Privacy and Cookie Policy

INTRODUCTION
Scottish Refugee Council is committed to protecting your privacy and being transparent
about the collection and the use of your personal data.
The purpose of this Notice is to explain how Scottish Refugee Council processes your data,
whether you are using our services, you are interested in working or volunteering with us,
making a donation, involved in our New Scots Connect initiative, or just browsing our
website.
We may update this Notice from time to time to reflect changes in our practices or in the law
but if we do so, we will provide you with access to an updated copy of this Notice as soon
as reasonably practical. This Notice was last updated on 19 July 2022.
CONTENT
1.
2.
3.
4.
5.
6.
7.
8.
9.
1.

How to contact us
General information
Using our services
Supporting our cause
Interested in working or volunteering with us
Browsing our website, Cookies and Google Analytics
New Scots Connect map and forum
Your rights
Complaints
HOW TO CONTACT US

If you have any queries about Scottish Refugee Council’s Privacy Notice or the way weprocess your personal information, please contact: The Data Protection Officer, Scottish
Refugee Council, Portland House, 17 Renfield Road, G2 5AH or email
data@scottishrefugeecouncil.org.uk
Please contact us as soon as possible after there is any change to your personal details,
including your contact details.
2.

GENERAL INFORMATION

Retention periods
Generally, we will not hold your personal data for any longer than is necessary for the uses
outlined in this Notice, unless we are required to keep your personal data longer to comply
with the law and any regulatory requirements.

Privacy and Cookie Policy

To determine the appropriate retention period for personal data, we consider the amount,nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use
or disclosure of your personal data, the purposes for which we process your personal data
and whether we can achieve those purposes through other means, and the applicable legal
requirements.
In some circumstances we may anonymise your personal data so that it can no longer be
associated with you, in which case we may use such information without further notice toyou.
For further detail of specific retention periods please see the specific sections below.
Sharing information
We may share your personal data with others in certain circumstances. Further detail isprovided at the specific sections below but the general sharing undertaken by the Scottish
Refugee Council is as follows:
•

•

•

•
•
•
•

We contract with third party service providers and suppliers to deliver certain services,
including Campaign Monitor, JustGiving, CAF, Everyday Hero, Eventbrite and
Mailchimp.
We may share information with those organisations who provide us with grants (e.g.
Scottish Government and the EU) so that we can evidence that the granted funds arebeing used by us in accordance with the terms of the grant.
We will also provide your personal data to third parties where there is a legal obligation
to do so, for example to regulators, government departments, law enforcement
authorities, tax authorities and any relevant dispute resolution body or the courts.
We may also provide your personal data to third parties in connection with any sale,merger, acquisition, disposal, reorganisation or similar change to our charity.
We will provide information about you to any other person who is authorised by you to
act on your behalf.
We use Google forms for certain matters, including when you book onto training
courses. Please see their Terms of Service
To communicate or raise money for our work, we also use online platforms such asCampaign Monitor, Charities Aid Foundation, Just Giving, Everyday Hero andEventbrite. The privacy notices for these platforms can be viewed using the links below:
Campaign Monitor
Charities Aid Foundation Privacy and Cookies
JustGiving Privacy Policy
Everyday Hero
Eventbrite privacy policy
Mailchimp

Privacy and Cookie Policy

Where we store and transfer personal data
The personal information that we collect from you will usually be stored inside the UK or theEuropean Economic Area (EEA).
We may transfer data outside the UK or the EEA where our service providers host, process,or store data outside the UK or the EEA. Where we do this, we will ensure that the transfer
is to a country covered by a decision of the European Commission or the UK ICO or isotherwise made in circumstances where we have put appropriate safeguards are in place
to protect your data in accordance with EU standards of data protection laws (e.g. standard
contractual clauses, EU-US Privacy Shield compliant, etc.): Mailchimp
3.

USING OUR SERVICES

Scottish Refugee Council offers various services across Scotland, including advice services,training services and community development services. We collect and use personal
information differently depending on the type of service provided.
Type ofinformation

Use of information

Personal details:• Name• Address• Telephone• E-mail• Personal ID

Advice Services
We are required to hold the details of
the people who have requested ourservice in order to provide support.

Your personal
details such as:• Name• Address• Telephone• E-mail

Training
When you book onto a training course
we need these details so that we canprocess and handle your booking.

Lawfulbasis foruse
Article 9Specific
retention
periods
Generally forcontractual
purposes, we
keep the dataarchived for six
years after thelast contact
with the client.

Article 6

We keep yourinformation for
invoicing
purposes.
We might also
keep yourAll service users are asked to sign aconfidentiality mandate when joining
our service. We record clients’personal details and information
relating to their case on our CaseManagement System. Access to thisdatabase is restricted and all users
adhere to Scottish Refugee Council’s
Confidentiality Policy.

Privacy and Cookie Policy

Type ofinformation

Use of information• Accessibilityneeds

We need your accessibility information
so that we can make necessary
adjustments for you.

Your personal
details such as:• Name• Address• Telephone• E-mailCommunity Development Services
We use your data to contact andinform you on community development
related activities provided by the
Scottish Refugee Council.
We record your details in our
database. Access to this data is
restricted to Community Development
Team, who adhere to Scottish
Refugee Council’s Confidentiality
Policy.

Lawfulbasis foruse

Article 6

Specific
retention
periods
details to
inform you of
future training
courses if
consent isgiven from you
to do this.
We keep yourdata active forone year after
the last contact
beforedeletion.

Privacy and Cookie Policy

4.

SUPPORTING OUR CAUSE

When you sign up to receive our newsletter, take part in a campaign action, attend an eventor enquire about opportunities to support our work, we collect information and use it inaccordance with this section.
Type ofinformation
The types of
personal
information wewill ask you forand collect could
include:• Title• Name• Address• Telephone• E-mail• Personal ID• Opinion about
an issue.
At the point ofcontact we will
also ask you how
you would like us
to contact you
again.
• Name• Address• Bank details

LawfulUse of informationbasis foruse
We collect information that is needed in Article 6order to respond to your request

When you make a donation, whether it Article 6
is a single or regular donation, we willcollect your name, address, and bankdetails to process the payments. We
also ask for your contact details andchoice of communication so that we cansend you an acknowledgement of thetransaction for your records as well as
future correspondence on our work andthe difference your donation makes.

Specific
retention
periods

Privacy and Cookie Policy

You can withdraw your consent to receive marketing communications from us at any time.
This can be done in the following ways:
•
•
•
5.

E-mail: data@scottishrefugeecouncil.org.uk
Telephone: 0141 223 7958
Using unsubscribe link provided.
APPLYING TO WORK OR VOLUNTEERING WITH US

When you enquire on job or volunteer opportunities, we will ask for and collect informationneeded to process your application.
Type ofinformation
The types of
personal
information we will
ask you for andcollect will include:• Title• Name• Address• Telephone• E-mail
Employment
history
Qualifications
Scottish RefugeeCouncil iscommitted toensuring equalityof opportunity in its
recruitment andemployment
practices so we
also collectinformation about
your age,disability, gender,

Use of information

Lawfulbasis foruse

When you enquire on job or volunteer
opportunities, we will ask for andcollect information needed to process
your application

To understand whether you are suited
to the role you are applying for
To understand whether you are suited Article 9
to the role you are applying for
The information provided will not
influence any part of the selection
process and will not be shared with theinterview panel. All information you
disclose will be treated confidentiallyand will only be used for statistical andmonitoring purposes.
Should you
choose not to provide the details, thesuccess of your application will not beaffected. Scottish Refugee Council
has a diverse workforce and we are

Specific
retention
periods
Unsuccessful
applicants’
information will
be deleted
3 months post
recruitment
campaign.
Successful
employeeinformation will
be retained for 6
years postemployment.
Successful
volunteer
information will
be retained for 6
years postemployment.

Privacy and Cookie Policy

Type ofinformation
employment status
and ethnicity tohelp us with equal
opportunities
monitoring.

Use of information

Lawfulbasis foruse

Specific
retention
periods

committed to ensuring that our staff
reflect the communities we serve.

All information generated and accumulated during a recruitment process is stored for 3
months after the end of the recruitment process in line with our internal HR and volunteering
processes. After 3 months all information for unsuccessful candidates is generally disposedof securely. If applicants are successful, their recruitment information will be retained by us
for a longer period and we issue employees and volunteers with separate privacy notices.
6.

BROWSING OUR WEBSITE

Cookies
When we provide services, we want to make them easy, useful and reliable. Where services
are delivered on the internet, this sometimes involves placing small amounts of information
on your device - for example, computer or mobile phone. These include small files known
as cookies but they cannot be used to identify you personally. These pieces of information
are used to improve services for you through, for example:•••

enabling a service to recognise your device so you don't have to give the same
information several times during one task
recognising that you may already have given a username and password
for every web page requested measuring how many people are using services, so they
can be made easier to use and there's enough capacity to ensure they are fast

Google Analytics
Our website uses Google Analytics, a web analytics service provided by Google, Inc.
('Google'). Google Analytics uses cookies, which are text files placed on your computer, tohelp the website analyse how users use the site.
The information generated by the cookie about your use of the website (including your IP
address) will be transmitted to and stored by Google on servers in the United States. Google
will use this information for the purpose of evaluating your use of the website, compilingreports on website activity for website operators and providing other services relating to
website activity and internet usage.

Privacy and Cookie Policy

Google may also transfer this information to third parties where required to do so by law, or
where such third parties process the information on Google's behalf. Google will not
associate your IP address with any other data held by Google.
You may refuse the use of cookies by selecting the appropriate settings on your browser,
however, please note that if you do this you may not be able to use the full functionality of
our website. By using this website, you consent to the processing of data about you by
Google in the manner and for the purposes set out above.
Scottish Refugee Council uses this information to find out how the site is being used, what
is working and what we need to improve or change. We do this to ensure that yourexperience of using our website is as beneficial to you as possible.
7.

NEW SCOTS CONNECT – MAP and FORUM

New Scots Connect Map
If you apply to be listed on the New Scots Connect Map as an organisation or community
group which supports and works with refugees, you are required to provide details about
your organisation in your application form, and some contact details for yourself as acontact/representative of your organisation. We use this information for the following
purposes:
Type of information

Use of information

Your name, role, andcontact details

To correspond with you
regarding yourapplication to be listed
and/or your listing
For publication on the
Map

Details about yourorganisation

For publication on the
Map

Your name, role, andcontact details

Lawful basis for use

Necessary for our legitimate
interests of corresponding withyou
With your prior consent onlyThis is not personal data as it
relates to an organisation rather
than an individual.

With your consent, the information you provide to us is made publically available on the Map.
We keep your information for as long as required for the Map unless you ask that we remove
or update the information.
If you are a user of the Map, we do not collect any personal data about you, but the Map
may use cookies. Please see the cookies section above.

Privacy and Cookie Policy

New Scots Connect ForumIf you have been invited to join our New Scots Connect Forum, we may collect, use, store
and transfer different kinds of personal data about you which we have grouped together asfollows:
Identity Data
Contact Data
User Generated Data

includes your first name and last nameincludes your e-mail address and telephone numbers, and anyother contact details that you provide
includes information that you upload or add to the Forum• We ask that you refrain from uploading any personal information to the Forum
We use this information for the following purposes:
Type of information

Use of information

Lawful basis for use
Necessary for our legitimate
interests of corresponding withyou
Necessary for our legitimate
interests of setting up youraccount

Identity Data
Contact Data

To correspond with you
regarding the Forum

Identity Data
Contact Data

To set up a user account foryou to access the Forum

Identity Data
Contact Data
User Generated Data

To consider, respond to, anddeal with any allegations thatyour User Generated Data is
non-compliant with our Terms
and Conditions and Acceptable
Use Rules related to Forum

Necessary to comply with ourTerms and Conditions andAcceptable Use Rules related
to Forum

Identity Data
Contact Data
User Generated Data

To host your User Generated
Data on the Forum

Necessary for our legitimate
interests of allowing you toaccess and use the Forum

The Forum is hosted by Basecamp. Therefore all data related to and hosted on Basecamp
may be transferred to the US. Basecamp is EU-US Privacy Shield compliant and therefore
your personal data will be afforded the same level of protection as if it were in the EU. Pleasesee Basecamp’s privacy policy (https://basecamp.com/about/policies/privacy) for further
information on how your personal data is used by Basecamp.
Depending on how you use the Forum, other users of the Forum may have access to yourpersonal data.
If you decide to stop using and or leave the Forum, we will not automatically delete accounts,
posts, or other User Generated Content. You may request an item to be removed at any

Privacy and Cookie Policy

time, but we will decide when and if to remove content from our Forum. If you wish to nolonger be identified with our Forum, we may close your account and alter your profile
information to remove all identifying characteristics. After account closure, you will no longer
be able to participate in this Forum.
8.

YOUR RIGHTS

Under certain circumstances, you have rights under data protection laws in relation to yourpersonal data.
You have the right to:
Request access to your personal data (commonly known as a "data subject accessrequest"). This enables you to receive a copy of the personal data we hold about you andto check that we are lawfully processing it.
Request correction of the personal data that we hold about you. This enables you to have
any incomplete or inaccurate data we hold about you corrected, though we may need toverify the accuracy of the new data you provide to us.
Request erasure of your personal data. This enables you to ask us to delete or remove
personal data where there is no good reason for us continuing to process it. You also havethe right to ask us to delete or remove your personal data where you have successfully
exercised your right to object to processing (see below), where we may have processed
your information unlawfully or where we are required to erase your personal data to comply
with local law. Note, however, that we may not always be able to comply with your requestof erasure for specific legal reasons which will be notified to you, if applicable, at the time ofyour request.
Object to processing of your personal data where we are relying on a legitimate interest(or those of a third party) and there is something about your particular situation which makes
you want to object to processing on this ground as you feel it impacts on your fundamental
rights and freedoms. You also have the right to object where we are processing yourpersonal data for direct marketing purposes. In some cases, we may demonstrate that wehave compelling legitimate grounds to process your information which override your rights
and freedoms.
Request restriction of processing of your personal data. This enables you to ask us tosuspend the processing of your personal data in the following scenarios: (a) if you want us
to establish the data's accuracy; (b) where our use of the data is unlawful but you do notwant us to erase it; (c) where you need us to hold the data even if we no longer require it asPrivacy and Cookie Policy

you need it to establish, exercise or defend legal claims; or (d) you have objected to our useof your data but we need to verify whether we have overriding legitimate grounds to use it.
Request the transfer of your personal data to you or to a third party. We will provide to you,or a third party you have chosen, your personal data in a structured, commonly used,machine-readable format. Note that this right only applies to automated information which
you initially provided consent for us to use or where we used the information to perform acontract with you.
Withdraw consent at any time where we are relying on consent to process your personal
data. However, this will not affect the lawfulness of any processing carried out before you
withdraw your consent. If you withdraw your consent, we may not be able to provide certain
products or services to you. We will advise you if this is the case at the time you withdraw
your consent.
If you wish to exercise any of the rights set out above, please contact us.
No fee usually required
You will not have to pay a fee to access your personal data (or to exercise any of the otherrights). However, we may charge a reasonable fee if your request is clearly unfounded,
repetitive or excessive. Alternatively, we may refuse to comply with your request in thesecircumstances.
What we may need from you
We may need to request specific information from you to help us confirm your identity andensure your right to access your personal data (or to exercise any of your other rights). Thisis a security measure to ensure that personal data is not disclosed to any person who has
no right to receive it. We may also contact you to ask you for further information in relation
to your request to speed up our response.
Time limit to respond
We try to respond to all legitimate requests within one month. Occasionally it may take us
longer than a month if your request is particularly complex or you have made a number ofrequests. In this case, we will notify you and keep you updated.
8.

USER FEEDBACK/COMPLAINTS

You have the right to make a complaint at any time to the Information Commissioner's Office(ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would,
however, appreciate the chance to deal with your concerns before you approach the ICO so
please contact us in the first instance.
Click here to access our Feedback/Complaints form.