Service Users Privacy Notice
This notice explains what personal data (information) we hold about you, how we collect it, and how we use and may share information about you whilst we are working with you and for a period thereafter. It also explains your rights under the law relating to your personal data. We are required to notify you of this information under data protection legislation. Please ensure that you read this notice (sometimes referred to as a 'Privacy Notice') and any other similar notice we may provide to you from time to time when we collect or process personal information about you.
Who collects and uses the information?
Cosmos Community Centre (SCIO), (the 'Charity') is a 'data controller' and gathers and uses certain information about you. Where the Charity is also a 'data processor', we will process information received from third parties about you.
Cosmos Community Centre (SCIO), is a Registered Scottish Charity No. SC053096
Registered address: Cosmos Community Centre, Abbey Walk, St Andrews, Fife
Main trading address: Cosmos Community Centre, Abbey Walk, St Andrews, Fife.
Our childcare facility, Cosmos After School & Holiday Club, is regulated by Scottish Social Services Council and regularly inspected by the Care Inspectorate (Social Care and Social Work Improvement Scotland) – Registration Number CS2003015112.
What is personal data/information?
Personal data is defined under data protection laws in the UK and Europe as 'any information relating to an identifiable person who can be directly or indirectly identified' and is, in effect, any information about you that enables you to be identified. This would include obvious information such as your name and contact details, but could include less obvious information such as identification numbers, electronic location data, and other online identifiers. The personal data that we collect, process and store is set out in this Notice.
Data protection principles
We will comply with the data protection principles when gathering and using personal information, as set out in our Data Protection Policy.
About the information we collect and hold
The table sets out on the following pages summarises the information we collect and hold, how and why we do so, how we use it and with whom it may be shared.
We may also need to share some of the categories of personal information set out below with other parties, such as government and/or law enforcement agencies, third party agencies, our professional advisers, our regulators and funders. Usually, information will be anonymised, but this may not always be possible. The recipient of the information will be bound by confidentiality obligations. We may also be required to share some personal information with our funders as is necessary or required to comply with the law.
We seek to ensure that our information collection and processing is always proportionate - that is, we only collect and process what we need to, and we only store it for as long as we need to. We will notify you of any changes to information we collect or to the purposes for which we collect and process it.
Where information may be held
Information may be held at our offices and by third-party agencies, service providers, representatives and agents. We have security measures in place to seek to ensure that there is appropriate security for information we hold.
How long we keep your information
We keep your information for no longer than is necessary; this normally means whilst we are working with you and for a period thereafter the length of which will depend on the nature of the service and support we are providing to you. In most cases, we will not keep your information for more than 12 months after you last contact us, or until any outstanding costs or fees have been reclaimed, or your details have been requested by any governing body, such as Child Protection teams or Law Enforcement agencies. Further details are set out in our Data Retention Policy.
Your rights
Under the GDPR, you have the following rights, which we will always work to uphold:
1) The right to be informed about the personal data we collect and use about you. This Privacy Notice should tell you everything you need to know, but you can always contact us to find out more or to ask any questions.
2) The right to access the personal data we hold about you. This is called making a Subject Access Request – please contact the Cosmos Centre for instructions on how to make a request.
3) The right to have your personal data rectified if any of your personal data we hold is inaccurate or incomplete. Please contact the Cosmos Centre to arrange for this amendment.
4) The right to be forgotten, i.e. the right to ask us to delete or otherwise dispose of any of your personal data that we have. Please contact the Cosmos Centre for instructions on how to make a request.
5) The right to restrict (i.e. prevent) the processing of your personal data.
6) The right to object to us using your personal data for a particular purpose or purposes.
7) The right to data portability. This means that you can ask us for a copy of your personal data held by us to re-use with another organisation or business in certain cases.
8) Rights relating to automated decision-making and profiling. We do not use your personal data in this way.
For more information about how we use your personal data or to exercise any of your rights as outlined above, please contact us. Further information about your rights can also be obtained from the Information Commissioner's Office or your local Citizens Advice Bureau.
If you have any cause for complaint about how we use your personal data, you have the right to lodge a complaint with the Information Commissioner's Office. You can contact them through their website at www.ico.org.uk or can call them on 0303 123 1113.
Keeping your personal information secure
We have appropriate security measures in place to prevent personal information from being accidentally lost, used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.
We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.
Changes to what we do
We regularly review and, where necessary, update our privacy information, policies, procedures and privacy notices. If we plan to use your personal information for a new purpose we will update our documentation and privacy notice, and communicate the changes to you before starting to use the information in a new way. Where we have obtained your consent to process your personal data and we wish to change how we process it, we will seek your consent for the new processing.
Sometimes we have to change what we do because of a change in the law or we need to change the way we do things as an organisation and have a legitimate interest for doing so. The latest version of this Privacy Notice will always be available at Cosmos Community Centre, either by calling in to see us, or by requesting via email (info@cosmoscentre.org.uk) or by telephone on 01334 474140.
How to contact us
For information about how we collect, store and process your personal data or for any questions or concerns you might have about data protection please contact Diane Sangster, Centre Financial Administrator and After School & Holiday Club Business Manager, using any of the above details.
How to complain
We hope that Mrs Sangster can resolve any query or concern you raise about our use of your information. If not, contact the Information Commissioner at www.ico.org.uk/concerns/ or telephone: 0303 123 1113 for further information about your rights and how to make a formal complaint.
Schedule relating to the information we collect and hold
| The information we collect | How we collect the information | Why we collect the information | How we use and may share the information |
| Your name, contact details (i.e. address, home and mobile phone numbers, e-mail address) | From you | • To enter into an agreement with you to provide you with our services/support • To maintain contact with you in order to support you • To comply with our legal obligations
| • To provide you with the necessary support/service which you have sought
|
| If applicable – your child or children’s personal details and any relevant medical information pertaining to those children | From you | • This is required for our childcare facility to keep those children safe while attending our service
| • In certain circumstances information may be shared with third party agencies e.g. social work, law enforcement, regulatory bodies, educational establishments, child protection teams etc.
|
As well as having a lawful basis for processing, we will not handle any sensitive personal information (special categories) without first obtaining the appropriate explicit consent from you.
You will be required by law to provide certain categories of information which we have marked with an asterisk (*) above. If you do not provide this information, we may not be able to provide you with the service(s) you are seeking, or we may have to stop providing you with the services/support you are seeking.
