Privacy Policy
Last updated: September 2026. This page explains how Verena Group collects, uses and protects your information.
Introduction
This Privacy Notice provides information about how Verena Limited a company registered in Ireland and having its registered office at Chapter House, Dominic Street, Tralee, Kerry, Ireland (“Company”, “we”, “our”, “us”) collects, holds and uses (“processes”) personal data about you during and after your working relationship with us. This Privacy Notice applies to all current and former employees and all interns, agency workers and contractors.
The Company is a “controller” of your personal data. This means that we are responsible for deciding the purposes and means by which we use the personal data we hold about you. “Personal data” is any information by which you or any living person can be individually identified either directly or indirectly but does not include anonymised data. There are “special categories” of more sensitive personal data which require a higher level of protection.
As a controller, we are obliged to provide this Privacy Notice to you under Irish data protection laws, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”), and the Data Protection Acts 1988 to 2018, as such laws may be updated from time to time (“Data Protection Laws”). In brief this Privacy Notice explains:
-
what personal data of yours we hold and why we process it;
-
the legal grounds that allow us to process your personal data;
-
where we obtain your personal data, who gets to see it and how long we keep it;
-
your data protection rights; and
-
where to address queries or complaints.
This Privacy Notice does not form part of any contract, or offer to enter into a contract, with us. It may be amended by us at any time. We will provide you with a new privacy notice when we make any substantial updates and we may also notify you by other means from time to time about the processing of your personal data.
It is important that you read this Privacy Notice so that you are aware of how and why we are using your personal data. Please see Section 11 (Your Data Protection Rights) and Section 13 (Queries and Complaints) for further information about your rights and how to exercise those rights.
What personal data we collect
We may collect, use, store and transfer different kinds of personal data about you. This can be broken down into the following categories and examples of personal data:
-
Identity Data such as your name, title, gender, date of birth, marital/civil status, PPS number and photographs for use in an identification card/ for identifying staff on a website etc.
-
Contact Data such as your home address; personal and business email addresses; and personal phone number.
-
Qualification Data such as details of your employment history, your qualifications, your eligibility to work in Ireland and your references.
-
HR Data such as contract of employment or engagement, work contact details, employee or payroll number, work location, your worker ID and various system IDs, your work biography, colleague and manager feedback, your appraisals and performance reviews, formal and informal performance management process records, disciplinary and grievance information, your termination/contract end date, the reason for termination, your last day of work, exit interviews.
-
Pension Data such as periods of pensionable service, earnings and details of other benefits.
-
Access Data: information obtained through electronic means such as swipe card records.
-
Financial Data such as your remuneration information (including salary/hourly plan/contract pay/fees information as applicable, allowances, overtime, bonus and commission plans), payments for leave, bank account number, relevant tax details, details of any benefits you receive or are eligible for, benefit coverage start date, expense claims and payments.
-
Leave & Absence Management Data: attendance records and absence records, holiday dates, requests and approvals and information related to family leave or other special or statutory leave, absence history, fit notes, details of incapacity, details of work impact and adjustments, manager and HR communications, return to work interviews.
-
Security Data: Monitoring information (to the extent authorised by applicable laws): closed circuit television footage, download and print records, call or meeting recordings, information captured by IT security programmes and filters.
-
Special Categories of Data such as information in your sickness and absence records your physical and/or mental health, information about health that is needed for your pension and to determine and provide benefits, your racial or ethnic origin, your trade union membership (if applicable).
How we use special categories of data
Special Categories of Data are particularly sensitive personal data requiring higher levels of protection. We need to have further justification for processing Special Categories of Data in the following circumstances:
-
where we need to carry out our legal obligations and in line with this Privacy Notice (“Legal Obligation”);
-
where it is needed to assess your working capacity on health grounds and for the purposes of occupational and preventative medicine, subject to appropriate confidentiality safeguards (“Medical”);
-
where it is needed for public health reasons, as required or otherwise permitted under applicable law (“Public Health”); and/or
-
where it is needed in relation to legal claims, legal proceedings or prospective legal proceedings or is otherwise necessary for the purposes of establishing, exercising or defending legal rights (“Legal Claims”).
How we collect your personal data
We receive your personal data from different sources, depending on our relationship with you. Personal data is normally obtained directly from you. In certain circumstances, it will, however, be necessary to obtain data from (internal) third parties, e.g. your line manager, or from external third parties, e.g. references from previous employers, tax data from the Revenue Commissioners or our customers.
Apart from personal data relating to you, you may also provide the Company with personal data of your family, dependants, and other individuals, for purposes of HR administration and management, including the administration of benefits and someone to contact in an emergency. Before you provide any other individual’s personal data to the Company, you must inform that individual and provide him or her with a copy of this Privacy Notice.
The legal basis we rely on to process personal data
Data Protection Laws permit six legal basis to process personal data. The legal basis that we rely on are set out in table in this section of the Privacy Notice. In some contexts, more than one legal basis may apply to our or our sub-processors’ processing activities.
Legal basis
Explanation
Processing is necessary for our performance of a contract with you or to take steps at your request to enter a contract (“Contract”)Legal basis
Processing is necessary to comply with our legal obligations (“Legal Obligation”)
Processing is necessary for our or a third party’s legitimate interests (“Legitimate Interests”)
Processing is necessary in order to protect the vital interests of you or of another person (“Vital Interests”)
This covers carrying out our contractual duties with you if you are employed or otherwise engaged by us.Explanation
Ensuring we perform our legal and regulatory obligations. For example, providing a safe place of work and avoiding unlawful discrimination.
-
HR Administration. To ensure that we effectively manage and administer all aspects of our recruitment process, and to ensure the fairness in our recruitment process.
-
Business Administration. To facilitate our day-to-day business operation in general, including in relation to matters such as business planning and budgeting.
-
Corporate Governance. To manage our risks and safeguard the assets, reputations, and other rights and interests of the Company as well as that of our workforce, clients, and other stakeholders.
This covers emergency situations such as someone becoming seriously ill while at work.
Why we process your personal data
Subject to applicable law, your personal data may be stored and processed by us for purposes detailed in the following table:
Purpose for our processing your personal data
Category of personal data
The legal basis we rely on
To administer remuneration (including deductions for tax), benefits, pensions and incentive schemes.
To maintain accurate and up-to-date employment records and contact details (including details of who to contact in the event of an emergency), and records of employee contractual and statutory rights.
To operate and keep a record of holidays and other leave entitlements (including maternity, paternity, adoption parental leave), to allow effective workforce management, to ensure that the organisation complies with duties in relation to leave entitlement, and to ensure that employees are receiving the pay or other benefits to which they are entitled.
To operate and keep a record of attendance, absence and absence management procedures, to allow effective workforce management and to ensure that employees are receiving pay or other benefits to which they are entitled.
To operate and keep a record of employee performance and related processes, to plan for career development, and for succession planning and workforce management purposes.
To manage the security of our property
To plan for business contingency and emergency incidents.
Providing information to third parties in connection with our services to customers.
To obtain legal advice and conduct of legal proceedings.
To provide references on request for current or former employees.
Measuring the performance of our IT systems, includes analysing times, locations and activities whilst users are logged into the network.
To determine fitness for work.
To facilitate a return to workplace/work premises.
To make adjustments or accommodations to duties or the workplace.
In the event of an emergency, it will be necessary for us to contact your emergency contact, next of kin or other contact
-
Identity Data
-
Financial Data
-
HR Data
-
Identity Data
-
Contact Data
-
HR Data
-
Leave & Absence Management Data
-
Identity Data
-
Leave & Absence Management Data
-
Identity Data
-
Leave & Absence Management Data
-
Identity Data
-
Employment Data
-
Access Data
-
Employment Data
-
Leave & Absence Management Data
-
Security Data
-
Identity Data
-
Contact Data
-
Employment Data
-
Security Data
-
Identity Data
-
Contact Data
-
Employment Data
-
Leave & Absence Management Data
-
Financial Data
-
Security Data
-
Special Categories of Data
-
Identity Data
-
Contact Data
-
Employment Data
-
Security Data
-
Medical Data
-
Medical Data
-
Public Health Data
-
Medical Data
-
Public Health Data
-
Identity Data
-
Contact Data
-
Legal Obligation
-
Legitimate Interests (namely HR and business administration).
-
Legal Obligation
-
Legitimate Interests (namely HR and business administration).
-
Contract
-
Legal Obligation
-
Legitimate Interests (namely HR and business administration).
-
Legal Obligation
-
Legitimate Interests (namely HR and business administration).
-
Contract
-
Legal Obligation
-
Legitimate Interests (namely HR administration, business administration and corporate governance).
-
Legitimate Interests (namely to keep our staff and property safe and secure)
-
Legitimate Interests (namely business administration and corporate governance).
-
Legitimate Interests (namely business administration and corporate governance)
-
Legal Obligation
-
Legitimate Interests (namely business administration and corporate governance)
-
Legal Claims
-
Legitimate Interests (namely HR administration)
-
Legitimate Interests (namely business administration and corporate governance)
-
Legal Obligation
-
Legal Obligation
-
Legal Obligation
-
Vital Interests
If you fail to provide personal data
If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as paying you or providing a benefit to you), or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of our individuals undertaking a role within the credit union). If there are any changes to your personal data (e.g. a new address), you should let us know as soon as possible.
Change of purpose
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. This will only be done in accordance with our policies. Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
Disclosure of your personal data
We may have to share your personal data with various parties, including those detailed in Section 7.2 of this Privacy Notice. We require these parties to keep your personal data confidential and secure and to protect it in accordance with the law. They are only permitted to process your personal data for the lawful purpose for which it has been shared and in accordance with our instructions.
Third parties
-
We will disclose your personal data with other entities associated with us for our legitimate interests in managing our business and where we are under a legal obligation to do so.
-
We may share your personal data with professional advisors and other third parties that supply services or products to us. For example, the following activities are carried out by professional advisors and third-party service providers, which may involve their processing of your personal data in respect of the service they provide: pension administration and consultancy; benefits provision and administration; health insurance; cloud hosting services; legal and accounting services.
-
We may need to share your personal data with a public authority, regulator or to otherwise comply with the law. This may include making returns to The Revenue Commissioners.
-
We may have to share your data with third parties in the context of the possible sale or restructuring of the business.
Transfers of your personal data
In connection with our business and for employment, administrative, management and legal purposes, we may transfer your personal data outside the European Economic Area. Where we transfer your personal data, we ensure that the transfer is in accordance with Data Protection Laws and that there are appropriate security arrangements in place for the transferring data.
Security of your personal data
The Company is committed to maintaining the security of your personal data it processes. We maintain appropriate physical, procedural, organizational and technical security measures intended to prevent loss, misuse, unauthorised access, disclosure, or modification of your personal data under our control. If you have reason to believe that your personal data is no longer secure, please notify us immediately using the contact information supplied in Section 13 (Queries and Complaints).
Retention of your personal data
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, tax or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
Your data protection rights
You have various rights under Data Protection Laws, subject to certain exemptions, in connection with our processing of your personal data, including those set out in the table below.
Data Protection Right
Explanation of Data Protection Right
Access and Information
Rectification of your personal data
Erasure of your personal data
Object to processing
Request restriction of processing of your personal data
Data Portability
Not be subject to solely automated decision.
The right to complain to the Data Protection Commission
You are entitled to receive, on request and free of charge, a copy of all your personal data that we hold together with other information about the processing of that personal data. There are some limitations to this right. For example, if the personal data also relates to another person and we do not have that person’s consent, or if the personal data is subject to legal privilege. Where there is data that we cannot disclose, we will explain this to you.
You may request to have inaccurate or incomplete information corrected and updated by us.
This right enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing. However, where we hold and process your personal data in order to comply with legal obligations, such as compliance with tax, or for the establishment exercise or defence of legal claims, your right to ask us to delete or remove your personal data is limited.
You may object to our processing of your personal data where we are relying on a legitimate interest (or those of a third party) in order to justify the basis for our processing your personal data and there is something about your particular situation which makes you wish to object to processing on this ground.
This right enables you to ask us to suspend the processing of your personal data (e.g. if you want us to establish its accuracy or the reason for processing it).
Where we process your personal data by automated means (i.e. not on paper) and this processing is based on your consent or required for the performance of a contract between us, you are entitled, where technically feasible to request that we transmit your personal data in this format to another controller.
You have the right to be informed if your personal data will be subject to automated decision making, including profiling, where that decision impacts on your legal rights. Profiling is an automated form of processing of personal data often used to analyse or predict personal aspects about an individual person. We do not engage in profiling when processing your personal data.
You have the right to make a complaint in respect of our compliance with Data Protection Laws to the Data Protection Commission, the supervisory authority in Ireland.
Updating your personal data
You are responsible for notifying us of any changes to your personal data during your working relationship with us.
Queries and complaints
If you have any questions or wish to exercise any of your data protection rights, you should raise these with our data protection team by emailing denis.carroll@verenagroup.com. You may also raise complaints with the Data Protection Commission. For contact and other details see: www.dataprotection.ie.