Privacy policy

This privacy notice gives you information on how South of Scotland Enterprise collects, uses, shares and looks after your personal information. Personal information, or personal data, means any information about an individual from which that person can be identified. Anything we do with your personal information (from the point at which we collect it, until we delete it from our systems) is called processing.

The privacy notice applies when you visit our website, provide any personal information through this website or the customer portal of MySOSE, when we provide services to you, or when you agree to, or have asked to, receive marketing or other information from us (regardless of where you are located). It also applies where you are a supplier or contractor to us. The privacy notice will also tell you about your privacy rights and how the law protects you.

This privacy notice is provided in a layered format so you can select the specific areas set out below.

For guidance on connecting with SOSE on social media, please see our Acceptable Use Policy. Or contact our Communications and Marketing team via our Contact Form.

South of Scotland Enterprise is one of Scotland's economic development agencies, and a non-departmental public body of the Scottish Government. We have our registered office at Carmont House, The Crichton, Bankend Road, Dumfries DG1 4TG, United Kingdom, and operate our business from locations within the south of Scotland.

We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about the privacy notice, including any requests to exercise your legal rights in respect of your personal information, please contact the DPO using the details below.

Contact details

Maureen Malone
Data Protection Officer, Head of Governance and Assurance

Carmont
The Crichton
Bankend Road
Dumfries
DG1 4TG

Changes to our privacy notice:

This current version of our privacy notice is dated June 2024.  Any proposed changes or updates should be communicated to dataprotectionofficer@sose.scot.

Letting us know about changes to your personal information:

It is important that the personal information that we hold about you is accurate and current. Please let us know if your personal information changes during your relationship with us, by contacting our Customer Support Team

We may collect, use, store and share different kinds of personal information about you. To help you identify these, they have been grouped together as follows:

Data Sets

Personal information may include

Identity Data

Name, signature, date of birth, National Insurance Number, job role/title, job description, photographs, passport details, contracts of employment, CVs, service agreements/consultancy/secondee contracts, social media profile.

Contact Data

Email address, phone number, address, billing and work address, skype, Whatsapp, Instagram, LinkedIn, social media contacts.

Claims Data

Personal information to enable a claim of expenditure to be evidence. For example, timesheets, salary information, payroll number, details of training received, payslips. This may come from your employer where your employer is in receipt of funding from South of Scotland Enterprise.

Financial Data

Bank account and statements, payment card details, credit reference, credit history, PAYE.

Transaction Data

Details of claims and payments to and from you, details of services and products you may have received from us.

Technical Data

Internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website.

Profile, Feedback and Performance Data

Username ?, your preferences, feedback and survey responses including engaging with our Performance Management Framework activities such as outcome and outputs and other qualitative performance information and measures.

Usage Data

Information about how you contact us,  use our website or the MySOSE customer portal, products and services.

Marketing Data

Your preferences in receiving marketing from us, our partners and selected third parties. You can learn more about this on our ‘Who we will share your personal information with’ section of this page.

Special Category Data

Data relating to equal opportunities, fair work or analyses including but not limited to race or ethnicity, religious or philosophical beliefs, gender, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data, information about criminal convictions and offences.

 

We also collect, use and store and share other information that is not personal information, including:

Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal information but is not considered personal information in law, as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal information so that it can directly or indirectly identify you, we treat the combined data as personal information, which will be used in accordance with this privacy notice.

Anonymised Data is the process of turning personal information into a form which does not identify individuals and where identification is not likely to take place.

Company Data is any information relating to a company, such as the company’s address, financial information, business plans (although these may contain elements of personal information), methodologies, project briefs etc.

We collect personal information using different types of methods and sources. We have grouped these together as follows:

Direct interactions:

Directly from you. For example, when you use our website or any of our online or other systems collecting client/customer information using appropriate systems or tools,such as MySOSE, to apply for our products and services for you or on behalf of your company or employer, create an account on our website, update your details that are held by SOSE, or request marketing materials to be sent to you, complete a survey or provide feedback, or where you are involved in reviewing information or evaluating applications.

Employer or company:

From your employer or a company you work with. For example, if your personal information is included as part of an application for funding or support, or in a bid to supply services to us, or as evidence in support of a claim for grant funding.

Public Sector Partners:

Where you or your company has engaged with our public sector partners and as part of the public sector partners’ and our public functions, they have shared personal information with us. You can read more about who our public sector partners are here.

CRM Partnership:Where we or any of our partners have input or share or use your data in the CRM shared customer relationship management system and where we share or use that data with our Public Sector Partners as part of our public task and delivery of our business functions.

MySOSE is SOSE’s separate CRM system and the CRM Partnership means the CRM systems used by other public sector partners.

Third party sources/publicly available sources:

We may receive personal information about you from various third party sources. This may include open source data, where we may have subscribed to a database, or have been provided with information from an interested third party, such as an investor. It may also come from a publicly available source (e.g. Companies House) or is available through social media (e.g. Linkedin).

Suppliers:

Any supplier we have procured to deliver a service on our behalf. Such suppliers will be under contractual obligations to process your personal information in compliance with Data Protection Laws.

South of Scotland Enterprise collects and uses personal information about you in order to provide its public task and deliver its services. In general terms, South of Scotland Enterprise collects, uses, stores and shares personal information about you to:

  • deliver its services and meet its legal responsibilities
  • verify your identity, where this is required
  • contact you by post, email or telephone
  • to register with our websites
  • understand the needs of your company or organisation and how they may be met
  • join with our public sector partners to deliver comprehensive services for you and your company or organisation
  • as supporting evidence when making claims for funding and support
  • provide you with marketing you have asked for, and to sign you up for events
  • review, analyse, measure and report on SOSE’s performance
  • maintain our records
  • process financial transactions
  • carry out background checks and due diligence where appropriate
  • prevent and detect crime, fraud or corruption.

Lawful Grounds

Data Protection law  says that we must have a legal ground in order to process your personal information. These are known as lawful grounds. There are six lawful grounds, but we will generally use the lawful basis of Performance of our public task’ carried out in the public interest, or in the exercise of our official authority (Public Task).  We sometimes  use three others in other circumstances, as set out below:

Lawful ground

What it means

Consent

You have given your consent to the processing of personal information for the specified purpose.

Contractual

Where you are in a contractual relationship, and we need to process personal information to allow us to perform the contract, or where you intend to enter into a contractual relationship with us.

Legal obligation

Where we need to process personal information to comply with a legal obligation placed on us.

Performance of tasks carried out in the public interest or in the exercise of our official authority

Where we process your personal information to meet a task that is in the public interest (eg using CCTV as a method of crime prevention) or where it is processed in the exercise of our official authority.Our official authority is granted under the South of Scotland Enterprise Act 2019.

MARKETING AND EVENTS

Where you wish us to provide you with marketing information (information, updates, newsletters) or wish to attend an event, your personal information will be processed as follows:

Personal information processed

Identity Data

Contact Data

Profile Data

Marketing Data

Special Category Data

Source of personal information

Direct Interactions, MySOSE, CRM Partners,, Public Sector Partners, Suppliers

The purpose for processing

To match your personal information to an existing customer record held by us

To update your preferences

To create a new customer record if one doesn’t currently exist

To send you the information that you have opted in to receive

To sign you up to events, seminars and webinars hosted by or on our behalf, and/or our Public Sector Partners

To create and circulate delegate lists for events

*Special Category Data will only be collected for the purpose of meeting any dietary or equality requirements that you may have when you attend an event.  

Lawful ground

Consent

Consequences of not providing the personal information

We will be unable to send you our updates and newsletters.

We will not know who you are when you sign up to our events.

We will be unable to meet your dietary or equality needs

How long we will keep your personal information

Your personal information will be retained until you advise us that you wish to unsubscribe or opt-out from receiving marketing information.

Personal information processed for events will normally be deleted within six months from event date to allow statistics to be gathered, anonymised and analysed. If we need to hold your personal details for longer, we will advise you accordingly with the reason why.   Special category data will normally be deleted within one month of the event date. Data will be held in line with the SOSE retention policy.

 Funding and Support

South of Scotland Enterprise provides a range of funding and support to its customers. In order to provide that funding and support we will need to process personal information from time to time. The amount of personal information required and the purpose for processing personal information varies depending on the nature and type of funding and/or support a customer needs. We have set out below, in general terms, the types and purposes for processing personal information where this relates to funding and support.

Personal information processed

Identity Data

Contact Data

Claims Data

Financial Data

Transaction Data

There may also be instances where we require to process Special Category Data. Where Special Category Data is required we will let you know the purpose for processing this and seek your express consent to this.  

Source of personal information

Direct Interactions, Employer or Company, Public Sector Partners, , Third Party Sources, Suppliers, Open source data

The purpose for processing

  • As a point of contact for funding and support applications
  • To undertake due diligence for fraud prevention
  • To assess the need for funding and support
  • Appraisal of applications for funding and support
  • To enable the delivery of funding and support
  • As evidence substantiating claims for payment of funding and support
  • To make payments of funding and support
  • To analyse and report on funding and support
  • To meet requirements of regulatory frameworks
  • To audit our compliance with regulatory frameworks
  • Management of investments, including monitoring the use of investment funds and processing consents
  • To assess and report on our performance.

Lawful ground(s)

Contractual

Legal obligation – funding and support provided under UK legislation requires us to process personal information;

Performance of task in the public interest task/exercise of our official authority (using funds appropriately);

*We will use consent as the lawful ground for processing personal information for the purposes of non-executive directors.

Consequences of not providing the personal information

We will be unable to provide advice or funding and support.

How long we will keep your personal information

Legislation, under which we provide funding and support specifies the periods of time for which we have to keep documentation relating to funding and support we have granted. This can be up to , 10 years from the date of the end of  a funding programme.   For example, funding and support given under a 2014-2020 programme  may  require to be retained until the end of 2030.

Where personal information is processed for the purpose of managing investments, we will retain this for so long as we continue to be invested in the Company, and for a period of 5 years after we have exited a company or in accordance with the relevant programme, whichever is later. Data will be held in line with the SOSE retention policy.

Supplier, employee and other personaldetails will be retained in line with our Data Retention Policy and archiving arrangements.

 RESEARCH

South of Scotland Enterprise undertakes research and evaluation to support improvements to our services and economic development in the south of Scotland

Personal information processed may include

Identity Data

Contact Data

Profile Data

Usage Data

Source of personal information

Direct interactions

Client engagement

Employer or company

Public sector partners

 Other project and external partners

Third party sources/publicly available sources

The purpose for processing for legitimate research

To conduct focused research to:

  • Support our strategy, business planning and investment decisions
  • Monitor and improve the effectiveness, efficiency and impact of our interventions/support
  • Understand the need/demand for our products and services and support the redesign of these.

We will use the personal information detailed above to contact you to invite you to participate in our research.

Lawful ground

Performance of task in the public interest task/exercise of our official authority.

Consequences of not providing the personal information

We will be unable to carry out strategic research necessary for the development of the economy.

How long we will keep your personal information

For the period of the research, and no longer than 2 years after the research is complete and aligned to SOSE’s retention policy.

Enquiries

Where you make an enquiry to the South of Scotland Enterprise Enquiry Service, it will be processed as follows:

Personal information processed

Identity Data

Contact Data

Source of personal information

Direct interactions

The purpose for processing

To keep you informed of the status of your enquiry

To answer your enquiry/complaint

To respond to freedom of information requests

To exercise data subject rights

To respond to data subject rights requests

To create a new customer record

Lawful ground

Contractual

Legal obligation

Consequences of not providing the personal information

We will be unable to answer your queries.We will be unable to meet our legislative requirements under the Freedom of Information (Scotland) Act 2002, Environmental Information (Scotland) Regulations 2004, the INSPIRE (Scotland) Regulations 2009, the General Data Protection Regulation 2016/679 and the Data Protection Act 2018.

How long we will keep your personal information

Your personal information will be retained for a period of 2 years after your enquiry is answered, or as part of our legal requirements. If there is a continuation of service, (e.g. funding and support) your personal information will be retained as per the details of that service. Data will be held in line with the SOSE retention policy.

 Providing us with goods and/or services.

As a supplier to South of Scotland Enterprise, there will be a need to process personal information, either because you are the principal point of contact for your company, or your information has been included as part of a tender response. Where you are a supplier to South of Scotland Enterprise, your personal information will be processed as follows:

Personal information processed

Identity Data

Contact Data

Financial Data

Transactional Data

Source of personal information

Direct interactions

Employer or company

Public Sector Partners

The purpose for processing

To submit a bid in response to a tender

To assess a bid in response to a tender

To make payment in exchange of delivery of goods and/or services

To issue feedback surveys to you

Lawful ground

Contractual

Legal Obligation

Consequences of not providing the personal information

We will be unable to consider your bid or to enter into a contract with you or your company.

How long we will keep your personal Information

We will keep your personal information for the period of your contractual relationship with us plus 10 years (or for 20 years for construction project contracts).   Where your tender has been unsuccessful we will keep your information for 1 year from the contract award date.

Supplier details will be retained for 12 years from last activity date. Data will be held in line with the SOSE retention policy.

 

We do not currently subscribe to any databases.

We may share your personal information with our Public Sector Partners and our suppliers to enable them to do any of these things for, or in collaboration with, South of Scotland Enterprise, or where we are required to do so to meet our legal obligations to the Scottish Government and/or theUK Government.

Where required to do so by law, we may also share your information with law enforcement agencies.

Where we share your personal information with our Public Sector Partners, this will be done in accordance with the data sharing arrangements that we have with them. Personal information will be shared with the CRM Partnership and our Public Sector Partners on the basis that either:-

  • We have jointly determined the purpose and means of processing (joint controllers); or
  • We process the same personal information but for different purposes (controllers in common)

Where South of Scotland Enterprise works with international partners, and your personal data may be transferred across international borders, it may be transferred to countries that have different data protection laws from the country from where you submitted your personal data.

We will, however, ensure the transfer complies with data protection law both during transit and at the storage location and all personal data will be secure.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, our employees, agents, secondees and suppliers will only process personal information on our instructions and in accordance with this privacy  policy, contractual terms and any sharing or processing agreements.. They are also subject to a duty of confidentiality.

Access to your information – you have the right to request a copy of the personal information about you that South of Scotland Enterprise holds.

Correcting your information – South of Scotland Enterprise wants to make sure that your personal information is accurate, complete and up to date and you may ask South of Scotland Enterprise to correct any personal information about you that you believe does not meet these standards.

Deletion of your information – you have the right to ask South of Scotland Enterprise to delete personal information about you where:

  • You consider that South of Scotland Enterprise no longer requires the information for the purposes for which it was obtained.
  • South of Scotland Enterprise is using that information with your consent and you have withdrawn your consent – see Withdrawing consent to using your information
  • You have validly objected to South of Scotland Enterprise’s use of your personal information – see Objecting to how we may use your information
  • South of Scotland Enterprise’s use of your personal information is contrary to law or South of Scotland Enterprise’s other legal obligations.

Objecting to how we may use your information – you have the right at any time to require South of Scotland Enterprise to stop using your personal information for direct marketing purposes. In addition, where South of Scotland Enterprise uses your personal information to perform tasks carried out in the public interest or in exercising official authority vested in it then, if you ask it to, South of Scotland Enterprise will stop using that personal information unless there are overriding legitimate grounds to continue.

Restricting how we may use your information – in some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to South of Scotland Enterprise’s use of your information. The right might also apply where South of Scotland Enterprise no longer has a basis for using your personal information but you don't want South of Scotland Enterprise to delete the data. Where this right to validly exercised, South of Scotland Enterprise may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.

Automated processing – if South of Scotland Enterprise uses your personal information on an automated basis to make decisions which significantly affect you, you have the right to ask that the decision be reviewed by an individual within South of Scotland Enterprise to whom you may make representations and contest the decision. This right only applies where South of Scotland Enterprise uses your information with your consent or as part of a contractual relationship with you.

Withdrawing consent using your information – where South of Scotland Enterprise uses your personal information with your consent you may withdraw that consent at any time and South of Scotland Enterprise will stop using your personal information for the purpose(s) for which consent was given.

Please contact South of Scotland Enterprise in any of the ways set out in the Contact information and further advice section if you wish to exercise any of these rights.

South of Scotland Enterprise seeks to resolve directly all complaints about how it handles personal information through its complaint handling procedure, but if you are dissatisfied you also have the right to lodge a complaint with the Scottish Information Commissioner's Office, whose contact details are as follows:

Email
enquiries@itspublicknowledge.info

Post
Scottish Information Commissioner
Kinburn Castle
Doubledykes Road
St Andrews
Fife
KY16 9DS

Telephone
01334 464610

This website is not intended for children, and we do not knowingly collect data relating to children.

It is important that you read this privacy notice together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are fully aware of how and why we are using your data. This privacy notice supplements the other notices and is not intended to override them.