Windmill Healthcare Privacy Notice

Last updated: July 2026

Windmill Healthcare respects your right to privacy and is committed to protecting your personal data. This Privacy Notice explains how we collect, use, store and share personal data and outlines your rights under the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Data Protection Act 2018 and other applicable Irish data protection legislation. (Eur-Lex)

This notice applies to people who interact with Windmill Healthcare through our website, including:

• prospective residents and their representatives;

• residents and family members;

• prospective employees and job applicants;

• employees and former employees;

• contractors and service providers;

• visitors to our care centres; and

• members of the public who contact us.

Separate and more detailed privacy notices may be provided to residents, employees, job applicants and other individuals where appropriate.

1. Who We Are

For the purposes of data protection law, Windmill Healthcare is the controller of the personal data described in this Privacy Notice.

Data controller:
Windmill Healthcare
Market House
Churchtown
Mallow
Co. Cork
Ireland

Telephone: 022 34693
Data protection email: dpo@windmillhealthcare.ie

Questions about this Privacy Notice or the way we process personal data should be directed to our Data Protection Office using the contact details above.

2. Data Protection Principles

Windmill Healthcare processes personal data in accordance with the principles set out in the GDPR. Personal data must be:

• processed lawfully, fairly and transparently;

• collected for specified, explicit and legitimate purposes;

• adequate, relevant and limited to what is necessary;

• accurate and kept up to date;

• retained only for as long as necessary;

• protected using appropriate technical and organisational security measures; and

• processed in a manner that allows Windmill Healthcare to demonstrate compliance with its data protection obligations.

These principles are central to the GDPR and require organisations to provide clear, accessible information about how personal data is processed. (Data Protection Commission)

3. Personal Data We May Collect

The personal data we collect depends on the nature of your relationship with Windmill Healthcare and how you interact with us.

We may collect:

• your name, address and contact details;

• telephone numbers and email addresses;

• information submitted through website enquiry forms;

• details relating to an enquiry about residential, respite, convalescence or other services;

• information about a prospective resident’s care requirements;

• emergency contact and next-of-kin details;

• employment history, qualifications and professional information;

• curriculum vitae, application forms and recruitment information;

• correspondence and records of communications with us;

• feedback, complaints and survey responses;

• visitor information;

• IP address, browser type, device information and website usage data;

• cookie preferences and consent records; and

• other information that you choose to provide to us.

Where necessary in connection with the provision of health or social care services, we may also process special-category personal data, including health information. Such information will only be processed where there is a lawful basis under Article 6 GDPR and an appropriate condition under Article 9 GDPR.

Please do not provide medical or other sensitive information through a general website enquiry form unless it is necessary for your enquiry.

4. How We Collect Personal Data

We may collect personal data:

• directly from you;

• through website forms, telephone calls, emails or written correspondence;

• from a family member, representative, advocate or next of kin;

• from healthcare professionals, hospitals, the HSE or other care providers, where lawful and appropriate;

• during the recruitment and employment process;

• when you visit one of our care centres;

• from contractors, agencies or professional advisers;

• through cookies and similar website technologies; and

• from publicly available sources where permitted by law.

Where personal data is obtained from someone other than the individual concerned, we will provide the required privacy information unless an applicable legal exception applies.

5. How We Use Personal Data

Windmill Healthcare may use personal data to:

• respond to enquiries and requests for information;

• assess enquiries relating to admission or care services;

• arrange visits, assessments or meetings;

• provide residential, nursing, respite, convalescence or other care services;

• communicate with residents, family members and representatives;

• manage recruitment applications and communicate with candidates;

• administer employment and contractual relationships;

• manage our care centres, facilities and services;

• register individuals for events, training or information sessions;

• manage website enquiries and interactive website features;

• improve the operation, security and performance of our website;

• prevent spam, fraud, misuse or unauthorised access;

• maintain business and administrative records;

• comply with legal, regulatory, clinical and professional obligations;

• establish, exercise or defend legal claims;

• protect the health, safety and welfare of residents, staff and visitors;

• manage complaints, feedback and quality-improvement processes; and

• send marketing communications where permitted by law.

We will not use personal data for a purpose that is incompatible with the purpose for which it was originally collected unless permitted or required by law.

6. Lawful Bases for Processing

Windmill Healthcare must have a lawful basis before processing personal data. The lawful basis will depend on the information concerned and why it is being used. The possible lawful bases are set out in Article 6 GDPR. (Data Protection Commission)

We may process personal data where:

Consent

You have given clear consent to the processing, for example, where you have chosen to receive certain marketing communications or accepted optional website cookies.

You may withdraw your consent at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.

Contract

Processing is necessary to:

• enter into a contract with you;

• provide a service that you have requested; or

• fulfil our obligations under an existing contract.

Legal obligation

Processing is necessary to comply with legal, regulatory, employment, taxation, safeguarding, health and safety, clinical governance, record-keeping or reporting obligations.

Legitimate interests

Processing is necessary for Windmill Healthcare’s legitimate interests or those of a third party, provided those interests are not overridden by your rights and interests.

Our legitimate interests may include:

• operating and administering our services;

• responding to enquiries;

• maintaining the security of our website and systems;

• preventing fraud and misuse;

• improving our services;

• maintaining appropriate business records; and

• communicating with residents, families, suppliers and other relevant parties.

Where we rely on legitimate interests, we consider the nature of the information, the reasonable expectations of the individual and the potential effect of the processing.

Vital interests

Processing is necessary to protect someone’s life or physical safety, particularly in an emergency.

Public interest

In limited circumstances, processing may be necessary to perform a task carried out in the public interest or pursuant to an applicable legal or regulatory function.

7. Special-Category Personal Data

Health data and certain other sensitive forms of personal data are afforded additional protection under the GDPR.

Where we process special-category personal data, we will identify both:

• a lawful basis under Article 6 GDPR; and

• an appropriate condition under Article 9 GDPR.

Depending on the circumstances, special-category data may be processed where necessary for:

• the provision or management of health or social care;

• medical diagnosis or assessment;

• protecting vital interests;

• employment, social security or social protection obligations;

• reasons of substantial public interest;

• establishing, exercising or defending legal claims; or

• another purpose permitted by law.

Access to health and care information is restricted to authorised personnel and service providers who require it for legitimate purposes.

8. Recruitment Information

When you apply for a position with Windmill Healthcare, we may collect:

• your contact details;

• curriculum vitae;

• employment and education history;

• professional qualifications;

• references;

• right-to-work information;

• interview notes;

• Garda vetting information, where applicable;

• occupational health or accommodation information, where appropriate; and

• information supplied by recruitment agencies or referees.

We use this information to assess your application, communicate with you, conduct appropriate checks and manage the recruitment process.

Unsuccessful applicant information will be retained only for an appropriate period, in accordance with our recruitment retention policy and applicable legal requirements.

9. Marketing Communications

We may send you marketing or informational communications where:

• you have provided your consent;

• the communication is otherwise permitted by applicable law; or

• we have another lawful basis for contacting you.

You may unsubscribe at any time by:

• using the unsubscribe facility contained in the communication; or

• contacting us at dpo@windmillhealthcare.ie.

Withdrawing from marketing communications will not prevent us from contacting you about an existing service, contract, enquiry or other non-marketing matter.

10. Sharing Personal Data

We may share personal data with appropriate third parties where this is necessary, lawful and proportionate.

These parties may include:

• healthcare professionals and care providers;

• the HSE and other relevant public bodies;

• regulatory and inspection authorities, including HIQA;

• emergency services;

• professional advisers, including solicitors, auditors and insurers;

• IT, hosting, telecommunications and cybersecurity providers;

• website developers and analytics providers;

• payroll, HR and recruitment service providers;

• training providers;

• contractors and facilities-management providers;

• financial institutions and payment-service providers;

• courts, law-enforcement bodies or other competent authorities;

• prospective purchasers, investors or professional advisers involved in a business reorganisation, where legally permitted; and

• other parties where you have authorised the disclosure.

Service providers that process personal data on our behalf are required to protect it, use it only for authorised purposes and comply with applicable data protection obligations.

We may also disclose personal data where required by law, court order, regulatory requirement, warrant or other lawful authority.

11. International Transfers

Some service providers may store or process personal data outside the European Economic Area.

Where personal data is transferred outside the EEA, Windmill Healthcare will ensure that an appropriate legal transfer mechanism and safeguards are in place. These may include:

• an adequacy decision issued by the European Commission;

• European Commission Standard Contractual Clauses;

• supplementary technical and organisational measures; or

• another lawful transfer mechanism permitted under the GDPR.

Further information about applicable safeguards may be requested by contacting dpo@windmillhealthcare.ie.

12. Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected and to meet applicable legal, regulatory, clinical, contractual and operational requirements.

Retention periods vary depending on:

• the nature and sensitivity of the information;

• the reason it was collected;

• applicable health and social-care record requirements;

• employment and taxation obligations;

• limitation periods for legal claims;

• regulatory requirements; and

• whether continued retention is necessary to protect residents, employees or Windmill Healthcare.

When personal data is no longer required, it will be securely deleted, destroyed or anonymised in accordance with our retention procedures.

13. Information Security

Windmill Healthcare uses appropriate technical and organisational measures to protect personal data against:

• unauthorised access;

• unlawful processing;

• accidental loss;

• alteration;

• unauthorised disclosure;

• destruction; and

• damage.

These measures may include:

• controlled and password-protected access;

• access restrictions based on staff roles;

• secure systems and servers;

• cybersecurity protections;

• staff confidentiality obligations;

• staff training;

• secure storage of paper records;

• data-backup and recovery procedures; and

• incident-management and breach-response procedures.

While we take appropriate steps to protect information, no method of transmission over the internet or electronic storage system can be guaranteed to be completely secure.

Where Windmill Healthcare becomes aware of a personal data breach, we will assess it and notify the Data Protection Commission and affected individuals where required by law. GDPR requires certain breaches presenting a risk to individuals to be reported to the relevant supervisory authority within 72 hours of becoming aware of the breach. (Data Protection Commission)

14. Your Data Protection Rights

Subject to applicable conditions, restrictions and exemptions, you may have the following rights:

Right to be informed

You have the right to receive clear information about how your personal data is collected and used.

Right of access

You may request confirmation as to whether we process your personal data and obtain a copy of that information, together with relevant information about the processing.

Right to rectification

You may ask us to correct inaccurate personal data or complete information that is incomplete.

Right to erasure

You may request the deletion of personal data in certain circumstances. This right is sometimes known as the “right to be forgotten”.

This is not an absolute right. We may need to retain information where required by law or where another lawful reason applies.

Right to restrict processing

You may ask us to restrict the processing of your personal data in certain circumstances.

Right to object

You may object to processing based on legitimate interests or the performance of a task in the public interest.

You also have the right to object at any time to the use of personal data for direct marketing.

Right to data portability

Where processing is based on consent or contract and is carried out by automated means, you may request that certain personal data be provided in a structured, commonly used and machine-readable format.

Right to withdraw consent

Where processing is based on consent, you may withdraw that consent at any time.

Rights relating to automated decision-making

You may have rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.

Windmill Healthcare does not ordinarily make decisions about website users based solely on automated processing.

Right to complain

You have the right to make a complaint to the Data Protection Commission.

The GDPR rights available to individuals and the restrictions that may apply depend on the circumstances of the processing. (Data Protection Commission)

15. Exercising Your Rights

To exercise a data protection right, contact:

Data Protection Office
Windmill Healthcare
Market House
Churchtown
Mallow
Co. Cork
Ireland

Email: dpo@windmillhealthcare.ie
Telephone: 022 34693

Please describe your request clearly and specify the information to which it relates.

We may need to ask for reasonable evidence of identity before acting on a request. This is to protect personal data from unauthorised access or disclosure.

We will respond within the period required by data protection law. In certain circumstances, this period may be extended where a request is particularly complex or where several requests have been made. We will inform you where an extension applies.

Data protection requests are generally dealt with free of charge. However, a reasonable fee may be charged, or a request may be refused, where permitted by law, including where a request is manifestly unfounded or excessive.

16. Complaints to the Data Protection Commission

We encourage you to contact Windmill Healthcare first so that we have an opportunity to address your concern.

You may also lodge a complaint with:

Data Protection Commission
21 Fitzwilliam Square South
Dublin 2
D02 RD28
Ireland

Telephone: 01 765 0100 or 1800 437 737

Contact details and complaint procedures are available from the Data Protection Commission.

17. Children’s Personal Data

Our website and services are not directed at children for marketing purposes.

We do not knowingly collect personal data directly through our website from children under the age of 16 without appropriate involvement or authorisation from a parent, guardian or other lawful representative.

Where information relating to a child is required for a legitimate care, employment, visitor, safeguarding or legal purpose, it will be processed in accordance with applicable data protection and safeguarding requirements.

Parents and guardians should supervise children’s use of the internet and should not permit children to submit personal data through our website without appropriate guidance.

18. Website Usage Information

When you use our website, certain technical information may be collected automatically, including:

• IP address;

• browser type;

• device type;

• operating system;

• pages visited;

• referring website;

• time and date of access;

• approximate location derived from an IP address; and

• website interaction and performance information.

This information may be used to:

• operate and secure the website;

• diagnose technical issues;

• prevent misuse or cyberattacks;

• understand how the website is used; and

• improve website content and performance.

Where technical information can identify or be linked to an individual, it will be treated as personal data.

Cookie Policy

19. What Are Cookies?

Cookies are small text files placed on a computer, smartphone or other device when a person visits a website.

Cookies can be used to:

• enable essential website functions;

• remember preferences;

• maintain security;

• measure website performance;

• understand how visitors use the site;

• display embedded or third-party content; and

• support advertising or marketing activities.

20. Types of Cookies We May Use

Strictly necessary cookies

These cookies are required for the website to operate or to provide a service explicitly requested by the user.

They may support:

• security;

• network management;

• accessibility;

• cookie-consent preferences; and

• essential website functions.

Strictly necessary cookies do not normally require consent, but information about their use should still be provided.

Analytics and performance cookies

These cookies help us understand how visitors use the website, including which pages are visited and whether users encounter errors.

In Ireland, analytics cookies generally require consent and must not be activated before valid consent has been obtained. (Data Protection Commission)

Functional cookies

These cookies allow the website to remember preferences and provide enhanced functionality.

Where they are not strictly necessary to provide a service requested by the user, they will only be used with consent.

Advertising or targeting cookies

These cookies may be used to build a profile of a visitor’s interests, measure advertising or display relevant content.

They will only be used where the user has provided consent.

Third-party cookies

Third-party services embedded within the website may place cookies or use similar technologies. These may include:

• video or media platforms;

• social-media services;

• mapping services;

• analytics providers; and

• recruitment or enquiry platforms.

The use of these services should be listed accurately in the website’s cookie-management platform and cookie table.

21. Cookie Consent

We do not rely on implied consent for non-essential cookies.

When you first visit the website, you will be presented with a cookie-consent tool that allows you to:

• accept non-essential cookies;

• reject non-essential cookies;

• select specific cookie categories; and

• review information about the cookies used.

Non-essential cookies should remain disabled unless and until you provide valid consent. Under GDPR, consent must be freely given, specific, informed, unambiguous and demonstrated through a clear affirmative action. (Data Protection Commission)

You may withdraw or change your cookie consent at any time through the cookie settings facility available on the website.

Withdrawal of consent will not affect the lawfulness of processing carried out before consent was withdrawn.

22. Managing Cookies Through Your Browser

You may also use your browser settings to:

• block cookies;

• delete existing cookies;

• receive warnings before cookies are placed; or

• browse using a private or incognito setting.

Blocking certain cookies may affect website functionality.

Browser settings do not replace the need for an appropriate website cookie-consent mechanism where non-essential cookies are used.

23. Cookie Details

The website should provide an up-to-date cookie table identifying:

• the cookie name;

• the organisation setting the cookie;

• its purpose;

• its category;

• whether it is a first-party or third-party cookie; and

• how long it remains on the user’s device.

The cookie table should reflect the cookies actually deployed on the Windmill Healthcare website. Linking only to a third party’s general cookie policy is not sufficient; the information provided must explain Windmill Healthcare’s own deployment and use of cookies. (Data Protection Commission)

24. Links to Other Websites

Our website may contain links to websites operated by other organisations.

Windmill Healthcare is not responsible for the privacy practices, security or content of third-party websites. You should review the privacy and cookie notices of those websites before submitting personal data.

25. Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect:

• changes to our services;

• changes to our processing activities;

• new technologies or service providers;

• legal or regulatory developments; or

• improvements to our privacy practices.

The updated notice will be published on this page and the “Last updated” date will be amended.

Material changes may also be communicated through other appropriate channels.