This privacy notice tells you what Children’s Hearing Scotland (CHS) does with the personal data that you provide. This notice is for the information of people who have applied to join the CHS community as Panel Members, are undergoing training, are currently volunteers, or are AST members. For the purposes of this privacy statement, you are considered an applicant from the point you first submit an expression of interest in volunteering up until you are either a) unsuccessful in your application or b) accepted into the training programme.
Some Key Phrases:
Personal Data: this is any piece of data that either by itself or when taken with another piece of data makes you identifiable. It can be in any format.
Data Controller: this is the organisation or authority that takes ultimate responsibility for the data you provide. They can ask other parties to help process it, but they are responsible for ensuring that it is securely and properly managed.
Data Processor: this is any third party or agency that is brought in to process data on behalf of the Data Controller.
Data Subject: this is you, the person that the data is about.
1. Who is the Data Controller?
CHS is the Data Controller for the information we hold about you. This means that when you provide us with any of the information listed in the next section, CHS is responsible for ensuring its security, who sees it, where it goes, and when (and how) it is destroyed. Where you see “we,” or “us,” it refers to CHS as the Data Controller. You can find more information on how to contact us in Section 6.
2. What information do we collect from you?
This section outlines the different types of information that we will ask you to provide.
CHS will ask you to provide the following types of personal data:
- Your first and surname
- Email address
- Contact information (phone number, postal address, etc.)
- Date of birth
- Eligibility to work
- Details of any criminal convictions
- Name and contact information for references.
We also gather more sensitive types of information on volunteers. These types are called Special Categories of data, some examples include:
- Race and ethnic origin
- Sexual orientation
- Physical health
- Mental health
We gather some of this information to help us create panels that are diverse and representative of a range of backgrounds and experiences. When you are asked to provide this data, it will be made clear whether it is a requirement or an optional question. Where you provide these pieces of information, additional safety measures are put in place to protect them.
3. Why do we collect this data, and what do we do with it?
Children’s Hearing Scotland is required to gather personal data for a variety of uses. Below you will find an overview of what we do with your data. The speech bubbles provide information on what are referred to as the ‘legal bases for processing.’ We are required to tell you this, but you do not need to worry about remembering it or being able to recite it.
We use it for administrative purposes
We process your data:
• To meet our obligation to you
• To enrol you on our systems
• To provide you with access to the application resources.
We use it to meet our duty of care to you and our legal obligations
We process your data:
• To meet our legal duty of care to you under health and safety and safeguarding laws
• To comply with our statutory obligations, for example the Children’s Hearings (Scotland) Act 2011
• To comply with our obligations under the UK Equality Act (2010).
We use it for public safety and the prevention and detection of crime
We process your data:
• To apply welfare, security and other measures where they are necessary for the safety and security of volunteers, the CHS community, and the wider public under health and safety and other relevant laws
• When it is necessary for IT monitoring purposes.
We use it to promote our activities
We will process your data:
• To provide you with reminders to complete partial or incomplete applications, and to submit completed applications.
Sometimes we use it for research and archiving
We will process your data:
• To retain any promotional materials that include data, such as images, of the CHS community
• To support research on CHS and the Children’s Hearing System
• To produce management and statistical information to monitor and improve our performance and service provision to you.
4. Who do we share this information with?
In order to meet our obligations to you we will, from time to time, share your information with selected partners. We will only share your data when there is a legal requirement to do so, and all partners and processing agencies are carefully vetted to ensure that they are GDPR-compliant as well. Where possible, we sign Data Processor Agreements with them that carefully spell out what data will be shared, for what purpose, and for how long. These agreements hold our partners to a very high standard and are used to ensure that they process your data securely, and only for the purposes that we have requested.
We share your information with IT and Communications service providers. This enables them to provide IT and communications systems for CHS.
CHS uses Microsoft Office 365 to communicate with applicants, panel members and staff. This is because Microsoft complies with the Privacy Shield framework, a certification programme that ensures that participants based in the United States (and all of their subsidiary and partner businesses) are following UK and EU regulations when it comes to the security of personal data. Leidos Innovations and Brightwire provide IT system support to CHS. We need to share your data with them in order to provide you with access to all the necessary resources to participate in the recruitment process.
We share your information with National and Local Government agencies and partners. This is to ensure that security measures are in place, and that you are able to fulfil the requirements of your contract.
We will give your information to Disclosure Scotland, to allow them to check that you are allowed to work with children, young people, and vulnerable groups.
From time to time, we will share your information with lawyers commissioned by CHS to undertake work on our behalf. This is to enable them to fulfil their contracts with CHS.
When the National Convener is required to intervene or investigate complex cases, or where there may be a conflict of interest, CHS will be required to share some personal data with an external legal advisor/solicitor. This is only in exceptional circumstances, and you will be informed in advance.
5. How long do we keep hold of your information?
We only keep information for as long as it is needed. For the majority of your data, this means that we destroy it after a specified length of time. There are some pieces of information that we must keep permanently for either business continuity or historical value. CHS operates a Retention and Disposal Schedule that shows how long we can keep different types of information. This document also explains how we destroy different types of information, and the reason for processing the information in this way. To read this, please click here.
We hold the personal data of unsuccessful applicants for six months after the recruitment campaign has finished. The specific date varies each year. For further information on this, please contact us at email@example.com. In exceptional circumstances, we may hold your data for a longer period of time. This will never be done without your knowledge. For information on how long we hold the personal data of successful candidates, please refer to our Retention and Disposal Schedule.
6. Your rights
Under the law, you as the Data Subject, have rights that can be exercised at any time in relation to your personal data:
I want to know why I did not get the role I applied for.
You have the right to request copies of the information we hold about you. This can include any images, copies of training transcripts, any email correspondence about you, and so on. This is called a Data Subject Request. You may be asked to provide ID to confirm that you are the Data Subject, and the information can be provided either electronically or in hard copy, depending on your preference.
I recently moved house and I need to update my address.
You have the right to request that the Data Controller rectifies any inaccuracies in the data held about you. If you change your telephone number, for example, CHS is required to ensure that your information is kept up to date.
I don’t want to receive marketing emails anymore.
You have the right to request the erasure of your data. This is more commonly known as ‘the right to be forgotten’. For example, you may wish to have an email exchange you were involved in removed, or ask to be removed from a mailing list.
*NOTE: due to our statutory obligations listed above, it is not always possible to completely erase an individual’s data. Where this is the case, you will be informed as soon as possible.*
I don’t want my application to be used as training material.
You have the right to request the restriction of processing of your data for a given purpose. You do not need to quote your rights, or any part of the legislation, to enact them. To make sure that your request is processed properly, or to find out more you should contact the Data Protection Officer, whose details are listed below. You can also contact the representative of the controller - the Chief Executive of CHS.
Data Protection Officer:
Information Governance Team
T: (0131) 244 3614
Area 2/1/1 Ladywell House
Representative of the Data Controller:
National Convenor and Chief Executive
T: 0131 244 3698
Area 2/1/1 Ladywell House
Contact the Information Commissioner’s Office:
If you feel that CHS has mishandled your information to an extent that cannot be adequately investigated or resolved ‘in house’ you can always contact the Information Commissioner directly.
To report the organisation, or register concern about how your data has been managed, you can use the ICO’s web forms: https://ico.org.uk/concerns/
For advice on data protection and your rights, you can send all queries to:
Information Access Team
Information Commissioner’s Office
Or email them at: firstname.lastname@example.org