Privacy Policy

 

1. Who we are

We are the Royal College of Surgeons in Ireland of 123 St Stephen’s Green Dublin D02 YN77. You can contact us at this address by post or by email at info@rcsi.ie.

RCSI is the data controller for personal data processed through the My CPD E-Portfolio.

Our data protection officer may be contacted by email at dataprotection@rcsi.ie.

 

2. Why we process your data, the lawful basis for processing your data and with whom we share it

A) For student education and welfare, we process data:

• To enable users to access and use the My CPD E-Portfolio.
• To allow users to maintain an accurate and structured record of their professional development.
• To support RCSI in delivering a secure, reliable, and effective educational service.

The legal basis for this processing is our legitimate interest in the administration and operation of the My CPD E-Portfolio as an educational service for nurses and midwives. Processing this information is necessary to enable users to access the platform, record and review their continuous professional development, compile evidence of learning activities, and track progress over time.

The processing is limited to information that is relevant and proportionate to these purposes and is carried out in a way that respects users’ rights and expectations. Appropriate safeguards are in place to minimise any potential impact on individuals.

B) For dealing with queries, complaints or claims, we process data:

• To enable timely and appropriate responses to requests or concerns.
• To support RCSI in meeting its responsibilities to users and maintaining trust in the service.

The legal basis for this processing is our legitimate interest in the administration and operation of the My CPD E-Portfolio. Processing this information is necessary to investigate issues, communicate effectively with users, resolve concerns, and maintain the quality, integrity, and security of the service.

The information used is limited to what is necessary for these purposes and is handled in a fair and proportionate manner.

C) For fellowship and membership applications, we process data:

• To enable users to apply for professional fellowship and membership.
• To facilitate the efficient assessment of applications for fellowship and membership.
• To provide a structured and secure way for users to present their professional development.
• To support RCSI and the Faculty of Nursing and Midwifery in maintaining professional standards.

The legal basis for this processing is the performance of a contract with you, and our legitimate interest in supporting the assessment and administration of applications for professional fellowship and membership. Processing this information is necessary to enable applicants to submit relevant CPD evidence, qualifications, and supporting documentation and to allow applications to be reviewed in a fair, consistent, and transparent manner.

The processing is limited to information that applicants choose to submit for these purposes and is carried out with appropriate safeguards to protect individuals’ rights and interests.

Special category personal data

In the course of using the My CPD E-Portfolio, users may choose to provide information that is considered special category personal data under Article 9 of the General Data Protection Regulation (GDPR). This may include, for example, health-related reflections, wellbeing or equality information, or other sensitive material submitted as part of continuous professional development records or applications for fellowship or membership.

The legal basis for processing special category personal data is the explicit consent of the data subject, provided when the information is submitted, and, where applicable, the substantial public interest in professional education, regulation, and the maintenance of standards in nursing and midwifery.

RCSI processes such information only where it is voluntarily provided by the user and where it is necessary for the purposes of maintaining an accurate professional portfolio or assessing applications for professional fellowship or membership.

Appropriate technical and organisational safeguards are in place to protect this information and ensure it is processed fairly, securely, and in accordance with data protection law.

Combining other information with personal data

In some instances, we may combine other information with personal data, such as deriving geographical location from your IP address and combine website browsing data about your usage of RCSI services with your name. If we combine other information with personal data, we will treat the combined information as personal data.

Data Processors

RCSI uses trusted service providers to operate and support the My CPD E-Portfolio, including IT service providers and email communication services, who process personal data on our behalf under contractual data protection obligations.

Axia Digital Ltd.

This data processor does the following activities for us: software development, hosting, maintenance, and technical support services for the My CPD E-Portfolio.

Mailgun

This data processor does the following activities for us: supporting the delivery of system notifications and service-related communications to users.

Others we share personal information with:

• External auditors or inspectors
• Organisations we’re legally obliged to share personal information with

 

3. Transfers of data outside the European Economic Area

In certain circumstances, personal data may be accessed or processed by trusted service providers located outside the European Economic Area (EEA), for example:

• Service providers based in the United Kingdom providing hosting, software development, or technical support services
• Email and communications service providers that are part of global organisations with infrastructure or operational support located outside the EEA, including in the United States.

Where personal data is transferred outside the EEA, RCSI ensures that appropriate safeguards are in place in accordance with the General Data Protection Regulation (GDPR). These safeguards include the use of European Commission approved Standard Contractual Clauses, and where applicable, reliance on adequacy decisions recognised by the European Commission. These measures are designed to ensure that personal data continues to be protected to a standard equivalent to that required under EU data protection law.

 

4. Your rights relating to personal data

You have the following rights under the General Data Protection Regulation (GDPR), in certain circumstances and subject to certain exemptions, in relation to your personal data:

• Right to access the data – you have the right to request a copy of the personal data that we hold about you, together with other information about our processing of that personal data.
• Right to rectification – you have the right to request that any inaccurate data that is held about you is corrected, or if we have incomplete information you may request that we update the information such that it is complete.
• Right to erasure – you have the right to request us to delete personal data that we hold about you. This is sometimes referred to as the right to be forgotten.
• Right to restriction of processing or to object to processing – you have the right to request that we no longer process your personal data for particular purposes, or to object to our processing of your personal data for particular purposes.
• Right to data portability – you have the right to request us to provide you, or a third party, with a copy of your personal data in a structured, commonly used machine-readable format.

In order to exercise any of the rights set out above, please contact us at dataprotection@rcsi.ie.

If we are processing personal data based on your consent, you may withdraw that consent at any time. This does not affect the lawfulness of processing which took place prior to its withdrawal.

Articles 13 and 14 of the GDPR requires information to be provided, or made readily available, to data subjects so that they are informed in a transparent manner as to the purposes for which their data is to be processed. You can learn more about this on the Higher Education Authority website.

If you are unhappy with how we process personal data, we ask you to contact us so that we can rectify the situation.

You may lodge a complaint with a supervisory authority. The Irish supervisory authority is the Data Protection Commission (DPC).

 

5. Requirement to process personal data

You may view public information relating to the My CPD E-Portfolio without providing personal data. However, certain personal information is required to create an account and use the E-Portfolio. If this information is not provided, we will be unable to provide access to the platform or support applications for fellowship or membership awards. The provision of special category personal data is voluntary and at the discretion of the user.

 

6. Use of cookies and similar technologies

We use cookies and similar technologies to support the functionality, security, and performance of the My CPD E-Portfolio.

Strictly necessary cookies are used to enable core functionality of the platform, such as secure login, session management, and access to user accounts. These cookies are essential for the operation of the My CPD E-Portfolio and cannot be disabled.

Non-essential cookies, such as analytics cookies, are used to help us understand how the platform is used and to improve the user experience. These cookies are only set where you have provided your consent.

 

Information collected

We value your privacy and are committed to protecting your personal information. In line with our commitment to transparency, below you will find information on how we collect and use information on our users, while maintaining the security and privacy of your data.

1. Technical and usage information

RCSI collects information about all visitors to the My CPD E-Portfolio for the purpose of producing statistical reports of online traffic to identify how we can improve the website. Every data file contains the following information.

• The referring website from which you came when visiting us
• The IP address
• Time and date of website access
• User agent (browser)
• HTTP code (secure channel or standard channel)
• Bytes served
• Information on browser and operating system that you used at the time of accessing the site

Information on internet traffic is collected routinely by RCSI and by its service providers (e.g. Axia Digital). This information is used to ensure the smooth operation of the My CPD E-Portfolio.

2. Account and professional information

RCSI collects the following types of personal data when you use the My CPD E-Portfolio:

• User account information: Such as your email address, which is required when you create an account.
• Other identifiable information: Such as your name, address, or other details you choose to provide.
• Information related to your education, qualifications, and professional experience: Which you may provide voluntarily or as part of an application for fellowship or membership.

How is your information used?

Your information is collected securely and used to operate and administer the My CPD E-Portfolio. This includes enabling you to create and manage an account, record and review continuous professional development activities, and submit applications for fellowship or membership awards. Your information may also be used to respond to enquiries, manage applications, and maintain the quality, security, and integrity of the platform. Information is only shared with trusted service providers where necessary to support these purposes.

Data security and retention

RCSI only retains your data for as long as necessary to fulfil the purposes outlined in this policy or as required by law. Adequate organisational and technical security measures, which are reviewed on a regular basis, are taken to ensure the security of your personal information.

 

Data ethics

RCSI is committed to the core principle of data ethics namely that personal data is "... generated, reported, stored and used in a trustworthy way" (Ethical Use of Customer Data in a Digital Economy – UK Finance March 2019).

In addition to its statutory responsibilities, annual data protection training is a mandatory requirement among RCSI staff.  RCSI also has a Research Ethics Committee where proposed research studies, which involve the use of sensitive personal data (medical, genetic, gender etc.), must be evaluated in advance to ensure that their intended use is one that can withstand rigorous ethical scrutiny.

RCSI also has a Quality Enhancement Office which regularly conducts staff surveys and performs evaluations using a multiplicity of data. This office adheres to the highest standards of probity and confidentiality in the discharge of its duties.

Going beyond the requirements of GDPR, RCSI is confident that it meets our aspiration to handle personal data in an ethical manner consistent with its mission "to educate, nurture and discover for the benefit of human health".

 

Changes to this privacy policy

RCSI may update this privacy policy from time to time to reflect changes in our practices or relevant regulations. We encourage you to review this policy periodically for any updates.

 

Queries

Any queries or concerns you may have about the processing of personal information on this website should be addressed to:

Dónall King

Data Protection Officer

Royal College of Surgeons in Ireland

123 St Stephen’s Green

Dublin

D02 YN77

Email: dataprotection@rcsi.ie