Privacy Policy

Who we are

Our full legal information is held under the name Wellbeing Scotland, a charity registered in Scotland SCO24065 and Registered Company Limited by Guarantee, Company No SC365238.

Our contact details are

14 – 16 Bank Street, Alloa, FK10 1HP

01324 630100

info@wellbeingscotland.org

Within this policy, any references to the words we, our, us or the organisation refer to Wellbeing Scotland and any of our services. This will include all of our services with their own titles – In Care Survivors, Open Secret, Children & Families and Wellbeing Matters.

What Personal Data Do We Process

Wellbeing Scotland collects, stores and uses information on:

• ndividuals who use or ask about using our services
• Individuals who use our Website and Social Media
• Individuals who make donations or purchase items
• Volunteers
• Employees and prospective employees
• Individuals who sign up for our newsletters or other marketing information
• Individuals who visit any of our premises (Visitors Signing In log)
• Professionals and Organisations
• Individuals making a complaint or who have been involved in an accident or incident within the organisation or at one of our external events
• Students on placement within the organisation
• Suppliers
• Funders

A separate notice is provided to our employees

We deal with all personal data in a fair and transparent manner. We ensure that all data is kept secure. This Privacy Policy details how we collect, store, and process any personal information we hold about you. We want you to feel confident that we treat your information and confidentiality seriously and manage all personal information carefully and respectfully and within the law.

This policy applies to the organisation’s legal responsibilities under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Throughout this document, we will refer to these as the ‘UK GDPR. The UK GDPR influences how we collect, store, and use your personal data . The UK GDPR relates to the following:

• Any websites we operate. Currently www.wellbeingscotland.org 
  and www.incaresurvivors.org.uk
• The organisation’s use of emails, text messages and direct mail for marketing purposes
• The organisation’s use of personal information held to provide services
• The organisation’s use of information we hold on volunteers and employees
• The Organisation’s use of personal information in relation to fundraising, donations and sale of items
• The use of information for case studies by professional researchers to support our organisational obligations (anonymised data only)
• Any other procedures and systems we use for processing personal, sensitive information

This policy details what personal information we collect, why we need to collect it, what we do with that information, what rights you have in relation to your personal information and also what we will not do with your personal data.

How we collect your personal information

We collect your personal data directly from you when you contact us about our services by phone, post, e-mail or via our website.

We also receive some personal data about you from other organisations we work with. These are:

[Please complete list of agencies referring/sharing data re any clients/customers]

Why we use your personal information

Wellbeing Scotland collects and uses data so that we are able to provide our services to individuals, raise funds, undertake effectiveness research. collect donations and organise and run events. The personal data you give us helps us to contact you to arrange services for you and to allow us to provide you with a service which is tailored to meet your individual needs.

If you feel you do not wish to provide us with any personal information, you have the choice not to do so however if we do not hold personal information for you we will not be able to make contact with you to offer support.

If you have any questions about your personal data and how Wellbeing Scotland use your information you can speak to any members of staff you currently work with or contact the office and ask to speak to our Corporate Services, Manager, who will be able to explain in more detail what we do with your information and how it might affect you if we are unable to hold this information.

Please see the section below about your Rights in relation to your personal data.

All of the information you share with us will be for a specific reason, for example to access a service, volunteer with us, make a donation, take part in an event. If we want to do anything with your information which is different from the reasons you initially chose to share your information with us, we will contact you and ask for your consent.

What is personal data/information?

Personal data is information that can be used to help identify you as an individual and includes information like your name, address, personal phone number, email address, date of birth and other information about you which may be gathered during your contact with the organisation. It will also include digital identifiers that are linked to you, such as an ‘IP’ address when using online methods of communication.

Some personal information belongs in specific categories which have additional protection due to being particularly sensitive. This can include information in relation to race, religion, sexual orientation or information about health conditions. Due to the nature of the support we offer, information on health conditions is something we may sometimes collect and process.

What are the laws around using your information

The ‘UK GDPR only allows our organisation to collect and use your data if the reasons we are collecting and using your information fall within the reasons cited in the UK GDPR, referred to as “lawful bases”.

Wellbeing Scotland will process your personal information under the following “lawful bases”. For reference, processing your personal data covers everything from collecting your information to storing it and also deleting it.

Contract: We will process your data under the lawful basis of a contract when you have requested us to provide you with a service (e.g., to receive counselling or to take part in a group activity or event or pay for good/make a donation). We will collect and process personal data to enable us to provide you with the service you have asked to receive. We cannot use this reason to process ‘special categories’ of data.

Consent: We may ask for your permission to use your information, for example to add your details to a mailing list for future communication. To have consent, you will be required to take an action to give your consent which may be ticking a box, subscribing to an online list or verbally agreeing to our request. Once your consent has been given, you can withdraw your consent at any time by contacting us or unsubscribing from an electronic mailing list.

Vital Interests: We will process your data if it is in your or someone else’s vital interests which would mean that using the data may be lifesaving, for example if someone is presenting with a risk to harming themselves, or a child protection issue, we may process your information to advise medical, emergency services or social work services as per our confidentiality agreement. Information which would fall under the category of special information would only be processed under this lawful basis if for some reason you are either legally or physically unable to give your consent.

Legitimate Interests: We are allowed to process your information if it is a legitimate business need or that of another organisation acting on our behalf, however if information is provided that there is a good reason to protect your personal data which overrides our organisation’s interests, we would not process this information. This lawful basis cannot be used to process information which falls under the special categories.

Legal Purposes: At times it may be necessary for us to process your data if it is necessary for us to comply with a legal obligation to share information. An example of this may be a mandate from a Procurator Fiscal or the Police to provide evidence for a criminal. This lawful basis would include personal information which falls under the special categories.

Special category (sensitive) personal data

The UK GDPR defines some particularly sensitive personal data as ‘Special category personal data’. This includes information in relation to race, religion, sexual orientation or information about health conditions. Before collecting and using this type of sensitive information, for example to provide our counselling services, we will ask for your Explicit Consent.

Employment: For employees, the organisation is entitled to process information including special categories, for the purposes of employment of staff and compliance with Employment Legislation.

Who will see my information?

Your information will only be seen by relevant staff and volunteers who need to see it in order to provide the service you have requested or make contact with you in relation to a service, donation or purchase you have enquired about, unless there is a valid reason to share it with other staff members – for example where a member of staff would like to discuss your case with another member of staff to enable us to enhance the level of service we can offer you.

Your information may also be shared with others in specific circumstance which are detailed in the section entitled Sharing Your Information.

Sharing your information

Sometimes we will share information you have given us with others for specific reasons such as:

• It is necessary to share information to provide the service you have requested from us and you would expect us to have to share your information in this way
• To undertake case study work with qualified researchers
• If we are legally required to do so, for example by a statutory agency legitimately exercising a power to receive the information for example information mandated by a Court
• If a situation arises where the organisation believes it is necessary to share information to protect our rights, property, or the personal safety of visitors to our premises or social media platforms
• If we are providing services in partnership with another agency who are carrying out work on our behalf. Examples of these partners may be another voluntary agency we have commissioned for a specific project/service, an independent consultant working on our behalf, payment processors, IT professionals, regulating bodies, marketing agencies. We only choose partners we can trust and we will only pass personal data to them if they have signed an agreement that requires them to:
  • Adhere to the legal requirements of the UK GDPR
  • Treat your information and confidentiality as carefully as we do
  • Only use the information for the purposes it was supplied and never for their own purpose or any other external organisation or person
  • Allow us to monitor their compliance with this agreement
• If our relationship with you involves payments we may on occasion have to share your information with financial organisations including auditors/accountants, credit reference organisations, debt collection agencies.

Sharing Information for Safety

If you share information with us that raises our concern for the safety of yourself or someone else, or relates to an actual or intended crime, we may be obliged to share this information with the relevant authorities and statutory agencies.

Using your personal information for marketing purposes

We distribute marketing information to enable us to tell people about our service, raise awareness of campaigns, gain financial support for the charity and to advertise events and any goods/services we may sell. We will only send you marketing information if you have given us consent to do so, and the format in which you would like to receive information, for example by post, email, SMS message.

You can remove your consent for marketing information, or change how you receive this information from us at any time by looking for the unsubscribe link in any of our marketing emails or contacting the office on 01324 630100, email us at info@wellbeingscotland.org or writing to us at Wellbeing Scotland, Admin Department, 14 Bank Street, Alloa FK10 1HR.

If you have not yet requested information from us but would like to do so, again please contact us using the information in the previous paragraph.

Storing your information

Information is stored by us on our computer systems, within paper files held within secure filing cabinets on our premises and within secure online services. To enable us to provide services in different locations, we may sometimes transfer your information to other locations and to reputable third-party organisations for example secure storage facilities.

To protect the information, we hold we also utilise online backup services for disaster contingency planning in the event of a problem with our own internal systems.

Under the UK GDPR we must not keep your information for any longer than necessary. ‘Our Data Retention Policy details how long we will keep your information for. Our retention timescales are influenced by guidance from public bodies, legal requirement and guidance and experience from individuals who have used our services and what they have told us meets their needs in relation to retaining personal information. Our retention schedule was last updated January 2024 . See appendix 1 for summary of retention for client records.

You have the right at any time to request that your information is deleted or no longer used.

Keeping your information secure

We take the storing and security of your personal data and confidentiality very seriously. The organisation has specific security measures in place to protect your information against the risk of being lost, stolen, misused, or altered in any way. For example, only authorised staff will have access to your information, and we use security access levels on all of our electronic systems. Whilst we cannot ensure or guarantee that misuse, loss, or alteration of your information will never occur within our systems we have taken every measure possible to ensure the safety and security of your information.

When we no longer need information or you have requested that we no longer hold or use your information, we’ will delete it provided this does not breach any legislative requirements to retain the information

If we are disposing of personal, sensitive information we ensure this is done securely to prevent anyone else from gaining access to the information, For example paper files will be shredded and disposed of using a confidential waste disposal expert, and we use specialist companies to dispose of computers and other electronic data storage equipment.

What we won’t do with your information

We will never sell or share your information to other individuals or organisations to use for their own purposes, other than outlined in this privacy notice

Media Recordings and Footage

‘We´ hold a record of photographs, recordings, film footage and other media taken by us or supplied by any other individuals or organisations working on behalf of Wellbeing Scotland.

The majority of these media files will be from events and activities organised by us. This information is used to help us to tell others about our services, record progress within the organisation and gather pictorial/audio/video testimony from those using our services and celebrate individual and organisational successes.

We will never use any media footage which would be seen as personal to you without your consent.

There may be instances at public events and activities where photography or videoing may be taking place and it would not be possible to receive individual consent from all individuals in attendance. In these circumstances, we would take steps to ensure that notices and other methods were used to advise all in attendance that photography or filming or recording was taking place along with guidance on who to contact/approach should you object to your image/voice being used.

We would always advise that before consenting to the use of any images/recordings/footage which would identify you that you give careful consideration about how you may feel about this footage being available in the future.

Media footage is used by us in many formats including websites, social media platforms such as Facebook, Twitter, Instagram, Linked in, local press such as radio, TV and newspapers, brochures, reports and newsletters.

We will never use photos, videos or audio footage that feature you without your consent, out with the exclusion above of public events.

We will never sell or share media footage of you to other individuals or organisations for their own purposes.

If you change your mind at a later point about media content you have consented to us publishing we will make every endeavour to remove this where feasible, however there may be situations where this would not be immediately possible, for example if it would be costly to locate, withdraw and reprint brochures from various sources, information that has been shared with other organisations, information that has been published on the internet on websites that are not our intellectual property. For this reason, we would ask that you give this consideration before consenting to taking part in any collection of media footage.

Evaluation and Feedback Information

‘We´ keep a record of evaluation information and individual feedback provided by those who have used our services to help us adapt and improve services. This feedback enables us as an organisation to review practices and procedures to improve service delivery but also provides an opportunity for individuals to share their personal experiences and journeys to support others.

All feedback we share to promote services is done so anonymously but you should be aware that if you have given consent for us to use your feedback that this may appear in several formats, for example in brochures/posters, on our website/social media platforms, in marketing and advertising materials.

If with redaction your experience may still personally identify you, we will only ever publish your feedback with your consent. Again, you may withdraw your consent at any time in the future.

Your privacy on other websites

Our websites and social media platforms may link to other websites. Please note this privacy policy only applies to any websites and domains owned by Wellbeing Scotland.

Your rights

GDPR gives you the following rights over your information and how we use it:

• Access: You have the right to enquire if we hold any personal information about you and to gain access to any personal information we hold on you.
• Right to Rectification: If we hold incorrect information about you, you have the right to have this corrected and to provide additional information if the information we hold is incomplete.
• Right to Erasure: In certain cases, where we are not bound by any legislative requirements, you will have the right to ask for the data we hold about you to be erased.
• Right to Restrict Processing: In circumstances where there is no legislative requirement, you have the right to ask us to stop using your data.
• Right to Data Portability: In circumstances where you have input your personal data to our website or other system, you have the right to ask for a copy of that information we hold on you and to ask us to transfer that information to you or another organisation.
• Right to Object: In certain cases, you have the right to object to us using your personal information. You may also object to the use of your information where it has been processed for direct marketing purposes.
• Right to be Not Subject to Automated Individual Decision-Making: You have the right to prevent us from making decisions about you that are based solely on rules used by automatic processors.

For more information about your rights go to the website of the Information Commissioner’s Office at ico.org.uk.

Wellbeing Scotland may make changes to this policy from time to time. Any changes made will be publicised on our websites, other social media and in our written copies of the policy and will be effective from the date that we post the changes

This document reviewed January 2024

Appendix 1 – retention of client records