Privacy Policy

SCAA

Introduction

Scotland’s Charity Air Ambulance (also referred to as ‘the charity’, ‘we’, ‘our’ or ‘us’) is the Data Controller over any personal data we process about you for the purposes set out in this Privacy Notice (see below).  This notice outlines what personal data the charity collects and processes about you in various situations, which we have explained below.  This notice does not cover personal data we process about our staff. The categories of data subjects whose personal data is covered by this privacy notice include; patients and victims of accidents, patients’ next of kin, volunteers, supporters, donors, third party healthcare employees, employees of public authorities, employees of corporate partners, individuals who make enquiries via our website or over the phone or email, supporters and donors.

Please read through the privacy notice to understand how the charity uses and processes your personal data obtained. If you have any concerns about our processing of your personal data or you have a general enquiry in relation to data protection please contact our Data Protection Officer at dpo@scaa.org.uk

What is personal data?

Personal Data: means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Special Category of Data: means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

When we use the term ‘personal data’ we mean both personal data and special category of data.

Our Processing

Personal Data is collected in several different ways dependent on your interaction with the charity.  The table below sets out what personal data we process about you, where we get it from, why we use it, our legal basis and who we share it with.  Otherwise we will only share your personal data:

  1. where we use third parties to undertake certain services on our behalf and in doing so they require to process personal data in order to do this.  If so, we will ensure that adequate arrangements are in place to protect your personal data.  These third parties include: our professional advisors, our DPO, cloud storage suppliers, CRM suppliers, marketing platforms (including parties used for sending email marketing communications), IT infrastructure suppliers, payroll provider, donation site, payment bureau provider, postal mailing housing, fundraising management sites;
  2. where we are required to share your personal data in accordance with law e.g. such as to assist with investigations carried out by the police, other authorities or any regulatory requirement to which the charity is subject;
  3. where we are undergoing a corporate restructure;
  4. where we have your consent.

How Scotland’s Charity Air Ambulance uses the Personal Data

Will we share your Personal Data outside of the UK?

Some of our service providers process personal data we give them outside of the UK.  Where this happens and the recipient country is not deemed adequate by the UK Government, then we will put in place additional measures to protect your personal data called the Standard Contractual Clauses.
 
Retention

SCAA shall keep your personal data for as long as is necessary and in accordance with our Retention Policy.  In short, we retain general correspondence and emails for 1 year from receipt; inactive donor records for 2 years, after which we will archive your record; active donor records for as long as required until 2 years inactive, after which we will archive your record; financial records for up to 7 years.   

Your rights

You have certain rights under data protection law, which are summarised below.  You can exercise these by contacting our DPO on dpo@scaa.org.uk:

  • In certain circumstances you have the right to ask us to erase the personal data we hold about you.  We will consider any such request in line with UK GDPR.  Please note this is not an absolute right and there may be circumstances where we choose not to delete all of the personal data we hold about you. 
  • You have the right to access personal data held by us about you.
  • You can withdraw your consent (including for marketing) at any time, at which point we shall stop processing your personal data in that way.  Please note this does not affect the legality of our processing up to the date of your withdrawal of consent.
  • You can seek to restrict our processing of your personal data, ask us to rectify any personal data we hold about you or object to us processing your personal data for the purposes stated above. 
  • In certain circumstances you have the right to ask us to provide you with your personal data in a structured, commonly used and machine-readable format to allow you (or us on your behalf) to transmit this information to another party. 
  • You have the right to lodge a complaint with the Information Commissioners Office (ICO) if you think that we have infringed your rights. You can find more information about reporting a matter to the ICO at the following link: https://ico.org.uk/

Website

The SCAA website www.scaa.org.uk may contain links to other websites.  Please note that SCAA has no control of websites outside our domain. The charity is not responsible for the protection and privacy of any sensitive information provided to a website linked to scaa.org.uk

Changes

We reserve the right to amend this privacy notice from time to time. 

Last Updated: April 2021