Privacy Notice
This privacy notice covers how the Scottish Civic Trust (‘we’, ‘us’, ‘our’, ‘the Trust’) treats the personal identifiable information (personal data) that we collect. Personal Data is factual information that both identifies and relates to a living individual, and includes any expression of opinion about the individual.
The notice includes where we collect data, why we collect your data, what we collect and who it is provided to. The notice also explains the legal basis on which we do this.
The notice applies to all personal data regardless of format or medium, including paper, electronic, audio, visual, microfilm and photographic. Unless stated otherwise, our current Privacy Notice applies to all information that we have about you.
Scottish Civic Trust knows that you care how information about you is used and shared and we appreciate your trust in us to do so lawfully, carefully and sensibly. As the Data Controller, the Trust complies with the six data protection principles as laid out by the Information Commissioner’s Office.
Where do we collect your personal information and why?
Our website: We operate a Website located at scottishcivictrust.org.uk from which users can gather information about news and services provided by the Trust. We collect information you provide by filling in one of our online application or submission forms, and we will use this to keep you updated about job vacancies for the purpose of progressing your application and assess your suitability, or for nominations you submit for our awards schemes. You may withdraw this consent at any time by emailing us at sct@scottishcivictrust.org.uk or writing to us using the information at the end of this notice.
E-Newsletter subscribers: We issue a regular e-newsletter from which users can gather information about news and services provided by the Trust. If you have signed up to receive our e-bulletin, you will receive communications from us including our e-bulletin and other information on our events and activities. You are able to ‘unsubscribe’ at any time by clicking the “Unsubscribe” option at the bottom of every newsletter. To distribute our e-bulletins, we use a third party provider, Mailchimp, to deliver them on our behalf. Using Mailchimp also allows us to gather statistics relating to email opening which helps us improve our communications. For more information, please see the Mailchimp Privacy Notice.
Donations and Fundraising: When receiving your donation we will collect personal data from you via the online donation platform that we use. If we have not done so already, we will seek your consent to continue to receive communications from us. We will share only your name with our auditor for normal disclosure purposes and we might publish your name, and only your name, on an annual report or similar. You may withdraw this consent at any time by emailing us at sct@scottishcivictrust.org.uk or writing to us using the information at the end of this notice.
What personal information do we collect about users?
Information You Give Us: We receive and store any information you enter on our website or give us in any other way. You can choose not to provide certain information, but then you might not be able to take advantage of several of our features. We use the information that you provide for such purposes as responding to your requests and communicating with you.
Automatic Information: We receive and store certain types of information whenever you interact with us. For example, we use “cookies” to recognise your browser and provide various features. Although we will not be able to provide you with a personalised experience at scottishcivictrust.org.uk if we cannot recognise you, we want you to be aware that these tools exist.
What are cookies?
Cookies are small text files placed on your computer by websites that you visit. They are widely used in order to make websites work or work more efficiently, and they can help to provide information to the Scottish Civic Trust.
We use the following types of cookies: analytical/ performance cookies and functionality cookies.
What is the lawful basis we are relying on to use personal information?
We collect and use this information under the following lawful basis:-
Article 6 of the UK Data Protection Act:
- You, or your legal representative, have given consent to this particular information being used (Art 6(1)(a));
- It is necessary for compliance with a legal obligation to which we are subject (Art 6(1)(c).
Article 9 of the UK Data Protection Act:
- You, or your legal representative, have given explicit consent to this particular information being used (Art 9(2)(a))
- For reasons of substantial public interest based upon the law (Art 9(2)(g)).
To ensure our processing of data is lawful, fair and transparent, the Scottish Civic Trust maintains a Register of Data Processing Activities, which notes the legal basis for all data processing. The Register of Data Processing Activities is reviewed at least annually.
Who do we share your information with?
The Scottish Civic Trust will not disclose personal data to any third party unlawfully. We only share user information as described below:
Event Organisers at External Venues: Where we are obliged to share personal data of event attendees, such as for an event we might hold at an external venue when the invitation list must be shared for security reasons (e.g. at the Scottish Parliament building), we will make this clear when we collect the information. In these cases where we use a contractor to process Personal Data on our behalf, we must be satisfied that the recipient of any such data already is taking adequate steps to meet its obligations as the Data Processor and allow the Scottish Civic Trust to meet our obligations at the Data Controller under the GDPR. Further, they must process the personal information in accordance with this Privacy Notice and as permitted by the UK’s Data Protection Act.
Third Party Service Providers: We may employ other companies and individuals to perform functions on our behalf, such as MailChimp, which we use to send emails. They have access to personal information needed to perform their functions, but may not use it for other purposes. In these cases where we use a contractor to process Personal Data on our behalf, we must be satisfied that the recipient of any such data already is taking adequate steps to meet its obligations as the Data Processor and allow the Scottish Civic Trust to meet our obligations at the Data Controller under the GDPR. Further, they must process the personal information in accordance with this Privacy Notice and as permitted by the UK’s Data Protection Act.
Protection of Scottish Civic Trust and Others: We release personal information when we believe release is appropriate to comply with the law; or protect the rights, property or safety of the Trust, our users or others. This does not include selling, renting, sharing or otherwise disclosing personally identifiable information from customers for commercial purposes in a way that is contrary to the commitments made in this Privacy Notice.
With Your Consent: Other than as set out above, you will receive notice when information about you might go to third parties and you will have an opportunity to choose not to share the information.
How secure is your information?
The Scottish Civic Trust takes appropriate technical and organisational security measures to safeguard personal information and has established information security procedures for both manual and electronic records, subject to appropriate risk assessment.
The Scottish Civic Trust ensures that:
- Personal data stored electronically is secure, using up-to-date software.
- Access to personal data is limited to personnel who need access and appropriate security is in place to avoid unauthorised sharing of information.
- Personal data is deleted securely, such that the data is irrecoverable.
- Appropriate back-up and disaster recovery solutions are in place.
How long do we keep your information?
We will not retain any of the information you provide for any purpose for any longer than is necessary.
What rights do you have in relation to your personal information?
Your personal data is protected by the General Data Protection Regulation (GDPR). The GDPR was approved by the EU Parliament on 14 April 2016 and is enforceable from 25 May 2018. It is fully absorbed into UK law through the Data Protection Act 2018. It is designed to standardise data privacy laws throughout the EU to ensure a consistent approach to all EU citizens’ data privacy. The GDPR establishes a framework of rights and duties which balance the need of organisations to collect and process Personal Data for clearly defined purposes with the right of the individuals to confidentiality. These individuals are known as Data Subjects.
As a Data Subject, you have certain rights in respect of the data we hold relating to you. The GDPR provides the following rights for Data Subjects:
- The right to be informed
- The right of access to data held
- The right to rectification
- The right to erasure of the data held
- The right to restrict processing
- The right to data portability
- The right to object
- The rights related to automated decision making and profiling
In order to exercise these rights or if you have any concerns about our use of your personal information, please contact the Data Manager using the information at the end of this notice.
We will endeavour to keep your information accurate. If at any time after giving us this information it becomes out of date, then we ask you to notify us directly and we shall remove or amend the information within a reasonable time frame.
Are children allowed to use scottishcivictrust.org.uk?
Scottishcivictrust.org.uk does not display information that might be considered unsuitable for children. However, our information is generally aimed at an adult (18+) audience. If you find content that you think may be unsuitable for children, please let us know.
Other websites
Our website contains links to other websites. If you click and follow those links, then these will take you to the other websites. We do not provide any personally identifiable customer information to these websites.
This privacy notice only applies to our website. Other websites may collect personal information from you. When you use a link to another website, you should read the privacy policy of that site to understand how your personal information is collected and used by them.
Changes to our Privacy Notice
We keep our privacy notice under regular review. This privacy notice was updated in October 2022. We reserve the right to update this privacy notice at any time and we will advise you should we make any substantial update to it.
How to contact us
If you have any questions about our privacy notice or the information we hold about you please contact us at sct@scottishcivictrust.org.uk, or by post to:
Data Manager
Scottish Civic Trust
The Tobacco Merchant’s House
42 Miller Street
Glasgow
G1 1DT