Introduction

Clancy Project Management [“Clancy”] Limited is strongly committed to protecting the data protection rights of its customers, contractors, employees, vendors and website visitors. The intent of this data protection statement is to detail the information Clancy may gather about individuals who visit its website or in day-to-day interactions and how that information is used. You should read this statement carefully before using this website and our services.

In this Statement we refer to personal data, which is defined as information concerning or relating to a living person (a natural person who hereafter will be called the Data Subject) Data Protection Laws such as the General Data Protection Regulation seeks to protect and enhance the rights of data subjects. These rights cover the safeguarding of personal data, protection against the unlawful processing of personal data and the unrestricted movement of personal data within the EU.

Clancy’s website is for use by people who are 16 years and over only.

It is not our intention to collect any special categories of personal data about you from our website, or during general business activities (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). Nor is it our intention to collect any information about criminal convictions and offences. However, if it is necessary to collect special categories of personal information and/or criminal conviction data, we will only do so with your explicit consent and we will explain the purpose for which the information will be used at the point where we ask for your consent.

This is not an exhaustive statement of all our data protection practices, and we may apply specific policies within certain environments. We might include a separate statement at the point of capturing data and any specific consents obtained or information provided in this way will apply specifically to that activity and will supplement this Statement. We will update this Statement from time to time to reflect any material changes in technology, legislation or data use practices which may materially affect the way in which we process Personal Data.

1. Who’s data do we Process.

• All users of our Website Clancy and our social media pages;
• Clancy employees and contractors (including applicants for employment);
• All members (including former employees) of Clancy on sponsored pension schemes;
• Clancy business contacts and vendors;
• All customers or prospective customers of Clancy.

2. Categories of Personal Data and how we use it.

This section of this Statement sets out the type of personal data collected by Clancy, the purposes for which such personal data is collected and processed and the lawful justifications for such processing in the context of our Website and day-to-day interactions with you. We may collect, use, store and transfer various kinds of personal data about you which we have grouped together as follows;

• Identity Data includes first name, last name, username or similar identifier, title, and gender. It may also include your image (when captured on CCTV) and details pertaining to and supporting your employment with Clancy.
• Contact Data includes email address, business email address, telephone number and postal address.
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, cookies, chosen language, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website.
• Profile Data includes your interests, preferences, and feedback.
• Usage Data includes information about how you use our website and services.
• Marketing and Communications Data includes your preferences in receiving marketing from us and any third parties and your communication preferences.

You may be asked, either when you engage with us, or at other times, for personal data about yourself, such as your name, e-mail address, title or role within your employment, postal address, and telephone number. You may also be asked to share with us your interests and preferences. You are under no obligation to provide this information, but if you do not we may not be able to provide you with certain services or personalise your experience on our website.

3. How we obtain your information

We use different methods to collect data from and about you through the following:

Direct interactions;

You may give us your Identity and Contact Data by filling in forms or by corresponding with us by email or otherwise. This includes personal data you provide when you:

• submitting a contact form;
• request our services (pricing or quotations);
• engage directly through social media communications;
• purchase a service;
• request marketing or information about our services to be sent to you;
• provide feedback via a survey or email;
• apply for a job with Clancy;
• attend a trade event where we are represented;
• visit our premises or site where your image will be collected on CCTV;

Automated technologies or interactions;

As you interact with our website, we may automatically collect Technical Data about your equipment, browsing actions, and patterns. We collect this personal data by using cookies, server logs, and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. All cookies apart from strictly necessary cookies will require your consent.

Log files/IP addresses;

When you visit our Web Site, we automatically log your IP address (the unique address which identifies your computer on the internet) which is automatically recognised by our web server. We use IP addresses to help us administer our website and to collect broad demographic information for aggregate use. We do not link IP addresses to personally identifiable information.

4. What Personal Data does Clancy collect and use online?

Clancy collects various types of Personal Data when a person uses our website or our social media sites. The following are examples of Personal Data collected by Clancy:

• We may collect your personal data from Contact Forms, (such as receiving an enquiry form you about a service we provide) this enables us to deal with your request in a timely manner.
• Our website uses cookies, web beacons, device identifiers, social plugins, tracking pixels, etc. “Cookies” these are small pieces of information stored by your internet browser that collect data such as your browser type, your operating system, web pages visited, time of visits, content viewed, advertisements viewed, and other click stream data. We use cookies to help us tailor our websites to your needs, to deliver a better, more personalised service and to remember certain choices you have made so you do not have to re-enter them. Cookies also enable us to identify traffic to our website including pages visited, visitor numbers and traffic paths taken. We do not deploy unnecessary cookies, such as statistical, analytics, marketing, targeting, or profiling cookies without your consent. Please refer to our Cookie Policy for further details Cookie Policy Clancy
• Our website may also include links to third party websites, plugins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their data protection practices or statements. When you leave our website, we encourage you to read the data protection statement of every website you visit.
• Social Media Pages contain content such as messages and photographs, which are posted on social media pages where we have a presence and which may be made publicly available and may be used in connection with the operation and promotion of our social media pages, services, and our website. If content is posted that is deemed to be in breach of this Statement or the policies operated by such websites or social media platforms, such content may be removed by or at the request of Clancy or the operators of those social media websites. If such inappropriate content is posted to a social media page that is under our control, you can report it at the following address dataenquiries@clancy.ie and we will endeavour to ensure that appropriate action is taken in accordance with our policy’s and those of the relevant social media platforms. Clancy provides for easy connection to our Social Media sites via the inclusion of “buttons” on this website. Clancy is aware that they may be deemed a “joint controller” with these social media agencies.

5. The Purpose and Lawful Basis for Processing Your Data

Clancy collects and processes your personal data described below for a variety of purposes. As required by data protection laws, below is a brief summary of these purposes and the lawful justifications that support them:

The Performance of a Contract or entering into one;

We may process your personal data in order to enter into a contract with you or to provide you with a service which you have requested from us.

To comply with our legal obligations;

We are required to process your personal data to comply with certain legal and regulatory obligations to which we are subject. For example, we are required to obtain certain business records in accordance with employment law, company and revenue law which may include your personal information.

For our legitimate business interests;

We may use your personal data for the purposes of conducting activities that are in our legitimate interests (or those of a third party). Where we process your personal data for our legitimate interests, we ensure that there is a fair balance between our legitimate interest and your fundamental rights and freedoms.

• We may use legitimate interest to promote the services offered by Clancy to prospective and existing business clients.
• We may use your personal data to manage our everyday business needs, including accounting, internal reporting needs, and market research, to progress and respond to legal claims.
• To manage our health and safety obligations, the security of our premises and employees through the use of CCTV .
• To ensure appropriate IT security and to prevent fraud, to monitor and audit any claims.
• Our legitimate interest is the effective and secure management of our business.

Should you have any objections to the above processing scenarios please contact us on dataenquiries@clancy.ie

With your consent;

If you use our website and consent to the use of cookies that are not strictly necessary. You can withdraw your consent at any time through the Cookie Preference Centre which is located at the bottom of the webpage.
Consent maybe required for other purposes, and you can withdraw your consent at any time by contacting us via the above and below contact details.

To protect your vital interests;

We will in certain circumstances use your personal data to protect your vital interests or those of another, for example; we may need to process your data in relation to a serious incident or safety issue.

6. Your Information and Third-Party Disclosure

Clancy may on occasion pass your personal data to third parties exclusively to process it on its behalf. Clancy requires these parties to agree to process this information based on our instructions and requirements consistent with this Statement and our obligations to Data Protection Laws.

Third party service providers;

We disclose personal data to third parties in certain instances. For example, we use third party service providers for the processing of personal data for a number of purposes, including, security service providers, consultant advisors, IT service providers, data storage providers, debt collection agencies, marketing companies, insurance providers and organisations that provide administrative services. These service providers are subject to a contractual obligation to only process personal data for purposes for which it was obtained and for the fulfilment of the services.

We will not provide your personal data to third parties or partners for direct marketing or promotional purposes unless you have consented to us disclosing your personal data to such third parties for that purpose. If a user opts-out from receiving communications from third parties or partners, we will no longer share that user’s contact details with our partners or third parties. However, users will still need to directly opt-out from communications from the partners to whom we have already given their information.

In certain circumstances we will disclose personal data to other external third parties such as its professional advisors as necessary in the context of the performance of their services. Such recipients may include external legal advisors, regulatory advisors, auditors, actuaries, pension and tax advisors, pension administrators and other professional advisors. Disclosure of such data will take place for a variety of reasons including in order to ensure that Clancy meets its tax and other statutory obligations. We may also disclose personal data to insurance providers in connection with our insurance requirements, legal claims and prospective legal claims or proceedings.

Potential Sale or Merger;

If we sell any part of our business and/or integrate it with another organisation, your personal data may be disclosed to our advisers and to prospective purchasers or joint venture partners and their advisers. If this occurs, the new owners of the business will only be permitted to use your personal data in the same or comparable way as set out in this data protection statement.

Garda Síochána, Government or Quasi-Government Bodies, Courts, and Tribunals;

We may share your personal data with these organisations and bodies, where required to do so by law. Specific employee roles within Clancy may be asked to submit to Garda Vetting, in this instance the employee will authorise this activity.

Links to Third Party Sites;

Please note that this policy applies only to this website and not to the websites of other companies or organisations to which we provide links. Any third-party websites are viewed at your own risk.

7. Transfers outside the European Economic Area

We may transfer, store, or process your personal data to countries outside the European Economic Area. Where the laws of such countries do not afford an equivalent level of protection of personal data as the laws of Ireland, we take specific steps in accordance with data protection law to protect your personal data, and we will use one of these following safeguards:

• Transfer to a non-EEA country with data protection and privacy laws that give the same protection as the EEA.
• Put in place a contract (in a form that is approved by the European Commission) with the recipient of the personal information that means they must protect it to the same standards as the EEA.
• Transfers to organisations that are part of an EU Framework that sets data protection and privacy standards for data sent between countries. These frameworks make sure those standards are similar to what is used within the EEA.

8. Data Storage

The majority of Personal Data processed by Clancy is held in Ireland/Europe. Clancy may process personal data outside the EEA to territories subject to EU adequacy decisions and/or where Clancy has put in place other measures such as Standard Contractual Clauses.
Every effort is taken to ensure all data is hosted in the EEA. This website provides for plugins such as Facebook, Instagram LinkedIn, and X. By using our site or submitting information through our contact form you accept that personal data may be processed outside the EEA in limited circumstances and with adequate measures in place.

9. Retention Policy

Clancy will process personal data during the duration of any contract and will continue to store only the personal data needed in accordance with our Data Retention Policy. The majority of personal data is retained for a period of seven years after the end of the business relationship. CCTV footage is retained for a period of 30 days. If you would like further details regarding our retention periods, please contact us on the details provided below.

10. Your rights as a data subject

In certain circumstances, you have the following rights under data protection law in relation to your personal data: To enforce your rights please email or contact us on the information provided below.

A right to access Personal Data held by Clancy;

(a) Any individual has a right to make an access request under data protection law for a copy of their Personal Data held by us. We may ask for further identification details to confirm your identity before the relevant information is provided. This would be in a situation where you, as a Data Subject, are not known directly by Clancy or where the request came via a communication where the personal data does not match what we have on file.
(b) It should be noted that there may be specific exemptions relating to accessing Personal Data. If we utilise any of the exemptions, we will provide you with details and our justification for their use.

Other data protection rights

• (a) Rectification of inaccurate personal data;
• (b) Erasure of personal data (also known as the “right to be forgotten”);
• (c) Restriction of processing of persona data;
• (d) Right to data portability;
• (e) Right to object to processing of personal data.

However, under data protection law, these rights are available only in certain circumstances.

If you wish to exercise any of these rights, exercise any of your data protection rights, please contact us on dataenquiries@clancy.ie or by us using the contact details below. Should you make a right of access request we will endeavour to respond to you within a month. If we are unable to deal with your request within a month, we may extend this period by a further period of two months, and we will explain why. Please provide as much detail as possible to enable us to respond to your request and to locate relevant personal data about you.
You also have the right to lodge a complaint to the Data Protection Commission. For further information please use the contact details below.
The details for each of these contacts are:

Registered Office: Clancy Project Management Limited
Ballylusky, Drangan, Thurles
Co. Tipperary
Ireland

Phone: 00 353 (0) 522166 Email: dataenquiries@clancy.ie

Data Protection Commission
21 Fitzwilliam Square South
Dublin 2
D02 RD28

or via webform: Data Protection Commission

11. Changes to this Data Protection Statement & Governing Laws

This Data Protection Statement [“version 2”] was deemed effective on the 12/11/25. The Laws of Ireland govern this Statement, and you submit to the exclusive jurisdiction of the Irish Courts.

Please note we will update this data protection statement from time to time, any updates will be made available on our website clancy and we would ask that you check regularly.