1. Our stance on personal data
AFKA Scotland takes your right to privacy seriously. We are committed to protecting your privacy and security and it is important to us that you understand how and why we collect and use information about you. This Privacy Notice explains how and why we use your personal data, to ensure you remain informed and in control of your information.
2. Who are we?
AFKA Scotland is an independent membership organisation for professionals, foster carers and adopters, and anyone else working with or looking after children in or from care, or adults who have been affected by adoption. Our registered name and address is: AFKA Scotland, Foxglove Offices, 14 Links Place, Edinburgh, EH6 7EZ (Charity No. SC046417).
3. What information do we collect?
We collect only the personal data that we need to provide you with services, fulfil orders and keep in touch. The categories of personal information that we collect, process, store and share include:
- Personal details (name, email address, phone number, postal address);
- Professional details (workplace, job title, subject interests); and
- Details of purchases (training events, workshops and conferences).
4. How do we process your personal data?
AFKA Scotland complies with its obligations under current GDPR and Data Protection legislation by using data only for the purposes for which it was collected; by keeping personal data up-to-date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data. We use your personal data for the following purposes:
- To administer membership records.
- To deliver membership benefits to you (such as providing advice and information, sending newsletters and mailings, running forums).
- To effectively manage and provide commissioned training, workshops and conferences.
- To recruit and manage our employees and volunteers.
- To run our training and events.
- To maintain our own accounts and records.
- To record enquiries submitted to the AFKA Scotland advice line.
- To operate the AFKA Scotland website and deliver the services that you have requested.
- To process your financial payments.
- To keep you informed about news, events, activities and services that are relevant to you.
- To send you information about products and services that relate to your previous interests or where you have requested such information.
5. What is our lawful basis for processing your personal data?
We will only process your personal data where we have a lawful basis (a legal reason allowing us to process personal data) to do so. The categories of lawful basis which apply to our processing of personal data are:
5.1 Consent
Where we have a record that shows you have given us express consent to use your personal data. This applies to the following purposes:
- Direct marketing (if requested to be added to our mailing list); and
- Training, workshop and conference information.
5.2 Legitimate interests
Where we are able to demonstrate a legitimate interest in using your personal data which has been balanced against your own interests, rights and freedoms as the data subject. This applies to the following purposes:
- Direct marketing (if based on e.g. previous purchases);
- Sending email newsletters and upcoming events to members;
- Marketing workshops, training and conferences; and
- Administration of consortium and forum meetings and special interest group meetings.
5.3 Compliance with legal obligations
Where we are required to process your personal data to comply with a common law or statutory obligation. This applies to the following purposes:
- Keeping financial records.
5.4 Contractual necessity
Where it is necessary for us to process your information in order to fulfil our contractual obligations to you, or where you have asked us to do something prior to entering into a contract. This applies to the following purposes:
- Membership administration – signing up new members, renewing and cancelling membership;
- Collecting membership fees;
- Delivering membership benefits – sending mailings and books, organising and facilitating of member meetings and providing information around workshops and conferences relevant to the member;
- Administrating groups – providing information to members regarding upcoming events, workshops, conferences, meetings and training relevant to the member;
- Running training/events/workshops/consultancy services – booking delegates onto conferences and speakers;
- Providing our advice line service; and
- Consultancy work – serving on adoption or fostering panels, chairing disruption meetings or any other specific contracted work carried out for you by AFKA Scotland.
6. Sharing your personal data
Within AFKA Scotland
Your personal data will only be accessible to AFKA Scotland staff who need to process it for the purposes of providing services, fulfilling orders and keeping in touch, and for the purposes of processing payments.
With Third Parties
We sometimes share your personal data with trusted third parties (other organisations or companies that we work with or which provide services to us). For example in compiling a delegate list for meetings, workshops and conferences when circulating information among our members by e-mail.
We apply the following policies to those organisations to keep your data safe and protect your privacy:
- We provide only the information they need to perform their specific services;
- They may only use your data for the exact purposes we specify in our contract with them;
- We work closely with them to ensure that your privacy is respected and protected at all times; and
- If we stop using their services, any of your data held by them will either be deleted or rendered anonymous.
7. How long will we keep your personal data?
Whenever we collect or process your personal data, we will only keep it for as long as necessary for the purpose for which it was collected.
At the end of that retention period, your data will either be deleted completely or anonymised, for example by aggregation with other data so that it can be used in a non-identifiable way for statistical analysis and business planning. Some examples of customer data retention periods:
- Your membership – while the membership is current and for 3 years after the membership expires.
- Financial data: records of sales e.g. invoices and receipts – for 6 years plus the current financial year.
- Making an enquiry to the Advice Line – for 6 years.
- Attendance at our training, workshop, conferences or other events – while membership is current and for 3 years after the membership expires.
- You working for us as a member of staff, associate or volunteer – payroll records for 6 years, health and safety records for 3 years, basic employment details indefinitely.
8. Further processing
If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Whenever necessary, we will seek your prior consent to the new processing.
9. How will we secure your personal information?
We know how much data security matters to you. With this in mind, we will treat your data with the utmost care and take all appropriate steps to protect it. We employ a variety of physical and technical measures to keep your data safe and to prevent unauthorised access to or use or disclosure of your personal information.
Electronic data and databases are stored on secure computer systems and we control who has access to information (using both physical and electronic means). Our staff all receive data protection training and we have a set of detailed data protection procedures that personnel are required to follow when handling personal data.
We secure access to all transactional areas of our websites using ‘https’ technology.
Access to your personal data is password-protected, and sensitive data (such as payment card information) is secured by SSL encryption.
10. Your rights and your personal data
We want to ensure that you remain in control of your personal data. Part of this is making sure you understand your legal rights.
An overview of your different rights
You have the right to request:
- Access to the personal data we hold about you, free of charge in most cases.
- The correction of your personal data when incorrect, out of date or incomplete.
- The deletion of your personal data, for example, when you withdraw consent, or object and we have no legitimate overriding interest, or once the purpose for which we hold the data has come to an end.
- That we stop using your personal data for direct marketing (either through specific channels, or all channels).
- That we stop any consent-based processing of your personal data after you withdraw that consent.
- Review by Brenda Reilly, AFKA Scotland Business Support and Finance Manager, of any decision.
You have the right to request a copy of any information about you that AFKA Scotland holds at any time, and also to have that information corrected if it is inaccurate. To ask for your information, please email or write to Brenda Reilly, Data Protection Co-ordinator, AFKA Scotland, 14 Links Place, Edinburgh, EH6 7EZ.
To ask for your information to be amended, please update your online account (where applicable), or speak to Brenda Reilly. If we choose not to action your request we will explain to you the reasons for our refusal.
Your right to withdraw consent
Whenever you have given us your consent to use your personal data, you have the right to change your mind at any time and withdraw that consent.
Where we rely on our legitimate interest
In cases where we are processing your personal data on the basis of our legitimate interest, you can ask us to stop for reasons connected to your individual situation. We must then do so unless we believe we have a legitimate overriding reason to continue processing your personal data.
Direct marketing
You have the right to stop the use of your personal data for direct marketing activity through all channels, or selected channels. We must always comply with your request.
Checking your identity
To protect the confidentiality of your information, we will ask you to verify your identity before proceeding with any request you make under this Privacy Notice. If you have authorised a third party to submit a request on your behalf, we will ask them to prove they have your permission to act.
11. Complaints
AFKA Scotland tries to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously and encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office. You can contact them by calling 0303 123 1113 (local rate) or email scotland@ico.org.uk.
12. Contacting us
If you have any questions or concerns about this Privacy Notice and our privacy practices, please in the first instance contact the Data Protection Co-ordinator at AFKA Scotland by email at brenda.reilly@afkascotland.org.
For further information on how your information is used, how we maintain the security of your information, and your rights to access information we hold on you, please contact us:
By email at info@afkascotland.org.
Or write to us at:
Data Protection Co-ordinator
AFKA Scotland
14 Links Place
Edinburgh
EH6 7EZ
13. Changes to this Privacy Notice
If we modify this Privacy Notice, we will post the revised version here, with an updated revision date. Please check back periodically, and especially before you provide any personally identifiable information.
Last revision: September, 2019