This policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat your information.
The rules on the processing of personal data are set out in the General Data Protection Regulation (the “GDPR”). The GDPR applies to ‘personal data’ meaning any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier. For example, name, home address or private email address. Online identifiers include IP addresses and cookies.
As well as setting out how general personal data must be processed, the GDPR also makes special reference to sensitive personal data as ‘special categories of personal data’. The special categories specifically include financial or health data where processed to uniquely identify an individual. Other examples include racial and ethnic origin and sexual orientation. If we process criminal offence data, then it will only ever be because we have specific legal authorisation to do so. Criminal offence data includes the type of data about criminal allegations, proceedings and convictions.
Who are we?
Support in Mind Scotland is a mental health charity based and operating in Scotland. For the purposes of this policy and in line with GDPR guidance, we are the data controller. This means we decide how your personal data is processed and for what purposes. For all data matters contact Frances Simpson, CEO of Support in Mind Scotland.
6 Newington Centre, Dalkeith Road Mews, Edinburgh, Scotland , EH16 5GA
We are committed to safeguarding the privacy of those we engage with; in this policy we explain how we will handle your personal data. In this document we set out the general categories of personal data which we may process and the purposes for which we may process your data and the legal basis for holding and using your data. We also provide guidance on your rights to your personal information.
Personal identification information
We may collect personal identification information from our those we engage with in a variety of ways, including, but not limited to, when those who use our services visit our website, subscribe to our newsletter, fill out a form, and in connection with other activities, services, features or resources we make available both online and face-to-face.
We also need to hold your personal information if you are a member of Support in Mind Scotland. This is required by Companies House as we are a Company. If we cannot hold personal information about you, such as your name and address, you cannot be a member of Support in Mind Scotland.
The people we engage with may interact with us online, via events or through access to certain services anonymously. Those we engage with, can always refuse to supply personal identification information, although doing so may prevent them from utilising certain Support in Mind Scotland services and may mean that we are unable to communicate in a direct way.
Some of the information we process can be used to identify you, for example your name, date of birth, address, email and phone number. Beyond keeping in touch with you, if you engage with our services some of the information we hold may also be sensitive. This sensitive information may include your mental health diagnosis, other health conditions and ethnicity.
The purpose(s) of processing your personal data
We use your personal data for the following purposes:
• To record that you are a member of the Association as required by Companies House
• To keep our members and contacts informed about Support in Mind Scotland, our services, staff and fundraising activities.
• To provide you with appropriate support and health services and keep you informed about opportunities to engage and participate in mental health related activities.
• To ensure that we are able to provide a clear audit trail of services used by those we engage with through delivery of various initiatives and across different regions.
• To be able to provide data to funding providers such as the local authority or the Scottish Government.
• The information you provide helps us to improve our services and the mechanisms through which we deliver those services.
• The information you provide helps us to respond to your requests and support needs more efficiently.
• You may give us information about yourself by filling in forms on our website www.supportinmindscotland.org.uk or by corresponding with us by phone, e-mail or otherwise eg. sponsorship forms. When you request information from Support in Mind Scotland, participate in social media functions on our site, or when you send information to Support in Mind Scotland, this is all part of the personal data we may hold.
• We may use your personal data to respond to your enquiries, questions, and/or other requests. If a person we engage with decides to opt-in to our mailing list, they will receive direct mailings and emails that may include charity news, updates, fundraising event information or information about the services we provide. If at any time the those we engage with would like to unsubscribe from receiving these direct mailings and / or emails, we include detailed unsubscribe instructions in each mailshot and at the bottom of each email.
• We may use your personal data to contact you to participate in surveys (sometimes through third parties like Survey Monkey). This helps us to drive change and make improvements to our charity.
• If you wish to purchase via our online shop or donate to the charity, then we will share your information with our payment services provider only to the extend that is necessary for processing the payment or making a refund to you. We will ensure that our service providers are GDPR compliant.
The categories of personal data concerned
We process the following categories of your data: Personal data – name, address, email address and phone number
We have obtained your personal data from the Opting-in, Membership or Service User forms. You have stated that you would like to receive communications from us or access our services.
What is our legal basis for processing your personal data?
Generally speaking our lawful basis for processing your general personal data is for the consent of the data subject to continue to receive communication and updates from Support in Mind Scotland.
Our lawful basis for processing some data, especially data concerned with those using the support services we provide, may be any of the other 5 eligible lawful basis (Consent; Contract; Legal Obligation; Vital Interests or Legitimate Interests).
A specific lawful basis will be identified for any data being held beyond the ‘Consent’ provided by you to receive general communications. More information on lawful processing can be found on the Information Commissioner’s Office website www.ico.org.uk.
Sensitive data – this is special category data. This is considered more sensitive and so needs more protection.
Only when required, we may collect what would likely be considered a special category of sensitive data:
• ethnic origin;
• sexual orientation; or
• financial standing
What is our legal basis for processing your sensitive personal data?
In order to provide the best service to those we engage with, it may be necessary to secure this sort of more sensitive information. In order to process this, we will always identify a lawful basis and a ‘separate condition’ for processing. This will be documented.
How long do we keep your personal data?
We keep your personal data for no longer than reasonably necessary and we only retain your data for the purpose of Support in Mind Scotland related services and communication, via email, letter or social media. We will remind you annually that you can opt out of marketing communications with Support in Mind Scotland.
For those we engage with through our services, it may not be possible to specify in advance the periods for which your data will be retained. We may retain your personal data when it is necessary for legal obligations or to protect your vital interests or those of another person. When we have provided you with all the help we are able to give, we will keep your case-files for a period of time (usually up to 6 years) or another period if required to do so by law.
Providing us with your personal data
We require your personal data in order to communicate with you in relation to our activities and services – past, current or future and via email, letter or social media. We will require more sensitive data if you are engaging with any of our outreach services.
Sharing your personal data
Your personal data will be treated with care and sensitivity and will never be sold onto a third party. We may share generic aggregated demographic information not linked to any personal identification information only with partners, funders and trusted affiliates for the purposes outlined above and only when those bodies are also GDPR compliant.
Now and again, we may require to share your data with others to deliver our services and activities, however we will only provide as much data as is reasonably necessary for the purposes set out in this policy. We may have to provide some personal data to professional advisors for the purposes of gaining insurance cover, managing risks or gaining legal advice. We will only provide data to GDPR compliant organisations.
We may use third party service providers to help us operate our business and administer activities on our behalf, such as sending out newsletters or surveys. We may share your information with these third parties for those limited purposes provided that you have given us your permission and provided that these organisations are also GDPR compliant.
Your rights and your personal data
Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data:
• The right to request a copy of the personal data which we hold about you;
• The right to request that we correct any personal data if it is found to be inaccurate or out of date;
• The right to request your personal data is erased where it is no longer necessary to retain such data;
• The right to withdraw your consent to the processing at any time, where consent was the lawful basis for processing the data.
• The right to request that we provide you with your personal data and where possible, to transmit that data directly to another data controller.
• The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing;
• The right to object to the processing of personal data.
On request we can provide you with your personal data. You will need to supply appropriate evidence of identify. We may withhold personal information, only to the extent permitted by law and where there is good reason to do so.
Transfer of Data Abroad
We do not transfer personal data outside of the UK.
Automated Decision Making
We do not use any form of automated decision making in our business.
100 Streets Challenge Website
We only work with GDPR compliant businesses. This 100 Streets Challenge website - www.100streetschallenge.com - is hosted by Squarespace.
Third party websites
Users may find advertising or other content on Support in Mind Scotland's main website - www.supportinmindscotland.org.uk - that link to the sites and services of our partners, suppliers, advertisers, sponsors, licensors and other third parties. We do not control the content or links that appear on these sites and are not responsible for the practices employed by websites linked to or from our website. In addition, these sites or services, including their content and links, may be constantly changing. These sites and services may have their own privacy policies. Browsing and interaction on any other website, including websites which have a link to our website, is subject to that website's own terms and policies.
How we protect your information
We adopt appropriate data collection, storage and processing practices and security measures to protect against unauthorised access, alteration, disclosure or destruction of your personal information, service use information and data stored by us, electronically or otherwise. Paper copies of your data may be stored securely and accessed only by appropriate personnel within our service. Our staff are trained to manage your data securely.
Though we make every effort to preserve the privacy of those we engage with, we may need to disclose personal information when required to do so by law, wherein we have good-faith and belief that such action is necessary to comply with a current judicial proceeding, a court order or legal process.
Your acceptance of these terms
By providing us with your personal data through using our services, signing up for our mailings or connecting via our website or social media, you signify your acceptance of this policy.
How to make a complaint
To exercise all relevant rights, queries or complaints please in the first instance contact firstname.lastname@example.org or call 0131 662 4359.
If this does not resolve your complaint to your satisfaction, you have the right to lodge a complaint with the Information Commissioners Office on 03031231113 or via email https://ico.org.uk/global/contact-us/email/ or at the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, England.
Support in Mind Scotland
6 Newington Centre
Dalkeith Road Mews
Support in Mind Scotland is the operating name of the national Schizophrenia Fellowship (Scotland), a company limited by guarantee registered in Scotland SC088179. Charity Number SC013649.
This policy was last updated on 16 May 2018.