Volunteer Privacy Notice

Updated February 2019

We ask that you read this privacy notice carefully as it contains important information on who we are, how and why we collect, store, use and share personal information, your rights in relation to your personal information and on how to contact us and supervisory authorities in the event you have a complaint.

Your personal data

Personal data relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in the controller’s possession or likely to come into such possession. The processing of personal data is governed by the General Data Protection Regulation (EU) 2016/679 (the “GDPR”).

The privacy and security of our volunteers’ personal data is important to us. This privacy notice explains how we use the information we collect about you, how you can instruct us if you prefer to limit the use of that information, and the procedures that we have in place to safeguard your privacy.

This privacy notice relates to personal information that we obtain from you when you volunteer with Caledonian Concepts (Scotland) Limited, by attending and/or volunteering at any events with us and your image in photographs from our events.

Who we are and contact details

Caledonian Concepts (Scotland) Limited, Registered in Scotland SC310846 with our registered office at Alder House, Cradlehall Business Park, Inverness IV2 5GH is the controller and responsible for deciding how your personal data is processed and for what purposes (collectively referred to as “we”, “us”, or “our” in this privacy notice).

You have the right to make a complaint at any time to the Information Commissioner’s Office (the “ICO”). We would however appreciate the chance to deal with your concerns before you approach the ICO so please get in touch with us in the first instance.

How we process your personal data

We comply with our obligations under the GDPR by keeping your personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.

Any information that we collect about you is stored electronically on our online registration system, Active Network. It may also be printed and stored in our filing system.

The personal data we collect

We may collect and use different kinds of personal data about you which we have grouped together as follows:

• Identity Data: g. your name, date of birth, gender;
• Contact Data:g. your email address, mobile number and details of a next of kin contact for use in the event of an emergency;
• Organisation Data: g. if you represent any organisation or group and which charity / community group you have nominated for a donation in return for volunteering;
• Photographs:g. photographs taken during an event by our official event photographers may be used in the event marketing literature.

In nearly all cases, we collect your personal data directly from you when you complete our online registration form or complete our volunteers form at the events. We will not collect or store any other sensitive information about you without your explicit consent. However, by volunteering at an event, we will ask you for consent to the event, sponsor or charity beneficiaries storing copies of such images or video footage.

We require you to provide the Identity Data, Contact Data and Organisation Data detailed above to enable us to fulfil your volunteering role.

How we protect your personal data

We will keep your personal data confidential except to the extent that we are compelled to disclose it by law (e.g. where fraud or other crime is involved) or to comply with an instruction of a regulatory body of competent jurisdiction. To comply with the GDPR we follow strict security procedures for storing personal data. The personal data that we hold will be held securely to ensure no unauthorised disclosure or access.

Purposes for which we will use your personal data

We will only use your personal detail where we are allowed to by law. The main circumstances where we use your data are as follows:

• where we have your consent (in limited circumstances);
• where it is necessary for our legitimate interests (or those of a third party) to contact you about volunteering at future events, send you information regarding the events at which you are volunteering and keeping a record of your volunteer activity, provided your interests and rights do not override such legitimate interests;
• where it is necessary to protect your vital interests in emergencies; or
• where we need to comply with a legal or regulatory obligation.

Generally we do not rely on consent as a lawful basis for processing your personal data other than asking you for consent to the free use of your name, voice or photograph in any photo, image or video footage broadcast, telecast, advertising, promotion or other account of the event for which you are a volunteer, the sponsor and the beneficiary charities in any future fundraising, marketing or publicity materials including national and regional press, or the event organiser’s website as well as on the event, sponsor or charity beneficiaries social media accounts.

You can ask us to stop sending you volunteer communications at any time. We have set out below a description of all the ways we plan to use your personal data, and which of the lawful bases under the GDPR that we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Special Category Data

Special category data is personal data which under the GDPR is more sensitive, and so needs more protection. We have set out below a description of the ways we plan to use your special category personal data, if applicable to you, and which of the lawful bases under the GDPR that we rely on to do so.

Sharing your personal data

We keep your personal data confidential, but may disclose it to our personnel, suppliers or sub-contractors as is reasonably necessary for the purposes set out in this privacy notice and for which you might reasonably expect. We make sure that these third parties do not make independent use of the information and that they have agreed to adhere to the rules set out in this privacy notice.

Categories of third parties are listed below:

• volunteer coordinators who are contracted by us as consultants;
• volunteer team leaders at events; and
• our online registration and email suppliers;
• event relevant suppliers (e.g. radio / communication system suppliers).

Where we wish to publish a photograph of you with other personal data online, including on social media, this may be accessed outside of the EU and we may seek to obtain your consent if we consider it to be necessary.

In the event that we do share personal data with external third parties, we will only share such personal information strictly required for the specific purposes and take reasonable steps to ensure that recipients shall only process the disclosed personal information in accordance with those purposes.

International data transfers

Whilst we operate within the UK, we will transfer parts of your personal data, where reasonably necessary, to our third party service providers who may be located outside of the EU or who may engage sub-processors located outside of the EU. There are agreements in place to ensure that all of our third party suppliers or service providers process personal information using appropriate safeguards that meet the requirements of the GDPR.

Our online registration system, Active Network, and our communications system, Mailchimp, are US companies with servers based outside of the EU.  Both suppliers self-certify and comply with the EU-U.S. Privacy Shield Framework and we have entered into data processing agreements with both.

If you would like to find out more about these safeguards or if you have any other queries or comments in relation to this privacy notice, please let us know by emailing [email protected].

How long we keep your personal data

In accordance with the GDPR and good commercial practice we keep data in a form that permits identification of the person to whom it relates for no longer than reasonably necessary and to deal with any claims. It will depend on factors such as whether you have got an account with us, have volunteered at our recent events or receive volunteer communication from us. We will retain your personal data as necessary to comply with legal, accounting or reporting requirements.

Your rights

Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data:

• the right to request a copy of your personal data which we hold;
• the right to request that we correct any personal data if it is found to be inaccurate or out of date;
• the right to request your personal data is erased where it is no longer necessary for us to retain such data;
• the right to withdraw your consent to the processing of your personal data where we have asked you for consent at any time;
• the right to request that we provide you with your personal data and where possible, to transmit that data directly to another controller (known as the right to data portability);
• the right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing;
• the right to object to the processing of personal data, where applicable; and
• the right to lodge a complaint with the ICO.

If you wish to exercise any of the rights set out above please contact us by emailing [email protected].

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data. This is a security measure to ensure that personal data is not disclosed to any person who does not have right to receive it.

Targeted marketing

Where we have a legitimate interest to send you volunteer communications about our events and services, we may from time to time use the information we collect about you to serve you targeted advertisements in order to provide you with more relevant advertising content. This targeted marketing may be accomplished via our own channels (e.g. our website) and third party channels, including across multiple devices or browsers, using some or all of the following platforms:

• Facebook
• Twitter
• Google
• Instagram
• WhatsApp
• YouTube
• Mailchimp

Updating Your Details and Email Preferences

If any of the information that you have provided to us when you volunteer for an event changes, for example if you change your email address, please email [email protected].

You can also update your email preferences by clicking on the unsubscribe link at the bottom of all our emails.

Further processing

If we wish to use your personal data for a new purpose, not covered by this privacy notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary and required, we will seek your prior consent to the new processing.

Review

If we change this privacy notice we will update our website and online volunteer registration form and notify you by email, so that you may be aware of the personal data we collect and how we use it at all times. We may also email you should we make any changes so that you may consent to our use of your personal data in that way, if required.

Contact Details

To exercise all relevant rights, queries or complaints please in the first instance contact us by emailing [email protected].

If we cannot able to resolve your query or complaint satisfactorily you can contact the ICO.