Employee and HR Data Privacy Notice

Last Updated: 10/07/2026

1. Introduction

JFC Manufacturing Co Limited (“the Company”, “we”, “our” or “us”) is committed to protecting the privacy and security of personal information relating to our employees, former employees, job applicants, contractors, temporary workers and other individuals whose personal information is processed by our Human Resources (HR) function.

This Privacy Notice explains how we collect, use, store and protect personal information throughout the employment lifecycle, including recruitment, employment, career development, absence management, and the end of the employment relationship.

We process personal information in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Data Protection Act 2018 and other applicable data protection legislation.

2. Data Controller

The organisation responsible for processing your personal information is:

JFC Manufacturing Co Limited
Weir Road, Tuam, Co. Galway, H54 RX46, Ireland

Email: hr@jfcgroup.ie
Telephone: +353 93 24066

If you have any questions about this Privacy Notice or how we process your personal information, please contact the HR Department.

3. Personal Information We Collect

The personal information we process depends on your relationship with the Company.

Job Applicants

During recruitment, we may collect:

• Name and contact details
• CV and cover letter
• Employment history
• Qualifications and certifications
• References
• Interview notes
• Right-to-work information
• Salary expectations
• Recruitment correspondence

Employees

During employment, we may collect and process:

Personal and Employment Details

• Name and contact details
• Date of birth
• Employee number
• Role and department
• Employment contract and amendments
• Working hours and employment status
• Work location
• Salary and benefits information

Payroll and Statutory Information

• Bank account details
• Tax information
• Social insurance information
• Pension information
• Benefits information

Workplace Management Information

• Attendance records
• Annual leave records
• Training records
• Qualifications and certifications
• Performance objectives and reviews
• Company equipment records
• IT user account information
• Access control information where applicable

Employee Relations Information

• Disciplinary records
• Grievance records
• Investigation records
• Workplace incident records
• Correspondence relating to employment matters

Special Category Data

Where necessary and permitted by law, we may process limited special category personal information, including:

• Health information relating to absence management
• Occupational health assessments
• Workplace accommodations
• Information required to meet health and safety obligations

Such information is processed only where an appropriate legal basis exists and additional safeguards are applied.

4. How We Use Personal Information

We process personal information for the following purposes:

Recruitment

• Assessing suitability for employment
• Managing recruitment processes
• Communicating with applicants
• Completing pre-employment checks

Employment Administration

• Managing employment contracts
• Paying salaries and benefits
• Managing attendance and annual leave
• Administering pensions and benefits
• Maintaining employee records

Employee Development

• Managing training
• Recording qualifications
• Supporting career development
• Conducting performance reviews

Workplace Management

• Maintaining health and safety
• Managing company equipment and systems
• Protecting company assets
• Managing employee relations

Legal and Regulatory Requirements

• Meeting obligations to Revenue and other statutory authorities
• Maintaining employment records
• Responding to legal requests
• Defending legal claims where necessary

5. Legal Basis for Processing

Depending on the circumstances, we process personal information under one or more of the following lawful bases:

• Processing necessary for entering into or performing an employment contract
• Processing necessary to comply with legal obligations
• Processing necessary for our legitimate business interests
• Processing necessary for employment law obligations
• Consent, where consent is specifically required

Where we rely on consent, you may withdraw that consent at any time.

6. Sharing Personal Information

We may share personal information where necessary with:

• HR personnel
• Managers with a legitimate business need
• Payroll providers
• Pension providers
• Insurance providers
• Occupational health providers
• IT and systems providers
• Recruitment service providers
• Professional advisers
• Government departments and regulatory authorities where required by law

We only share information where necessary and require service providers to protect personal information appropriately.

We do not sell personal information.

7. How HR Records Are Stored

HR records are maintained in both electronic and paper formats.

Electronic Records

Electronic HR records are stored within secure systems protected by appropriate technical measures, which may include:

• User authentication
• Role-based access controls
• Password protection
• Secure backups
• Encryption where appropriate
• System monitoring and security controls

Access is restricted to authorised personnel who require access for legitimate business purposes.

Paper Records

Where paper HR records are required, they are:

• Stored in secure filing systems
• Kept in restricted-access areas
• Accessible only by authorised personnel
• Protected against loss, damage or unauthorised access

Sensitive documents are not left unattended or accessible to unauthorised individuals.

8. Access to HR Records

Access to employee information is limited to those who require it as part of their role.

This may include:

• HR personnel
• Relevant managers
• Payroll and finance personnel
• Senior management where appropriate
• External advisers where necessary

Access permissions are reviewed periodically to ensure information remains appropriately protected.

9. International Transfers

We primarily store and process personal information within the European Economic Area (EEA).

Some information may be transferred to the United Kingdom where required for business continuity, operational purposes or the provision of services. The United Kingdom is currently (as at 15 July 2026) recognised as providing an adequate level of protection for personal data under applicable European data protection legislation.

Where personal information is transferred outside countries recognised as providing adequate protection, we will ensure appropriate safeguards are implemented, such as Standard Contractual Clauses or other lawful transfer mechanisms.

10. Retention of HR Records

We retain personal information only for as long as necessary for the purposes for which it was collected and to meet legal and regulatory requirements.

Typical retention periods include:

Record Type	Retention Period
Unsuccessful job applications	Twelve months after recruitment process concludes. This ensures we can address any potential discrimination claims under the Employment Equality Acts, which typically carry a six to twelve-month limit for filing disputes with the Workplace Relations Commission (WRC)
Personnel files	Duration of employment plus seven years
Payroll records	Duration of employment plus six years post-termination (Revenue Commissioners audit compliance)
Training and qualification records	Mandatory safety, certification, and training records are kept for the duration of your employment plus 6 years following termination. This maintains audit readiness for regulatory bodies and verifies professional competence in the event of contractual or operational disputes
Performance records	Annual performance reviews and performance management files are retained for the length of your employment plus 6 years post-termination. This aligns with the Statute of Limitations for breach of contract claims, protecting both parties should a dispute arise
Disciplinary and grievance records	Formal outcome records of internal investigations, grievance proceedings, and disciplinary actions are retained for the duration of employment plus six years. This ensures the company holds the necessary information to defend against post-employment legal claims or constructive dismissal actions
Health and safety records	Workplace accident reports and dangerous occurrence logs are retained for ten years after the incident occurs. This fulfills our legal obligation under the Safety, Health and Welfare at Work Regulations and allows us to provide accurate documentation for personal injury claims, which must be reported to the Health and Safety Authority (HSA)

Retention periods may be extended where required for legal claims, regulatory requirements or legitimate business purposes.

11. Secure Disposal of Information

When personal information is no longer required, it is securely deleted or destroyed.

Electronic Records

Electronic records are:

• Deleted from active systems following approved retention periods
• Removed from accessible storage locations
• Managed in accordance with backup retention processes

Paper Records

Paper records are:

• Confidentially shredded; or
• Destroyed through an approved secure disposal provider

Disposal methods are designed to prevent unauthorised access or reconstruction.

12. Employee Monitoring

Where necessary, the Company may operate monitoring systems for legitimate business purposes, including:

• Security of company systems
• Protection of company assets
• Health and safety
• Compliance requirements

Any monitoring is conducted proportionately, transparently and in accordance with applicable legislation.

13. Ending Employment

When employment ends, certain personal information may continue to be processed where necessary for:

• Meeting legal obligations
• Managing payroll and benefits
• Providing employment documentation
• Responding to legal claims
• Maintaining required records

Information will continue to be protected and retained only for as long as necessary.

14. Your Data Protection Rights

Depending on the circumstances, you have rights including:

• The right to access your personal information
• The right to correct inaccurate information
• The right to request deletion where applicable
• The right to restrict processing
• The right to object to certain processing
• The right to receive your personal data in a portable format where applicable
• The right to withdraw consent where consent is used as the lawful basis

To exercise these rights, contact the HR Department.

You also have the right to lodge a complaint with the Data Protection Commission in Ireland, at https://www.dataprotection.ie/en/faqs/initial-contact-dpc/making-complaint-dpc, or with the Information Commissioner’s Office in the UK, at https://ico.org.uk/make-a-complaint/, if you believe your information has been processed unlawfully.

15. Data Security

We maintain appropriate technical and organisational measures to protect HR information from:

• Unauthorised access
• Accidental loss
• Misuse
• Alteration
• Unauthorised disclosure

These measures include secure systems, restricted access, staff awareness and appropriate physical security controls.

16. Contact Details

For questions regarding this Privacy Notice or the processing of HR information, please contact:

JFC Manufacturing Co Limited
Human Resources Department
Weir Road, Tuam, Co. Galway, H54 RX46

Email: hr@jfcgroup.ie

Telephone: +353 93 24066