MyCoCo Data Privacy Statement

What is MyCoCo?

MyCoCo is a build to share digital solution that enables Local Authorities to provide online services to the public. MyCoCo has been recognised by the Department of Public Expenditure, NDP Delivery and Reform as a building block of reform in Better Public Services – A transformation strategy to deliver for the public and to build trust and is a key enabler for Local Authorities to deliver on the Connecting Government 2030 ambitions. The MyCoCo solution is compliant with Data protection, Information Security, and accessibility.

Ascendas Business Solutions (Ascendas) is the (Data Processor and the software service provider) who has developed the MyCoCo platform for use of Local Authorities and other government agencies. Ascendas also maintains and provide software and technical support for MyCoCo to the Local Authorities and the Government Agencies using this platform.

What is personal data?

Personal data is any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person and includes Special Categories of Personal Data.

Special Categories of Personal Data is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.

Why is Personal Data collected?

The personal data is collected for the purposes of performing the functions of the individual Local Authority and providing a better customer service to you.

What personal data do we collect from you?

MyCoCo platform sets out the information it requires from you in a number of separate Data Protection privacy statements. Please refer to the privacy statements of the Local Authorities and Government Agencies for the list of MyCoCo services they use, personal data collected, lawful basis, purpose of processing, categories of personal data, who it is shared with and the retention period information.

The personal data is collected to process your application/request for service/request for information in relation to any of the services provided by MyCoCo.

Ascendas does not use your data in anyway or any purpose except as described in this document. We only deliver the information provided by customers to relevant government agency. Ascendas is a data-processor whereas local-authorities that you interact with using this platform are the data-controllers.

How do we collect your personal data on MyCoCo?

Local Authorities and the government agencies use the MyCoCo platform to provide services to their customers.

In this Privacy Statement we explain what personal data Ascendas collects from visitors to MyCoCo websites and users of MyCoCo Services. We also explain how we use such personal data and how the owners of that data can exercise their available data privacy rights.

Data Categories and Collection Purposes

When you visit MyCoCo, we collect only the information which is necessary to achieve the purpose(s) for which it was collected. We do not use your personal data for additional purpose(s) which are incompatible with their initial collection.

Customer Account and Registration Data:

This is the data you provide us when you create your MyCoCo account, request support or technical assistance. This typically includes, but is not necessarily limited to, first and last name and a valid email address. This data is needed to make MyCoCo platform available to you and to maintain and support your account.

Transactional Emails: We use the email address to send you transaction notification emails from MyCoCo. The emails include but are not limited to emails regarding your online orders and requests on MyCoCo, messages from Local Authorities and other Government Agencies, new Documents, Invoice, Statement notifications. You will also receive emails and notifications about your MyCoCo user account security, password, and profile updates.

You cannot opt-out of transactional emails and notifications.

Promotional Emails: Your email address may also be used to inform you of future enhancements to MyCoCo services and other promotion emails from Local Authorities and Government Agencies. If you want to opt-out of promotional emails, please click on the link in the email. Alternatively, you can also contact MyCoCo DPO.

Information provided by you in this data category is available to the Local Authorities and the Government Agencies.

The legal basis for processing this data is to comply with applicable legal obligations, perform our contractual obligations under the applicable Services agreements with Local Authorities and Government Agencies using MyCoCo, and for our legitimate interest to do business with you or your business.

The user account data is retained as long as your MyCoCo user account is active. Should you wish to delete your MyCoCo account, please contact the data protection officer with request to delete your account. You may be required to verify your identity before your account is deleted.

User Activity and Access Log

This section outlines our practices regarding the collection and use of access logs when you interact with MyCoCo. Access logs are records of the actions and interactions that occur when you access MyCoCo digital platforms.

We utilize this information to provide, operate, support the use of, and improve MyCoCo. We also use this data for the purpose of providing, operating, and supporting the service and for fraud prevention and security monitoring.

These logs may contain information such as your IP address, browser type, operating system, timestamps, session data and the pages you visit on MyCoCo. MyCoCo also records your usage and activity data on MyCoCo. MyCoCo may also collect information such as browser type & version, hardware, equipment & devices used to access MyCoCo, language settings, operating system used, unique device identifiers and other diagnostic, troubleshooting, crash, and bug reporting data.

The usage data, activity and access logs may contain your personally identifiable data.

Information collection in this data category may be shares with the Local Authorities and the Government Agencies.

Please read this section carefully to understand access logs data collection.

Purpose of Access Logs Collection

The collection of access logs is essential for maintaining the security and performance of our digital platforms. These logs help us monitor and analyse various aspects of user interactions to:

– Ensure the proper functioning of our services and identify and fix any technical issues.

– Detect and prevent unauthorized access, fraudulent activities, and security breaches.

– Improve the overall user experience and optimize our website and applications.

Types of Information Collected

When you access our digital platforms, we may collect the following types of information through access logs:

IP Address: Your IP address is a unique identifier assigned to your device by your internet service provider, which helps us understand the geographical location and device type you are using to access our services.

Browser Type and Version, Timestamps: We may collect information about the web browser you are using, including its version, to optimize the user experience and ensure compatibility with different browsers.

Operating System: We may record the type of operating system you use to access our services, which aids us in identifying technical issues specific to certain operating systems.

Timestamps: Access logs include timestamps of your interactions, helping us analyse user behaviour, track trends, and troubleshoot issues related to time-sensitive actions.

Referral URL: We may log the website or source that referred you to our platform, which helps us understand the effectiveness of our marketing efforts.

Pages Visited: Access logs may record the specific pages you visit on our website or within our applications, enabling us to improve content and navigation.

Devices, Hardware and other information: MyCoCo may collect information such as hardware, equipment & devices used to access MyCoCo, language settings, unique device identifiers and other diagnostic, troubleshooting, crash, and bug reporting data.

Data Retention

We will retain access logs for a limited period as required for the purposes mentioned in this Privacy Statement. The retention period may vary based on legal requirements and the legitimate business needs of Ascendas. After this period, we will securely delete or anonymize the logs.

We take the security of access logs seriously and implement appropriate technical and organizational measures to safeguard this information from unauthorized access, disclosure, or alteration. Our data protection measures follow applicable data protection laws and regulations.

Data Security

We take the security of access logs seriously and implement appropriate technical and organizational measures to safeguard this information from unauthorized access, disclosure, or alteration. Our data protection measures follow applicable data protection laws and regulations.

Legal Basis for Processing

Our collection and processing of access logs are based on our legitimate interests in maintaining the security and performance of our services. In some cases, we may process this data to comply with legal obligations or respond to lawful requests from public authorities.

Third-Party Sharing

We do not sell your access logs or share this information with third parties for their marketing purposes. However, we may share access logs with trusted third-party service providers who assist us in maintaining and improving our digital platforms. These service providers are contractually obligated to handle your data securely and in accordance with our privacy statement.

Changes to this Section

We may update this section of our data privacy statement to reflect changes in our data collection and processing practices. When we make substantial changes, we will notify you through appropriate means or obtain your consent as required by applicable laws.

By accessing our website, applications, or services, you acknowledge that you have read and understood the information provided in this section, and you agree to the collection and processing of your access logs as described herein. If you have any questions or concerns about our data privacy practices, please contact MyCoCo data protection officer.

Data that you provide while requesting a service on MyCoCo:

When you interact with a Local Authority or Government Agency on MyCoCo (to request a service, make a payment etc.) you provide certain information such as your name, address, billing details, documents, and any other information that the Local Authority or the Government Agency may require to provide you with the service you are requesting.

For this data category, Ascendas is a data-processor whereas the Local Authorities and the Government Agencies that you interact with using this platform are the data-controllers.

Information provided by you in this data category is available to the Local Authorities and the Government Agencies.

The Local Authorities and Government Agencies have their own data privacy statements based on their use of MyCoCo platform.

MyCoCo Payments Service:

When you sign-up for MyCoCo payments service using your Customer Id and PIN or add your customer Id and PIN in your MyCoCo account for a Local Authority Rates, Loans, Rents or any other Local Authority payment, your invoices, statements, transactions data and other customer account information is regularly uploaded to MyCoCo from Local Authority computer systems. By adding your Local Authority Payments customer Id to MyCoCo, you agree that your payments transaction data will be uploaded to MyCoCo.

This data is required to provide you with MyCoCo Payments application service, allow you to view your transactions, payment history, download payments history and other payments related activity.

Payments Account Transactions are available to the Local Authorities and the Government Agencies.

The Local Authorities and Government Agencies have their own data privacy statements based on their use of MyCoCo platform.

Sub-Processors
We engage third-party providers as Sub-Processors to Process Personal Data on your behalf in following ways:

1. We engage Sub-Processors to assist us with hosting and infrastructure.
   2. We engage with Sub-Processors to support product features and integrations.
   3. We also engage Sub-Processors for service and support.

These Sub-Processors will apply to you as default. When we appoint a new sub-processor, we will give notify you via a notice on www.mycoco.ie.

We have currently appointed, as Sub-Processor, the third parties listed below:

Amazon Web Services, Inc (AWS)

Global Payments

Data Privacy Statement Regarding the Use of Google Maps

MyCoCo integrates functionality from Google Maps to enhance user experience and provide location-based services. By using this feature, you acknowledge and agree that Google’s Privacy Policy, governs your use of Google Maps within MyCoCo.

Google may collect, process, and store such data as per their own privacy practices. We encourage users to review both Google’s Privacy Policy and the Google Maps Terms of Service, to fully understand how their data is used and protected.

Your use of the Google Maps feature within MyCoCo constitutes your acceptance of these terms and the potential sharing of location information with Google.

Googles Privacy Policy: https://policies.google.com/privacy

Google Maps Terms of Service: https://www.google.com/intl/en_IE/help/terms_maps

Data Privacy Statement for External Links

MyCoCo contains links to third-party websites that operate independently and are not under our control. These external websites may have data practices and policies that differ from ours. We do not endorse, oversee, or warrant the accuracy of the privacy practices of such external websites.

When you follow a link to an external website, we strongly recommend you review their privacy policy and terms of service to understand how your personal information may be used by them.

The lawful basis for the processing of your personal data is:

The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Local Authority (The Controller) by virtue of their statutory functions set out under the Local Government Acts and various other statutory provisions.

The lawful basis for the processing of your Special Category personal data is:

Subject to suitable and specific measures having been taken to safeguard your fundamental rights and freedoms, the processing is necessary for the performance of a function conferred on the Local Authority (The Controller) under the Local Government Acts (as amended) and various other enactments, in accordance with Section 45 and 49 of the Data Protection Act 2018 and Article 9 GDPR.

The lawful basis specific to each of the Local Authority Services provided by MyCoCo is set out in the privacy statement of the relevant Local Authority or Government Agency.

Who do we share your personal data with?

The Personal Data may be shared with selected third parties, including for example Department of Housing, Local Government and Heritage, and other government agencies, where required to do so by law.

The personal data may also be shared with other Local Authorities, Government Agencies suppliers and other third parties who assist the Local Authority and Government Agencies (The Controller) in fulfilling their functions. Further information regarding the sharing of your personal data can be found on the relevant Local Authority websites.

What information about you do we obtain from third parties?

MyCoCo does not obtain any information about you from third parties except in the scenario listed below:

Linking MyCoCo account with MyGovID: When you link your MyGovID account with your MyCoCo account, MyCoCo receives your personal information like your PPSN, Name, Date of Birth, Address, Email Address, Phone Number, MyGovID verification level and any other information MyGovID may have about you.

This information is stored in MyCoCo and may be used to validate your future MyCoCo logins using MyGovID.

This information will also be used to validate any services you avail of in MyCoCo that require PPSN, Date of Birth or other MyGovID information.

When you unlink your MyGovID account from MyCoCo, your PPSN and Date of Birth are deleted. Other information like name and address etc. may still be retained in MyCoCo.

Login to MyCoCo with MyGovID: When you login to MyCoCo with MyGovID, MyCoCo receives your personal information like your PPSN, Name, Date of Birth, Address, Email Address, Phone Number, MyGovID verification level and any other information MyGovID may have about you. Some of this information is used to verify you every time you login to MyCoCo using MyGovID.

Access to PPSN, date of birth and other MyGovID information: Local Authorities and Government Agencies using MyCoCo will have access to this information.

How long do we keep hold of your personal data?

MyCoCo will retain your information for no longer than is required or permitted. Refer to privacy statements of individual government agencies.

Do we transfer your information outside of the European Union or European Economic Area?

We do not transfer your information outside of the European Union or European Economic Area.

What are individual rights with respect to the processing of personal data?

Individuals have the following rights:

•  Access the personal data the local authority or the government agency holds about you.
•  Require the local authority or the government agency to rectify any inaccurate personal data about you without undue delay.
• Have the local authority or the government agency erase any personal data it holds about you. It should be noted that this is not an absolute right and is limited to certain specific circumstances such as, for example, where processing is unlawful, where it is no longer necessary for the local authority or the government agency to hold the personal data in order to provide you with their services or, in some cases if you have withdrawn your consent to the processing and there is no other legal ground for the processing of the data;
• Object to the local authority or the government agency processing personal data about you such as processing for profiling or direct marketing.
• Ask the local authority or the government agency to provide your personal data to you in a portable format, or where technically feasible, for the Local Authority to port that personal data to another provider provided it does not result in a disclosure of personal data relating to other people. This right only applies to data which you have provided to the Local Authority and where the processing is carried out by automated means.
• Request a restriction of the processing of your personal data.
• Where you have consented to the processing of your personal data, you have the right to withdraw that consent at any time but any processing that the local authority or the government agency have carried out before you withdrew your consent remains lawful.

Individuals may exercise any of the above rights by contacting the Data Protection Officer at dataprotectionofficer@monaghancoco.ie.

For any questions about your data related to a MyCoCo service, please contact the relevant Local Authority or Government Agency at the email address mentioned in their Privacy Policy.

You may lodge a complaint with the Data Protection Commission with respect to the processing of your personal data.

You can contact the office of the Data Protection Commission at:

  Lo Call Number 1800 437 737

  Website: www.dataprotection.ie

  Postal Address: Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28.

————————————————-End of Document————————————————-