BARON'S UNION PERSONAL DATA PROTECTION POLICY
Privacy Policy and Description of Processing of Personal Data at the Bára Trade Union.
Responsible party
The controller of the processing operations is the Báran Trade Union, registration number 460172-2259, at Austurvegur 56, Selfoss. Báran Trade Union is responsible for the collection and registration of personal data and the handling of that data in the union's activities. The association can be contacted by calling 480-5000 or by sending an email to baran@baran.is.
Purpose of processing personal data
Báran, a trade union, collects personal information solely to fulfill its duties in accordance with laws, collective bargaining agreements, and the union's bylaws.
The purpose of the union's work is multifaceted, but in essence, it is as follows:
Formulation of a demand agenda on behalf of the members
First, the purpose of the union's processing is to formulate the bargaining position for the labor contract of Bára, a trade union, but information about members' salaries, obtained from t.d. by reviewing the amounts of contributions returned to the association, but all personally identifiable information is de-linked beforehand. Negotiating collective bargaining agreements is one of the association's primary functions, and this information is crucial for formulating a demand platform on behalf of the members. This processing of personal data is based on Article 6(1)(f) of the GDPR.
Provide specific services in accordance with the company's laws and regulations.
Secondly, the purpose of the processing by the trade union is to provide members of Bárún, a trade union for specific services in accordance with the role of Bárún, a trade union as defined in the association's bylaws and operating rules. This service is m.a. take place through the association's funds: the Sickness Fund, Vacation Fund, Education Fund, and Strike Fund when the member is requested to provide specific information in order for their case to be processed.
Services are also provided for matters received by the association from members regarding labor issues, or to ensure that employers and their employees comply with applicable laws and labor contracts. Such wage and salary matters are primarily based on information that the member is asked to provide so that the matter can be reviewed and handled on their behalf.
In these cases, the processing of personal data is based primarily on the member's consent, see 1. Art. 9 and Art. 11(1)(a) of the Personal Data Act, and additionally, where applicable, on Art. 11(1)(b) and (d) of the Personal Data Act, if the information is considered sensitive within the meaning of the Act.
Fulfillment of legal obligation
In some cases, the purpose of the trade union's processing is to fulfill a legal obligation. For example, pursuant to b. item 1 of the first paragraph of Article 7 of Act No. 97/2002 on the Employment Rights of Foreign Nationals, a review from the relevant trade union or national labor federation must be provided for the processing of a temporary work permit. In cases where the trade union is asked to provide an opinion, a position on the work permit is taken based on information provided to the union and, in certain cases, information the union obtains from public authorities. Also included are data collected by the union's workplace inspector during workplace inspections pursuant to the Act No. 42/2010 on Workplace Certificates and Inspections, and contracts entered into based on this act. The processing is also based on Article 9(3) of the Personal Data Act and, where applicable, Article 11(2) and (4), if the information is considered sensitive under the Act.
Statistical processing
In addition, Báran, a trade union, collects information from users of the union's website (cookies), such as information sent by a browser, which may include information such as IP address, browser type and version, or what is viewed on the website, the time and date of the visit, the time you spent on these pages, and other data. Báran Trade Union reserves the right to create anonymized statistical summaries and other derived information that is, without a doubt, non-personally identifiable, and to use them in the union's operations.
What personal data does the company process, and about whom?
Registered individuals with the trade union are its members, those who seek services from the union, and individuals for whom a recommendation is provided for a work permit application. In addition, the association has access to information from the National Registry about individuals and companies, as well as information about its employees. The association also collects information from the public through its website (cookies).
Information is received from members themselves, from employers, and in cases where employees have given the association authorization to obtain information; from, for example, employers, pension funds, educational institutions, the Employment Office, and healthcare institutions.
Báran, a trade union, emphasizes that the collection of personal data does not go beyond what is necessary at any given time to fulfill the role assigned to the union by law, collective bargaining agreements, and the union's own laws and regulations. However, Báran must process certain personal data to fulfill its mission, the most important of which are listed below.
Premium History
Báran, a trade union, has access to a member's contribution history with the union and thus information about their terms of employment with an employer, or whether another party, e.g., the Maternity and Paternity Fund or the Unemployment Insurance Fund, has paid a member's dues to the trade union.
Assistance with labor matters
Báran, a trade union, records information on whether a member has sought the union's assistance regarding a labor dispute, including unpaid wages or termination. In these cases, pay stubs, employment contracts, bank statements, tax withholding statements from the tax authority, lease agreements, timesheets, and other information are typically requested as appropriate. The member obtains the relevant information themselves and provides it to the union, or, in exceptional cases, grants the union power of attorney if they request assistance with gathering the evidence.
Applications to the society's fund
The union, Báran, has information on whether a member has applied for grants from the union's fund, sick fund, vacation fund, strike fund, or education fund. Báran, the trade union, stores information about the type of grant applied for, payment receipts, and the amount. The union also maintains information on whether a member has applied for sick pay benefits from the union's sick fund due to illness or other circumstances, the amount of the benefits, as well as all documents that accompany such an application, e.g., a doctor's certificate, a birth certificate, or a death certificate. sickness benefit certificates, and employer certificates regarding an employee's sick days. Additionally, information from the membership register about the payment of dues to the association is used to verify eligibility and, where applicable, the amount of benefits in accordance with the rules of the association's funds.
Information is also recorded about whether a member has purchased discount vouchers, rented a vacation home, or used other benefits from the union. It is also recorded if a member is placed on a blacklist due to poor conduct at the union's vacation home.
Information from the National Register
The association has access to information in the National Registry about its members. This includes their legal residences, marital status, nationality, and social security number.
Membership Register
The membership register contains contact information for members, such as name, social security number, email address, phone number, nationality, and home address, which they have provided to the union, for example, when applying for grants, vacation rentals, or other services from the union. Information in the membership register is only used for the benefit of the union, such as for conducting wage surveys for collective bargaining agreements and other similar purposes.
Members can opt out of having their contact information used to contact them on behalf of the association, for example for salary surveys, by sending an email to baran@baran.is.
Deletion of personal data
A fundamental principle in the operations of Báran, a trade union, is to retain personal information for no longer than necessary to fulfill the union's functions, unless a legal or contractual obligation requires the data to be kept for a longer period.
Information is not provided to a third party unless a member has requested it in writing and granted permission for it with a written authorization, unless permitted by law, or unless required by a court order.
The data subject has the right to have the trade union delete personal data concerning them without undue delay if one of the following reasons applies:
- The personal data are no longer necessary for the purpose for which they were collected or otherwise processed.
- The data subject withdraws the consent on which the processing is based, and there is no other legal basis for the processing.
- The data subject objects to the processing in accordance with data protection law, and there are no legitimate grounds for the processing that take precedence.
- The personal data must be deleted to fulfill a legal obligation that rests on the trade union under the law.
Union Processors
Here you can find information about the main processors of Bárunnar, a trade union, what processing is carried out, and what information is processed.
- DK software runs the association's membership system and accounting system.
- Dorado runs Frímann, the company's time off and discount system.
- TRS ehf. handles the hosting of the website and the setup of computer systems, cloud services, including the company's email addresses, as well as its telephone system.
- Onesystem Iceland – operates the company's case management system.
- Festa Pension Fund collects the company's contributions.
- Securitas and Öryggismiðstöðin handle security and security guarding.
Confidentiality and Non-Disclosure of the Staff of Bárún, a Trade Union
The association's staff is informed about laws and regulations regarding the protection and security of personal data, and how to enforce privacy laws and regulations.
All employees are bound by confidentiality and this obligation remains in effect even after leaving employment. Upon signing the employment agreement, all employees sign a confidentiality statement. Employees shall maintain complete impartiality in their work for the company and may not take on additional jobs that could in any way jeopardize their confidentiality regarding their duties.
To ensure that the staff of Bárunnar, a trade union, conduct themselves properly in their duties, the union has established rules of conduct and ethics that apply to its elected officials and all employees. These rules of conduct and ethics form the basis for interactions with members and clients.
General description of technical and organizational security measures
The following is a description of the security measures the trade union has taken to ensure the security of personal data, e.g., the use of pseudonyms and encryption, in accordance with Article 27 of the Personal Data Act.
- Báran, a trade union, places great emphasis on ensuring the security of its members' personal information.
- Báran, a trade union, ensures that all personal data is handled in accordance with the Personal Data Processing Act No. 90/2018.
- Báran, a trade union, emphasizes that the collection of personal data is limited to what is necessary to fulfill its role as assigned by law, collective bargaining agreements, and the union's bylaws and regulations.
- The policy of Bárunnar, a trade union, is to store and process as little personally identifiable information as possible in order to provide the services the union is obligated to offer its members.
- A fundamental principle in the operations of Báran, a trade union, is to retain personal information for no longer than necessary to fulfill the union's functions, unless a legal or contractual obligation requires the data to be kept for a longer period.
- Báran, a trade union, guarantees not to use information about its members for any purpose other than that of the union, or in an irresponsible, insecure, or illegal manner.
- Báran, a trade union, ensures that the union's employees have received appropriate training on the handling of personal data, what sensitive personal data is, and how data should be stored.
- Information about members 18 years of age and older is not provided to the members' parents.
- Access to the vacation portal and „My Pages“ is only possible with an eID or Íslykill.
- A review has been conducted of the premises of Bárúnna, the trade union, so that access to work areas is locked. Personal data are not accessible to anyone other than those who work with them. Employees have access to locked cabinets for storing sensitive information.
- Sensitive information is stored on a separate drive with access control. Access to information is restricted so that employees only have access to information necessary for their job.
- The access to the Bárður association system, the trade union, and information about applications to the association's funds is restricted to ensure the utmost protection of the personal data of registered individuals. Only those employees who need access to specific information about a registered individual for the purposes of their work on behalf of the trade union have access to that information.
Security breach at Bárunni, trade union
Báran, a trade union, is legally obligated to report without undue delay if a security breach concerning personal data occurs and poses a high risk to an individual. A security breach is defined as a breach of security that results in the accidental or unlawful destruction, loss, alteration, disclosure, or access to personal data.
Please be aware that an individual is responsible for personal information, such as name, social security number, and photo, that he or she chooses to share on a public forum, for example, via the Facebook page of Bárún, a trade union.
Data Protection Officer of the Bar
You can contact the Data Protection Officer by sending an email to baran@baran.is marked „Data Protection Officer“.
The company's Data Protection Officer oversees compliance with the provisions of laws and regulations regarding data protection and the processing of personal data. The Data Protection Officer receives inquiries from individuals about whom the company processes information and provides individuals with advice regarding data protection. The Data Protection Officer provides staff training on data protection regulations, advises employees on data protection matters when issues arise, conducts audits, and resolves data protection disputes.
The company's Data Protection Officer is the point of contact for the Data Protection Authority.
Who has access to the information of Bárún, a trade union?
All individuals have the right to certain information about themselves that is recorded by the company.
That information can be obtained by contacting the association at baran@baran.is or bring it to the company's office during business hours. A government-issued ID must be presented when the request is submitted. Requests for access to your own personal data are not accepted by mail, email, or phone. These measures are necessary to ensure that personal data is only disclosed to the individuals concerned. We will endeavor to provide the data within 30 days of receiving the request.
If an individual believes the information is inaccurate or incorrect, they can request that it be corrected or deleted if there is no legal obligation to retain it. An individual also has the right to request information about the purpose for which the information is used, whether the information is disclosed to third parties and, if so, to whom, the origin of the information, and how long the company intends to retain the information. In certain cases, an individual may also have the right to object to the processing of personal data and to request that its processing be restricted.
Under the following circumstances, the data subject may request that the processing of personal data be restricted:
- When the data subject contests the accuracy of personal data, its processing shall be restricted until the controller has had an opportunity to verify its accuracy.
- When processing is unlawful and the data subject objects to the erasure of the personal data and requests its restricted use instead.
- When the trade union no longer needs the personal data for the processing, but the data subject needs them to establish, pursue, or defend legal claims,
- When the registered party objects to processing, it shall be restricted pending verification of whether the interests of the trade union take precedence over the legitimate interests of the registered party.
Supervisor
The Data Protection Authority supervises the implementation of laws on data protection, regulations, and specific provisions in laws that deal with the processing of personal data. If a dispute arises regarding the handling of personal data, a complaint can be sent to the Data Protection Authority by emailing the address postur@personuvernd.is Information about Data Protection can be found on the institution's website, www.Personal data protection
Updated December 4, 2023