Privacy statement

Who we are

We are Children in Scotland Ltd. Our registered address is: Thorn House, 5 Rose Street, Edinburgh, EH2 2PR. Email: dataprotection@childreninscotland.org.uk

Our commitments to you:

• We will keep your data safe and secure
• When you provide us with any of your personal data, we will tell you what our legal basis for holding it is
• We will process your data fairly and in a transparent fashion
• We will tell you why we are collecting your data, and the specified explicit reason for collection of your data
• We will only keep your personal data for as long as necessary, in line with our data retention limits, or until you tell us to remove it
• We will provide you with details of your rights under the relevant data protection legislation.

Your data, your rights

Under data protection legislation you have rights about the way Children in Scotland handles and uses your data.

The UK GDPR provides you with the following rights:

• The right to be informed
• The right of access
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to data portability
• The right to object
• Rights in relation to automated decision making and profiling.

You can exercise these rights by contacting us at the above address, or by telephone or e-mail.
You also have the right to make a complaint to the Information Commissioner’s Office, (www.ico.org.uk). They are the body responsible for making sure organisations handle your data lawfully.

Who we share your data with

We may share your data with our sub-processors, these are Primate and WordPress (website management), Google (who provide our analytics), Microsoft, Mailchimp and MailerLite (who provide our email services), Endeavour (our IT provider), Breathe (HR platform), Xero (financial information), Humanitix (event booking system), printing houses (magazine subscribers) and Asana (who provide our project management tool). Data is only shared with these companies for the purpose of operating and delivering our services.
Photography and videography containing images of identified persons, captured in line with our consent statements, may be shared on our social media platforms, including LinkedIn, Facebook, Instagram, Bluesky, TikTok and YouTube. We may upload images and video to Streamyard, Buffer or Canva for editing purposes.

We may also share information with our funders for the purpose of consultation or statistical analysis.

How we protect your data

Children in Scotland maintains a high standard of physical and network security. These security measures have been designed to protect paper and/or electronic forms of storage that hold your personal data.

Your personal data is subject to rigorous safeguards which ensure that it isn’t accessed or disclosed inappropriately.

Children and young people’s data

The UNCRC (Incorporation) (Scotland) Act 2024 reinforces the need for children’s rights to privacy and protection to be considered in all decisions. Where consent is the lawful basis for data processing, and a child is deemed to have sufficient capacity, we will seek the child’s informed consent for use of their personal data from the age of 12.