PRIVACY NOTICE
Privacy notice for Scots Music Group: students, members, ceilidh attendees and volunteers
Scots Music Group takes your privacy seriously. Under General Data Protection Regulation, we are a “controller” of the personal information that you provide to us. This privacy notice explains how, why and for how long we will use your personal data, as well as who it is shared with. It also explains your legal rights as a data subject and how to exercise them.
The data we hold
The table below sets out the personal information we hold and why this is required.
| Category of individual | Data held | Why we need to hold this data | How long we hold your data |
| People registered through our website. We also register these details for people who do not sign up online. | Name, email address, postal address and age range. You may also provide us with your telephone number, date of birth and gender, but this is not compulsory.
| We hold your contact details for contractual purposes. We need to collect personal information from our students so that we can provide you with an online account enabling you to manage your bookings with us and so that we can send you information about your bookings.
We will also process your personal information in our legitimate interests of:
| Your contact details are deleted from our MailChimp mailing list when you unsubscribe, which you may do at any time. We regularly review our customer data and if on such review an individual has not made an active booking for five years, their details will be deleted. |
| SMG members. | Name, email address, postal address. | We have a legal obligation under the Charities and Trustees Investment (Scotland) Act 2005, which requires us to maintain a register of members, including name, address, date admitted to membership and date on which membership ceased, to hold general meetings, issue notices and AGM voting arrangements. | We retain members’ details in accordance with charity and company law. |
| People who attend SMG events such as student concert, stramashes and ceilidhs. | We may take photographs or videos at Scots Music Group events. | We will also process your personal information in our legitimate interests of using photographs and videos in our promotional material, on our website and on our social media channels.
| Photographs and videos may be used until replaced by other marketing material. |
| People who have bought ceilidh tickets. | Name, email address, mobile telephone number, registered payment card address.
| We hold your details for contractual purposes, so that we can identify you as having bought a ticket for the ceilidh.
| We regularly review our customer data and if on such review an individual has not made an active booking for five years, their details will be deleted. |
| Volunteers. | Name and preferred contact details. Board members must also provide additional personal information to allow them to be registered as directors of SMG at Companies House. We hold volunteer’s bank details where provided in order to allow us to reimburse legitimate expenses. | We have a legitimate interest in holding your contact details so that we can contact you in relation to the voluntary role you are undertaking. We have a legal obligation to register Board members as directors of SMG at Companies House. We need to hold bank details as part of our contractual relationship with a volunteer where they wish to be reimbursed for expenses. | Contact details are deleted when the volunteer relationship ends (note that we may still hold your data in a different capacity, for example if you still have an active online account on our website). |
Other uses of your personal information
We may ask you if we can process your personal information for other purposes. Where we do so, we will provide you with an additional privacy notice explaining how we will use your information for these purposes.
Third party suppliers
Scots Music Group may use third party suppliers to provide services. These suppliers may process personal data on our behalf as “processors” and are subject to contractual conditions to only process that personal information under our instructions and protect it.
In the event that we share personal information with external third parties, we only share such information strictly required for the specific purposes and take reasonable steps to ensure recipients shall only process the disclosed personal information in accordance with those purposes.
- Bookeo Pty Limited provide our booking system for classes and membership. They are based in Australia and their terms and conditions with us oblige them to comply with General Data Protection Regulation.
- Yapsody provide our booking system for ceilidhs. Their servers are based in the US and their terms and conditions with us oblige them to comply with General Data Protection Regulation.
- MailChimp distribute some of our email communications. Their servers are based in the US and they uphold the EU Privacy Shield to certify their data security.
- Documents stored on SMG computer systems are backed up on Dropbox, which is based in the US but upholds the EU Privacy Shield.
- Tutors receive names and contact details of class participants to allow them to communicate with students about their classes.
Storing your personal information
Your personal information is accessed by our Administrator and Development Worker only for the purposes set out in the table above. It is stored by Scots Music Group electronically on our password protected computers and backed up in Dropbox (whose servers are based in the US and who uphold the EU Privacy Shield to certify their data security). Our paper records are kept in the Scots Music Group office which is kept locked outwith office hours. A paper copy of names of ceilidh ticket purchasers is taken to each event to be used to issue tickets by the volunteers running the ceilidh and is destroyed thereafter. Contact details for volunteers may be held on the personal devices of our Administrator and Development Worker to allow you to be contacted if required urgently.
You have a right to:
- Change your communication preferences or restrict the processing of your personal data for specific purposes.
- Request that we correct your personal data if you believe it is inaccurate or incomplete.
- Request that we delete your personal information.
- Access the personal data that we hold about you through a “subject access request”.
You can contact us at info@scotsmusic.org on 0131 555 7668 or at Office 1F6, Eric Liddell Centre, 15 Morningside Road, Edinburgh EH10 4DP for the attention of the Development Worker.
If you are dissatisfied, you have a right to raise a complaint with the Information Commissioner’s Office at www.ico.org.uk