Privacy Notice
Important Information & Who We Are
What is the purpose of this document?
Aberdeen Foyer wants you to feel assured that we are committed to protecting the privacy and security of your personal information. This notice describes how and why Aberdeen Foyer uses your personal information, how we protect your privacy when doing so, and your rights and choices regarding this information.
Everyone has rights with regard to the way in which their personal data in handled. During our activities we will collect, store and process personal data and we recognise that the correct and lawful treatment of this data will maintain confidence in the organisation and will promote a positive working environment.
Your personal data, which may be held on paper or on a computer, on cloud-based systems or other media, is subject to certain legal safeguards specified in the General Data Protection Regulation 2018.
This notice and any other documents referred to in it, sets out the basis on which we will process any personal data we collect from you or that is provided to us by yourself or other sources. This policy sets out rules on data protection and the legal conditions that must be satisfied when we obtain, handle, process, transfer and store personal data.
This notice applies to anyone who participates in any of our services, is working in partnership with us, has a contract with us or chooses to support us. We may update this notice at any time.
Who we are
Aberdeen Foyer is a Charitable Company Limited by Guarantee, registered in Scotland, No: 184423 and a registered Scottish Charity, No:SC023655. The Registered Office is at Marywell Cente, Marywell Street, Aberdeen AB116JF. We are registered with the Information Commissioners Office (registration No Z5907511) as a Data Controller. This means that we are responsible for deciding how we hold, use and protect personal information about you.
The kind of information we collect about you
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). We will collect, store and use the following categories of personal information about you as follows.
The personal information we collect about you will depend on how you have chosen to engage with us.
Identity Data including personal contact details such as name, date of birth, national insurance number, gender.
Contact Data including addresses, telephone numbers and personal email addresses, emergency contact details
Financial Data including bank account details, your debit or credit card information.
Social Services Data including medical practitioners contact details, social worker details
Employment Data including employment history details, benefit details, qualifications, training providers
Verification Data including driving license, passport, citizenship, proof of address
Service Data including your history and services you use/have used
We also collect information from the Special Categories of Data
Sensitive Data including race, ethnicity, sexual orientation, religious belief
Medical Data including past and current conditions
Criminal Offence Data including current convictions and pending cases
*We will only collect sensitive, medical or criminal offence data where it is absolutely necessary to fulfil our contract. For example, Medical Data in relation to our counselling services. *
If you fail to provide personal data
Where we need to collect personal data by law, or under the terms of a contract and you fail to provide that data when requested, we may not be able to deliver the services to you (for example, to register you on a programme, provide support services to you or enter into a contract with you). In this case, where we may not be able to provide you with those services we will notify you if this is the case at the time.
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
How is your personal information collected?
We collect personal information about you through:
Direct interactions. You may give us your personal information when registering for or using our services, making enquiries or entering into a contract.
Referrals or publicly available sources. We may receive personal data and additional information from referral agencies or online sources. We will make best effort to ensure this information is current and up to date.
How we will use information about you
Most commonly we will use your personal information in the following circumstances:
Where we need to deliver services to you under the terms of a contract.
Where we have entered into a contract with you.
Where we need to comply with a legal obligation.
Where we have your consent.
Where it is necessary for our legitimate interests (or those of a third party) and your fundamental rights do not override those interests.
We may also use your personal information in the following situations, which are likely to be rare:
Where we need to protect your interests (or someone else's interests).
Where it is needed in the public interest.
Use of Google Analytics
We use Google Analytics to help us understand how visitors interact with our website and to improve our services. Google Analytics collects data such as your IP address, browser type, operating system, and the pages you visit on our website. This data is anonymized where possible and used for statistical analysis.
Purpose of Google Analytics Tracking
The primary purposes of collecting this information are to:
Improve user experience by analyzing visitor behavior and preferences
Optimize website performance to ensure accessibility and functionality
Identify trends and usage patterns to improve content and structure
Data Collection Through Cookies
When you visit our website, cookies may be set on your device. Cookies are small data files that help us collect non-identifying information. You will be asked to consent to these cookies on your first visit to our website, and you have the option to refuse cookies through our cookie consent banner.
If you would like more information about cookies and how they function, please review our Cookie Policy
Data Retention and Sharing
Google Analytics data will be retained only as long as necessary to fulfill the purposes described above. Google acts as a data processor for this information, which may be stored on servers outside the EU, but complies with GDPR requirements. For further information on how Google handles data, please refer to Google’s Privacy Policy at https://policies.google.com/privacy.
Opting Out of Google Analytics Tracking
If you prefer to opt out of Google Analytics tracking, you can use the following options:
Disable cookies via our cookie consent banner on your first visit, or adjust your browser settings to refuse cookies.
Install the Google Analytics Opt-Out Browser Add-On. This is a tool provided by Google that prevents Google Analytics from collecting information about your website visits. You can download it from https://tools.google.com/dlpage/gaoptout.
Situations in which we will use your personal information
We need the categories of information in the list above primarily to allow us to deliver our services to you or fulfil our contractual obligations. The situations in which we will process your personal information are listed below.
To deliver services to you including:
Carrying out our obligations arising from any funding contracts or agreements
To deliver our services
To provide you with the information and services that you request from us
Identity
Contact
Financial
Social Services
Employment
Verification
Service
Sensitive
Medical
Criminal Offence
Performance of a contract
Type of data
Identity
Contact
Financial
Social Services
Employment
Verification
Service
Sensitive
Medical
Criminal Offence
Lawful basis for processing including basis of legitimate interest
Performance of a contract
To validate you as a registered customer or client when using our services and calling for information.
Identity
Contact
Verification
Performance of a contract
Lawful basis for processing including basis of legitimate interest
Performance of a contract
To notify you about our services and to make suggestions and recommendations to you about our services or events that may be of interest to you. We may also ask for your permission to take pictures or video for promotional material.
Identity
Contact
Consent
Lawful basis for processing including basis of legitimate interest
Consent
For the administration of files and records, business management and planning, including accounting and auditing.
Identity
Contact
Financial
Service
Performance of Contract.
Necessary to comply with a legal obligation
Lawful basis for processing including basis of legitimate interest
Performance of Contract
Necessary to comply with a legal obligation
For Administration of Payroll and HR services.
Identity
Contact
Financial
Employment
Verification
Service
Medical
Criminal Offence
Performance of Contract
Necessary to comply with a legal obligation
Lawful basis for processing including basis of legitimate interest
Performance of Contract
Necessary to comply with a legal obligation
To send certain communications (including by email and SMS) to you including service announcements and administrative messages and other communications relating to our services.
Identity
Contact
Performance of a contract
Lawful basis for processing including basis of legitimate interest
Performance of a contract
To ensure security for you and our staff, and help maintain service quality.
Identity
Contact
Performance of a contract.
Necessary for our legitimate interests (The on-going safety and security of our staff)
Lawful basis for processing including basis of legitimate interest
Performance of a contract
Necessary for our legitimate interests (The on-going safety and security of our staff)
To comply with applicable laws, regulations, court orders, government and law enforcement agencies' requests, to operate our systems properly and to protect ourselves, our users, customers and clients and to solve any disputes.
Identity
Contact
Financial
Service
Verification
Where we need to comply with a legal obligation
Lawful basis for processing including basis of legitimate interest
Where we need to comply with a legal obligation
Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.
Publicity and Promotion
We strive to provide you with choices regarding certain personal data uses, particularly around publicity and promotions. We have established the following personal data control mechanisms:
Information About Our Services
We may use your Identity or Contact Data to form a view on what we think may be of interest to you.
You will receive promotional communications from us if you have consented to be kept up to date with Foyer news, events, fundraising activities and our ongoing work, requested information from us or engaged in services with us and in each case you have agreed to receive communications from us.
Opting Out
You can ask us to stop sending you promotional messages at any time by responding to the communications stating your wishes.
Where you opt out of receiving these promotional messages, this will not apply to personal data provided to us as a result of a service or contract provided, or legal obligations.
Data Sharing
Sharing personal information with third parties
We may have to share your data with third parties, including third-party service providers. We require third parties to respect the security of your data and to treat it in accordance with the law. We will not generally transfer your personal information outside the EU. If we do, you can expect a similar degree of protection in respect of your personal information. We will share your personal information with third parties where required by law, where it is necessary to administer our contract with you or where we have another legitimate interest in doing so.
Third party service providers who will process your personal information
Our partner companies or agencies and their sub-contractors or prospective partners who help us run our services.
Cloud-based systems.
All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our contracts.
Data Security
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
Data Retention
How long will we use your information for?
We will only retain your personal information for as long as is necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means and the applicable legal requirements.
By law we have to keep basic information about our employees, customers and suppliers (including contact, identity, financial data) for six years after activities cease for tax purposes.
Service user information will be retained for the period defined in the funding contract.
In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. We will retain and securely destroy your personal information in accordance with applicable laws and regulations.
Rights of Access, Correction, Erasure, Restriction & Transfer
Your rights in connection with personal information
Under certain circumstances, by law, you have the right to:
Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below). Please note, however, that we may not always be able to comply with your erasure request for specific legal reasons, which will be notified to you, if applicable, at the time of your request.
Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for promotional purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which may go against your objections.
Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you in the following scenarios: (a) if you want us to establish the data's accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
Request the transfer of your personal information to another party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you
If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact us in writing (see contact details below).
No fee usually required
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
Your Rights in Connection with Google Analytics Data
You have the right to:
Request access to or deletion of your personal information collected through Google Analytics.
Object to data processing for analytics purposes or restrict processing if you believe your data privacy rights are being violated.
Withdraw consent to data processing via cookies at any time by adjusting your browser settings or through the Google Analytics Opt-Out Browser Add-On.
To exercise these rights, please contact us in writing at the details provided at the end of this document.
Right to withdraw consent
In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact us in writing (see contact details below). Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law. Please note that, if you withdraw your consent, this will not affect the lawfulness of any processing carried out before you withdrew your consent. If you withdraw your consent, we may not be able to provide certain services to you. We will advise you if this is the case at the time you withdraw your consent
Complaints
You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.
If you believe your rights regarding data collected via Google Analytics are not being respected, you may file a complaint with the Information Commissioner's Office (ICO) or contact us to resolve any concerns.
Changes to this privacy notice
We reserve the right to update this privacy notice at any time and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.
If you have any questions about this privacy notice, please contact admin@aberdeenfoyer.com,
Data Protection, Aberdeen Foyer, Marywell Centre, Marywell St, Aberdeen AB11 6JF