GDPR & Your Data Rights
A plain-English summary of your rights under the General Data Protection Regulation and the Irish Data Protection Acts, and how 2Flow meets its obligations as a data controller and as a data processor for our clients.
Our GDPR Commitment
2Flow (a trading name of Cyclone Corporate Services Group Limited) takes data protection seriously. We comply with the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Acts in how we collect, process, store and protect personal data.
This page is a summary. For the full detail of how we handle personal data, please read our Privacy Policy.
Your Rights Under GDPR
If we process your personal data, you have the following rights. You can exercise any of these by contacting our Data Protection Officer using the details at the bottom of this page.
Right to be informed
You have the right to know what personal data we collect, why, how long we keep it, and who we share it with.
Right of access
You can request a copy of the personal data we hold about you, free of charge, within 30 days.
Right to rectification
If the data we hold is inaccurate or incomplete, you can ask us to correct or complete it.
Right to erasure
Also known as the right to be forgotten. You can ask us to delete your personal data in most circumstances.
Right to restrict processing
You can ask us to limit how we use your data while we verify accuracy or handle an objection.
Right to data portability
You can ask us to send your data to you, or to another service provider, in a structured machine-readable format.
Right to object
You can object to our processing of your personal data, including for direct marketing, at any time.
Rights around automated decisions
You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.
How to Exercise Your Rights
To exercise any of the rights above, please write to our Data Protection Officer at the address below. Please include:
- Your full name and contact details
- A description of the right you wish to exercise
- Sufficient information for us to identify you and verify your request
We will respond within 30 days. In complex cases we may extend this by up to a further 60 days, and we will let you know within 10 days of your request if that is the case.
Please note: for security reasons, we do not accept Right of Access requests by telephone, email or text message. Written requests can be posted or submitted via our contact process with a signed letter.
Our Role as a Data Processor
When our clients engage us to handle fulfilment, warehousing, delivery or related services, we act as a Data Processor on their behalf. The client is the Data Controller and decides the purposes and means of processing. In that capacity, we:
- Only process personal data on the client's documented instructions and in line with the signed services agreement.
- Adopt appropriate technical and organisational measures to protect personal data against unauthorised access, loss or destruction.
- Notify the client promptly of any personal data breach affecting data we process on their behalf.
- Ensure all 2Flow personnel who handle personal data are bound by confidentiality obligations and appropriately trained.
- Support the client in meeting their own GDPR obligations, including responding to data subject requests and carrying out Data Protection Impact Assessments.
- Observe all obligations around sub-processing and international data transfers.
- Delete or return all personal data on termination of services, unless legally required to retain it.
International Data Transfers
Where personal data is transferred outside the European Economic Area, we put in place appropriate safeguards (such as Standard Contractual Clauses) to ensure your data receives a level of protection equivalent to that provided within the EEA.
Data Breaches
We have processes in place to detect, investigate and report personal data breaches. Where a breach is likely to result in a risk to your rights and freedoms, we will notify the Irish Data Protection Commission within 72 hours and, where required, notify affected individuals without undue delay.
Lodging a Complaint
If you are not satisfied with how we have handled your personal data or a request to exercise your rights, you have the right to lodge a complaint with the Irish Data Protection Commission.
Data Protection Commission website: www.dataprotection.ie
Email: info@dataprotection.ie
Contact Our Data Protection Officer
Data Protection Officer
Cyclone Corporate Services Group Limited (trading as 2Flow)
Pleasant's House
Pleasant's Street
Dublin 8, D08F54N
Ireland
Email: Eve.Martin@2flow.ie
Phone: 1800 532 532