Privacy

General information

This privacy notice tells you what to expect us to do with your personal information when you contact us, including by phone, email, and post and when you visit our website or subscribe to our newsletter.

When we process your personal information, we promise to:

• make sure you know why we need it
• only ask for what we need, and not collect too much or irrelevant information
• make sure it is accurate and up to date
• let you know if we share it with other organisations, unless we have a legal obligation to pass it on without telling you
• protect it and make sure nobody has access to it who shouldn't
• make sure we don't keep it longer than is necessary

The first part of the notice is information we need to tell everybody.

Controller's contact details

The Scottish Government falls under the legal entity of the Scottish ministers in relation to processing of your personal information. We are the controller for the personal information we process, unless otherwise stated.

Our Central Enquiry Unit will pass on your enquiry to the appropriate area.

Telephone

Opening hours: Monday to Friday - 8:30am to 5pm.

From the UK: 0300 244 4000 (0300 numbers are geographically neutral)

International callers: +44 131 244 4000

Text relay service: 18001+ 0300 244 4000 (service for the hard of hearing)

If you are a British Sign Language (BSL) user, you can contact us via our national BSL video relay service Contact Scotland-BSL.

Email

ceu@gov.scot

Post

Scottish Government
St. Andrew's House
Regent Road
Edinburgh
EH1 3DG

Data Protection Officer's contact details

You can contact our Data Protection Officer at DataProtectionOfficer@gov.scot or via our postal address. Please mark the envelope ‘Data Protection Officer’.

Your data protection rights

Data protection law gives you certain rights that you may exercise in respect of your own personal information.

• you have a right to request a copy of personal information we hold about you, by making a subject access request. This right always applies. There are some exemptions, which means you may not always receive all the information we process. We have published further information on this
• you have the right to ask us to update our records if you believe that the data we hold is inaccurate or incomplete. This right always applies
• you have the right to ask us to erase your personal information. There may however be some circumstances in which we cannot comply. Such as, if we have a legal duty to keep data, or we process it in a particular way
• you have the right to ask that we stop or restrict the processing of your information in certain circumstances
• you have the right to object to processing if we are able to process your information because the process forms part of our public tasks
• you have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. This right only applies to information you have given us and we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated

You are not required to pay any charge for exercising your rights. We have one month to respond to you. Please contact us at dpa@gov.scot if you wish to make a request, or contact our Central Enquires Unit on 0300 244 4000.

Your right to complain

If you have concerns about our compliance with data protection laws ,please contact our Data Protection Officer in the first instance at DataProtectionOfficer@gov.scot. They will look into the concerns you have raised and provides the response.

If you are not satisfied with the DPO’s response you have the right to lodge a complaint with the Information Commissioner's Office (ICO). The ICO are the supervisory authority responsible for data protection in the UK. You can contact the Information Commissioner at:

The Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 08456 30 60 60

More information is available at make a complaint on the Information Commissioner's site.  

How we get information

Most of the personal information we process is provided to us directly by you for one of the following reasons:

• you have a question or a concern about something
• you have made an information request to us
• you subscribe to our newsletter

We also receive personal information indirectly, in the following scenarios:

• we have contacted an organisation about an issue you have raised and it gives us your personal information in its response

Lawful basis for processing

We process your personal information because:

• you have given us clear consent for us to process your personal data for a specific purpose
• processing is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract
• processing is necessary for compliance with a legal obligation that applies to us
• processing is necessary to protect your (or some else’s) life
• processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law

Changes to this privacy notice

We keep our privacy notice under regular review to make sure it is up to date and accurate. If this privacy notice changes in any way, we will update this page. Regularly reviewing this page ensures that you are always aware of what information we collect, how we use it and under what circumstances we share it with other parties.

Contacting the Scottish Government

You may have written to us, or contacted us by phone, because you have a question or concern about something. This part of the privacy notice sets out how we use your personal data, and your rights when communicating with us.

What we do with information we collect from you when you contact us

When you write to us or call us, your enquiry will usually be first handled by our Central Enquiry Unit or Public Engagement Unit. They will then send it to a specific team so that your question can be answered. We will only use your personal information for the purpose of handling, investigating and resolving your issue. We will use the contact details you provided to respond to your correspondence. If you have raised any issues about a third party, we may use the contact details you have provided for them to investigate your issue.

What personal information we collect

We need enough information from you to answer your enquiry. If you call the helpline, we will make an audio recording of. If you contact us via email or post, we’ll need a return address for response.

Who we share your information with

Your enquiry will often need specialist advice, and will be passed to the relevant team for consideration and input.

In some circumstances we will share your information with other organisations. When we do that we’ll satisfy ourselves that we have a lawful basis on which to share the information and document our decision making and satisfy ourselves we have a lawful basis on which to share the information.

Calling our helpline

Our Central Enquiry Unit record all incoming calls as an audio record. The information collected is the date, time, duration, the telephone number if not withheld and the name of the agent who handled the call. That is captured by the software used to record the calls. The calls are recorded to monitor the behaviour of the callers and to provide training for staff. The information is kept for three months.

Visiting our website

We collect information about you when you visit our website, and when you interact with our pages. We also collect information when you provide feedback or subscribe to our newsletter.

What we do with information we collect from you when you visit our website

We use this information to:

• improve the site by monitoring how you use it
• respond to any feedback you send us, if you've asked us to
• send out email alerts to those who have subscribed to our e-newsletter
• record and/or publish your response to a survey or consultation
• publish your comment on a blog or discussion site

What personal information we collect

Analytics

We use a third party service, Google Analytics, to collect information on how you use the site, using cookies and page tagging techniques.

The information we - and Google - collect doesn't identify anyone, and is kept for a maximum of 38 months. If we do want to collect personally identifiable information through the site, we will be upfront about it.

When staff use our site

We use IP addresses to identify Scottish Government staff accessing the site from Scottish Government networks.

We record these users as 'internal' on this site. This helps us produce more accurate data about how members of the public use our content.

All visitors are anonymous. We cannot identify individuals.

Cookies

You can read more about how we use cookies, and how to change your cookies preferences, on our Cookies page.

Additionally, we use Plausible Analytics on this site to collect some anonymous usage data for statistical purposes. This is to track overall trends in our website traffic, not to track individual visitors. All the data is in aggregate only. No personal data is collected to Plausible. Data collected includes referral sources, top pages, visit duration, information from the devices (device type, operating system, country and browser) used during the visit. Read more in the Plausible Analytics data policy.

Subscribing to our e-newsletter

We collect your email address and subscription preferences when you sign up to our e-newsletter. You can also provide your name but this is optional. We track how our emails are used - for example whether you open them and which links you click on. The lawful basis we rely on to process personal data when you subscribe to our newsletter is consent. This means you have the right to withdraw your consent, or to object to the processing of your personal data for this purpose at any time. You can unsubscribe from receiving the newsletter at any time by selecting the 'unsubscribe' link that appears in every email. Once you have unsubscribed, your details will be deleted immediately from the system.

Feedback

If you contact us asking a question or giving feedback, we collect your email address and any other personal data contained in your message. If you contact us asking for information, we may need to contact other government bodies to find that information.

Consultations

We collect names and email addresses with every response we receive through our consultation platform.

Email addresses are used to send an acknowledgement of response following submission. They may also be used to contact you in the future in relation to the consultation exercise if you give consent to be contacted.

Where permission is given, we publish responses. We include personal data where permission has been given to do so. We never publish email or postal addresses.

Sometimes you may be accessing or linking to topic specific pages from our website – in such cases please refer to the privacy notice for that site.

Blogs and discussion sites

We collect names or usernames, and email addresses with each comment. This data is kept as long as the blog post or dialogue remains published.

Who we share your information with

We use Mailchimp to process our email newsletter subscriptions. Mailchimp’s privacy notice outlines how they collect, use, share and process personal information.

Links to other websites

When we link to other websites, we encourage you to read the privacy policy statements contained on those sites.

Data protection policy document

See Information assurance and data protection: data protection policy.