Privacy policy

Karo Privacy Notice

We are committed to protecting the privacy of those with whom we interact, and we recognise the need to respect and protect information that is collected or disclosed to us (called "Personal Information", explained below).

This Privacy Notice is intended to tell you how we collect and use your Personal Information to give you the information you need at a glance, with the option of following a link if you want to find out more. If you still can't find the information you need, you can contact us by reference to the details set out in section 1 below.

Please click on the links below for further information on our privacy practices:

1. Who we are?

2. What is Personal Information, and which Personal Information do we collect about you?

3. How is your Personal Information collected?

Personal Information that you provide directly

Automated technologies or interactions

Third parties or publicly available sources

4. How do we use your information?

5. To whom do we disclose your information?

6. What do we do to keep your Personal Information secure?

7. Data Retention – How long will we store/keep your Personal Information

8. Accessing your Personal Information and other rights you have

9. Third-Party Links

10. Cookies

11. Your Choices (e.g. marketing related emails or otherwise)

12. Changes to this Privacy Notice

This Privacy Notice should be read in conjunction with the Karo Platform Terms & Conditions of Use found at karo.ie/terms. The definitions in the Terms & Conditions are used throughout this privacy notice.- -

1. Who are we?

We are KARO HEALTHCARE LTD, trading as Karo ("Karo", "we", "us") and we act as a controller for the purposes of European Economic Area data protection law and data protection and e-privacy laws applicable in the United Kingdom (the "Data Protection Law"). We operate the Karo online and marketplace platform and website at https://www.karo.ie (the "Platform").

We are a registered fee payer with the Information Commissioner's Office (616688 registration number). Our Director, Odhran Ginnity is responsible for overseeing questions in relation to this Privacy Notice. If you have any questions about this Privacy Notice, including any requests to exercise your legal rights, please contact us using the following details:

FAO Odhran Ginnity

151 Thomas St, The Liberties, Dublin, D08 PY5E

odhran@karo.ie

Our Platform connects Clients with our Workers through https://www.karo.ie and any other website or application through which we may make the Platform and services available from time to time (our "services"). This policy applies to you if you are a Member, Client, Worker, supplier, referee, visitor to our Platform or applicant for a job with us. For the purposes of this policy:

- Members – a user of the Platform who completes a registration as a Member.

- Clients – a Member of the Platform who is a provider of healthcare services and operator of healthcare facilities that is regulated by the Care Quality Commission, such as but not limited to, care homes, hospitals, prisons.

- Workers – a Member of the Platform who is a Worker of Karo Staffing Ltd and a provider of healthcare services, such as but not limited to, qualified nurses, doctors or care workers.

- Referee – a person who provides a personal or work reference for a Worker or an Applicant.

- Suppliers – business contacts in our supplier organisations.

- Platform Visitors – anyone who visits our Platform.

- Applicants – an individual who is applying for a job with us.

- Vacancy – a specific ad hoc rota vacancy within the healthcare sector commonly on a shift-by-shift basis and "Vacancies" shall be construed accordingly.

- Assignments - an assignment entered into between Karo and the Client for the provision of services by a Worker to the Client corresponding to a Vacancy.

2. What is Personal Information, and which Personal Information do we collect about you?

For the purposes of this Privacy Notice, "Personal Information" consists of any information that relates to you and/or information from which you can be identified, directly or indirectly as defined under Data Protection Law. For example, information which identifies you may consist of your name, address, telephone number, photographs, location data, an online identifier (e.g. cookies identifiers and your IP address) or to one or more factors specific to your physical, economic, cultural or social identity. When we combine other information (i.e. information that does not, on its own, identify you) with Personal Information, we treat the combined information as Personal Information.

We may collect use, store and transfer different kinds of Personal Information about you which we have grouped together as follows:- -

3- -

• Identity Data includes first name, maiden name (if applicable), last name, community username, title, date of birth and gender, job title, a copy of a photographic identity document (such as a passport or ID card), a photograph for incorporation into your profile on the Platform, a screenshot from any applicable video-call between a Member (or their representative) and Karo, and, in respect of an Worker, the applicable NMBI pin/reference/registration number.

• Contact Data includes address, former addresses (where applicable), email address and telephone number(s).

• Career History and Education Data includes professional skills and experience, employment history, academic and professional qualifications, certificates, training, competencies (clinical and medication), reference information.

• Employment Status Data includes status/right to work and work permit information.

• Worker Profile Data includes job role, details of professional indemnity insurance cover, your ratings submitted via our in-built ratings system, feedback relating to you, preferences.

• Financial Data includes bank account details, direct debit mandate.

• Technical Data includes internet protocol (IP) addresses, location data, username and password, usage session dates and duration, page views, time zone setting and location, browser plug-in types and versions, operating system and platform, the type of browser used while visiting our Platform, how you use our Platform and the numbers of users who visit our website.

• Services Data includes information about how you use our services, details of which services you have received from us, choices you have made on the Platform (including, for example, settings and favorite workers), information as to Vacancies posted and applied for, Assignments, cancellations, ratings, reviews, responses to surveys and requests for feedback, information about your use of our services, correspondence and communications with you and information about any complaints or enquiries you make to us.

• Community Data includes any information you send to other Members via the Platform's community function.

• Marketing and Communications Data includes your preferences in receiving marketing from us and your communication preferences.

Special Categories of Data: we may collect the following special categories of Personal Information about you:

o occupational health information including vaccination/immunisation status and history ("Occupational Health Data");

o the identity of your professional indemnity insurer which may indicate trade union membership ("Trade Union Data"); and

o where a photographic ID is provided (for example by way of a copy of your passport, driving licence or other photographic ID document) an inference may be made as to your race, ethnicity and/or religious beliefs ("ID Data").

Criminal Offences Data: we will process information about a Workes's criminal convictions including enquiries made of the Disclosure and Barring Service ("DBS") in respect of criminal convictions as part of a Workers's membership application process, creation of a profile and use of the Platform.

Our Clients require us to carry out a criminal records check in order to satisfy themselves that there is nothing in a Worker’s criminal convictions history which makes a Worker unsuitable for becoming a Member of the Platform, using the Platform and/or applying for and carrying out an Assignment. Therefore, we may collect a copy of your DBS Certificate, your DBS Certificate number and DBS- -

5- -

Update Service Number. We may also ask you to provide a statement about the information contained in your DBS Certificate. We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data.

We also collect and use aggregated, anonymous or pseudonymised data, such as statistical or demographic data. If we combine any of this data with your Personal Information so that it can directly or indirectly identity you, we treat the combined data as personal data which will be used in accordance with this

Privacy Notice.

3. How is your Personal Information collected?

We use different methods to collect data from and about you.

A. Members

• Personal Information that you provide directly to us. You may give us your Identity Data, Contact Data, Marketing and Communications Data, by filling in our Platform registration form, creating an account and profile or by corresponding with us by email, phone or otherwise. We collect Services Data when we correspond with you about our services and when you use the Platform.

• Automated technologies or interactions. When you interact with our Platform, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this Personal Information by using cookies and other similar technologies, and our analytics providers. Please see section 10 below.

B. Clients

• Personal Information that you provide directly to us. You may give us your Identity Data, Contact Data, Financial Data, Marketing and Communications Data, by filling in our Platform registration form, creating an account and profile, updating and adding to your profile, using the Platform or by corresponding with us by email, phone or otherwise. We collect Services Data when we correspond with you about our services and when you use the Platform.

• Third parties or publicly available sources. We may collect your Identity Data and Contact Data from publicly available sources such as Companies House and the CQC.

C. Workers

• Personal Information that you provide directly to us. You may give us your Identity Data, Contact Data, Career History and Education Data, Employment Status Data, Worker Profile Data, Financial Data, Special Categories of Data, Criminal Offences Data, Marketing and Communications Data, by filling in- -

our Platform registration form, creating an account and profile, updating and adding to your- -

profile, using the Platform or by corresponding with us by email, phone or otherwise. We collect Services Data when we correspond with you about our services and when you use the Platform.

• Third parties or publicly available sources. We may receive Identity Data, Career History and Education Data from third parties such as your Referee and from publicly available sources such as LinkedIn, the NMC. We may also receive Criminal Offences Data from a third party DBS check provider if you have chosen to use our recommended provider to obtain a DBS Certificate and from the DBS Update Service provided by the government if you have given chosen to give us access to that service.

D. Suppliers

We collect your Identity Data, Contact Data, Financial Data and Services Data when we correspond with you about our services, and from publicly available sources such as Companies House.

E. Referee

We may obtain your Identity Data and Contact Data as well as information regarding your credentials as a referee, details of your relationship and your opinions of a Worker or Applicant, either directly from you or from an Worker or Applicant.

F. Platform Visitors

When you interact with our Platform, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this Personal Information by using cookies and other similar technologies, and our analytics providers. Please see section 10 below.

G. Applicants

• Personal Information that you provide directly to us. You may give us your Identity Data, Contact

Data, Career History and Education Data, Employment Status Data and Financial Data by applying for a job with us.

• Third parties or publicly available sources. We may receive Identity Data, Contact Data and Career

History and Education Data from third parties such as your employer, Referee, your recruiter and publicly available sources such as LinkedIn.

4. How do we use your information?

We will only use your Personal Information when Data Protection Law allows us to do so. You can see a full list of the types of data we process, the purpose for which we process it and the lawful basis on which it is processed in the table below.

Purposes for which we will use your Personal Information- -

9- -

We may use the Personal Information that we collect for the following purposes. For each purpose, we describe the legal bases we rely on to justify such use of your Personal Information.

Category Purpose/Activity Type of data Legal basis

Clients To register you or your employer as a Client

a. Identity Data

b. Contact Data

Necessary for performance of a contract with you

Clients To provide you with our services including:

• operating the Platform;

• allowing you to communicate with other Members;

• allowing you to post Vacancies and find WORKERs to fill those Vacancies;

• managing payments, fees and charges including via Payment Processor(s); and

• collecting and seeking to recover money owed to us.

a. Identity Data

b. Contact Data

c. Financial Data

d. Community Data

Necessary for:

i. performance of a contract with you;

ii. our legitimate interests to operate the Platform and those of other Members; and

iii. necessary for our legitimate interests (to recover debts due to us).

Workers To register you as a Worker including making enquiries of third parties, for example, via a Verification Services Provider (see section 5 below).

a. Identity Data

b. Contact Data

c. Career History and Education Data

d. Employment Status Data

e. WORKER Profile Data Necessary for performance of a contract with you- -

Workers To provide you with our services including:

• operating the Platform;

• allowing you to amend your profile;

• allowing you to communicate and interact with other Members;

• allowing you to apply for Vacancies, accept invitations from Clients and enter into Assignments with Clients;

• managing payments, fees and charges including via the Payment Processor; and

• collecting and seeking to

a. Identity Data

b. Contact Data

c. Financial Data

d. Services Data

e. Career History and Education Data

f. Employment Status Data

g. WORKER Profile Data

h. Community Data

Necessary for:

i. performance of a contract with you;

ii. our legitimate interests to operate the Platform and those of other Members; and

iii. our legitimate interests (to recover debts due to us).- -

recover money owed to us.

Workers For compliance purposes – Clients (as healthcare institutions) will need to access the personal data of an WORKER via the Platform in order:

• to assess the WORKER against the compliance standards set by the Client organisation ahead of arrangement of an Assignment; and

• to maintain records of WORKERs with whom the Client has entered into Assignments.

a. Identity Data

b. Contact Data

c. Profile Data

d. Referee Data

Necessary for:

i. performance of a contract with you;

ii. our legitimate interests to operate the Platform and those of other Members, Clients and Workers.

To communicate with relevant regulatory bodies including the Nursing and Midwifery Council and/or the Care Quality Commission.

a. Identity Data

b. Contact Data

c. Worker Profile Data

d. Services Data

Necessary for:

i. performance of a contract with you;

ii. to comply with a legal obligation;

iii. for our legitimate interests and those of any applicable regulators. Members, Clients and Workers

To manage our relationship with you which will include:

• notifying you about changes to our Terms and Conditions or Privacy Notice; and

• asking you to leave a reviewor provide feedback.

a. Identity Data

b. Contact Data

c. Marketing and Communications Data

d. Services Data

Necessary for:

i. performance of a contract with you;

ii. to comply with a legal obligation;

iii. our legitimate interests in keeping our records updated and studying how Members use our Platform and services.- -

Applicants To consider you for a role, if you are applying for a job with us

a. Identity Data

b. Contact Data

c. Career History and Education Data

d. Employment Status Data

Necessary:

i. To take steps in order to enter a contract with you;

ii. for our legitimate interests in finding- -

e. Financial Data employees;

iii. to comply with our legal obligations, such as to make reasonable adjustments.

Referees To perform our services to Workers and Clients and to enable us to obtain your opinions on an Applicant.

a. Identity Data

b. Contact Data

Necessary for our legitimate interest in providing our services to Clients and WORKERs, and obtaining information about Applicants Suppliers To carry out our contractual obligations to you, if you are our supplier or subcontractor, including to manage our payments to you.

a. Identity Data

b. Contact Data

c. Financial Data

d. Services Data

Necessary for our legitimate interests in receiving services from our suppliers to ensure our business is run efficiently. Members and Platform Visitors.

For security purposes and to administer our Platform – to maintain and enhance the Platform, to ensure that content from it is presented in the most effective manner for you and your computer, and to enhance the user experience (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data).

Technical Data Necessary:

i. for our legitimate interests in running our business, to ensure the security of our systems, to assist us in the provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or company restructuring exercise;

ii. for performance of a contract with you;

iii. to comply with a legal obligation.- -

Members, Clients and Workers

To provide you with marketing information relating to the services and and activities which you request from us or which we feel may be of interest to you,

a. Identity Data

b. Contact Data

c. Services Data

d. Marketing and Communications

Necessary for our legitimate interests to develop our services, grow our business and inform our marketing strategy.- -

and relevant Platform content, and to measure or understand the effectiveness of the marketing we serve to you.

Data

e. Technical Data

All categories

Business and analysis purposes

- for business monitoring, assessment and analysis of our Clients, Workers and Members, to develop our business strategy, record keeping including maintaining our accounts, complying with good practice and for other administrative, operational and security reasons, and to seek your thoughts and opinions on the services we provide.

a. Identity Data

b. Contact Data

c. Services Data

d. Marketing and Communications Data

e. Technical Data

Necessary:

i. for our legitimate interests in running our business efficiently, successfully and in order to keep our records updated;

ii. to comply with a legal obligation.

Members and Platform Visitors

To improve the Platform and the services, services, customer relationships and experiences.

a. Technical Data

b. Services Data Necessary for our legitimate interests to in understanding how Members use our services, keeping the Platform updated, and developing our business and to inform our marketing strategy.

Members, Workers, Clients and Referees

As required in special circumstances such as a police or other legal investigation or serious complaint requiring a Client, a Worker and/or Karo to release personal data.

a. Identity Data

b. Contact Data

c. Worker Profile Data

d. Employment Status Data

e. Career History and Education Data

f. Services Data

g. Marketing and Communications Data

h. Technical Data

i. Special Categories of Data

Necessary for:

i. performance of a contract with you;

ii. compliance with legal obligation;

iii. performance of a task in the public interest;.

iv. the establishment, exercise or defence of legal claims or whenever courts are acting in tier judicial capacity;- -

Workers As required in limited circumstances, when a Client must use personal data to help it

a. Identity Data

b. Contact Data

c. Worker Profile Data

Necessary for:

i. Performance of a contract with you;- -

Please be aware that we are not responsible for the data processing activities of others, such as Clients.

Marketing communications

Where permitted in our legitimate interest or with your prior consent where required by Data Protection Law, we will use your Personal Information for marketing analysis and to provide you with promotional update communications by email, telephone or post about our products and services. For further information on this, see the 'Your Choices' section of this Privacy Notice.

Combining Personal Information

We may combine the Personal Information that we collect from you to the extent permitted by applicable law. For example, we may combine various different databases that contain your Personal Information to carry out internal analysis of our Member base and how the services are used, and to provide better services and more personalised content (such as marketing).

Change of purpose

Where we need to use your Personal Information for another reason other than for the purpose for which we collected it, we will only use your Personal Information where that reason is compatible with the original purpose. If we need to use your Personal Information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

5. To whom do we disclose your information?

We will only use your Personal Information for our internal business purposes, some of which are mentioned above. We may disclose your information to the following entities:

I. Clients

We may need to disclose Worker's Personal Information to Clients as part of the services and use of the Platform. For example, we will share Workers' Identity Data, Contact Data, Worker Profile Data, Employment Status Data and Career History and Education Data with Clients when you apply for a Vacancy (as defined in our Terms and Conditions). We will also share limited Identity Data with Clients to enable them to invite Workers to apply for Vacancies.

discharge its functions relating to providing care to patients and relatives and looking after their welfare.

d. Services Data

e. Technical Data

f. Marketing and Communications Data

ii. Compliance with a legal obligation;

iii. Public interest.

All To prevent and detect crime,

a. Identity Data Necessary to comply with categories fraud or corruption and to meet

b. Contact Data our legal obligations our legal, regulatory and ethical

c. Technical Data responsibilities

d. Services Data- -

II. Service Providers- -

We use third party service providers to help us to administer certain activities and services on our behalf, such as IT, hosting and cloud services, payment processing services, verification services marketing services, customer support services and DBS check services. We may share Personal Information about you with such third party service providers solely for the purpose of enabling them to perform services on our behalf and they will operate only in accordance with our instructions. Here are examples of third-party service providers we use:

a. IT Service Provider and Administration Services – we use salesforce.com, inc. and Amazon Web Services, Inc. to provide us with IT, hosting and cloud services.

b. Marketing and Analytics Services – we use Segment.io, Inc. and Facebook to provide us with marketing and analytics services including Facebook Pixel and Custom Audiences.

• Facebook Pixel is a cookie (explained below at section 10) which we use to gather information about use of our Platform. Facebook's cookies policy can be found here.

• We use Custom Audiences to tailor our advertising to people who are likely to be interested in us. The data processing terms which apply to Facebook when we use Custom Audiences are found here.

c. Payment Processing Services – we use third party online payment processors to collect, process, hold and/or remit payments. Currently we use GoCardless, Mangopay S.A. and Hpillars Limited, trading as Telleroo. We may also use our bank which is currently National Westminster Bank Plc.

d. Verification Services – we use a third party online identity verification service provided by Onfido Ltd.

e. Customer Support Services – we use Voigue Pty Ltd to provide out of hours contact and customer support services, a company located in Australia with services performed in Sri Lanka.

f. Disclosure and Barring Check Services – we may refer you to a third party DBS check provider if you are an WORKER who wishes to register with the Platform and you do not have a valid Enhanced DBS Certificate. Currently we use Complete Background Screening Ltd.

g. Onboarding Workers and Managing Compliance and DBS Functions – we use A&J Global Associates, a third party service provider based in Bangladesh.

III. Anonymous statistics

We prepare and develop anonymous, aggregate or generic data and statistics for various reasons (such as aggregate usage statistics including "page views" on the Platform analysing how users use our content and for marketing). As this data is anonymous (i.e. you cannot be identified from it) we do not consider this information to be Personal Information. As such, we may share it with any third party.

IV. Third parties when required by law

We will disclose your Personal Information to comply with applicable law or respond to valid legal process, including from our regulators, law enforcement or other government agencies (in which case such agencies or regulators will be acting as controllers as well); to protect the users of the Platform (e.g. to prevent spam or attempts to defraud them); to operate and maintain the security of the Platform (e.g. to prevent or stop an attack on our systems or networks); or to protect our rights or property.

V. Other Parties in Connection with Corporate Transactions- -

We may disclose your Personal Information to a third party in the event that (a) we buy any business or assets, in which case we will disclose your Personal Information to the prospective buyer of such business or assets subject to the terms of this Privacy Notice; (b) all or substantially all of our business or assets are or are intended to be sold or otherwise assigned to another entity.

VI. Other Parties at Your Direction

We may share Personal Information about you with third parties when you request such sharing, such as to prospective employers, or to your legal or other professional advisers.

6. What do we do to keep your information secure?

We have put in place appropriate physical and technical measures to safeguard your Personal Information. In addition, we limit access to your Personal Information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your Personal Information on our instructions and they are subject to a duty of confidentiality. When we use service providers to assist us in processing your Personal Information, we have written contracts in place with such service provider which means that they cannot do anything with your Personal Information unless we have instructed them to do it.

However, please note that although we take appropriate steps to protect your Personal Information, no website or transmission of data, computer system or wireless connection is completely secure and therefore we cannot guarantee the security of your Personal Information.

International Transfer of Data

The Personal Information that we collect from you may be stored and processed in your region, or transferred to, stored at or otherwise processed outside the European Economic Area ("EEA"). By using the Platform and/or providing us with your Personal Information, you acknowledge that we will collect, transfer, store and process your information outside the EEA. We will take all steps reasonably necessary to ensure that your Personal Information is kept secure and treated in accordance with this Privacy Notice.

Where we transfer your Personal Information outside the EEA to third parties, we will ensure that appropriate transfer agreements and mechanisms, such as the EU Standard Contractual Clauses, are in place to help ensure that our third party service providers provide an adequate level of protection to your Personal Information. We will only transfer your Personal Information outside the EEA in accordance with applicable laws or where you have given us your consent to do so, where required by Data Protection Law.

We may transfer your personal information outside the EEA:

• In order to store it.

• In order to enable us to provide goods or services to you and fulfil our contract with you. This includes processing of payment details or the provision of support services.

• Where we are legally required to do so.

We may transfer your personal information to the following countries and using the following safeguards outside the EEA.- -

22- -

7. Data Retention – How long we will store/keep your Personal Information

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

We retain Workers' Personal Information for seven years after deletion of their account. We retain Clients'Personal Information for seven years following the last contact with such Client.

When your Personal Information is no longer required for the purpose it was collected or as required by applicable law, it will be deleted and/or returned to you in accordance with applicable law. In some circumstances you can ask us to delete your Personal Information (see section 8 below).

8. Accessing your Personal Information and other rights you have

We will collect, store and process your Personal Information in accordance with your rights under any applicable Data Protection Laws. Under certain circumstances, you have the following rights in relation to your Personal Information:

I. Subject Access - you have the right to request details of the Personal Information which we hold about you and copies of such Personal Information.

II. Right to Withdraw Consent – where you have consented to our processing of your Personal Information, you have the right to withdraw such consent at any time. In the event you wish to withdraw your consent to processing, please contact us using the details provided in section 1.

III. Data Portability – you may, in certain circumstances, request us to port (i.e. transmit) your Personal Information directly to another organisation or to you.

IV. Rectification – we want to ensure that the Personal Information about you that we hold is accurate and up to date. If you think that any information we have about you is incorrect or incomplete, please let us know. To the extent required by applicable laws, we will rectify or update any incorrect or inaccurate Personal Information about you.

V. Erasure ('right to be forgotten') - you have the right to have your Personal Information 'erased' in certain specified situations.

VI. Restriction of processing – you have the right in certain specified situations to require us to stop processing your Personal Information.

VII. Object to processing – You have the right to object to specific types of processing of your Personal Information, such as, where we are processing your Personal Information for the purposes of direct marketing.

VIII. Prevent automated decision-taking – in certain circumstances, you have the right not to be subject to decision being taken solely on the basis of automated processing.

Enforcing your rights- -

If you wish to enforce any of your rights under applicable Data Protection Laws, then please see section 1 above. We will respond to your request without undue delay and by no later than one month from receipt of any such request, unless a longer period is permitted by applicable data protection laws, and we may charge a reasonable fee for dealing with your request which we will notify to you. Please note that we will only charge a fee where we are permitted to do so by applicable Data Protection Laws.

Complaints

If you are concerned that we have not complied with your legal rights under applicable data protection laws, you may contact the Data Protection Commissioners Office (https://www.dataprotection.ie/en/ contact/how-contact-us) which is the data protection regulator in Ireland which is where we are located.

The DPC’s address is:

21 Fitzwilliam Square South

Dublin 2

D02 RD28

Ireland

Alternatively, if you are based outside the The Republic of Ireland, you may contact your local data protection supervisory authority.

9. Third-Party Links

Our Platform may contain links to other third party websites that are not operated by us. These linked sites and applications are not under our control and as such, we are not responsible for the privacy practices or the content of any linked websites and online applications. If you choose to use any third party websites, any Personal Information collected by the third party’s website will be controlled by the Privacy Notice of that third party. We strongly recommend that you take the time to review the privacy policies of any third parties to which you provide Personal Information.

10. Cookies

What are cookies?

We may use cookies on our website. Cookies are small text files that can be read by a web server in the domain that put the cookie on your hard drive. Cookies are assigned to and stored in a user's internet browser on a temporary (for the duration of the online session only) or persistent basis (cookie stays on the computer after the internet browser or device has been closed). Cookies collect and store information about a user’s preferences, product usage and content viewed which allows for us to provide users with an enhanced and customized experience when engaging with the website.

See our Cookies Policy - karo.ie/terms - for further information on cookies and how we use them.

11. Your Choices (e.g. marketing-related emails or otherwise)- -

When you request information on or from the website, or otherwise communicate with us, we may use your Personal Information (such as your contact details (e.g. name, address, email address, telephone number) to send you marketing-related correspondence by email related to our products or services.

When we process your Personal Information for marketing purposes, we do so on the basis that it is in our legitimate interests to use your Personal Information for these purposes or with your consent, where required by Data Protection Law.

We may also use your Personal Information to personalise and to target more effectively our marketing communications to ensure, to the extent possible, that any marketing-related correspondence is relevant to you.

You can object to further marketing at any time by clicking "Unsubscribe" from any marketing or promotional email you receive from us by sending us an email to support@karo.ie

12. Changes to this Privacy Notice

It also is important that you check back often for updates to the Privacy Notice, as we may change this Privacy Notice from time to time. The “Date last updated” legend at the bottom of this page states when the notice was last updated, and any changes will become effective upon our posting of the revised Privacy

Notice.

We will provide notice to you if these changes are material and, where required by applicable law, we will seek your consent. We will provide this notice by email or by posting notice of the changes on our website.

Date last updated: 5th February 2021