September 2025
PRIVACY AND DATA PROTECTION NOTICE
This Privacy and Data Protection Notice (this Notice) is intended to ensure that you are aware of what personal data National Pen Promotional Products Limited (National Pen, we, us, our) with a registered address at Building D, Xerox Technology Park, Dundalk, Co. Louth holds in relation to you, and how we use that personal data as data controller.
Please read the following carefully to understand our use of your personal data.
Scope
This Notice applies to you, whether you are a current (or former) employee, partner, worker, applicant, intern, agency worker, consultant, individual contractor or director. It also applies to third parties whose information you provide to us in connection with our relationship with you (for example, in respect of emergency contact information). Please ensure that you provide a copy of this Notice to any third parties whose personal data you provide to us.
Where we refer to 'employee personal data' or 'employment' in this Notice, we do so for convenience only, and this should in no way be interpreted as conferring employment status on non-employees to whom this Notice also applies. This Notice does not form part of any contract of employment and does not confer any contractual right on you, or place any contractual obligation on us.
It applies to all personal data collected, maintained, transmitted, stored, retained, or otherwise used (i.e. processed) by us regardless of the media on which that personal data is stored. We may update this Notice at any time and will notify you in writing of any changes.
What is Personal Data?
'Personal Data' is defined as any data relating to a living individual who can be identified directly from that data or indirectly in conjunction with other information. We hold some or all of the following types of personal data in relation to you:
1. Identity and Contact Data: Contact/identifying details including name, address, date of birth, photo, civil status, emergency contact details, username, job title/position and passport.
2. Employment Data: Work contact details, identification number, primary work location, employment status, terms and conditions of employment, contract of employment, signed confidentiality agreement, immigration status, work permit/visa details, job description, details of current position, interview records and performance assessments (including probationary assessments), data relating to training and development needs or records of training, data relating to any accommodations or adjustments in connection with any incapacity and information as to your next job when you leave National Pen, securities trading statements including information relating to family members and other accounts under employees control, information about outside activities for employees and family members, information about gifts received/given for the employee and family members and information about potential conflicts with your family members that impact on your role or with National Pen in general.
3. Professional Data: Curriculum Vitae and/or application form, previous employment background, references from previous employers, educational details, professional and/or academic transcripts, professional certifications, special skills including (driver) licenses, language skills and memberships of committees or other bodies.
4. Financial Data: Salary and benefit details, bank details, PPS number, tax information, bonus, compensation type, long term incentives, pension scheme, PRSA, health insurance scheme (and any third-party beneficiaries), company credit card data, salary reviews and employee expenses.
5. Termination Data: Reasons for leaving, termination arrangements and payments, exit interview and reference.
6. Leave Data: Documentation which may be provided in connection with any statutory leave, sick leave, vacation days, and any other type of leave such as unpaid leave.
7. Disciplinary Data: General correspondence and minutes of meetings relating to grievance and/or disciplinary processes, investigations, misconduct or performance issues, data arising in connection with litigation and complaints and involvement in incident reporting and disclosures.
8. Performance Management: Performance assessments/meetings (including probationary assessments), colleague and manager feedback, appraisals, outputs from talent development programs and formal and informal performance management processes, data relating to training and development needs or training received.
9. Premises and IT Access Data: Records of email and internet usage in accordance with our email and internet policy, premises and IT access including system and login and access records, download and print records, call recordings, CCTV images captured through the legitimate use of CCTV within National Pen, IP addresses and URLs/websites visited by an employee.
10.Technical Data: Geolocation, internet protocol (IP) address, device identifier, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system.
Where appropriate, we may collect your personal data from external sources such as national crime/fraud prevention databases, social media and publicly available information.
Purpose and Basis for Processing
We will only use your personal data when the law allows us to. We have set out a description of all the ways we plan to process your personal data and which of the legal bases we rely on to do so in a table format below. We have also identified what our legitimate interests are where appropriate.
Performance of a Contract: We process your personal data where it is necessary in order to perform our obligations in performance of your contract of employment (or engagement).
Consent: In principle, we do not rely on your consent for data use. We may, however, from time to time, (i) ask for your consent to use your personal data for a specific purpose; and/or (ii) process your personal data (including special category data) in order to protect your vital interests or the interests of another. If we do so, we will provide you with full details of the data that we would like and the reason we need it. We will also inform you about the fact that you can revoke your consent at any time and how you should do that. You should be aware that withholding your consent will never have an impact on your employment with us or otherwise negatively affect you.
Legitimate Interests: We process your personal data where this is necessary for our legitimate interests as specified in the table below. Where we process personal data on the basis of our legitimate interests, we do so in a fair, transparent and accountable manner and take appropriate steps to prevent such activity having any unwarranted impact on you. We do not process your personal data where such legitimate interests are overridden by your interests, fundamental rights or freedoms. You have a right to object to processing of your personal data where we are relying on a legitimate interest (see further section 9). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.
Compliance with a Legal Obligation to Which We Are Subject: We process your personal data to discharge a relevant EU or EU member state legal or regulatory obligation to which we are subject, including in order to comply with obligations arising under specific legislation. We have included examples of the relevant laws in the table below.
We will hold, process and may disclose personal data provided by you for the following purposes:
| Purpose/Activity | Processing Operations | Personal Data | Lawful Basis | Recipients |
| Recruitment Recruitment/appointment including assessing your job application. Providing you with building access for interviews. |
Collection Recording Organising Storing Retrieving Consulting Using Restricting |
Identity Contact Employment Professional | Necessary for our legitimate interests of hiring employees who satisfy our professional requirements and are aligned with our company values. | Group entities Legal and medical practitioners Individuals or companies employed by National Pen to carry out specific services, functions or consultancy work Potential purchasers or bidders |
| Employment Contract Payroll and finance including paying salary, reimbursing expenses and other payments. Keeping attendance and working time records. Performance appraisals and management of performance. Benefit payments and administration. |
Collection Recording Organising Structuring Storing Retrieving Consulting Using Disclosing Aligning or combining Restricting |
Identity Contact Employment Financial Performance Leave Disciplinary |
This processing of your data is necessary for the performance of your employment contract. | Group entities Payroll providers Auditors and accountants Law and medical practitioners Pension providers Individuals or companies employed by National Pen to carry out specific services, functions or consultancy work Regulatory bodies and courts Relevant government departments and agencies Insurance or assurance companies and health insurance providers or trade unions Potential purchasers or bidders |
| Managing our Business Providing you with building and IT access. Administration of employment termination. Providing third party stock and benefit plans administration services and assist HR and the business in discharging essential functions regarding its equity compensation and benefit plans. Investigating and responding to complaints from personnel, clients, business partners, regulators; and Maintaining emergency contact details. Monitoring use of IT and communications in accordance with the employee handbook. Provision of references. Other activities necessary for the maintenance of our employment relationship with you. Monitoring the correct functioning and ensuring the security of the Group's computer systems and preventing misuse and outside attacks or threats. Archiving and storing information. Preventing theft and unauthorised disclosure of the Group's intellectual property or confidential information. Detecting excessive personal use of Group computer system resources. Monitoring and promoting equal opportunities, including the review of gender breakdown and progression. |
Collection Recording Organising Structuring Storing Retrieving Consulting Using Disclosing Aligning or combining Restricting |
Identity Contact Employment Professional Financial Premises and IT Access Performance Leave Disciplinary Termination |
This processing of your data is necessary for our legitimate business interest in managing our business including legal, personnel, administrative and management purposes and for the prevention and detection of crime, provided our interest is not overridden by your interest. | Group entities Law practitioners Individuals or companies employed by National Pen to carry out specific services, functions or consultancy work Regulatory bodies and courts Relevant government departments and agencies Potential purchasers or bidders |
| EU and EU Member State Laws Managing health and safety at work and incident reporting. Compliance with our regulatory (for example disclosing tax data to the office of the revenue commissioners) and professional requirements. Exercising our right to defend, respond or conduct legal proceedings. |
Collection Recording Organising Retrieving Consulting Using Disclosing |
Identity Contact Employment Professional Financial Premises and IT Access Performance Leave Disciplinary Termination |
This processing of your data is necessary in order for us to comply with legal or regulatory obligations… | Group entities Law and medical practitioners Auditors and accountants Regulatory bodies Relevant government departments and agencies |
We may, from time to time, (i) ask for your consent to use your personal data for a specific purpose; and/or (ii) process your personal data (including "special category data") in order to protect your vital interests or the interests of another.
Special Categories of Personal Data
Certain categories of your personal data are regarded as 'special' including information relating to an individual's:
1. physical or mental health;
2. religious, philosophical or political beliefs;
3. trade union membership;
4. ethnic or racial origin;
5. biometric or genetic data;
6. sexual orientation.
We only process such data where necessary for the purpose of carrying out the obligations, and exercising specific rights, of National Pen or of an employee under employment law or for the assessment of your working capacity. If we wish to process your special personal data for any further purpose, we will seek your explicit consent to do so. You have the right to withdraw your consent to that processing at any time.
We will only process data relating to your criminal convictions or involvement in criminal proceedings when permitted by law, or where provided voluntarily by you.
Where you do not provide us with your Personal Data
If you do not provide us with your personal data, we may not be able to process your job application, suitability for a particular role, your pay or other benefits, comply with our legal obligations or manage our business. We will tell you when we ask for information which is a statutory or contractual requirement or needed to comply with our legal obligations.
Security and Storage of Personal Data
We securely store your personal data in a centralised database, with controlled access to such database. Access to personal data (including special category data) in both electronic and paper form is restricted to members of the HR Department and employees who have a legitimate and justifiable reason to view such data.
Recipients of Your Personal Data
We may disclose your personal data to a group company including for the following reasons: in order to run global processes, carry out group wide reporting, or take decisions about hiring or promotion. It may be necessary from time to time for us to disclose personal data to third parties or agents, including to the following:
1.Third parties to assist in the administration, processing and management of certain activities pertaining to past, current and prospective employees;
2.Individuals or companies employed by National Pen to carry out specific services, functions or consultancy work including external reference agencies and other financial institutions;
3.Relatives or legal representatives of past, current and prospective employees;
4.Regulatory bodies to whom we are obliged or required to disclose information including Workplace Relations Commission, Courts and Court-appointed persons;
5.Insurance or assurance companies and health insurance providers or trade unions;
6.Auditors and accountants;
7.Legal and medical practitioners;
8.Payroll providers;
9.Pension providers;
10.Potential purchasers or bidders;
11.Relevant Government departments and agencies; and
12.Other support service providers necessary to assist National Pen with the above.
Transfer of Personal Data outside the EEA
The personal data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area (EEA), for the purposes described above. Due to the global nature of our business, your personal data may be disclosed to Group Companies outside the EEA. It may also be processed by personnel operating outside the EEA who work for us or for one of our suppliers who act on our behalf.
There are adequacy decisions in place in respect of Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, the United Kingdom, the United States (only commercial organisations participating in the EU-US Data Privacy Framework) and Uruguay. Where the Company transfers personal data to these locations, it will rely upon these adequacy decisions to do so in accordance with Article 45 of the GDPR. In respect of all transfers to all other countries (for which there are no adequacy decisions), we use standard contractual clauses approved by the European Commission in accordance with Article 46 of the GDPR. You can request further information on our data transfers (including a copy of standard contractual clauses or information on which adequacy decisions are being relied upon) by contacting the HR Department.
Data Retention
Your data will be stored for the duration of your employment and retained to the extent necessary to enable National Pen to comply with any legal obligations (for example, per legislation, employers are obliged to keep records of their employees working time for a period of three years) or for the exercise or defence of legal claims following termination of employment.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. We reserve the right to delete and destroy all of the information collected about you in accordance with our retention policies unless otherwise required by law.
Our retention practices are reviewed and updated from time to time in line with legal requirements and best practice. Further information can be obtained from Andrew Graziani at EUPrivacy@pens.com.
Your Data Rights
You have several rights in relation to your personal data. You have a right to:
1.access a copy of your personal data held by National Pen;
2.request rectification of your personal data if it is inaccurate or incomplete;
3.request erasure of your personal data in certain circumstances which we can explain to you;
4.restrict our use of your personal data in certain circumstances which we can explain to you;
5.move (or port) personal data which is automated in certain circumstances;
6.object to the processing of your data where our legal basis for processing your data is our legitimate interests;
7.withdraw your consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent;
8.not to be subject to a decision based on automated processing, including profiling which has legal or similar significant affects; and
9.lodge a complaint with the Data Protection Commission (if you are unhappy with how your personal data is being handled). The Data Protection Commission can be contacted via the information at https://dataprotection.ie/en/contact/how-contact-us.
However, these rights may not be exercised in certain circumstances, such as when the processing of your data is necessary to comply with a legal obligation or for the exercise or defence of legal claims. If you wish to exercise any of your rights in this regard, please contact Andrew Graziani at EUPrivacy@pens.com. We will respond to your request as soon as practicable and in any event not more than within one month of receipt of your request.
Further Information
If you require any further clarification regarding this Notice, please contact: Andrew Graziani at EUPrivacy@pens.com.
Acknowledgment of Receipt of National Pen Privacy and Data Protection Notice
I acknowledge that I have received a copy of the National Pen Privacy and Data Protection Notice.
I acknowledge that the National Pen Privacy and Data Protection Notice is not a contract, express or implied and that it does not set terms or conditions of employment.
I understand that the National Pen Privacy and Data Protection Notice may be updated at any time and that National Pen will notify me in writing of any such changes.
Signature
Date