Privacy

5 Recipients of Your Personal Data

5.1 We may disclose your Personal Data:

(a) To GOAL employees and consultants who have a need to access the information for a lawful purpose;

(b) To members of the GOAL group (including affiliates, subsidiaries, branches and liaison offices), within or outside of the European Economic Area ("EEA"). Any such disclosure will be subject to strict obligations to protect your Personal Data and to process it on our behalf and under our control only;

(c) If we are under a duty to disclose or share your Personal Data in order to comply with any legal obligation or court order, or in order to enforce, establish, exercise or defend legal rights, the rights, property, or safety of you, us, our group, or employees, for example to statutory and regulatory authorities and government bodies;

(d) To third parties who provide a service to us who process Personal Data our behalf and are bound by confidentiality provisions, for example legal advisors, banks, payment providers, insurance and health providers. Any such disclosure will be subject to strict obligations to protect your Personal Data; and

(e) In the event that we restructure or reorganise our organisation or enter into a merger or acquisition in which case we may disclose your Personal Data to the relevant parties.

5.2 We may also provide data that is not Personal Data to third parties, [where such information is combined with similar information of other users of our Website]. For example, we might inform third parties regarding the number of unique users who visit our Website, the demographic breakdown of our community users of our Website, or the activities that visitors to our Website engage in while on our Website. The third parties to whom we may provide this information may include our Website design, development and hosting contractors.

6 Special Categories of Personal Data

6.1 Certain categories of your Personal Data are regarded as 'special'. Special data includes information relating to an individual's physical or mental health, religious, philosophical or political beliefs, trade union membership, ethnic or racial origin, biometric or genetic data and sexual orientation.

6.2 We will only process any special categories of your Personal Data where necessary under employment, social security, or social protection law or, where otherwise authorised by law. We will only process data relating to your criminal convictions or involvement in criminal proceedings when permitted by law or where provided voluntarily by you and only in the context of an application for employment.

7 Link to Other Websites

We may, from time to time, provide links to third party websites or which we believe may be of interest or that are relevant to the work we do. If you use these links, you will leave our Website, and you should note that we do not have any control over other websites and cannot be responsible for the protection and privacy of any information that you provide while visiting such sites. Providing a link to third party websites does not mean that we endorse or warrant the services provided by or activities of any third parties and this Privacy Statement does not govern such sites. These third parties will have their own privacy notices that will govern the data they collect.

8 Where We Transfer and Store Your Personal Data

8.1 The Personal Data that we collect from you may be transferred to, and stored at, a destination outside the EEA, for the purposes described above. Due to the global nature of our organisation, your Personal Data may be disclosed to entities in the Group outside the EEA, including in particular countries where our management offices are located (USA, Turkey and Jordan) and our programme countries (Ethiopia, South Sudan, Sudan, Zimbabwe, Sierra Leone, Niger, Iraq, Syria, Malawi, Honduras, Haiti, and Uganda). Please note this list may change from time to time. It may also be processed by personnel operating outside the EEA who work for us or for one of our suppliers who act on our behalf.

8.2 There are adequacy decisions in place in respect of the countries listed on the European Commission website which can be found here. Where GOAL transfers Personal Data to these locations, it will rely upon these adequacy decisions to do so in accordance with Article 45 of the GDPR. In respect of all transfers to all other countries (for which there are no adequacy decisions), we use standard contractual clauses approved by the European Commission in accordance with Article 46 of the GDPR. You can request further information on our data transfers (including a copy of standard contractual clauses or information on which adequacy decisions are being relied upon) by contacting us at DPO@goal.ie.

9 Your Rights

9.1 To the extent that we are a controller of your Personal Data you may request access to, rectification, or erasure of your Personal Data, or restriction of processing or object to processing of your Personal Data, as well as the right to data portability. In each case, these rights are subject to restrictions as laid down by law. The following is a summary of your rights:

(a) The right of access enables you to receive a copy of your Personal Data

(b) The right to rectification enables you to correct any inaccurate or incomplete Personal Data we hold about you

(c) The right to erasure enables you to ask us to delete your Personal Data in certain circumstances

(d) The right to restrict processing enables you to ask us to halt the processing of your Personal Data in certain circumstances

(e) The right to object enables you to object to us processing your Personal Data on the basis of our legitimate interests (or those of a third party) or where we are processing your Personal Data for direct marketing purposes

(f) The right to request restriction of processing of your Personal Data enables you to ask us to suspend the processing of your Personal Data in the following scenarios:

• If you want us to establish the data's accuracy.
• Where our use of the data is unlawful, but you do not want us to erase it.
• Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.
• You have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it

(g) The right to withdraw consent applies where we are relying on consent to process your Personal Data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.

(h) The right to data portability enables you to request us to transmit Personal Data that you have provided to us, to a third party without hindrance, or to give you a copy of it so that you can transmit it to a third party, where technically feasible.

(i) As a general rule, you have a right to request not to be subject to a decision based on automated processing (including profiling) which produces legal or similarly significant effects and to have safeguards put in place if any such processing of your Personal Data occurs.

9.2 If you have concerns about our processing of your Personal Data, we encourage you to contact us first at DPO@goal.ie so that we can attempt to resolve the issue. You also have the right to make a complaint to a data protection supervisory authority at any time.  The Data Protection Commission ("DPC") is the Irish supervisory authority and can be contacted at info@dataprotection.ie. In the UK the relevant supervisory authority is the Information Commissioner's Office ("ICO") and they can be contacted via the complaints form on their website at Make a complaint | ICO.

9.3 If you wish to exercise any of these rights, please contact us (see Contact Us below). We will respond to your request within one month. That period may be extended by two further months where necessary, taking into account the complexity and number of requests. We will inform you of any such extension within one month of receipt of your request. We may request proof of identity to verify your request and to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.  We have the right to refuse your request where there is a basis to do so in law, or if it is manifestly unfounded or excessive, or to the extent necessary for important objectives of public interest.

9.4 If you have opted-in to receiving communications from us you will at all times have the option to unsubscribe from such communications. If you do not wish to continue to receive correspondence from us, you can opt-out by clicking on the "unsubscribe" link in any emails which we might send you or by contacting us via unsubscribe@goal.ie or call +353 1 280 9779.

10 Retention of Your Information

10.1 Personal data will be stored for as long as required to satisfy the purpose for which the Personal Data was collected and used, unless a longer period is necessary for our legal obligations or for the exercise or defence of legal claims. Statutory retention periods apply to certain records including information we are required to retain for tax reporting purposes. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements.

10.2 We have a specific retention policy in place for Personal Data which we process in connection with our donors and people who fundraise on our behalf, If you send us information in connection with a job application, we may keep it for up to 2 years if you specifically request that we retain your Personal Data for contacting you about job vacancies. Thereafter, we and our duly authorised delegates will refrain from collecting any further Personal Data on you and shall take appropriate steps to dispose of any records containing your personal data, to the extent this is operationally feasible and proportionate. We reserve the right to delete and destroy all the information collected about you in accordance with our retention policies unless otherwise required by law.

11 Security

11.1 YYour Personal Data is protected by a secure system both online and offline. Your information will be stored on a secure, computerised database which seeks to prevent loss, misuse, unauthorised access or disclosure, alteration or destruction of this information.

11.2 The data you provide will be transmitted via SSL encryption (Secure Sockets Layer) which is the standard security technology for establishing an encrypted link between a web server and a browser. This link ensures that all data passed between the web server and browsers remain private and integral. SSL is an industry-standard and is used by millions of websites in the protection of their online transactions with their customers.

11.3 We will always endeavour to protect your Personal Data from loss, misuse, unauthorised access or disclosure, alteration or destruction. We are committed to providing security for your information, including working with leading suppliers of secure payment services. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Statement and Data Protection Law.

11.4 GOAL use industry-standard efforts to safeguard the confidentiality of your personally identifiable information. Unfortunately, no collection or data transmission over the Internet can be 100% secure. While we strive to protect your Personal Data from loss, misuse or alteration, we cannot ensure or warrant the security of any transmission, and you transfer the Personal Data at your own risk.

12 Children

Our websites are not intended for children, and we do not knowingly collect data relating to children. If you have reason to believe that a child has provided personal information to us, please contact us at DPO@goal.ie, and we will use commercially reasonable efforts to delete that information unless we are required, by law or in connection with the enforcement or defence of our rights, to retain this information unless we are required, by law or in connection with the enforcement or defence of our rights, to retain this information.

13 Changes to this Privacy Statement

We may revise this Privacy Notice from time to time. We advise you to review this page regularly to stay informed of any changes and to make sure that you are happy with any changes.

This Privacy Statement was last updated in June 2026.

14 Contact Us

14.1 If you have any questions about this Privacy Statement, including any requests to exercise your legal rights please email the Data Protection Officer at DPO@goal.ie; write to Data Protection Officer, GOAL, PO Box 19, Dun Laoghaire, Co Dublin; or call +353 1 280 9779.

14.2 14.1 Further information in respect of your rights is available at the websites of the DPC, www.dataprotection.ie and the ICO, https://ico.org.uk/.