Privacy policy
The privacy notice gives you information on how South of Scotland Enterprise collects, uses, shares and looks after your personal information. Personal information, or personal data, means any information about an individual from which that person can be identified. Anything we do with your personal information (from the point at which we collect it, until we delete it from our systems) is called processing.
The privacy notice applies when you visit our website, provide any personal information through this website, when we provide services to you, or when you have asked to receive marketing information from us (regardless of where you are located). It also applies where you are a supplier to us. The privacy notice will also tell you about your privacy rights and how the law protects you.
This privacy notice is provided in a layered format so you can select the specific areas set out below.
For guidance on connecting with SOSE on social media, please see our Acceptable Use Policy.
South of Scotland Enterprise is one of Scotland's economic development agencies, and a non-departmental public body of the Scottish Government. We have our registered office at Carmont House, The Crichton, Bankend Road, Dumfries DG1 4TG, United Kingdom, and operate our business from locations within the south of Scotland.
We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about the privacy notice, including any requests to exercise your legal rights in respect of your personal information, please contact the DPO using the details below.
Contact details
Maureen Malone
Data Protection Officer, Governance and Assurance Manager
Carmont House
The Crichton
Bankend Road
Dumfries
DG1 4TG
- Email: dataprotectionofficer@sose.scot
- 0300 304 8888 (calls charged at local rates)
- Minicom 0800 023 2071 - if you are deaf or hard of hearing (BT helpline 0800 731 1888)
Change to our privacy notice
This is the current version of our privacy notice. It was last updated on 1 April 2020.
Letting us know about changes to your personal information
It is important that the personal information that we hold about you is accurate and current. Please let us know if your personal information changes during your relationship with us, by contacting us using the details above.
We may collect, use, store and share different kinds of personal information about you. To help you identify these, they have been grouped together as follows:
| Group Data | Personal information includes |
| Identity Data | Name, signature, date of birth, job role/title, job description, photographs, passport details, contracts of employment, CVs, service agreements/consultancy/secondee contracts, social media profile. |
| Contact Data | Email address, phone number, address, billing address, skype, Whatsapp, social media contacts. |
| Claims Data | Personal information to enable a claim of expenditure to be evidence. For example, timesheets, salary information, payroll number, details of training received, payslips. This may come from your employer where your employer is in receipt of funding from South of Scotland Enterprise. |
| Financial Data | Bank account, payment card details, credit reference, credit history, PAYE, national insurance number. |
| Transaction Data | Details of payments to and from you, details of services and products you may have received from us. |
| Technical Data | Internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website. |
| Profile Data | Username and password, your preferences, feedback and survey responses. |
| Usage Data | Information about how you use our website, products and services. |
| Marketing Data | Your preferences in receiving marketing from us, our CRM Partners and selected third parties. You can learn more about this on our Who we will share your personal information with section of this page. |
| Special Category Data | Race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data, information about criminal convictions and offences. |
We also collect, use and store and share other information that is not personal information, including:
Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal information but is not considered personal information in law, as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal information so that it can directly or indirectly identify you, we treat the combined data as personal information, which will be used in accordance with this privacy notice.
Anonymised Data is the process of turning personal information into a form which does not identify individuals and where identification is not likely to take place.
Company Data is any information relating to a company, such as the company’s address, financial information, business plans (although these may contain elements of personal information), methodologies, project briefs etc.
We collect personal information using different types of methods and sources. We have grouped these together as follows:
Direct interactions:
Directly from you. For example, when you use our website to apply for our products and services for you or on behalf of your company or employer, create an account on our website, or request marketing materials to be sent to you, complete a survey or provide feedback, or where you are a panel member involved in evaluating applications.
Employer or company:
From your employer or a company you work with. For example, if your personal information is included as part of an application for funding or support, or in a bid to supply services to us, or as evidence in support of a claim for grant funding.
Public Sector Partners:
Where you or your company has engaged with our public sector partners and as part of the public sector partners’ and our public functions, they have shared personal information with us. You can read more about who our public sector partners are here.
CRM Partners:
Where any of our partners to the CRM Partnership have input your details to the shared customer relationship management system. You can find out more about the CRM partnership here.
Third party sources/publicly available sources:
We may receive personal information about you from various third party sources. This may include where we have subscribed to a database, or have been provided with information from an interested third party, such as an investor. It may also come from a publicly available source (e.g. Companies House) or is available through social media (e.g. Linkedin). We do not subscribe to any databases.
Suppliers:
Any supplier we have procured to deliver a service on our behalf. Such suppliers will be under contractual obligations to process your personal information in compliance with Data Protection Laws.
South of Scotland Enterprise collects and uses personal information about you in order to provide its public services. In general terms, South of Scotland Enterprise collects, uses, stores and shares personal information about you to:
- deliver its services and meet its legal responsibilities
- verify your identity, where this is required
- contact you by post, email or telephone
- to register with our websites
- understand the needs of your company or organisation and how they may be met
- join with our public sector partners to deliver comprehensive services for you and your company or organisation
- as supporting evidence when making claims for funding and support
- provide you with marketing you have asked for, and to sign you up for events
- maintain our records
- process financial transactions
- carry out background checks and due diligence where appropriate
- prevent and detect crime, fraud or corruption.
Further details can be found in the specific sections for each service which follow and can be accessed through these links:
- Marketing and Events
- Funding and Support
- Research
- Enquiries
- CRM Partnership
- Providing us with Goods and/or Services
Lawful Grounds
Data Protection law also says that we must have a legal ground in order to process your personal information. These are known as lawful grounds. There are six lawful grounds, but we will generally only use four of these, as set out below:
| Lawful ground | What it means |
|
Consent |
You have given your consent to the processing of personal information for the specified purpose. |
|
Contractual |
Where you are in a contractual relationship, and we need to process personal information to allow us to perform the contract, or where you intend to enter into a contractual relationship with us. |
|
Legal obligation |
Where we need to process personal information to comply with a legal obligation placed on us. |
| Performance of tasks carried out in the public interest or in the exercise of our official authority |
Where we process your personal information to meet a task that is in the public interest (eg using CCTV as a method of crime prevention) or where it is processed in the exercise of our official authority.Our official authority is granted under the South of Scotland Enterprise Act 2019. |
MARKETING AND EVENTS
Where you wish us to provide you with marketing information (information, updates, newsletters) or wish to attend an event, your personal information will be processed as follows:
|
Personal information processed |
Identity Data Contact Data Profile Data Marketing Data Special Category Data* |
|
Source of personal information |
Direct Interactions, CRM Partners, Public Sector Partners, Suppliers |
|
The purpose for processing |
To match your personal information to an existing customer record held by us To update your preferences To create a new customer record if one doesn’t currently exist To send you the information that you have opted in to receive To sign you up to events, seminars and webinars hosted by or on our behalf, and/or our Public Sector Partners To create and circulate delegate lists for events *Special Category Data will only be collected for the purpose of meeting any dietary or equality requirements that you may have when you attend an event. |
|
Lawful ground |
Consent |
|
Consequences of not providing the personal information |
We will be unable to send you our updates and newsletters. We will not know who you are when you sign up to our events. We will be unable to meet your dietary or equality needs |
|
How long we will keep your personal information |
Your personal information will be retained until you advise us that you wish to unsubscribe or opt-out from receiving marketing information. Personal information processed for events will be deleted within six months from event date to allow statistics to be gathered, anonymised and analysed. If we need to hold your personal details for longer, we will advise you accordingly with the reason why. Special category data will be deleted within one month of the event date. |
Funding and Support
South of Scotland Enterprise provides a range of funding and support to its customers. In order to provide that funding and support we will need to process personal information from time to time. The amount of personal information required and the purpose for processing personal information varies depending on the nature and type of funding and/or support a customer needs. We have set out below, in general terms, the types and purposes for processing personal information where this relates to funding and support.
|
Personal information processed |
Identity Data Contact Data Claims Data Financial Data Transaction Data There may also be instances where we require to process Special Category Data. Where Special Category Data is required we will let you know the purpose for processing this and seek your express consent to this. |
|
Source of personal information |
Direct Interactions, Employer or Company, Public Sector Partners, CRM Partners, Third Party Sources, Suppliers |
|
The purpose for processing |
|
|
Lawful ground(s) |
Contractual Legal obligation – funding and support provided under European legislation requires us to process personal information; Performance of task in the public interest task/exercise of our official authority (using funds appropriately); *We will use consent as the lawful ground for processing personal information for the purposes of non-executive directors. |
|
Consequences of not providing the personal information |
We will be unable to provide funding and support. |
|
How long we will keep your personal information |
European legislation, under which we provide funding and support specifies the periods of time for which we have to keep documentation relating to funding and support we have granted. This is generally, 10 years from the date of the end of the European funding programme. For example, funding and support given under a 2014-2020 programme will require to be retained until the end of 2030. Where personal information is processed for the purpose of managing investments, we will retain this for so long as we continue to be invested in the Company, and for a period of 5 years after we have exited a company or in accordance with the relevant ERDF programme, whichever is later. Supplier details will be retained for 12 years from last activity date. |
RESEARCH
South of Scotland Enterprise undertakes research and evaluation to support improvements to our services and economic development in the south of Scotland
|
Personal information processed |
Identity Data Contact Data Profile Data Usage Data |
|
Source of personal information |
Direct interactions Employer or company Public sector partners CRM partners Third party sources/publicly available sources |
|
The purpose for processing |
To conduct focused research to:
We will use the personal information detailed above to contact you to invite you to participate in our research. |
|
Lawful ground |
Performance of task in the public interest task/exercise of our official authority. |
|
Consequences of not providing the personal information |
We will be unable to carry out strategic research necessary for the development of the economy. |
|
How long we will keep your personal information |
For the period of the research, and no longer than 2 years after the research is complete. |
Enquiries
Where you make an enquiry to the South of Scotland Enterprise Enquiry Service, it will be processed as follows:
|
Personal information processed |
Identity Data Contact Data |
|
Source of personal information |
Direct interactions |
|
The purpose for processing |
To keep you informed of the status of your enquiry To answer your enquiry/complaint To respond to freedom of information requests To exercise data subject rights To respond to data subject rights requests To create a new customer record |
|
Lawful ground |
Contractual Legal obligation |
|
Consequences of not providing the personal information |
We will be unable to answer your queries.We will be unable to meet our legislative requirements under the Freedom of Information (Scotland) Act 2002, Environmental Information (Scotland) Regulations 2004, the INSPIRE (Scotland) Regulations 2009, the General Data Protection Regulation 2016/679 and the Data Protection Act 2018. |
| How long we will keep your personal information | Your personal information will be retained for a period of 2 years after your enquiry is answered, or as part of our legal requirements. If there is a continuation of service, (e.g. funding and support) your personal information will be retained as per the details of that service. |
CRM Partnership
The CRM Partnership is a group of public sector organisations, principally charged with the economic development of Scotland. The CRM Partnership comprises:
South of Scotland Enterprise
Scottish Enterprise
Scottish Development International (a joint venture among Scottish Enterprise, South of Scotland Enterprise, Highlands and Islands Enterprise and Scottish Government)
Business Gateway (represented by COSLA)
Skills Development Scotland
Purpose of the CRM Partnership
The CRM Partnership’s purpose is to provide a consistent, co-ordinated approach to delivery of services to its customers. To better serve this purpose, the members of the CRM Partnership have come together to share one customer relationship management (CRM) system. It is on the CRM system that all personal information and non-personal information of the CRM Partnership’s customers will be stored.
Personal Information in the CRM system will be processed by the CRM Partners as follows:
| Personal information processed |
Identity Data Contact Data Transaction Data Profile Data Marketing Data |
| Source of personal information |
Direct interactions Employer or company Third party sources/publicly available sources |
| The purpose for processing |
To provide consistent, clear and co-ordinated engagement with our customers on products, services and support that they are interested in. To enable better design of business support services across the wider public-sector landscape. To create opportunities to refer across and between CRM Partners, develop shared understanding and to monitor the effectiveness and responsiveness of the CRM Partners’ individual service offerings. To collaborate on the design of future services and interventions as a result of insights gained from a shared system, aggregated data and better understanding of what support the customer of the CRM Partners are seeking and receiving in real time. To provide you with information you have requested from us as part of our marketing services – please see Marketing and Events for further information. To answer any enquiries you have submitted to us – please see Enquiries for further information. To provide your business with funding and support – please see Funding and Support for further information. |
| Lawful ground |
Contractual Performance of task in the public interest task/exercise of our official authority. |
| Consequences of not providing the personal information | The CRM Partners will not be able to provide you or your business with the best possible support. |
| How long we will keep your personal Information |
We will keep your personal information in the customer relationship management system and for the purposes of the CRM Partnership for as long as you remain a customer of any of the CRM Partners, and in accordance with the period relevant to your relationship with the CRM Partners (e.g. for funding and support, this may be for a period of up to 10 years). Where you or the company of which you are an employee of are no longer a customer of the CRM Partnership, your personal information will be kept for 12 months following the date of your last interaction with any of the CRM Partners. Please refer to individual categories, however, for other circumstances under which personal information may be retained. |
Providing us with goods and/or services.
As a supplier to South of Scotland Enterprise, there will be a need to process personal information, either because you are the principal point of contact for your company, or your information has been included as part of a tender response. Where you are a supplier to South of Scotland Enterprise, your personal information will be processed as follows:
| Personal information processed |
Identity Data Contact Data Financial Data Transactional Data |
| Source of personal information |
Direct interactions Employer or company Public Sector Partners |
| The purpose for processing |
To submit a bid in response to a tender To assess a bid in response to a tender To make payment in exchange of delivery of goods and/or services To issue feedback surveys to you |
| Lawful ground |
Contractual Legal Obligation |
| Consequences of not providing the personal information |
We will be unable to consider your bid or to enter into a contract with you or your company. |
| How long we will keep your personal Information |
We will keep your personal information for the period of your contractual relationship with us plus 10 years (or for 20 years for construction project contracts). Where your tender has been unsuccessful we will keep your information for 1 year from the contract award date. Supplier details will be retained for 12 years from last activity date. |
We do not subscribe to any databases.
South of Scotland Enterprise will share your personal information with our CRM Partners, as part of the overall CRM Partnership collaboration. We may also share your personal information with our Public Sector Partners and our suppliers to enable them to do any of these things for, or in collaboration with, South of Scotland Enterprise, or where we are required to do so to meet our legal obligations to the Scottish Government and/or the European Commission.
Where required to do so by law, we may also share your information with law enforcement agencies.
Where we share your personal information with our Public Sector Partners, this will be done in accordance with the data sharing arrangements that we have with them. Personal information will be shared with the CRM Partnership and our Public Sector Partners on the basis that either:-
- We have jointly determined the purpose and means of processing (joint controllers); or
- We process the same personal information but for different purposes (controllers in common)
South of Scotland Enterprise works with international partners, and your personal data may be transferred across international borders. It may be transferred to countries that have different data protection laws from the country from where you submitted your personal data.
We will, however, ensure the transfer complies with data protection law both during transit and at the storage location and all personal data will be secure.
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, our employees, agents, secondees and suppliers will only process personal information on our instructions and in accordance with this privacy statement. They are also subject to a duty of confidentiality.
Access to your information – you have the right to request a copy of the personal information about you that South of Scotland Enterprise holds.
Correcting your information – South of Scotland Enterprise wants to make sure that your personal information is accurate, complete and up to date and you may ask South of Scotland Enterprise to correct any personal information about you that you believe does not meet these standards.
Deletion of your information – you have the right to ask South of Scotland Enterprise to delete personal information about you where:
- You consider that South of Scotland Enterprise no longer requires the information for the purposes for which it was obtained.
- South of Scotland Enterprise is using that information with your consent and you have withdrawn your consent – see Withdrawing consent to using your information
- You have validly objected to South of Scotland Enterprise’s use of your personal information – see Objecting to how we may use your information
- South of Scotland Enterprise’s use of your personal information is contrary to law or South of Scotland Enterprise’s other legal obligations.
Objecting to how we may use your information – you have the right at any time to require South of Scotland Enterprise to stop using your personal information for direct marketing purposes. In addition, where South of Scotland Enterprise uses your personal information to perform tasks carried out in the public interest or in exercising official authority vested in it then, if you ask it to, South of Scotland Enterprise will stop using that personal information unless there are overriding legitimate grounds to continue.
Restricting how we may use your information – in some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to South of Scotland Enterprise’s use of your information. The right might also apply where South of Scotland Enterprise no longer has a basis for using your personal information but you don't want South of Scotland Enterprise to delete the data. Where this right to validly exercised, South of Scotland Enterprise may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.
Automated processing – if South of Scotland Enterprise uses your personal information on an automated basis to make decisions which significantly affect you, you have the right to ask that the decision be reviewed by an individual within South of Scotland Enterprise to whom you may make representations and contest the decision. This right only applies where South of Scotland Enterprise uses your information with your consent or as part of a contractual relationship with you.
Withdrawing consent using your information – where South of Scotland Enterprise uses your personal information with your consent you may withdraw that consent at any time and South of Scotland Enterprise will stop using your personal information for the purpose(s) for which consent was given.
Please contact South of Scotland Enterprise in any of the ways set out in the Contact information and further advice section if you wish to exercise any of these rights.
South of Scotland Enterprise seeks to resolve directly all complaints about how it handles personal information, but you also have the right to lodge a complaint with the Information Commissioner's Office, whose contact details are as follows:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone - 0303 123 1113 (local rate) or 01625 545 745
Website - https://ico.org.uk/concerns
This website is not intended for children, and we do not knowingly collect data relating to children.
It is important that you read this privacy notice together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are fully aware of how and why we are using your data. This privacy notice supplements the other notices and is not intended to override them.