PRIVACY NOTICE: SCOTSCARE

WHO ARE WE?

“We”, “us”, “SC”, means ScotsCare. We are a charity with registered charity no. 207326 and registered in Scotland with charity no. SC052739. For over 400 years, ScotsCare has been in London giving a helping hand to Scots and the children of Scots; and is the longest established charity for Scots outside of Scotland

YOUR PRIVACY MATTERS

At ScotsCare, we are committed to keeping your personal data safe and secure.

This notice sets out in detail the purposes for which we process information about you, who we share it with, what rights you have in relation to that information and everything else we think it’s important for you to know.

If you have any questions about the processing of your personal information, or you would like to exercise any of your rights, please reach out to us with the details mentioned below:

EMAIL US: communications@scotscare.com

HOW WE PROCESS YOUR INFORMATION:

To understand how we process your personal information and to understand your rights, please visit the relevant appendix below:

Appendix 1: CLIENTS

Appendix 2: HUMAN RESOURCES (JOB APPLICANTS, EMPLOYEES, VOLUNTEERS)

Appendix 3: DONATIONS, FUNDRAISING AND MARKETING

Appendix 4: GENERAL INFORMATION (COMPLAINTS PROCEDURE, YOUR RIGHTS)

 

Changes to this Privacy Notice

We aim to keep this privacy notice regularly updated. This privacy notice is kept under regular review.  If we make any significant changes to the way in which we process your information, we will let you know by either reaching out to you or posting a banner on the website.

This was last updated in March 2026.

 

 Appendix 1: CLIENTS

 

How and when do we collect information about you? 

We collect personal data from you when you engage with us to enquire about or apply for help, services or financial support (grants). Our services include financial and household grants, counselling support via partner organisations, family support, homelessness support, employment & training assistance, advocacy, social events and befriending, sheltered housing and related services.

You may provide information through our online application forms on our website, telephone calls to our helpline, paper application forms completed in person, Face-to-face meetings with a Client Support worker and during eligibility checks and interviews to assess your needs.

When applying for support, you will be required to provide information such as your identity documentation (e.g. birth certificate or passport), bank statements and any other details that help us assess your eligibility for services.

What information do we collect?

The information we collect may include:

  • Contact details: name, address, telephone number, email address
  • Application details: details about your personal circumstances and household
  • Identity/eligibility information: proof of nationality, residency, dates of birth
  • Health and wellbeing information: details about physical and mental health, medical conditions, medication (if disclosed during an assessment)
  • Household information: information about others in your household relevant to your application
  • Other supporting information: details necessary for determining your eligibility or need for support

 

During face-to-face assessments, more sensitive personal information may be recorded by support workers as part of understanding your circumstances and what support you need. We may also request your dietary requirements if you are attending an event with us.

How is the information used? 

We use your information to:

  • Process and assess your application for grants or other services
  • Understand your needs and provide appropriate support
  • Communicate with you about the status of your application or services
  • Manage appointments, eligibility checks and service delivery
  • Address safeguarding concerns and fulfil our duty of care
  • Carry out internal evaluation, monitoring, and service improvement

 

Your information helps us provide timely, tailored support and ensures we meet our charitable objectives to assist people in need or hardship.

What is our lawful basis for processing this information?

  • To process your personal data through the application and assess your needs, we rely on legitimate interest, read with substantial public interest and conditions from the Data Protection Act 2018 (DPA).
  • To process your dietary requirements, we rely on your explicit consent.
  • Any information about any third parties that is shared with us when you use our services is processed on the basis of legitimate interest, read with substantial public interest and conditions from the DPA.
  • For any safeguarding information that we record, we rely on legitimate or vital interest, read with substantial public interest and conditions from the DPA.
  • For any identifiable case studies and photography that we circulate, we rely on consent. For surveys, we rely on your explicit consent (if they are not anonymous).

Who do we share your data with?

We may share your personal data with:

  • Partner organisations (e.g. counselling providers) acting as separate data controllers when you are referred for specialist support.
  • Adult social care, health professionals, GP or other statutory bodies where it is necessary to coordinate support or safeguard your welfare.
  • Authorities when required by law (e.g. to prevent harm, safeguard vulnerable individuals or comply with legal obligations).

 

How we store your information and for how long?

We retain personal data for as long as is necessary to fulfil the purposes for which it was collected and to meet legal or regulatory requirements. We take appropriate technical and organisational measures to protect your data, whether stored electronically (for example, in our CRM system hosted by Salesforce within the EEA) or in hard copy.

If you would like more information about our retention periods or how your information is stored, please contact us using the details above.

Appendix 2: HUMAN RESOURCES

(Job applicants and current and former employees, trustees, volunteers)

 

How and when do we collect information about you? 

You provide several pieces of data to us directly during the recruitment period and subsequently upon the start of your employment or engagement with us. In some cases, we will collect data about you from third parties, such as employment agencies or former employers when gathering references.

What information do we collect?  

We keep several categories of personal data to carry out effective and efficient processes. Specifically, depending on your type of engagement or arrangement with us, we may process the following types of data:

 

  • personal details such as name, address, phone numbers, marital status
  • name and contact details of your next of kin
  • footage of the organisation events where you may appear
  • information of any disability or other medical information you have disclosed
  • right to work documentation, National Insurance number, bank account details
  • information gathered via the recruitment process such as that included in a CV, cover letter or application form, references, details on your education and employment history etc
  • information relating to your employment with us (e.g. job title, job description, salary, terms and condition of the contract, annual leave records, appraisal and performance indication, formal and informal proceedings involving you such as letters of concern and disciplinary, disciplinary and grievance proceedings)
  • your biography and picture for the website (if applicable).
  • criminal records information if the role involves DBS check.

 

How is the information used? 

We are required to use your personal data for various legal and practical purposes for the administration of your contract of employment or your volunteer and trustee agreement, without which we would be unable to employ you or engage with you. Holding your personal data enables us to meet various administrative tasks, legal obligation or contractual/agreement obligation. We process information in relation to the DBS for our safe recruitment practices.

What is our lawful basis for processing this information?

  • We mainly use ‘contractual obligation’ as a lawful basis for processing personal data for employees, job applicants and freelancers.
  • We mainly use ‘legitimate interest’ for trustees and volunteers. We may also have legal obligation in order to process and share your data, for example we need to share salary information to HRMC or use some of your data to enrol a new employee on a pension scheme.
  • We may rely on our legitimate interest for processing activity such as keeping supervision and appraisal records; using your image, bio and videos/pictures of the organisations’ events where you may appear on our website or marketing/fundraising materials to promote the charity.
  • Some special categories of personal data, such as information about health or medical conditions is processed in order to carry out employment law obligations and for health and social care obligations (such as those in relation to colleagues with disabilities and for health and safety purposes).
  • When processing criminal records (for example, in order to perform DBS check), the organisation relies on the lawful basis of legitimate interest and additional conditions of the UK GDPR and DPA 2018.

 

Who do we share your data with? 

Personal Data in relation to your salary is shared with HRMC as part of our legal obligation. Personal Data may be shared with third parties for the following reasons:

  1. for the administration of payroll, pension, HR functions (for example the online holiday booking system) and administering other employee benefits. In most cases, these organisations work as data processors for us.
  2. When sharing information with third parties, we have data sharing agreements, data processing agreements or contracts in place to ensure data is not compromised. These third parties implement appropriate technical and organisational measures to ensure the security of your data.

How long do we keep your data? 

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to meet our legal, contractual, and regulatory obligations. For employees, personal data will generally be retained for the duration of your employment or engagement with us. After your employment or engagement ends, we will usually retain relevant records for up to six years, in line with statutory limitation periods and legal requirements. Certain categories of data (for example, payroll, pension, tax, or health and safety records) may be retained for longer where required by law. If you apply for a vacancy and your application is unsuccessful, we will retain your recruitment records for up to 6 months following the conclusion of the recruitment process, unless you request earlier deletion or we are required to retain it for legal reasons.

Retention periods may vary depending on the type of information and the reason it was collected. If you would like more information about specific retention periods, please contact us using the details provided above. When personal data is no longer required, it is securely deleted or destroyed in accordance with our data retention and disposal procedures

 

Appendix 3: DONATIONS, FUNDRAISING and MARKETING

 

DONATIONS:

Your personal Information is provided by you via a donation form on our website or via third party donation platforms (e.g. Fundraise Up, JustGiving ). The information gathered may be name, email address, Gift Aid sign up, company name if donation made by an organisation, donation details, reasons to engage and postal address.

This information allows us to process your donation, and deal with any potential enquiry. We rely on our legitimate interest to process this data.  If you agree that we can claim Gift Aid on your donations we are legally required to keep a record of the claim and your Gift Aid declaration.  If you are donating using a third party, please also refer to the privacy notice published on their websites. 

 

FUNDRAISING AND MARKETING:

We may contact you from time to time with information about our fundraising activities, events, campaigns, and ways you can support our work.

If you have previously engaged with us, for example, by making a donation, attending an event, applying for support or otherwise interacting with our organisation, we may send you marketing communications by email or post where permitted under the Privacy and Electronic Communications Regulations (PECR). This is sometimes referred to as the “soft opt-in”.

You will always be given the opportunity to opt out of receiving marketing communications at the point your details are collected and in every subsequent communication.

Where you have actively signed up to receive marketing communications, we rely on your consent to send you marketing emails. For marketing communications sent to business email addresses, we rely on our legitimate interests, unless you object.

You can withdraw your consent or opt out of marketing communications at any time by clicking the unsubscribe link in our emails or by contacting us using the details provided above.

 

Appendix 4: General Information (Complaints Procedure, Your rights)

 

Your rights as a Data Subject

You have the following rights:

 

  • ‘Right to be informed’, which means we will be completely clear and transparent about how we plan to use your personal information.
  • ‘Right of access’, which means you can request details of the personal information we hold about you and how we use it. We will provide this within one month.
  • ‘Right to rectification’, which means you can ask us to update or amend the personal information we hold about you, if it is incorrect.
  • ‘Right to restrict processing’, which means you can ask us to change, restrict or stop the way we are using your personal information.
  • ‘Right to erasure’ (or ‘right to be forgotten’), which means you can ask us to remove your personal information from our records.
  • ‘Right to object’, which means you can object to us using your personal information for marketing purposes.
  • ‘Right to data portability’, which means you can obtain the personal information we hold about you and reuse it for your own purposes.
  • ‘Right not to be subject to automated decision making’, which means if we use systems to make a decision about you, you have the right to ask for a person to intervene, which may change the outcome.
  • Right to lodge a complaint with a supervisory authority, such as the Fundraising Regulator or the Information Commissioner’s Office (ICO), if you are not satisfied with our response to a request you make to us, or you feel we are not using your information correctly.

 

International Data Transfers

Where personal data is stored outside of the UK and the EEA, safeguards to protect personal data may include but are not limited to the UK Addendum used in conjunction with the EU Standard Contractual Clauses (SCCs), or UK International Data Transfer Agreement (IDTAs). Such safeguards will be subject to Transfer Risk Assessments (TRAs).

 

COMPLAINTS PROCEDURE 

If you are unhappy with the way we process your data, please get in touch with the Data Protection Lead using the contact details mentioned above.

You can also make a complaint to the Information Commissioner’s Office (ICO), which regulates the use of information in the UK. They can be contacted at 0303 123 1113 or, you can write to them at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.