We may collect a range of personal information from you, depending on your circumstances and the services you require. You may give us personal data by:

• Communicating with us by phone, email text, instant messaging, social media, and/or any other form of written or audio communication. We ask you to disclose only as much information as we need to provide you with our services or to submit a question, a suggestion, or a comment in relation to our services.

• Attending meetings with us. These meetings might include the provision of personal data by you, or the filling in of forms required for us to provide a service to you.

• Visiting our website or social media channels, where applicable. If you wish to contact us using social media, please consult the privacy policy of the social media service provider for details on their privacy practices.

• Using the call back form on mortgageholders.ie.

In some cases, we may receive data from you that relates to another individual, for example, in a joint bank statement. In these cases, we will use the information purely for the purposes of the provision of services to you and we will not otherwise process the data.

When you use our services, we may obtain, with your authorisation, records relating to your situation, such as records held by your creditors or financial institutions. The records that we may obtain will vary depending on your circumstances and the third parties involved.

We collect the information in order to provide you with our services. We may use this information to:

• Contact you to arrange appointments or to return your calls

• Assess your circumstances and to recommend courses of action

• Refer you to a third-party (mabs, solicitor etc)

• Engage with third parties in relation to your situation, including public and private organisations

• Assist you to fill in forms

• Keep you informed in relation to your case

• Conduct statistical analysis and reporting, for training purposes, for quality review purposes and for social policy purposes

The legal bases for the processing of your data are:

• That you have provided consent for the processing for the provision of our services

• Processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us as the controller

• Processing necessary for compliance with a legal obligation to which we are subject From time to time, we may also collect sensitive or ‘special category’ data in the provision of our services.

The legal basis for the processing of your special category data is:

• That you have provided consent for the processing for the provision of our services

We may share your personal data with other advisory entities, and with public and private organisations such as creditors, financial institutions, or the Insolvency Service of Ireland to provide you with our services.

We attach at Schedule 1 a list of entities with whom your personal data may be shared. We attach at Schedule 2 an additional list of entities with whom your personal data may be shared if you avail of Insolvency Service with IMHO. Version: August 2020 In addition, we may disclose your personal information to third parties:

• If there is a risk of serious harm to you or to another person or to property

• If we are under a duty to disclose or share your information to comply with any legal obligation.

• If we are required to give evidence in court.

• To get legal advice or to defend a legal right.

• In the event of a disclosure relating to child abuse.

How long we keep your information depends on the type of information and the purposes for which it is required.

We will keep your information for no longer than is required or permitted, as follows:

• Where we have advised on or assisted with your financial situation, we will retain your information for two years, from the date your file is closed.

• Where you have availed of the Abhaile Scheme, we will retain your information for three years, after the termination of the scheme.

• Where we have arranged payments to or facilities with your creditors, we will retain your information for six years, from the date your file is closed.

• Where you have availed of the Approved Intermediary Service, we will retain your information for 12 months, from the date your file is closed.

No.

You have the following rights: • The right to access the personal data we hold about you. • The right to require us to rectify any inaccurate personal data about you without undue delay. • The right to request that we erase any personal data we hold about you in circumstances where, it is no longer necessary for us to hold the personal data or, in some circumstances, where you have withdrawn your consent to the processing. Version: August 2020 • The right to object to us processing personal data about you, such as processing for profiling or direct marketing. • The right to ask us to provide your personal data to you in a portable format or, where technically feasible, for us to transfer that personal data to another provider as long as it does not result in a disclosure of personal data relating to other people. • The right to request a restriction of the processing of your personal data. Where our processing of your personal data is based on your consent to that processing, you have the right to withdraw that consent at any time, but any processing that we have carried out before you withdrew your consent remains lawful. You may exercise any of the above rights by contacting the Operations Manager at our registered address. You may lodge a complaint with the Data Protection Commission with respect of our processing of your personal data. The Data Protection Commission website is www.dataprotection.ie

This notice may change from time to time, and any changes will be posted at www.mortgageholders.ie and be effective when posted. This notice was last updated August 2020.

IMHO welcomes your comments regarding this Data Protection Notice. If you believe that IMHO has not adhered to this Notice, please contact Angela O’Brien (angela@mortgageholders.ie) or 00353 1 874 7662. We will use commercially reasonable efforts to promptly determine and remedy the problem.