This policy document contains important information about your personal rights to privacy, and our legal obligation to you under the General Data Protection Regulation (GDPR). Please read it carefully to understand how Yes Edinburgh North & Leith (YENL) collects, stores, and uses your personal information. It also sets out your options regarding your rights.
You have the right to object to your personal data being processed.
YENL is a non-party political community group based in Edinburgh North & Leith that campaigned for a Yes vote in 2014 Scottish Independence Referendum. Since 2014 YENL has worked to explore how best to bring about Scottish independence, and to prepare for a future referendum.
We, the YENL community, are committed to safeguarding your privacy. We respect any personal data that you share with us and have designed protocols to keep it safe.
1 What personal data do we collect from you?
Personal data is any information about you which could be used to identify you. To plan and coordinate our campaigning effectively we collect, store, and use the following kinds of personal data:
- Your name.
- Your address.
- Your email address.
- Your telephone number.
- Social media account information.
- Lists of your interests, skills, and talents.
- Details of your availability.
We collect this information to help us coordinate our members, our campaigning activities, and our social media activities. It is up to you to decide what information you would like to give us, and how you would like us to use it.
2 Do we process sensitive personal information?
GDPR recognises that certain categories of personal information are sensitive and therefore require more protection. This includes information about your health and medical needs, ethnicity, religious and political opinions. YENL is a community organisation that campaigns for Scottish independence. Therefore, if you choose to give us your personal data, or choose to campaign with us, there is an assumption that you have some interest in furthering the cause of Scottish independence. However, we are a community with diverse religious and political views.
YENL does not collect, store, or use information regarding your religious or political beliefs, or any other type of sensitive personal information. If in the future there was a clear reason for collecting, storing, or using sensitive personal data of this nature, we would do so only with your explicit consent.
3 How do we get your information?
Personal data is provided to us directly by you. This includes when you sign-up online to our mailing list, or when you complete a physical sign-up card at one of our events, meetings, or on the street. You may also call, email, or instant message us through social media asking to subscribe to our regular email updates or to volunteer. We are contactable via our email address, Facebook, Twitter, and IndyApp.
When you sign up to our mailing list, either online or on paper, you will be contacted by email to confirm your contact details and opt-into our mailing list (this is called double opt-in). We do not access your data through any external organisation. We will not pass your data onto any external organisation, unless required to comply with law or to obey a court order.
4 Why do we need your personal data?
We use your personal data to keep you informed of our campaigning activities, events, fundraising, and social events. We also collect information to gain a better understanding of you to help us improve our campaign coordination and communications. We will use your personal data to send you information about:
- Our planning activities.
- Our events.
- Our social events and gatherings.
- Our campaigning activities and campaign coordination.
- Other local groups’ events or campaigning activities when the steering group considers it relevant to furthering the cause of Scottish independence or improving our community here in Edinburgh North & Leith.
We will also use your personal data for administrative purposes, such as:
- To provide you with information that you have requested.
- Handle administration and coordination of Steering Group activities (if you are on the Steering Group).
- Handle the administration of any payment that we are due you (for petty cash expenses relating to campaigning activities), or any donation that you make to us via credit card/ debit card/ cheque/ standing order/ or BACS transfer.
- Collect payment from or to you, and send your statements and/or receipts.
- Handle the administration and coordination of your campaign volunteering.
- Conduct research into the impact of our campaigns.
- Conduct research into your interests, experience, skills, and other information that may be helpful to our campaigning.
- Deal with enquiries and complaints.
- Audit or administer our accounts.
- Comply with any legal obligations required of us, and to comply with court orders.
5 How do we coordinate our campaigns?
We are a community of activists and volunteers. Most of our communication occurs through bulk email. However, should you wish to contact us to volunteer to campaign with us then we will ask you if we can pass on your contact details to a Point of Contact (PoC) within your geographic area. If you agree then your PoC and fellow activists in your area will contact you, usually by text or email. However, these are self-organising activist communities and so activist coordination at the street level is done outside of YENL. Therefore, if you chose to unsubscribe from our mailing lists your data will be automatically deleted and you will no longer receive emails from YENL, but you may still be contacted by your fellow activists. You will need to tell them separately if you do not wish to be contacted by them anymore.
6 Our skills database of our activists
We maintain a database of our activists. If you wish to become more involved in our campaigning activities then we may ask you for more information about yourself such as your interests, skills knowledge, availability and other assets that you could offer our community. This helps us get a better understanding of you, and how we can best organise our campaigning activities. You do not have to tell us this information to campaign with us, but if you have specialist skills, knowledge in any particular area which may be relevant to us, or any assets we could use, we would love to know about them to maximise our knowledge base and campaign effectiveness.
7 Do we share your personal data with external organisations?
No, we will not share your personal information with any external organisation unless you give us permission to, or we are required by law or to comply with a court order.
8 Where is my data stored?
9 How long is my data stored?
In general, unless still required in connection with the purposes for which it was collected and/or process, we will remove your personal information from our records six years after the date it was collected. However, we will remove your personal information before this if (i) you exercise your right of erasure, (ii) we are no longer lawfully entitled to process it, or (iii) your personal information is no longer required in connection to our campaigning objectives (i.e., after Scotland formally redeclares itself a sovereign state).
10 How old do you have to be to consent to your collecting and storing my data?
In Scots law you must be 16 years old to consent to having your data collected, stored and used. We do not knowingly process data of any person under the age of 16. If we discover, or have reason to believe, that you are 15 years old or younger, and we are holding your personal information, we will delete your personal information.
11 What security arrangements do we have?
We endeavour to ensure that we have appropriate technical and organisational measures to prevent loss, destruction, misuse, alteration, unauthorised disclosure of, or access to, your personal information. Your information is stored on MailChimp and Google drive, which are GDPR-compliant. Our accounts are protected with robust passwords. Direct access to the database is limited to those who are elected onto the Steering Group. Those who have access to the databases have undergone GDPR-training. We do not share your information to any other external organisation.
12 What if you want to donate to us, or we owe you money?
13 What about law enforcement?
We will disclose your personal information to regulatory and/or government bodies and/or law enforcement agencies upon request and when required to do so to satisfy legal obligations which are binding on us.
14 Your rights
Where we rely on consent to collect, store and use your personal data, you have the right to withdraw that consent at any time, and without reason. This includes the right to ask us to stop using your personal data to connect you, or to be unsubscribed from our emailing list at any time. You also have the following rights:
- Right to be informed – you have the right to be told how your personal information will be used. This policy documents and other policy statements used on our websites and in our communications provide you with this information. We seek to be as clear and transparent as possible.
- Right of access – You can write to us to ask for confirmation of what information we hold on you, and to request a copy of that information. To prevent data breaches, we will ask you for a confirmation of your identity unless you are personally known to a member of YENL Steering Group. Once you do so, we will provide you with this information within 28 days.
- Right of erasure – you can ask us for your personal information to be deleted from our records. Doing so prevents us from communicating with you.
- Right of rectification – if you believe our records of your personal information are inaccurate, or if your information has changed, you have the right for those records to be corrected and/or updated.
- Right to object – you have to right to object to your information being processed. To prevent data breaches, we will ask you for a confirmation of your identity unless you are personally known to a member of YENL Steering Group. Once you do so, we will provide you with this information within 28 days.
- Right to restrict processing – you have the right to ask for processing of your personal data to be restricted if there is disagreement about its accuracy or legitimate usage.
- Right to data portability – YENL does not automate data processing. We can provide your personal information to you in a machine-readable format.
- Right to complain to the Information Commission Office if you believe there is a problem with the way YENL handles your data. For more information on your rights, see here [https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/]
To exercise these rights, please send us a description of the personal information in question using the details at the bottom of this page, along with your personal identification.
15 Our lawful basis for processing
We are required to have at least one lawful basis for processing your personal information:
- Personal information is processed on the basis of a person’s consent.
- Personal information is processed on the basis of a contractual relationship.
- Personal information is processed on the basis of legal obligations.
- Personal information is processed on the basis of legitimate interests.
I. Consent: we will ask you for your consent to use your information to send you electronic communication such as newsletters, campaign coordination activities, meetings, events, and social events.
II. Contractual relationship: Our interactions with subscribers and activists are voluntary and not contractual. However, if your purchase something via our online shop, we will have entered a contractual relationship with each other.
III. Legal obligations: We may be obliged to process your personal information due to legal obligations which are binding on us. We will only do so in accordance with legal obligations and/or to fulfil a court order.
IV. Legitimate interests: Applicable law allows personal information to be collected and used if it reasonably necessary to our legitimate interests (so long as it is fair use, balanced, and does not unduly impact on individuals’ rights). We will rely on this ground to process your personal data when it is not practical to ask for consent.
16 Policy amendments
18 Data protection officer