1. Introduction

This statement will tell you in a clear, straightforward way what data Scottish PEN holds about you, how we store and process this data, how we keep it safe, and how you can opt-out at any time.

Scottish PEN values the privacy of its members, partners and supporters very highly and is committed to the responsible use and storage of your data. If you have any further questions, please don’t hesitate to get in touch with us using the details below.

It’s likely that we’ll need to update this Privacy Notice from time to time. We’ll notify you of any significant changes, but you’re welcome to come back and check it whenever you wish.

2. Opting Out

You can opt-out of Scottish PEN storing or processing your data at any time. We will remind you of this every time we contact you. There are a number of ways to opt out:

• Email info@scottishpen.org
• Speak to a member of the office team directly by dialling 0131 226 5590
• Write to us at:

Scottish PEN

The Writers Museum

Lady Stair’s House

Edinburgh

EH1 2PA

3. The Legal Stuff

Scottish PEN holds your data either with your Explicit Consent – i.e. if you have given us explicit permission to by opting-in to a service – or by assuming Legitimate Interest – i.e. if you have paid for membership, we reasonably assume that you will be interested in being contacted by Scottish PEN so you can realise the value of your membership, such as participation in our campaigns, events and other initiatives, as well as continuing to offer opportunities for promotion and support through the members network.

4. When does Scottish PEN Hold Data About You?

Scottish PEN may hold your data if you have:

• Paid for Scottish PEN membership (both as a writer or as a reader)
• Attended a Scottish PEN event
• Completed a post-event survey
• Made a donation to Scottish PEN
• Interacted with Scottish PEN on social media
• Emailed us, called us on the phone, or written us a letter
• Completed one of our surveys or campaign actions

5. How and Why We Use Your Data

We use your data because we want to give you the best possible experience of Scottish PEN. We do this by keeping our members, supporters and partners informed about our work.

The following sections explain the different services we can provide with your data, and the data we hold about you in each instance.

6. When You’re on Our Database and/or Mailing List(s)

If you are on our membership database we may hold your:

• Name
• Address & postcode
• Email Address
• Telephone
• Date Joined
• Membership Type
• Membership Status
• Payment Status
• Payment Method
• Date of Latest Payment
• Gift Aid? / Date of Gift Aid declaration
• Annual Membership Fee

When you are on our contact list held by MailChimp:

• Name
• Email Address
• Location (not full address)
• Open & Click Rates
• Preferred Email Client

When you’re on our database or mailing list(s) we will use this information to:

• Provide you with information about upcoming Scottish PEN events and campaigns
• Issue reminders for membership renewals and all official Scottish PEN processes such as AGMs and constitutional changes
• Promote members’ events that are submitted to us through our monthly newsletter to other members
• Monitor and analyse membership list and rates

As a rule, payment details are not stored locally. Any details that we do retain are stored on our online banking system, which is an encrypted web service that deploys two-factor authentication. Copies are not stored in the office and the web service can only be accessed by Scottish PEN staff and designated trustees. When we receive invoices or receipts from members, staff, partners or supporters, we do retain paper copies for our financial records (as necessary through UK law), these are stored in a locked filing cabinet in the Scottish PEN office, which is a secure space for Scottish PEN.

Membership dues paid through PayPal are stored securely on our PayPal account and we can only access details related to the PayPal accounts used, not the banking details of members. Our PayPal account stores:

• Name
• Email address
• Address
• Membership type
• Amount paid
• Date of renewal

7. When You Pay Membership Fees or Make A Donation

If you pay to become a member or make a donation, Scottish PEN will hold the data outlined above and use it for the aforementioned purposes. In addition, Scottish PEN will also:

• Keep a record of the amount, method and date of your donation
• Record what level of membership you hold (writer, reader, discount or through discounted membership schemes with the NUJ, Society of Authors and ASLS)
• Record if your donation is eligible for Gift Aid. If your donation is eligible for Gift Aid, your full name, house number and postcode will be submitted to HMRC in our annual Gift Aid claim, in compliance with UK law
• Write to you regularly to update you on our work and campaigns to give a chance for involvement
• Write to you one month before your membership expires and at regular intervals (no more than once a week) to let you know how you can renew

8. When you sign up for an event ticket

If you sign up for a ticket for a Scottish PEN event using EventBrite, the platform will ask for and store data related to your involvement. This includes your name and email address, and other details connected to your EventBrite user account. Emails are often sent to event participants, through the EventBrite platform, in the lead up to the event to share event information. These contact lists are retained on the platform and Scottish PEN does not hold on to copies or use them to augment our contact list for other means. Physical copies of guest lists, generated from EventBrite, that are used to monitor attendance are not retained by Scottish PEN and are securely destroyed following the event.

9. When You Complete a Campaign Action

As part of Scottish PEN’s campaigning work we will deploy a range of online tools as part of our campaigning. Tools we have used include, but are not limited to:

• Survey Monkey
• Start A Fire
• Google Drive

These actions are isolated actions and we will not add your details to other contact lists, without asking for your explicit and active consent i.e. being added to our newsletter contact sheet. Data stored for these actions are stored on the campaign action platforms and will only be stored as long as the campaign action is live. All platforms require a password only held by Scottish PEN staff via an end-to-end encrypted password manager to access, as well as using Two-Factor Authentication where supported.

All campaign actions are voluntary and are not required actions for membership or ongoing support of Scottish PEN.

10. Photography/Video

Scottish PEN sometimes takes photographs and videos at its events, which occasionally feature members of our audience. If this applies, you will be made aware that the event will be photographed or videoed through announcements made by people hosting the event or through signs posted in the venue.

Footage will then likely be shared online (Vimeo, Facebook, YouTube, Twitter) and may be used by partners with whom Scottish PEN is working. These partnerships are always announced ahead of the events, so all participants are aware of all active partners involved.

11. How Your Data Is Stored (and Where)

Data not held on 3^rd party platforms such as EventBrite or Google Drive, such as the password-protected membership database will be stored securely in the locked Scottish PEN office, with no remote access by staff or trustees.

12. How Long Your Data Will Be Stored For

Your data will not be stored longer than is necessary. If you tell us you no longer wish us to process your data, we will stop immediately.

13. Who Has Access To Your Data

Scottish PEN staff will have access to your data and will store and process it in line with Scottish PEN’s data usage policy. The Membership Secretary, an elected member of the Scottish PEN board of trustees will access the membership data throughout the calendar year in the Scottish PEN office. Data limited to email addresses of Scottish PEN membership have been shared, with the knowledge of the membership, to a designated individual for the purpose of the monthly newsletter. The access is limited to email addresses and this process is overseen by Scottish PEN staff, to ensure that all changes to the organisation’s data use and privacy policy, as well as changes to the membership list is incorporated into this process.

Through using 3^rd party platforms, user data may be captured by these platforms, but Scottish PEN does not share any data we hold with third parties not highlighted in this policy. This includes but is not limited to partner organisations, funders, supporters or members (apart from their own personal data upon request).

14. Your Rights

Under EU and UK law you have the right to request:

• Access to the personal data we hold about you
• The correction of your personal data when incorrect, out of date or incomplete.
• That we stop using your personal data for direct marketing (either through specific channels, or all channels).

To request or update your information please write to: info@scottishpen.org or Scottish PEN, Writers Museum, Lady Stair’s House, Edinburgh, EH1 2PA

Your Right to Withdraw Consent

Whenever you have given us your consent to use your personal data, you have the right to change your mind at any time and withdraw that consent.

Where We Rely on our Legitimate Interest

In cases where we are processing your personal data on the basis of our legitimate interest, you can ask us to stop for reasons connected to your individual situation. We must then do so unless we believe we have a legitimate overriding reason to continue processing your personal data.

Direct Marketing

You have the right to stop the use of your personal data for direct marketing activity through all channels, or selected channels. We must always comply with your request.

Checking your Identity

To protect the confidentiality of your information, we will ask you to verify your identity before proceeding with any request you make under this Privacy Notice.

If you have authorised a third party to submit a request on your behalf, we will ask them to prove they have your permission to act.

Contacting the Regulator

If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office.

You can contact them by calling 0303 123 1113, or go online to www.ico.org.uk/concerns

15. Questions

We hope this Privacy Notice has been helpful in explaining the way we handle your personal data and your rights to control it.

If you have any questions that haven’t been covered, please contact our staff who will be pleased to help you:

info@scottishpen.org

Scottish PEN

Lady Stair’s House

Edinburgh

EH1 2PA