other information about our processing of that personal data.
right to rectification – you have the right to request that any inaccurate data that is held about you is corrected, or if we have incomplete information you may request that we update the information such that it is complete.
right to erasure – you have the right to request us to delete personal data that we hold about you. This is sometimes referred to as the right to be forgotten.
right to restriction of processing or to object to processing – you have the right to request that we no longer process your personal data for particular purposes, or to object to our processing of your personal data for particular purposes.
right to data portability – you have the right to request us to provide you, or a third party, with a copy of your personal data in a structured, commonly used machine-readable format.

In order to exercise any of the rights set out above, please contact us at dataprotection@rcsi.ie.

If we are processing personal data based on your consent, you may withdraw that consent at any time. This does not affect the lawfulness of processing which took place prior to its withdrawal.

Articles 13 and 14 of the GDPR requires information to be provided, or made readily available, to data subjects so that they are informed in a transparent manner as to the purposes for which their data is to be processed. You can learn more about this on the Higher Education Authority website.

If you are unhappy with how we process personal data, we ask you to contact us so that we can rectify the situation.

You may lodge a complaint with a supervisory authority. The Irish supervisory authority is the Data Protection Commission (DPC).

5. Requirement to process personal data

You may browse our website without providing us with any personal data and this will not affect your ability to view our website.

If you do not provide us with your information for the purposes described above, we cannot send you our newsletters, respond to your queries sent through our contact form, liaise with you on RCSI queries, personalise your experience on the site, or assess your potential suitability for a role within RCSI.

6. Automated decision-making and profiling

As further described in our Cookie Policy we use cookies and similar technologies (such as device identifiers and pixels) to recognise you and track your activity across different RCSI services and devices by determining your interest in particular topics. We use cookies to collect information about the way that visitors use RCSI websites, to support the features and functionality of those websites, and to personalise your experience when you use them, thereby improving the user experience of our websites.

Information collected

We value your privacy and are committed to protecting your personal information. In line with our commitment to transparency, below you will find information on how we collect and use information on our users, while maintaining the security and privacy of your data.

1. Website optimisation

RCSI collects information about all visitors to our website for the purpose of producing statistical reports of online traffic to identify how we can improve our website. Every data file contains the following information.

The referring website from which you came when visiting us
The IP address
Time and date of website access
User agent (browser)
HTTP code (secure channel or standard channel)
Bytes served
Information on browser and operating system that you used at the time of accessing the site

Information on internet traffic is collected routinely by RCSI and by its service providers (eg, HEAnet). This information is used to ensure the smooth operation of RCSI’s web properties and enhance them by tailoring content that matches our users' interests.

2. Tracking user interactions and conversions

RCSI collects the following types of personal data when you interact with our websites or services:

Email address: When you sign up for our newsletter, create an account, or make a purchase.
Phone number: When you provide it as part of an order or service inquiry.
Other identifiable information: Such as name, address, or other details you voluntarily provide.

How is your information used?

Your information is collected securely and can be used to improve the performance of our advertising campaigns by tracking website conversions, such as newsletter sign-ups or event bookings. It may be shared with further third parties for the purpose of tracking conversions.

Data security and retention

RCSI only retains your data for as long as necessary to fulfil the purposes outlined in this policy or as required by law. Adequate organisational and technical security measures, which are reviewed on a regular basis, are taken to ensure the security of your personal information.

Any data shared with third parties for the purpose of conversion tracking is securely hashed (meaning that each character in an email address, telephone number or other identifiable information is anonymised) before being transmitted in compliance with data protection regulations to digital service providers such as Google, LinkedIn, Meta, Snapchat, TikTok and X where it is used to provide more accurate reporting on the effectiveness of our advertising campaigns.

Data ethics

RCSI is committed to the core principle of data ethics namely that personal data is "... generated, reported, stored and used in a trustworthy way" (Ethical Use of Customer Data in a Digital Economy – UK Finance March 2019).

In addition to its statutory responsibilities, annual data protection training is a mandatory requirement among RCSI staff. RCSI also has a Research Ethics Committee where proposed research studies, which involve the use of sensitive personal data (medical, genetic, gender etc.), must be evaluated in advance to ensure that their intended use is one that can withstand rigorous ethical scrutiny.

RCSI also has a Quality Enhancement Office which regularly conducts staff surveys and performs evaluations using a multiplicity of data. This office adheres to the highest standards of probity and confidentiality in the discharge of its duties.

Going beyond the requirements of GDPR, RCSI is confident that it meets our aspiration to handle personal data in an ethical manner consistent with its mission "to educate, nurture and discover for the benefit of human health".

Changes to this privacy policy

RCSI may update this privacy policy from time to time to reflect changes in our practices or relevant regulations. We encourage you to review this policy periodically for any updates.

Queries

Any queries or concerns you may have about the processing of personal information on this website should be addressed to:

Dónall King
Data Protection Officer
Royal College of Surgeons in Ireland
123 St Stephen’s Green
Dublin
D02 YN77
Email: dataprotection@rcsi.ie