1. Our stance on personal data
2. Who are we?
Scotland’s Adoption Register is an independent membership organisation for professionals, foster carers and adopters, and anyone else working with or looking after children in or from care, or adults who have been affected by adoption. Our registered name and address is: Scotland’s Adoption Register, Great Michael House, 14 Links Place, Edinburgh, EH6 7EZ.
3. What information do we collect?
We collect only the personal data that we need to provide you with services, fulfil orders and keep in touch. The categories of personal information that we collect, process, store and share include:
- Personal details (name, email address, phone number, postal address)
- Professional details (workplace, job title, subject interests)
- Details of purchases (training events, workshops and conferences)
4. How do we process your personal data?
Scotland’s Adoption Register complies with its obligations under current GDPR and Data Protection legislation by using data only for the purposes for which it was collected; by keeping personal data up-to-date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data. We use your personal data for the following purposes:
- To administer membership records
- To deliver membership benefits to you (such as providing advice and information, sending newsletters and mailings, running forums)
- To effectively manage and provide commissioned training, workshops and conferences
- To recruit and manage our employees and volunteers
- To run our training and events
- To maintain our own accounts and records
- To record enquiries submitted to the Scotland’s Adoption Register advice line
- To operate the Scotland’s Adoption Register website and deliver the services that you have requested
- To process your financial payments
- To keep you informed about news, events, activities and services that are relevant to you
- To send you information about products and services that relate to your previous interests or where you have requested such information
5. What is our lawful basis for processing your personal data?
We will only process your personal data where we have a lawful basis (a legal reason allowing us to process personal data) to do so. The categories of lawful basis which apply to our processing of personal data are:
Where we have a record that shows you have given us express consent to use your personal data. This applies to the following purposes:
- Direct marketing (if requested to be added to our mailing list)
- Training, workshop and conference information
5.2. Legitimate interests
Where we are able to demonstrate a legitimate interest in using your personal data which has been balanced against your own interests, rights and freedoms as the data subject. This applies to the following purposes:
- Direct marketing (if based on e.g. previous purchases)
- Sending email newsletters and upcoming events to members
- Marketing workshops, training and conferences
- Administration of consortium and forum meetings and special interest group meetings
5.3. Compliance with legal obligations
Where we are required to process your personal data to comply with a common law or statutory obligation. This applies to the following purposes:
- Keeping financial records
5.4. Contractual necessity
Where it is necessary for us to process your information in order to fulfil our contractual obligations to you, or where you have asked us to do something prior to entering into a contract. This applies to the following purposes:
- Membership administration – signing up new members, renewing and cancelling membership
- Collecting membership fees
- Delivering membership benefits – sending mailings and books, organising and facilitating of member meetings and providing information around workshops and conferences relevant to the member
- Administrating groups – providing information to members regarding upcoming events, workshops, conferences, meetings and training relevant to the member
- Running training/events/workshops/consultancy services – booking delegates on to conferences and speakers
- Providing our advice line service
- Consultancy work – serving on adoption or fostering panels, chairing disruption meetings or any other specific contracted work carried out for you by Scotland’s Adoption Register
6. Sharing your personal data
6.1. Within Scotland’s Adoption Register
Your personal data will only be accessible to Scotland’s Adoption Register staff who need to process it for the purposes of providing services, fulfilling orders and keeping in touch, and for the purposes of processing payments.
6.2. With Third Parties
We sometimes share your personal data with trusted third parties (other organisations or companies that we work with or which provide services to us). For example in compiling a delegate list for meetings, workshops and conferences when circulating information among our members by e-mail.
We apply the following policies to those organisations to keep your data safe and protect your privacy:
- We provide only the information they need to perform their specific services
- They may only use your data for the exact purposes we specify in our contract with them
- We work closely with them to ensure that your privacy is respected and protected at all times
- If we stop using their services, any of your data held by them will either be deleted or rendered anonymous
7. How long will we keep your personal data?
Whenever we collect or process your personal data, we will only keep it for as long as necessary for the purpose for which it was collected.
At the end of that retention period, your data will either be deleted completely or anonymised, for example by aggregation with other data so that it can be used in a non-identifiable way for statistical analysis and business planning. Some examples of customer data retention periods:
- Your membership – while the membership is current and for 3 years after the membership expires
- Financial data: records of sales e.g. invoices and receipts – for 6 years plus the current financial year
- Making an enquiry to the Advice Line – for 6 years
- Attendance at our training, workshop, conferences or other events – while membership is current and for 3 years after the membership expires
- You working for us as a member of staff, associate or volunteer – payroll records for 6 years, health and safety records for 3 years, basic employment details indefinitely
8. Further processing
9. How will we secure your personal information?
We know how much data security matters to you. With this in mind, we will treat your data with the utmost care and take all appropriate steps to protect it. We employ a variety of physical and technical measures to keep your data safe and to prevent unauthorised access to or use or disclosure of your personal information.
Electronic data and databases are stored on secure computer systems and we control who has access to information (using both physical and electronic means). Our staff all receive data protection training and we have a set of detailed data protection procedures that personnel are required to follow when handling personal data.
We secure access to all transactional areas of our websites using ‘https’ technology.
Access to your personal data is password-protected, and sensitive data (such as payment card information) is secured by SSL encryption.
10. Your rights and your personal data
We want to ensure that you remain in control of your personal data. Part of this is making sure you understand your legal rights.
10.1. An overview of your different rights
You have the right to request:
- Access to the personal data we hold about you, free of charge in most cases
- The correction of your personal data when incorrect, out of date or incomplete
- The deletion of your personal data, for example, when you withdraw consent, or object and we have no legitimate overriding interest, or once the purpose for which we hold the data has come to an end
- That we stop using your personal data for direct marketing (either through specific channels, or all channels)
- That we stop any consent-based processing of your personal data after you withdraw that consent
- Review by Scotland’s Adoption Register, of any decision
You have the right to request a copy of any information about you that Scotland’s Adoption Register holds at any time, and also to have that information corrected if it is inaccurate. To ask for your information, please email email@example.com or write to Scotland’s Adoption Register, Great Michael House, 14 Links Place, Edinburgh, EH6 7EZ.
To ask for your information to be amended, please update your online account (where applicable), or speak to us. If we choose not to action your request we will explain to you the reasons for our refusal.
10.2. Your right to withdraw consent
Whenever you have given us your consent to use your personal data, you have the right to change your mind at any time and withdraw that consent.
10.3. Where we rely on our legitimate interest
In cases where we are processing your personal data on the basis of our legitimate interest, you can ask us to stop for reasons connected to your individual situation. We must then do so unless we believe we have a legitimate overriding reason to continue processing your personal data.
10.4. Direct marketing
You have the right to stop the use of your personal data for direct marketing activity through all channels, or selected channels. We must always comply with your request.
10.5. Checking your identity
Scotland’s Adoption Register tries to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously and encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office. You can contact them by calling 0303 123 1113 (local rate) or email firstname.lastname@example.org.
12. Contacting us
For further information on how your information is used, how we maintain the security of your information, and your rights to access information we hold on you, please contact us:
- By email at email@example.com
- Or write to us at Scotland’s Adoption Register, Great Michael House, 14 Links Place, Edinburgh, EH6 7EZ