Privacy Policy
Our Privacy Notices
When we use your personal data, Harbour complies with the UK General Data Protection Regulations (UK GDPR) and the Data Protection Act 2018, and is the registered ‘controller’. Our data protection notification is registered with the Information Commissioner’s Office (ICO), Harbour Homes reference: Z5626639 and Harbour Multi-Trades ZA113265.
To make it clear how we collect and use your personal data, and to help you understand your rights, we’ve divided our Privacy Notice into the following areas:
1. How we handle personal data
This notice explains what personal information we (Harbour Homes Scotland Ltd, Scottish Charity Number SC027945), collect, when we collect it and how we use it. We collect and use personal data for a variety of reasons in line with the guidelines published in the UK General Data Protection Regulation and the Data Protection Act of 2018. We have separate Privacy Notices for our Employees and Members of our Board of Trustees.
We are registered as a Data Controller with the Office of the Information Commissioner under registration number Z5626639, and we are the data controller of any personal data that is provided to us.
Any personal data we process is done so for a clear purpose and with a clear legal basis for doing so. We only hold personal data for as long as is necessary, as is required by law or as is set out in any contract we enter. The length of time we hold certain types of personal data for is set out in our Data Retention Policy.
2. How we collect personal information and what we collect
We collect information about customers (for example, tenants, factored owners and mid market rent):
- When you apply for housing with us, become a tenant, request services/repairs, enter into a factoring agreement with us or otherwise provide us with your personal details
- When you apply to become a member
- When you use our online services, for example, to report any tenancy/factor-related issues or make a complaint etc
- When you make payments to us (such as bank details, payment card numbers, employment details, benefit entitlement and any other income and expenditure related information).
- When you telephone the office and speak to a customer advisor the calls are recorded.
Depending on our relationship with you as a customer, we may collect the following information about you:
- Name
- Address
- Telephone number
- Email address
- National Insurance number
- Next of kin
- Details of any dependents
- Date of birth
- Ethnic origin
- Sexual orientation
- Health information relevant to application or tenancy
- Employment details
- Bank details
- Passport number
- Whether you have served in the Armed Forces
We receive the following information from third parties:
- Benefits information, including awards of Housing Benefit/Universal Credit
- Payments made by you to us
- Complaints or other communications regarding behaviour or other alleged breaches of the terms of your contract with us, including information obtained from Police Scotland
- Reports on the conduct or condition of your tenancy, including references from previous tenancies, and complaints of anti-social behaviour
- Medical information for the purposes of managing your tenancy
Why we need this information and how it’s used:
- We require this information for the following reasons:
- To undertake and perform our obligations and duties to customers under the terms of our contract with them
- To enable us to supply customers with the services and information which they request
- To enable us to respond to repair requests, housing applications and complaints
- To analyse the information we collect so that we can administer, support and improve and develop our business and the services we offer
- To send customers details of any changes to our suppliers which may affect them
- For all other purposes associated with the proper performance of our operations and business
- To contact customers to find out their views on our products and services.
When you visit our website, we may collect personal information about you, if you:
- pay your rent;
- pay your factoring bill;
- report a repair to us;
- make a complaint to us;
- complete and submit a “contact us” form; and
- log in to your account via the Customer Login.
We may use this personal information to:
- provide you with the services that you have requested from us;
- communicate with you, including in response to any of your enquiries;
- improve our services and respond to changing needs;
- process your rent payments;
- carry out repairs to your property;
- handle and resolve complaints made by, or, against you;
- keep the personal information that we hold about you accurate and up-to-date (if you provide any new personal information to us via the website); and
- signpost you to organisations that can offer benefits and debt advice and support
Visiting our premises
- When you visit one of our premises, we may record your name in our signing-in register. Your image may be captured by our CCTV cameras. Notices are available where the cameras are in operation.
If you are a business contact
- We may collect your business contact details such as your name, business address and business e-mail and your company’s bank account details. If you are a sole trader this may be your personal details which will be treated in accordance with this notice.
If you apply for a job with us
- We will ask for your contact details, previous employment history and qualifications.
- We may collect details of ethnicity and disability – for equalities monitoring and so that we can make any appropriate adjustments to accommodate you through the recruitment process.
3. Lawful Processing
Data protection law requires us to rely on one or more lawful grounds to process your personal information. We consider the following grounds to be relevant:
Performance of a contract
Where we are entering into a contract with you or performing our obligations under it, like when you have a Tenancy of Factoring Agreement with us.
For our employees we are processing for the contract of employment.
Performance of a task in the public interest
Where we provide housing services in relation to:
(a) the prevention and alleviation of homelessness,
(b) the management of housing accommodation where we have granted a Scottish secure tenancy
Legal obligation
Where necessary so that we can comply with a legal or regulatory obligation to which we are subject, for example where we are ordered by a court or regulatory authority like HMRC.
Vital interests
Where it is necessary to protect life or health (for example in the case of medical emergency suffered by an individual on our premises) or a safeguarding issue which requires us to share your information with the emergency services.
Specific consent
Where you have provided specific consent to us using your personal information in a certain way, such as to send you email, text and/or telephone marketing.
Legitimate interests
Where it is reasonably necessary to achieve our or others’ legitimate interests (as long as what the information is used for is fair and does not duly impact your rights).
We consider our legitimate interests to be for running Harbour Homes. For example to:
- provide our services;
- run our business, for example, processing financial transactions for payment of our suppliers and to invoice our contractors
- recruit staff
- protect our staff and customers and assist with the prevention and detection of crime
- monitor who we deal with to protect Harbour Homes against fraud, money laundering and other risks;
- enhance, modify, personalise or otherwise improve our services /communications for the benefit of our customers; and
- better understand how people interact with our website.
When we legitimately process your personal information in this way, we consider and balance any potential impact on you (both positive and negative), and your rights under data protection laws. We will not use your personal information where our interests are overridden by the impact on you, for example, where use would be excessively intrusive (unless, for instance, we are otherwise required or permitted to by law).
When we use sensitive personal information, such as health information, we require an additional legal basis to do so under data protection laws, so will either do so on the basis of your explicit consent or another route available to us at law (for example, if we need to process it for employment, social security or social protection purposes, your vital interests, or, in some cases, if it is in the public interest for us to do so).
5. Security of personal information
We take steps to make sure that personal information we hold is kept secure and safe. We use appropriate technical and organisational measures to safeguard your personal information. Our systems are password protected and all electronic data is stored securely. All paper files are kept in locked cabinets. All information is kept in line with our Data Protection Policies which are available here.
6. Transfers outside of the UK and Europe
Your information will only be stored within the UK and EEA, with the exception of some data (such as the IP address of your computer, and websites you have visited) collected via the Cookies on our website which is stored in the USA. You will always have the option to consent to these Cookies when you visit the website.
7. How long we keep personal information
We review our data retention periods regularly and will only hold personal data for as long as is necessary for the relevant activity, or as required by law (we may be legally required to hold some types of information), or as set out in any relevant contract we have with the individual.
We will generally keep information for the minimum periods set out in our Data Retention Policy, which is available here.
8. Your rights
Under certain circumstances, the law gives you the right to request:
- A copy of your personal information and to check that we are holding and using it in accordance with legal requirements.
- Correction of any incomplete or inaccurate personal information that we hold and use about you.
- Deletion of your personal information where there is no good reason for us continuing to hold and use it. You also have the right to ask us to do this where you object to us holding and using your personal information (details below).
- Temporarily suspend the use of your personal information, for example, if you want us to check that it is correct or the reason for processing it.
- The transfer of your personal information to another organisation.
You can also object to us holding and using your personal information where our legal basis is a legitimate interest (either our legitimate interests or those of a third party), including the right to object to direct marketing.
If you wish to make any of the above requests, please complete this form. When you make a request, we are required to verify your identity and may ask you for specific information to fulfil this purpose. Normally, you will not need to pay a fee when you make any of the above requests, but we may charge a reasonable fee or refuse to comply if your request for access is clearly unfounded or excessive.
9. Keeping in touch with us
The accuracy of the personal data we hold is important to us. Please help us keep our records updated by telling us about any changes to your personal and/or contact details by calling our Customer Advice Team on 0131 554 0403 or emailing hello@harbour.scot.
Any questions about this notice should be sent, in the first instance, to Data Protection Lead, at data@polha.co.uk or at our registered office: 108 Constitution Street, Leith, Edinburgh, EH6 6AZ.
Our Data Protection Officer is provided by RGDP LLP and can be contacted either via 0131 222 3239 or info@rgdp.co.uk
11. Complaints
We seek to directly resolve any complaints about how we handle personal information and would request you contact us in the first instance. If you are not happy thereafter, you also have the right to complain to the Information Commissioner’s Office in relation to our use of your information. The Information Commissioner’s contact details are noted below:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
We keep this privacy notice under regular review and will place any updates on this website.
Privacy Notice for Community Works clients
This notice explains what information we collect when we collect it and how we use this. During the course of our activities, we will process personal data (which may be held on paper, electronically, or otherwise) about you and we recognise the need to treat it in an appropriate and lawful manner. The purpose of this notice is to make you aware of how we will process your personal data.
Harbour Homes is a data controller and will collect and process your personal data. We are required to explain to all clients the personal data we collect, the purpose for processing and the legal basis we are relying on.
Who are we?
Harbour Homes (Scotland) Ltd, registered as:
With the Financial Conduct Authority, registration FRN772734 a Scottish Charity (Scottish Charity Number SC027945), and having their Registered Office at: 108 Constitution Street, Leith, Edinburgh, EH6 6AZ
We are notified as a Data Controller with the Information Commissioner’s Office under registration number Z5626639 and we are the data controller of any personal data that you provide to us.
Our Data Protection Officer is appointed as RGDP LLP, info@rgdp.co.uk.
What information do we collect?
Harbour Connections collects and processes a range of information containing personal data about you. We process this information in order to be able to provide our services under the Community Works Service.
We are required to process your personal information when you have come to us for Community works Service and there may be some occasions where processing of special category personal data (such as health or ethnicity) is required. Where we process special category data it is necessary for the establishment, exercise, or delivery of your Community Works Service.
The personal data we collect, and use will only be the minimum necessary for your case. The following table shows the data we collect and process in relation to your tenancy.
| Data processed as necessary for the performance of a contract with you: | Processed under the legal bases of: |
| Your Details Name, Address, NI number, date of birth, ethnic origin, phone number, email address, qualifications, health, criminal, crime data, financial information. | Consent as you provide the data and explicit consent for data such as health, ethnicity, criminal data on basis of substantial public interest (special category data) |
Who has access to your data?
Your information may be shared internally within Harbour Connections Community Works Service on a need-to-know basis as appropriate. We may share your personal data with the following third parties where it is necessary for the legal service, we provide to you:
- Service providers and their sub-contractors we are using to run our business including identity checks;
- IT services providers;
- Confidential waste disposal services and document storage providers;
- Marketing service providers.
- Other service and support providers as part of our Community Works Service
- Where we share your information, we have appropriate contractual arrangements in place to ensure that these third parties do not use our data for their own purposes, will treat it with confidence and that they keep the data secure.
What are the legal bases for us processing your personal data?
We will only process your personal data on one or more of the following legal bases:
- Your consent
- Any information on criminal conviction data will be held under substantial public interest.
Processing special category personal data
Special categories of personal data mean information about your racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; health; sex life or sexual orientation; criminal convictions, offences, or alleged offences; genetic data; or biometric data for the purposes of uniquely identifying you.
The “special categories” of sensitive personal information referred to above require higher levels of protection. We need to meet additional legal requirements for collecting, storing, and using this type of personal information.
Where do we keep your data?
Your information will only be stored within the United Kingdom except where international transfers are authorised by law
How does Harbour Homes protect your personal data?
Harbour Homes takes the security of your data seriously. Harbour Homes has policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused, or disclosed, and is not accessed except by authorised persons who have a need to know in order to perform their duties and are under a duty to maintain the confidentiality and security of such information.
If personal data is transferred outside the EU, we will ensure that adequate safeguards are in place, relying on an adequacy agreement or other contractual terms as appropriate.
How long do we keep your personal data?
We review our data retention periods regularly and will only hold your personal data for as long as is necessary for the relevant activity, or as required by law, as recorded in our Data Retention Policy and Schedule.
Your rights
As a data subject, you have a number of rights in relation to your personal data. These are listed below.
- The right to access information about your personal data Harbour Homes is processing and to obtain a copy of it;
- The right to require Harbour Homes to change incorrect or incomplete data;
- The right to require Harbour Homes to erase or stop processing your data in certain circumstances; and
- The right to object to the processing of your data where Harbour Homes is relying on its legitimate interests as the legal ground for processing.
- The right to data portability from Harbour Homes
A fee will not generally be charged for exercising any of these rights unless your requests are unfounded or are manifestly excessive.
If you would like to exercise any of these rights, or if you have any concerns about how your personal data is being processed, please contact our Data Protection lead at Harbour Homes ; or our Data Protection Officer at: info@rgdp.co.uk ; Telephone: 0131 222 3239.
Queries and Complaints
Any questions relating to this notice and our privacy practices should be directed, in the first instance, to data@harbour.scot or by telephoning 0131 554 0403
Alternatively, you can contact our Data Protection Officer, who is provided by RGDP LLP and can be contacted either via 0131 222 3239 or info@rgdp.co.uk
You also have the right to complain to the Information Commissioner’s Office in relation to our use of your information. The Information Commissioner’s contact details are noted below:
Telephone: 0303 123 1113
Online: www.ico.org.uk/make-a-complaint/
The accuracy of your information is important to us – please help us keep our records updated by informing us of any changes to your email address and other contact details.
Our Privacy Policy describes the categories of personal data we process and for what purposes. We are committed to collecting and using such data fairly and in accordance with the requirements of the UK General Data Protection Regulations (UK GDPR) and the Data Protection Act 2018.
Introduction
We take your privacy seriously and you can find out more here about your privacy rights and how we gather, use and share your personal information – that includes the personal information we already hold about you now and the further personal information we might collect about you, either from you or from a third party. How we use your personal information will depend on the products and services we provide to you.
How we gather personal information
Information that you provide to us directly:
- Over the phone or when you fill out an application
- Through our website:
- When you visit our premises
- We also may obtain some personal information from monitoring or recording calls and when we use CCTV at our premises.
Information provided by other organisations such as housing associations and landlords:
- Your contact details
- Whether you have a vulnerability we need to be aware of to provide a service to you
When you use our website we may gather information about you via Cookies
Cookies are small text files containing information sent by a web server to a web browser, and stored on your computer, tablet or mobile phone when you visit certain web pages. The information is then sent back to the server each time the browser requests a page from the server. This enables the web server to identify and track the web browser.
If you select the ‘Only Necessary’ option from the Cookies pop-up shown when you first access our website, we will only place Cookies on your device that are necessary to make the website work well for you.
We will automatically log your IP address (the unique address that identifies your computer on the internet) which is automatically recognised on our web server. We may use IP addresses to help us administer our website. We do not link IP addresses to personally identifiable information.
If you select the ‘Accept All’ option from the Cookies pop-up, our website uses all of the following categories of cookies:
- “Session cookies” – these keep track of you while you navigate our website, and will be deleted from your computer when you close your browser.
- “Persistent cookies” – these enable our website to recognise you when you visit, and they remain stored on your computer until deleted, or until they reach a specified expiry date. They enable us to remember details such as your preferences and enable us to give you a better service.
- We use Google Analytics to analyse the use of our website. Google Analytics generates statistical and other information about use of our website such as number of new visitors to our website, how long visitors spend browsing our website and which pages they viewed by means of cookies which are stored on user’s
- You can find out more about Google Analytics here: google.co.uk/intl/en/policies/privacy/.
Where our website contains links to other websites this privacy policy will not apply to those third-party websites. When you link through to another website you should read the privacy policy which applies to that website.
How we use your personal information
We use your personal information to provide you with products and services, to comply with the law and enforce our legal rights (including debt recovery), and to improve and market our products and services.
To provide you with any products and services we need to know your name, address, contact telephone number and in some cases email address.
We need this personal information before we can provide our products and services to you, for example to allow us to check your identity. In some cases we won’t be able to provide products and services to you if we don’t have all the personal information we need. You do not have to provide us with this data but without it we cannot provide you with our services.
We sometimes need to gather, use and share additional personal information for specific purposes, which are set out in more detail below.
To operate and administer our products and services, including dealing with your complaints and fixing our mistakes, we will use:
- your contact details;
We might share all of the information we use for this purpose with third parties who help us to verify your contact details and deliver our products and services, such as our subcontractors. We use your information in this way because it is necessary to perform our contract with you and to meet our legal obligations.
To administer payments to and from you, we will use:
- your name, address, telephone number, bank
We may give this information to our third-party payment providers to process the payment to you.
To comply with our legal obligations, to prevent financial crime including fraud and money laundering we will use:
- any information you have given us, including our name and address, that we have obtained from a third party, or that we have obtained by looking at how you use our services, where it is necessary for us to use that information to comply with a legal obligation
We will give information to and receive information from third parties where that is necessary to meet our legal obligations, including credit reference agencies, fraud prevention agencies, the police and other law enforcement and government agencies, other banks and regulators.
To comply with our legal obligations, to support our vulnerable customers:
- information you give to us which identifies a vulnerability (such as a health condition); and
- information we may receive from another Group company which identifies
We will give information to and receive information about a vulnerability from third parties where that is necessary to meet our legal obligations, for example from police, social services or someone acting on your behalf.
For financial management and debt recovery purposes, we will use:
- your contact details;
- information we obtain from looking at how you have used our services, including information about your location that we may find from reviewing your accounts.
We will give information to and receive information from third parties where that is necessary to recover debts due by you to us, for example debt recovery agents’ sheriff officer or bailiff services. This might include passing personal information about you to a third party who we have transferred your debt to, and who will then contact you directly to collect that debt. If your debt is transferred to a third party, you will be advised of the identity of that third party. We use your information in this way because it is necessary to perform our contract with you, to exercise our legal rights, and because it is fair and reasonable for us to do so.
For regulatory purposes, for training and to ensure and improve quality of service delivery, to ensure safety of our staff and customers, and to resolve queries or issues:
- We will record or monitor phone calls with
- We also use CCTV on our premises to ensure the safety and security of our staff, customers and suppliers;
Our legal basis for using your personal information
We only use your personal information where that is permitted by the laws that protect your privacy rights. We only use personal information where:
- we have your consent (if consent is needed);
- we need to use the information to comply with our legal obligations;
- we need to use the information to perform a contract with you; and/or
- it is fair to use the personal information either in our interests or someone else’s interests, where there is no disadvantage to you – this can include where it is in our interests to contact you about products or services, market to you, or collaborate with others to improve our services.
Your consent
Sometimes we need your consent to use your personal information (for example for marketing). We won’t always need consent to use personal information – for example if we need it to meet regulatory requirements or to perform a contract with you. Where you have given us consent, you have the right to withdraw it at any time.
Sharing and transferring personal information
We may share your personal information with the organisations and agencies detailed above and also with our suppliers and other third parties where needed to provide you with the best service. Some of our suppliers may be based outside the UK. Where this is the case, we take steps to ensure that appropriate security measures are taken with the aim of ensuring that your privacy rights continue to be protected as outlined in this policy.
Keeping personal information
We keep your personal information securely for as long as we need it for legitimate business purpose or purposes for which we originally collected it including for the purpose of satisfying any legal, accounting or reporting requirements.
Your rights
Under certain circumstances, the law gives you the right to request:
- A copy of your personal information and to check that we are holding and using it in accordance with legal requirements.
- Correction of any incomplete or inaccurate personal information that we hold and use about you.
- Deletion of your personal information where there is no good reason for us continuing to hold and use it. You also have the right to ask us to do this where you object to us holding and using your personal information (details below).
- Temporarily suspend the use of your personal information, for example, if you want us to check that it is correct or the reason for processing it.
- The transfer of your personal information to another
- You can also object to us holding and using your personal information where our legal basis is a legitimate interest (either our legitimate interests or those of a third party), including the right to object to direct marketing.
If you would like further information regarding the use or storage of your personal data please address your correspondence to the Data Protection Manager:
Martina Healy
Harbour Multi-Trades
Granton House
219 Granton Road Edinburgh
EH5 1AB
Email: martina.healy@tbmes.co.uk
or call 0131 552 6103 between 9am and 5pm (GMT) Mon-Fri.
Our Data Protection Officer is RGDP who can be contacted at info@rgdp.co.uk
Complaints
We are committed to ensuring that your personal data is processed lawfully, fairly and securely. If you have any questions or concerns about the way in which we process your personal data, please contact us at the address above and we will attempt to resolve any issues you have. If you remain unsatisfied you can contact the Information Commissioner’s Office at ico.org.uk/make-a-complaint/.
From time to time, we add or change functions, features or products to our website or add or change services. This, and our commitment to protecting the privacy of your personal information, may result in periodic changes to this Privacy Policy. We will make every effort to inform you of any changes.
The Harbour Multi-Trades privacy notice was last updated in July 2023.
This privacy notice explains how Harbour uses your data when captured on CCTV.
Harbour has CCTV in operation at various sites, including Harbour offices and other premises. CCTV will capture images in real time wherever the cameras are pointed. These cameras may capture footage of you whilst you are on the premises. Cameras have been situated both inside and outside the buildings. There are signs in place to inform you where cameras are in use.
Harbour Homes is a data controller and will collect and process your personal data. We are required to explain to all clients the personal data we collect, the purpose for processing and the legal basis we are relying on.
Who are we?
Harbour Homes (Scotland) Ltd, registered as:
With the Financial Conduct Authority, registration FRN772734 a Scottish Charity (Scottish Charity Number SC027945), and having their Registered Office at: 108 Constitution Street, Leith, Edinburgh, EH6 6AZ
We are notified as a Data Controller with the Information Commissioner’s Office under registration number Z5626639 and we are the data controller of any personal data that you provide to us.
Our Data Protection Officer is appointed as RGDP LLP, info@rgdp.co.uk.
What personal data do we use?
- static and moving images of people
What types of special category personal data do we need from you?
We do not deliberately set out to capture any special category personal data. However, cameras may incidentally record information which falls within these categories. Additionally, footage cameras may be used as evidence regarding criminal offences or related security measures.
Why do we use your data?
- to ensure the health and safety of employees, service users and visitors to the sites
- to detect, prevent or reduce the incidence of crime
- to prevent and respond effectively to all forms of possible harassment and disorder
- to reduce the fear of crime
- to create a safer environment
What legal reasons allow us to use your data in this way?
Our legal basis for processing your personal data is:
- that it is necessary to meet a legal obligation
- that it is necessary to perform tasks in the public interest
- that we have a legitimate interest in processing this information
Our basis for processing special category persona data is:
- there is a substantial public interest in processing this information, for the purposes of detecting and preventing crime
Who may we share your data with or receive it from?
Sometimes we need to share your information with others. We will only do this when it is necessary, or if we are required to do so by law. We do not plan to share it with anyone else or use it for anything else.
We may be asked to provide footage to assist the police with any criminal damage or their investigations.
However, there is no planned regular or scheduled sharing of CCTV footage with any external organisation. Should this situation change, this privacy notice will be updated and reissued, to keep you fully aware of how the council plans to use CCTV footage which you may be captured in.
CCTV footage will only be processed internally by Harbour staff who are authorised to do so and any other departments where there is a legitimate and lawful reason for their involvement.
May personal data be transferred overseas?
Your information will only be stored within the United Kingdom except where international transfers are authorised by law.
How long is your data kept for?
We review our data retention periods regularly and will only hold your personal data for as long as is necessary for the relevant activity, or as required by law (we may be legally required to hold some types of information), or as set out in any relevant contract we have with you.
We will generally keep your information for the following minimum periods:
| Item | Retain for |
| CCTV recording | Auto deleted after 28 days |
| CCTV recordings used for investigations | In line with relevant retention schedule ie complaints, ASB case |
after which this will be destroyed if it is no longer required for the reasons it was obtained.
This notice explains what information we collect when we collect it and how we use this. During the course of our activities, we will process personal data (which may be held on paper, electronically, or otherwise) about you and we recognise the need to treat it in an appropriate and lawful manner. The purpose of this notice is to make you aware of how we will process your personal data.
Harbour Homes is a data controller and will collect and process your personal data. We are required to explain to all clients the personal data we collect, the purpose for processing and the legal basis we are relying on.
Who are we?
Harbour Homes (Scotland) Ltd, registered as:
With the Financial Conduct Authority, registration FRN772734
a Scottish Charity (Scottish Charity Number SC027945),
and having their Registered Office at: 108 Constitution Street, Leith, Edinburgh, EH6 6AZ
We are notified as a Data Controller with the Information Commissioner’s Office under registration number Z5626639 and we are the data controller of any personal data that you provide to us.
Our Data Protection Officer is appointed as RGDP LLP, info@rgdp.co.uk.
How we collect information from you and what information we collect
We collect information about you when:
- you make a complaint;
- you make a request for information under Freedom of Information (Scotland) Act 2002 or Environmental Information (Scotland) Regulations 2004
- you make a request under Data Protection Act 2018 (DPA)
We collect the following information about you:
- Name;
- Address;
- E-mail;
- Phone number
- Contact preference
- Details of complaint or request
- ID document to allow us identity verification. This only applies for requests under DPA.
Why we need this information about you and how it will be used
We need your information and will use your information:
- to enable us to respond to your request for information and complaints made.
Sharing of Your Information
Your information will only be stored within the United Kingdom except where international transfers are authorised by law. We may disclose your information to other third parties who act for us for the purposes set out in this notice or for purposes approved by you, including the following:
- If we enter into a joint venture with or merged with another business entity, your information may be disclosed to our new business partners or owners;
- If we are investigating a complaint, information may be disclosed to Police Scotland, Local Authority departments, Scottish Fire & Rescue Service and others involved in any complaint, whether investigating the complaint or otherwise;
- if you are dissatisfied with our response to your complaint and refer the issue to the Scottish Public Services Ombudsman (SPSO), we would have to provide evidence of our response to you to SPOSO;
- if you are dissatisfied with our response to your Data Protection Request and refer the issue to the Information Commissioner’s Office (ICO), we would have to provide evidence of our response to you to the ICO;
- if you are dissatisfied with our response to your Freedom of Information or Environmental Information request and refer the issue to the Scottish Information Commissioner (SIC), we would have to provide evidence of our response to you to the SIC.
Unless required to do so by law, we will not otherwise share, sell or distribute any of the information you provide to us without your consent.
How long we will keep your information
We review our data retention periods regularly and will only hold your personal data for as long as is necessary for the relevant activity, or as required by law (we may be legally required to hold some types of information), or as set out in any relevant contract we have with you.
We will generally keep your information for the following minimum periods:
| Item | Retain for |
| Complaints records | 5 years (from final reply) |
| Records in relation to FOI & EIR requests and Data Protection requests | 3 years from last action |
after which this will be destroyed if it is no longer required for the reasons it was obtained.
Data Protection Request
You can use this form to make a Data Protection request. Once we’ve received your request, we will contact you to verify your identity and/or clarify your request. If you are requesting information on behalf of someone else we will ask you to provide a signed consent.
We will complete your request within a calendar month, if the request is more complex, we will let you know if we need an extra time to complete it.
Appropriate Policy Document
The Data Protection Act 2018 (DPA 2018) outlines the requirement for an Appropriate Policy Document (APD) to be in place when processing special category (SC) and criminal offence (CO) data under certain specified conditions.