1. Introduction

We have developed this Data Protection Statement to illustrate our commitment to the protection of the privacy and personal information of data subjects who interact with King’s Inns.

The purpose of this Data Protection Statement is to provide you with a clear understanding of:

• how we process your information

• the types of your personal information which we collect;

• how we use and share your personal information;

• how we protect your data protection rights;

• details on how you can find out more about how we use your personal information; and

• other details relevant to how we give effect to the privacy rights of individuals who interact with King’s Inns and the King’s Inns website.

When we refer to “Personal Data” in this Data Protection Statement we mean any information relating to an identified or identifiable natural person (‘Data Subject‘); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

In some situations where we are collecting and/or processing your personal information, we will provide you with further details about the information we are collecting, the purposes for which we are using and sharing that information as well as any other information which is particularly relevant to such situations. When we do so, we may also refer back to this Data Protection Statement and the general principles set out here.

1.1 Organisation Information

We are The Honorable Society of King’s Inns (referred to herein as “we”, “us”, “our” and the “King’s Inns”).

1.2 LEGISLATION

All personal data we gather will be “processed” in accordance with all applicable data protection laws and principles, including the EU General Data Protection Regulation 2018 (‘GDPR’) and the Data Protection Acts 1988, 2003 and 2018.

1.3 QUERIES AND COMPLAINTS

If you have any questions about this Data Protection Statement or the way in which your Personal Data is being used by us, please contact:

Data Protection Officer

King’s Inns, Henrietta Street, Dublin 1, DO1 KF59, Ireland

Email: data.privacy@kingsinns.ie

Telephone: +353 1 874 4840

You have the right to lodge a complaint with the Office of the Data Protection Commission. To contact the Office of the Data Protection Commission, please use the following details:

Data Protection Commission

Address: 6 Pembroke Row Dublin 2 D02 X963 Ireland

Telephone: (01) 765 01 00 / 1800 437 737

Email: info@dataprotection.ie

For your convenience we have divided our Data Protection Statement into sections:

2. ABOUT US

King’s Inns is the oldest institution of legal education in Ireland. Its main objectives are:

• the promotion and advancement of learning in the law;

• the education and training of students and members of the King’s Inns;

• the protection and furtherance of the reputation and standing of the degree of Barrister–at–Law;

• the preservation of the heritage that is comprised in the King’s Inns, its buildings, library, furnishings, and environs; and

• to ensure the fitness of persons to practise as or to hold themselves out as barristers prior to and, subject to Part 6 of the Legal Services Regulation Act 2015, after their call to the Bar of Ireland.

In addition to our main activities listed above, the King’s Inns provides a number of products and services including merchandising, newsletters, dining services, cottage rental, venue hire, and parking services. Our Data Protection Statements provides further information about the Personal Data we process in connection with these activities.

3. WHO THIS DATA PROTECTION STATEMENT APPLIES TO?

We process Personal Data about a wide range of people. This general section includes information relevant to all Data Subjects including:

• users of our website,

• individuals identified on our CCTV system; and

• individuals who receive marketing communications.

We have included further details about our processing activities relating to Students, Members, Business Contacts, and Job Applicants in specific sections of this Data Protection Statement as follows:

4. HOW DO WE COLLECT PERSONAL DATA?

We receive Personal Data from a variety of sources, as follows:

• the Personal Data is often provided by the data subjects themselves as part of the relationship;

• the Personal Data may be collected from public sources;

• the Personal Data may be collected indirectly from another person;

• the Personal Data may be collected through our website;

• the Personal Data may be collected through our systems, including CCTV;

• the Personal Data may be collected indirectly from a website or from a third party.

5. CATEGORIES OF PERSONAL DATA

We process the following categories of Personal Data. For each category we have included an example of the type of Personal Data that may be part of that category:

6. LAWFULNESS OF PROCESSING

We process all Personal Data lawfully and in accordance with the requirements of the law. The GDPR sets out the legal grounds for processing Personal Data.

When we process General Contact Personal Data any one of the following legal grounds will generally apply. If we operate under a legal ground, that is not listed below, we will try to ensure you are informed what that is.

Consent

For certain processing activities we may rely on your consent. Where we are unable to collect consent for a particular processing activity, we will only process the Personal Data if we have another lawful basis for doing so.

You can withdraw consent provided by you at any time by contacting us at data.privacy@kingsinns.ie. If you do withdraw your consent, it does not mean that any processing, with your consent, of your personal data up to that point is unlawful.

Your right to withdraw consent also relates to our use of your personal data for marketing purposes. You may withdraw your consent to receiving marketing communications from us by contacting us at data.privacy@kingsinns.ie or by using the “Unsubscribe” option available to you in each communication.

Please note that if you have opted in and consented to receive any information from our associated organisations, third parties or our partners and you wish to unsubscribe from their marketing or communications, please contact those organisations directly or use the “Unsubscribe” option available to you in their communications.

Contract

We will process Personal Data where necessary to perform our obligations relating to or in accordance with any contract that we may have with you or to take steps at your request prior to entering into that contract.

Legitimate Interest

At times we will need to process your Personal Data to pursue our legitimate interests, for example for administrative purposes, to collect debts owing to us, to provide information to you, to operate, evaluate, maintain, develop and improve our websites and services or to maintain their security and protect intellectual property rights.

We will not process your Personal Data on a legitimate interest basis where the impact of the processing on your interests or fundamental rights and freedoms outweigh our legitimate interests. You may object to any processing we undertake on this basis. If you do not want us to process your Personal Data on the basis of our legitimate interests, contact us at data.privacy@kingsinns.ie and we will review our processing activities.

Legal Obligation

If we have a legal obligation to process Personal Data, we will process Personal Data on this legal ground.

Defence of Legal Claims

In limited circumstances and in accordance with the law we may use Personal Data in the defence of legal claims or enforcing legal rights.

7. OUR PROCESSING ACTIVITIES

The table below sets out the purpose for which we collect General Contact – Personal Data, our lawful basis for doing so, and the Personal Data that we collect.

In limited circumstances we may need to use your Personal Data for purposes other than those stated when we collected the Personal Data. Should this happen, we will notify you of this new purpose.

8. SECURITY OF YOUR PERSONAL INFORMATION

We will take all steps reasonably necessary to ensure that all Personal Data is treated securely in accordance with this Data Protection Statement and the Data Protection Laws. In particular, we have put in place appropriate technical and organisational procedures to safeguard and secure the Personal Data we process.

We monitor for and do everything we can to prevent security breaches of the Personal Data that we process. Once we have received your Personal Data, we will use strict procedures and security features for the purpose of preventing unauthorised access and ensuring that only those who need to have access to your Personal Data can access it.

We also use secure connections to protect Personal Data during its transmission. Where you have been given (or where you have chosen) a password which enables you to access services, you are

HSKI DP Statement V5 May 2026 © The Honorable Society of King’s Inns 9

responsible for keeping this password confidential. Please do not share your password with anyone.

If you think that there has been any loss or unauthorised access to Personal Data of any individual, please let us know immediately.

9. DISCLOSURE OF PERSONAL DATA

We will need to share your Personal Data in order to provide services to you and in certain circumstances we may disclose your Personal Data as follows:

• to business partners and sub–contractors for the performance of any contract relating to services provided by the King’s Inns;

• to tax, audit or other authorities, if we are under a duty to disclose or share Personal Data in order to comply with any legal obligation or in order to enforce or apply any contract that we have;

• to official authorities to protect our rights, property, or safety, or those of other persons (including you);

• to payment service partners for the processing of payments to and from King’s Inns, to screen for fraud and carry out other related activities;

• to our catering and events management partners;

• to King’s Inns insurance brokers and providers where required for administering claims;

• to our email distribution partner and service providers in the case of marketing and newsletters;

• to other academic institutions and partners in the case of marketing and promotions of the King’s Inns;

• to the Residential Tenancies Board in the case of our rental properties; and

• to our subcontractors involved in the maintenance and repair of the rental property, in advance and with notification to the tenant.

Some of the parties to whom we disclose your Personal Data may be located outside of the European Economic Area (EEA), however, we will always ensure that this is done in compliance with the relevant laws.

We will only use and share Personal Data outside of the EEA if necessary. We will ensure that any transfer of Personal Data outside of the EEA is undertaken using legally compliant transfer mechanisms and in accordance with the GDPR, such as Standard Contractual Clauses

10. RETENTION OF YOUR PERSONAL DATA

We will only retain your Personal Data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal or reporting requirements. This means that the period of time for which we store your Personal Data may depend on the type of data we hold. To determine the appropriate retention period for Personal Data, we consider the amount, nature and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements.

The table below outlines a general summary of our retention periods:

We may retain certain Personal Data beyond the periods specified herein in some circumstances such as where required for the purposes of legal claims. We may also delete Personal Data earlier than the specified Retention Period where the Personal Data is no longer required for the purpose.

Further information is set out in the relevant sections of this Data Protection Statement.

11. YOUR RIGHTS

You have a number of rights when it comes to your personal data. On receipt of a valid request to invoke one of your rights, we will do our best to adhere to your request as promptly as reasonably possible, however, restrictions may apply in certain situations.

Right of Access

You have a right to know what personal data we hold on you, why we hold the data, and how we are using the data. When submitting your request, please provide us with information to help us verify your identity and as much detail as possible to help us identify the information you wish to access (i.e. date range, subject of the request).

Identity verification will require a copy of your photographic ID. If the request is submitted by a third party (such as a solicitor) on your behalf, the request will be required to include written authorisation from you for the provision of a specific data to the third party.

We will provide the first copy of your personal data free of charge, but we may charge you a reasonable fee for any additional copies.

We cannot give you access to a copy of your personal data in some limited cases where permitted under applicable data protection laws, including where this might adversely affect the rights and freedoms of others.

Right to Rectification

You have a right to request that the personal data held in relation to you is up to date and accurate. Where information is inaccurate or incomplete, we encourage you to contact us to have this information rectified. Upon receipt of your request, we will ensure that the personal data is rectified and as up to date as is reasonably possible.

Right to Erasure

In some circumstances you can ask for your personal data to be deleted, for example, where:

• your personal data is no longer needed for the reason that it was collected in the first place

• you have removed your consent for us to use your personal data (where there is no other lawful basis for us to use it)

• there is no lawful basis for the use of your personal data

• you object to the use of your personal data and there are no overriding legitimate grounds for the use of the data.

• deleting the personal data is a legal requirement

Please note that we can’t delete your personal data where:

• we are required to have it by law

• it is used for freedom of expression

• it is used for public health purposes

• it is used for scientific or historical research or statistical purposes where deleting the personal data would make it difficult or impossible to achieve the objectives of the processing

• it is necessary for legal claims.

Right to Restriction

You have the right to restrict the extent for which your personal data is being used by us in circumstances where:

• You believe the personal data is not accurate (restriction period will exist until we update your information).

• The processing of the personal data is unlawful, but you wish to restrict the use of the data rather than erase it.

• Where the personal data is no longer required by us, but you require the retention of the data for the establishment, exercise, or defence of a legal claim.

• You have a pending objection to the future use of your personal data.

When the use of your data has been restricted, your personal data will only be further used:

with your consent;

• for the establishment, exercise or defence of legal claims;

• for the protection of the rights of other people; or

• for reasons important to public interest, such as for the protecting against cross-border threats or ensuring high standards of quality and safety of health care.

We will contact you to confirm where the request for restriction is fulfilled and will only lift the restriction after we have informed you that we are doing so.

Right to Data Portability

You have the right to the provision of all personal data, which you provided to us, provided to you in a structured, commonly used and machine-readable format where:

• The lawfulness of the use of your personal data by us is reliant on the provision of your consent.

• The data is being utilised by fully automated means.

You may also request that we send this personal data to another legal entity where technically feasible. We will only refuse such a request if the data being requested may adversely affect the rights and freedoms of others.

Right to Object

You have the right to object to the further use of your personal data where:

• The lawfulness of the use of your personal data by us is reliant on the basis of our legitimate interests.

• Where the data is non-sensitive and being used for reasons in the public interest.

• Where the data is being used for direct marketing purposes.

If you wish to object to the use of your data, please contact us with your request. We will then stop using the data or personal data unless it is required for legal proceedings.

Right to withdraw consent

Where we are processing your personal data based on your consent, you will have the right to withdraw consent at any time. If you wish to withdraw your consent, please contact us with your request. We will then stop the further processing of your personal data.

Right not to be subject to Automated Decision-Making Profiling

You have the right not to be subject to a decision based solely on automated processing where such decisions would have a legal effect or significant impact on you.

This right shall not apply where the processing is necessary for a contract with you, or the processing is undertaken with your explicit consent or the processing is authorised by law.

Right to Complain

You have the right to lodge a complaint with the local supervisory authority for data protection in the EU member state where you usually reside, where you work or where you think an infringement of data protection law took place.

Where do I send requests?

Please send all requests to the contact details provided in Section 1, with as much detail as possible regarding your requirements to enable us to deal with your request efficiently. To answer your request, we may ask you to provide identification for verification purposes.

How long will a request take to complete?

Upon receipt of a request, we will have 30 days to provide a response, with an extension of two further months if required. If we require more time to deal with your request, we will notify you of the delay, and of the factors responsible for the delay, within 30 days of the receipt of your request. If we refuse your request, we will notify you within 30 days of the receipt of the request accompanied by the reason for refusal.

You are entitled to contact the Office of the Data Protection Commissioner if we refuse your request.

How much does it cost to submit a request?

We will not charge a fee for any requests, provided we do not consider them to be unjustified or excessive. If we do consider these to be unjustified or excessive, we may charge a reasonable fee (also applicable for multiple copies) or refuse the request.

12. USE OF THIRD PARTY WEBSITES

Websites that you access via a link on the King’s Inns website are outside our control and are not covered by this Data Protection Statement. If you access other websites using the links provided, the operators of these websites may collect Personal Data from you, which will be used by them in accordance with their own data protection statements, which may differ from ours. Please check the data protection statements on those websites before you submit any Personal Data to them.

13. COOKIES

Please see our separate Cookie Notice available for further information.

14. AMENDMENTS TO THIS DATA PROTECTION STATEMENT

We will post any changes on the Website and when doing so will change the effective date at the top of this Data Protection Statement.

In some cases, we may provide you with additional notice of changes to this Data Protection Statement, such as via email. We will always provide you with any notice in advance of the changes taking effect where we consider the changes to be material.