Privacy notice - Scottish Funding Council

Register with us

The Scottish Funding Council (SFC) is committed to processing personal data fairly, transparently and in accordance with the law.

This privacy notice advises what personal data we collect, how we use it, what your rights are in relation to your personal data and how to contact us if you have any questions or concerns about the use of personal data.

SFC ensures that its data processing is compliant with applicable data protection laws including:

The Data Protection Act 2018 (DPA).

The EU General Data Protection Regulation (GDPR).

The Privacy and Electronic Communications Regulation (PECR).

College student data

Overview

SFC collects personal data of students in Scotland’s colleges in order to carry out our public tasks. These include to appropriately allocate funding to colleges, monitor their performance and to improve the student experience.

Source of the personal data

SFC collects this data directly from colleges.

Categories of personal data collected

SFC collects the following categories of personal data about college students:

Demographic information.
Information about the course that they undertake.
Funding information.
Equalities information.
Student status.
Previous qualifications.
Proof of the right to live/work in the UK.
Course outcomes.
Leaver information including information relating to employment or College after completion of the course.

Purposes of processing

SFC processes college student data so far as it is necessary for:

Monitoring College institutions’ educational outcomes.
Assessing the financial requirements of colleges.
Assessing colleges’ equality and diversity.
Monitoring college student leaver destinations in order to monitor the outcomes of the provision of College to students aged 16-25.
Monitoring institutional sustainability and governance.
Evaluate the quality of College in Scotland.
Provide European Social Fund (ESF) funding to College Institutions and monitor and audit their compliance with ESF requirements.
Provide statistical data on College in Scotland.

Legal basis for processing

SFC processes college student data so far as it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in SFC.

SFC processes college student special category data so far as it is necessary for reasons of substantial public interest, on the basis of law under:

Further and Higher Education (Scotland) Act 1992.
Further and Higher Education (Scotland) Act 2005.
Post-16 Education (Scotland) Act 2013.

Recipients of the data

SFC shares student data with other public sector bodies to allow them to carry out their tasks in the public interest and to carry out their statutory functions. SFC may share personal data with:

The Scottish Government.
The European Commission.
Colleges.
National Records of Scotland.
NHS Education Scotland.
Higher Education Statistics Agency.
Skills Development Scotland.
Higher Education Funding Council for Wales.
Regional Strategic Bodies (aka Joint Regional Boards)

SFC uses third parties for some of its IT systems which are used to hold and process personal data.

College staff data

Overview

SFC collects personal data of staff in Scotland’s colleges in order to carry out our public tasks. These include to appropriately allocate funding to colleges, monitor their performance and to improve the student experience.

Source of the personal data

SFC collects core staffing data directly from colleges.

Aggregate staff salary data is collected from the Colleges Development Network. While this is generally not identifiable, in some instances where there are small categories of individuals involved identification may be possible.

Categories of personal data collected

SFC collects the following categories of personal data about college members of staff:

Permanent/temporary contract.
Employed full time/part time/FTE.
Teaching/non-teaching staff.
If staff have a teaching qualification.
Age.
If staff are considered to have a long term health condition or disability.
Equalities monitoring information.
Salary.
Institution of employment.

Purposes of processing

SFC processes college staff data so far as it is necessary for:

Assessing the financial requirements of colleges.
Assessing colleges’ equality and diversity.
Monitoring College institutions’ educational outcomes.
Monitoring institutional sustainability and governance.
Providing European Social Fund (ESF) funding to College Institutions and monitor and audit their compliance with ESF requirements.
To provide statistical data on College in Scotland.

Legal basis for processing

SFC processes college staff data so far as it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in SFC.

SFC processes college staff special category data so far as it is necessary for reasons of substantial public interest, on the basis of law under:

Further and Higher Education (Scotland) Act 1992.
Further and Higher Education (Scotland) Act 2005.
Post-16 Education (Scotland) Act 2013.

Recipients of the data

SFC shares college staff data with other public sector bodies to allow them to carry out their tasks in the public interest and to carry out their statutory functions. SFC may share personal data with:

The Scottish Government.
The European Commission.
Skills Development Scotland.
Regional Strategic Bodies (aka Joint Regional Boards).

SFC uses third parties for some of its IT systems which are used to hold and process personal data.

University student data

Overview

SFC collects personal data of students in Scotland’s universities in order to carry out our public tasks. These include to appropriately allocate funding to universities, monitor their performance and to improve the student experience.

Source of the personal data

The Higher Education Statistics Agency (HESA) collects personal information on university students(/staff) directly from universities and shares this data with SFC.

HESA is the principal body responsible for collecting and analysing data about the higher education institutions in the UK. More information on how HESA use personal data can be found on the privacy information page of their website.

Data Lab collects personal data of European Social Fund Students on behalf of SFC. Data Lab is an innovation centre within the University of Edinburgh. Please refer to the Data Lab privacy notice for more information.

Categories of personal data collected

SFC collects the following categories of personal data about university students:

Demographic information.
Information about the course that you undertake.
Funding information.
Equalities information.
Student status.
Previous qualifications.
Proof of the right to live/work in the UK.

Purposes of processing

SFC processes university student data so far as it is necessary for:

Monitoring universities’ educational outcomes.
Assessing universities’ financial requirements.
Ensuring that universities are promoting equality and diversity.
Providing European Social Fund (ESF) funding to universities and to monitor and audit their compliance with ESF requirements.
Monitoring institutional sustainability and governance.
Evaluate the quality of university education in Scotland.
To provide statistical data on university education in Scotland in collaboration with HESA.

Legal basis for processing

SFC processes university student data so far as it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in SFC.

SFC processes university student special category data so far as it is necessary for reasons of substantial public interest, on the basis of law under:

Further and Higher Education (Scotland) Act 1992.
Further and Higher Education (Scotland) Act 2005.
EU legislation for the provision of the European Social Fund.

Recipients of the data

SFC shares university student data with other public sector bodies to allow them to carry out their tasks in the public interest and to carry out their statutory functions. SFC may share personal data with:

The Scottish Government.
The European Commission.
Universities.
NHS Education for Scotland.
Colleges in Scotland.

SFC uses third parties for some of its IT systems which are used to hold and process personal data.

University staff data

Overview

Source of the personal data

The Higher Education Statistics Agency (HESA) collects personal information on university staff directly from universities and shares this data with SFC.

SFC also collects data directly from universities for the provision of European Social Fund funding and to monitor the institutional governance and sustainability.

Categories of personal data collected

SFC collects the following categories of personal data about university members of staff:

Permanent/temporary contract.
Employed full-time/part-time/FTE.
Teaching/non-teaching staff.
Staff qualification.
Age.
If staff are considered to have a long term health condition or disability.
Equalities monitoring information.
Salary.
Institution of employment.
Involvement in research and innovation.

Purposes of processing

SFC processes university staff data so far as it is necessary for:

Monitoring institutional sustainability and governance.
Ensuring that HEIs are promoting equality and diversity.
Providing European Social Fund (ESF) funding to Higher Education Institutions and monitor and audit their compliance with ESF requirements.
Evaluate the quality of university education in Scotland.
To provide statistical data on university education in Scotland in collaboration with HESA.

Legal basis for processing

SFC processes HE staff data so far as it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in SFC.

SFC processes HE staff special category data so far as it is necessary for reasons of substantial public interest, on the basis of law under:

Further and Higher Education (Scotland) Act 1992.
Further and Higher Education (Scotland) Act 2005.
EU legislation for the provision of the European Social Fund.

Recipients of the data

SFC uses third parties for some of its IT systems which are used to hold and process personal data.

Research and innovation

Overview

SFC funds research and innovation projects in Scotland in collaboration with Scotland’s universities. We collect the personal data of key stakeholders to allow us to carry out this task.

Source of the personal data

The data is collected from universities.

Categories of personal data collected

Name.
Workplace email address.
Workplace telephone number.
Workplace address.
Signatures of staff authorising claims and verifying documents.

Purposes of processing

SFC processes the personal data of university members of staff, business contacts and other key stake holders to assess, to validate the funding of Innovation Centres and to grant Innovation Vouchers and to allow us to process funding for research purposes.

Legal basis for processing

SFC processes the data of university members of staff, business contacts and other key stake holders so far as it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in SFC.

Recipients of the data

SFC shares contact details and validation of claims with other public sector bodies to allow them to carry out their tasks in the public interest and to carry out their statutory functions.

SFC may share personal data with:

The Scottish Government.
Regional Strategic Bodies (aka Joint Regional Boards).
Scottish Enterprise.
Highland and Islands Enterprise.

SFC also shares personal data collected for the issuing of Innovation Vouchers with Interface to allow for links between businesses, SFC and universities to be established.

SFC uses third parties for some of its IT systems which are used to hold and process personal data.

Privacy Notice for institutional Research Excellence Framework (REF) 2029 contacts

Scottish Funding Council is providing you with this information to comply with data protection law and to ensure that you are fully informed, and we are transparent in how we collect and use your (personal) data.

Who is collecting the information?

Scottish Funding Council is the Data Controller. We have an appointed Data Protection Officer (DPO), Emma Pantel who can be contacted by emailing: info@sfc.ac.uk.

Why are we collecting it and what are we doing with it (Purpose)?

The data will be used by SFC and/or the UK REF Team within Research England as the official institutional contact for REF 2029 and to keep institutions up to date with development of the Research Excellence Framework (REF) 2029.

Categories of data collected?

Forename
Surname
Job title
Institution
Work email address

Data source

The data is provided by universities.

The lawful basis for the processing

SFC processes the data of university members of staff so far as it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in SFC.

Who we share the information with

SFC shares contact details and validation of claims with other public sector bodies to allow them to carry out their tasks in the public interest and to carry out their statutory functions.

SFC may share personal data with:

The UK REF team based within Research England.

SFC uses third parties for some of its IT systems which are used to hold and process personal data.

Where will your personal information be stored?

Personal information will be stored on servers in the UK and will not be transferred outside that territory unless required by a court.

How long do we hold the personal data?

SFC will hold the data until the REF 2029 process and evaluation is complete.

Individuals’ rights in relation to this processing

Under data protection law, individuals have rights in relation to the processing of their personal data. These rights are as follows

Right to be informed.
Right of access – this means individuals have the right to access and have copies of all personal data held.
Right to rectification – this means individuals have the right to correct/update inaccurate or incomplete information about them.
Right to erasure, also known as ‘the right to be forgotten’ – this means individuals can request that all their personal data held by an organisation is destroyed.
Right of restriction – this means individuals can restrict how their personal data is processed. This only applies in certain circumstances.
Right to data portability – this means individuals can request their personal data in a machine readable format to transfer to another organisation.
Right to object – this means an individual can object to how their personal data is processed.
Automated individual decision-making including profiling – this means individuals have the right not to be subjected to a decision made solely by automated means.

Some of these rights may only apply in certain circumstances and are not absolute. Requests will be assessed on a case by case basis.

To exercise these rights, please contact SFC via info@sfc.ac.uk.

Complaints to UK Information Commissioner’s Office (ICO)

If you are concerned about how your personal data is being used by the Council, in the first instance please can you contact their Data Protection Officer at info@sfc.ac.uk. If you are not satisfied with the outcome then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO has guidance on their website here.

You can email them at casework@ico.org.uk or call them on 0303-123-113 or you can send a letter to them at the following address:

Customer Contact
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF

Privacy Notice for Value of Research and Innovation in Scotland Task and Finish Working Group

The Scottish Funding Council is providing you with this information to comply with data protection law and to ensure that you are fully informed, and we are transparent in how we collect and use your (personal) data.

Who is collecting the information?

The Scottish Funding Council is the Data Controller. We have an appointed Data Protection Officer (DPO) who can be contacted by emailing: info@sfc.ac.uk.

We use Jisc Survey to process your data as our data processor on our behalf.

Why are we collecting it and what are we doing with it (Purpose)?

We use personal information you give to us, via JISC Survey for the following purposes:

To process your application.
If successful, to engage with you for the duration of the Working Group.
In relatIon to any reasonable adjustments that may need to be made.
If unsuccessful, communicate with you regarding any future participation in the Working Group’s diffuse network (where you have provided consent).

What personal data do we collect?

We collect a range of information about you including:

Application Stage

Your name and email address.
Your current employer and location.
Your job title.
Information regarding your experience and expertise.

Participating in the Working Group

Whether or not you have a disability for which the organisation needs to make reasonable adjustments during working group lifecycle.
Your bank details to facilitate the processing of honorarium payments (where applicable).

How are we collecting this information? What is the source?

We collect your personal data directly from you via JISC Survey and store on secure SFC networks.

The lawful basis for the processing

The lawful basis we rely on for processing your personal data are article 6(1)(e) of the UK GDPR, which relates to processing necessary to perform our public task(s) and article 6(1)(f) for the purpose of our legitimate interests.

If you provide us with any information about reasonable adjustments you require under the Equality Act 2010, the lawful basis we rely on for processing this information is article 6(1)(c) to comply with our legal obligations under the Act.

If your application is unsuccessful but you are subsequently invited to participate in the diffuse network, the lawful basis we rely on to communicate with you is article(6(1)(a) – explicit consent.

Consent must be a clear positive action that you have given your agreement to the use of your personal information, and consent can also be withdrawn at any point if you are no longer happy with the use of your personal information for a specific reason. If you to wish to withdraw consent, please do so by emailing: info@sfc.ac.uk.

Once consent is withdrawn, we will destroy all relevant personal information unless we are relying on a different legal basis to justify keeping your personal information. If that is the case, we will tell you in writing. However, withdrawing your consent does not affect the lawfulness of processing based on consent before you withdrew consent.

Who we share the information with

Your information will be shared internally only. This includes: colleagues in the R&I Team responsible for the Working Group; Finance staff to process any payments (where applicable), if required and IT staff if access to the data is necessary for the performance of their role.

How long do we hold the personal data?

For unsuccessful applicants who have not agreed to be contacted in regards to the diffuse network) we will retain your data for a period of 4 weeks at which point your data will be deleted.

If you have consented to be part of the diffuse network and have been invited to it, we will retain your name and email address for the duration of the Working Group lifecycle, at which point your data will be deleted.

Successful candidates’ data will be kept for the duration of the Working Group lifecycle, at which point your data will be deleted.

If you receive an honorarium payment, your financial details will be retained for a period of 7 years, as part of our statutory retention period for financial transactions.

Individuals’ rights in relation to this processing

Under data protection law, individuals have rights in relation to the processing of their personal data. These rights are as follows:

Right to be informed.
Right of access – this means individuals have the right to access and have copies of all personal data held.
Right to rectification – this means individuals have the right to correct/update inaccurate or incomplete information about them.
Right to erasure, also known as ‘the right to be forgotten’ – this means individuals can request that all their personal data held by an organisation is destroyed.
Right of restriction – this means individuals can restrict how their personal data is processed. This only applies in certain circumstances.
Right to data portability – this means individuals can request their personal data in a machine readable format to transfer to another organisation.
Right to object – this means an individual can object to how their personal data is processed.
Automated individual decision-making including profiling – this means individuals have the right not to be subjected to a decision made solely by automated means.

Some of these rights may only apply in certain circumstances and are not absolute. Requests will be assessed on a case by case basis.

To exercise these rights, please contact SFC via info@sfc.ac.uk.

Complaints to UK Information Commissioner’s Office (ICO)

You can email them at casework@ico.org.uk or call them on 0303-123-113 or you can send a letter to them at the following address:

Customer Contact
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF

Privacy Notice for Research Assurance and Accountability Reporting

Who is collecting the information?

Scottish Funding Council is the Data Controller. We have an appointed Data Protection Officer (DPO) who can be contacted by emailing: info@sfc.ac.uk.

Our survey responses are collected by Jisc on behalf of SFC via Online Survey (OS) and therefore act as a Data Processor.

What are we collecting it and what are we doing with it (Purpose)?

We use the personal information you give to us as a means of corresponding with you in relation to your reporting return.

We may summarise and/or publish case studies provided as part of the RAA return. No personal data such as individuals’ names, addresses or other contact details will be included.

What personal data do we collect?

Name.
Business email address.
Job title.

How are we collecting this information? What is the source?

We collect this information directly from you, the data subject.

The lawful basis for the processing

The lawful basis we rely on for processing your personal data is article 6(1)(e) of the UK GDPR, which relates to processing necessary to perform our public task(s).

Where your personal information will be stored

Your personal information will be stored securely on SFC’s network, within the UK and will not be transferred outside that territory unless required by a court order.

Information collected through Jisc Survey is stored on secure servers in the UK or EU and does not leave Europe at any point.

Who we share the information with

Your information will be shared internally only.

A copy of the return will be provided to your institution upon submission.

How long do we hold the personal data?

We will only retain your personal data for as long as it is necessary to fulfil the purpose it was collected for.

Individuals’ rights in relation to this processing

Under data protection law, individuals have rights in relation to the processing of their personal data. These rights are as follows:

Right to be informed.
Right of access – this means individuals have the right to access and have copies of all personal data held.
Right to rectification – this means individuals have the right to correct/update inaccurate or incomplete information about them.
Right to erasure, also known as ‘the right to be forgotten’ – this means individuals can request that all their personal data held by an organisation is destroyed.
Right of restriction – this means individuals can restrict how their personal data is processed. This only applies in certain circumstances.
Right to data portability – this means individuals can request their personal data in a machine readable format to transfer to another organisation.
Right to object – this means an individual can object to how their personal data is processed.
Automated individual decision-making including profiling – this means individuals have the right not to be subjected to a decision made solely by automated means.

Some of these rights may only apply in certain circumstances and are not absolute. Requests will be assessed on a case by case basis.

To exercise these rights, please contact SFC, email: info@sfc.ac.uk

Complaints to UK Information Commissioner’s Office (ICO)

You can email them at casework@ico.org.uk or call them on 0303 123 113 or you can send a letter to them at the following address:

Customer Contact
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF

Key stakeholder data

Overview

SFC collects personal data of key stakeholders in colleges and universities as well as the wider education sector, individuals in the media, individuals involved in local and national government in order to facilitate business communications with them.

Source of the personal data

SFC will collect the data directly from the data subject directly or from publicly available sources such as institution websites.

Categories of personal data collected

Name.
Role and organisation.
Workplace email address.
Workplace phone number.
Preferences and areas of interest (e.g. widening access, innovation, etc.).

Purposes of processing

SFC processes this data in order to communicate with relevant individuals in the sector, to promote the work we carry out and to ensure that we are able to carry out our tasks in a transparent matter.

Legal basis for processing

SFC processes the data of key stake holders so far as it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in SFC.

Website and subscribers

Overview

We collect personal data from our website users so we can:

Monitor the usage of our website.
Customise web content for registered users.
Update subscribers on SFC’s activities.

Website subscribers

SFC allows interested individuals to subscribe to updates about our activities. This helps SFC promote the work it carries out and to be transparent in carrying out our functions.

Categories of personal data collected

Name.
Role and organisation.
Address
Email address.
Phone number.
Areas of interest.

Purposes of processing

SFC’s purpose for collecting your contact details is so we can provide you with a service and let you know about our work, guidance and events.

Legal basis for processing

The lawful basis we rely on for processing your contact details and interest preferences is your consent under article 6(1)(a) of the UK GDPR. You can withdraw your consent at any point by emailing webmaster@sfc.ac.uk.

Website forms

SFC uses online forms to collect data, including personal data, for any of the following purposes:

Registering to attend an event.
Responding to an online consultation.
Responding to an online survey.

Cookies

Cookies are small files that a site or its service provider transfers to the user’s computer’s hard drive through a Web browser (if allowed) that enables the sites or service providers’ systems to recognize the browser and capture and remember certain information.

Why we use cookies

Cookies are used for a variety of purposes, including storing registered usernames (subscribers only) for logging in, collecting visitor statistics using Google Analytics, and social media sharing tools. Some third party cookies are used to hold and process personal data – see what cookies are stored on the website.

Legal basis for processing

SFC processes the data collected by cookies so far as it is necessary for the performance of a task carried out in the public interest.

Third party website content

SFC is not responsible for the content of any third party websites linked to. These websites may collect your personal data, please see the relevant privacy notices of any of these sites for further information.
We occasionally embed YouTube videos on our website using YouTube’s privacy-enhanced mode. This mode may set cookies on your computer (including Flash) but YouTube will not store personally-identifiable cookie information if you play the video.

Please visit the YouTube website for further information from embedding YouTube videos.

The data collected by the Google Analytics cookies is hosted by Google. For more information please see Google Analytics Privacy Policy.

General enquiries, information requests and complaints

Overview

Enquiries, information requests and complaints contain personal data of the enquirer as well as third parties in some circumstances. We will use this personal data in order to respond to the query, request or complaint.

Purposes of processing

SFC processes this personal data in order to adequately respond to enquiries and to advise the sector and wider public about our activities. We also process this information in order to identify trends in enquiries received by the organisation.

Legal basis for processing

SFC carries out this data processing as it is necessary for the performance of a task carried out in the public interest (Article 6(1)(e) of the GDPR)

Recipients of the data

The contents of general enquiries shall be shared with members of SFC staff in order to adequately respond to your request.

SFC uses third parties for some of its IT systems which are used to hold and process personal data.

Subject Access Requests

A Subject Access Request is a request for your own personal data under the GDPR/DPA. SFC has a legal duty to respond to such requests in accordance with the law.

Purposes of processing

SFC processes the information supplied in Subject Access Requests in order to respond to the request in line with legislative requirements including to confirm the identity of the requester. We also process this information in order to identify trends in enquiries received by the organisation.

Legal basis for processing

SFC carries out this data processing as it is necessary for compliance with a legal obligation under the GDPR and DPA.

Recipients of the data

Your data will be shared with relevant members of staff in the organisation as necessary for us to respond to your request.

If the personal data you have requested is processed by any third party providers on behalf of SFC, we will share the necessary data with those third parties in order to respond to the request.

We may also share subject access request information with the Information Commissioner’s Office in the event of a complaint being made about the handling of the request.

SFC uses third parties for some of its IT systems which are used to hold and process personal data.

Freedom of Information Requests

A Freedom of Information request is a request for information held by SFC under the Freedom of Information (Scotland) Act 2002 (FOISA) or the Environmental Information (Scotland) Regulation 2004 (EIRS). SFC has a legal duty to respond to such requests in accordance with the law.

Purposes of processing

SFC processes the information supplied Freedom of Information requests in order to respond to the request in line with legislative requirements including verifying the validity of the request. We also process this information in order to identify trends in enquiries received by the organisation.

Legal basis for processing

SFC carries out this data processing as it is necessary for compliance with legal obligations under FOISA and EIRS.

Recipients of the data

Your data will be shared with relevant members of staff in the organisation as necessary for us to respond to your request.

We may also share the content of your request with relevant third parties such as contractors employed by SFC and other public bodies who have an interest in the information requested in order to consult them on our proposed response. We remove as much personal data as possible when sharing requests for this purpose.

We may also share subject access request information with the Office of the Scottish Information Commissioner in the event of a complaint being made about the handling of the request.

SFC uses third parties for some of its IT systems which are used to hold and process personal data.

Complaints

A complaint is an expression of dissatisfaction by one or more members of the public about the Scottish Funding Council’s action or lack of action, or about the standard of service provided by or on behalf of the Scottish Funding Council.

Purposes of processing

SFC processes complaints information in order to adequately respond to complaints from members of the public, to identify improvements in how we carry out our services and in order to comply with the requirements of the Scottish Public Services Ombudsman.

Legal basis for processing

SFC processes complaints data as it is necessary for compliance with legal obligations under the Scottish Public Services Ombudsman Act 2002 and as it is necessary for carrying out a task in the public interest.

Recipients of the data

Your data will be shared with relevant members of staff in the organisation as necessary for us to respond to your complaint.

We may also share the content of your request with relevant third parties such as contractors employed by SFC and other public bodies who have relevant to your complaint in order to consult them for our response.

We may also share complaint information with the Scottish Public Services Ombudsman in the event of an appeal being made about the handling of the complaint.

SFC uses third parties for some of its IT systems which are used to hold and process personal data.

Recruitment

Overview

We use personal information you give to us to facilitate the job application and recruitment process.

Our full Recruitment Privacy Policy is available on our Pinpoint Application Portal.

Data subject rights

Overview

Individuals have right under data protection law which serve as checks and balances on data processing in accordance with the law. This section covers:

The right to complain.
The right to access.
The right to rectification.
The right to erasure.
The right to restrict processing.
The right to object.

Right to Complain

If you believe that SFC has handled your personal data in a way that is not consistent with data protection law, you have the right to complain to the Information Commissioner’s Office (ICO).
You can report your concern on the ICO’s website or by calling their office on 0303 123 1113.

Right to Access

Data Subjects have a right to have access to the personal data which we hold about them (subject to certain limitations).

If you would like a copy of your information, you can submit a request to SFC by contacting us using the details at the end of this notice.

We are obliged to respond to any such request within a calendar month of receipt. If the request is complex we can extend this by a further two months. We will only extend the deadline if necessary and in line with the law. If this is the case, we will inform you within one month of the receipt of the request and explain why the extension is necessary.

We will inform the applicant in writing following receipt of your request and if necessary, seek additional information about them and their request in order to help us locate the information.

Right to rectification of personal data

Individuals have a right to have your personal data rectified if it is inaccurate or incomplete.

We are obliged to comply with any such request within one month of receipt. This may be extended two months where the rectification request is complex.

Right to erasure

Individuals have a right to request the deletion or removal of their personal data where there is no compelling reason for its continued processing.

The right to make such a request will arise in specific circumstances for example, where data is no longer necessary for the purpose for which it was collected or where consent is withdrawn and consent is the sole basis on which data is processed.

Right to restrict processing

Individuals have a right to block or suppress the processing of personal data in certain circumstances.

If, for example, the accuracy of the personal data SFC processes; that processing may be restricted until the accuracy of the personal data has been verified. This will also apply if the processing of the data is unlawful.

Right to object

Individuals have the right to object to processing of their personal data if it is based on the performance of a public task or for research purposes.

To exercise this right, please submit a written request outlining your grounds of objection. We will then consider this request in accordance with our obligations under data protection law.

Further use of personal data

Overview

SFC will process data for purposes other than which it was originally requested in certain circumstances. Data processed for any of the below purposes will be kept to a minimum and shall be anonymised wherever possible.

Archival purposes

SFC has an archival transfer agreement in place with the National Records of Scotland. SFC may keep limited personal data for archival purposes in accordance with the GDPR and DPA.

Statistical purposes

Sections of core data sets may also be kept for statistical purposes even once it is no longer required for the purpose it was initially collected for.

Research purposes

SFC may share personal data with external partners for research purposes. SFC will take all appropriate steps to ensure that data shared is necessary for those purposes and is kept securely.