This statement will tell you in a clear, straightforward way what data Scottish PEN holds about you, how we store and process this data, how we keep it safe, and how you can opt-out at any time.
Scottish PEN values the privacy of its members, partners and supporters very highly and is committed to the responsible use and storage of your data. If you have any further questions, please don’t hesitate to get in touch with us using the details below.
It’s likely that we’ll need to update this Privacy Notice from time to time. We’ll notify you of any significant changes, but you’re welcome to come back and check it whenever you wish.
You can opt-out of Scottish PEN storing or processing your data at any time. We will remind you of this every time we contact you. There are a number of ways to opt out:
The Writers Museum
Lady Stair’s House
Scottish PEN holds your data either with your Explicit Consent – i.e. if you have given us explicit permission to by opting-in to a service – or by assuming Legitimate Interest – i.e. if you have paid for membership, we reasonably assume that you will be interested in being contacted by Scottish PEN so you can realise the value of your membership, such as participation in our campaigns, events and other initiatives, as well as continuing to offer opportunities for promotion and support through the members network.
Scottish PEN may hold your data if you have:
We use your data because we want to give you the best possible experience of Scottish PEN. We do this by keeping our members, supporters and partners informed about our work.
The following sections explain the different services we can provide with your data, and the data we hold about you in each instance.
If you are on our membership database we may hold your:
When you are on our contact list held by MailChimp:
When you’re on our database or mailing list(s) we will use this information to:
As a rule, payment details are not stored locally. Any details that we do retain are stored on our online banking system, which is an encrypted web service that deploys two-factor authentication. Copies are not stored in the office and the web service can only be accessed by Scottish PEN staff and designated trustees. When we receive invoices or receipts from members, staff, partners or supporters, we do retain paper copies for our financial records (as necessary through UK law), these are stored in a locked filing cabinet in the Scottish PEN office, which is a secure space for Scottish PEN.
Membership dues paid through PayPal are stored securely on our PayPal account and we can only access details related to the PayPal accounts used, not the banking details of members. Our PayPal account stores:
If you pay to become a member or make a donation, Scottish PEN will hold the data outlined above and use it for the aforementioned purposes. In addition, Scottish PEN will also:
If you sign up for a ticket for a Scottish PEN event using EventBrite, the platform will ask for and store data related to your involvement. This includes your name and email address, and other details connected to your EventBrite user account. Emails are often sent to event participants, through the EventBrite platform, in the lead up to the event to share event information. These contact lists are retained on the platform and Scottish PEN does not hold on to copies or use them to augment our contact list for other means. Physical copies of guest lists, generated from EventBrite, that are used to monitor attendance are not retained by Scottish PEN and are securely destroyed following the event.
As part of Scottish PEN’s campaigning work we will deploy a range of online tools as part of our campaigning. Tools we have used include, but are not limited to:
These actions are isolated actions and we will not add your details to other contact lists, without asking for your explicit and active consent i.e. being added to our newsletter contact sheet. Data stored for these actions are stored on the campaign action platforms and will only be stored as long as the campaign action is live. All platforms require a password only held by Scottish PEN staff via an end-to-end encrypted password manager to access, as well as using Two-Factor Authentication where supported.
All campaign actions are voluntary and are not required actions for membership or ongoing support of Scottish PEN.
Scottish PEN sometimes takes photographs and videos at its events, which occasionally feature members of our audience. If this applies, you will be made aware that the event will be photographed or videoed through announcements made by people hosting the event or through signs posted in the venue.
Footage will then likely be shared online (Vimeo, Facebook, YouTube, Twitter) and may be used by partners with whom Scottish PEN is working. These partnerships are always announced ahead of the events, so all participants are aware of all active partners involved.
Data not held on 3rd party platforms such as EventBrite or Google Drive, such as the password-protected membership database will be stored securely in the locked Scottish PEN office, with no remote access by staff or trustees.
Your data will not be stored longer than is necessary. If you tell us you no longer wish us to process your data, we will stop immediately.
Through using 3rd party platforms, user data may be captured by these platforms, but Scottish PEN does not share any data we hold with third parties not highlighted in this policy. This includes but is not limited to partner organisations, funders, supporters or members (apart from their own personal data upon request).
Under EU and UK law you have the right to request:
To request or update your information please write to: firstname.lastname@example.org or Scottish PEN, Writers Museum, Lady Stair’s House, Edinburgh, EH1 2PA
Your Right to Withdraw Consent
Whenever you have given us your consent to use your personal data, you have the right to change your mind at any time and withdraw that consent.
Where We Rely on our Legitimate Interest
In cases where we are processing your personal data on the basis of our legitimate interest, you can ask us to stop for reasons connected to your individual situation. We must then do so unless we believe we have a legitimate overriding reason to continue processing your personal data.
You have the right to stop the use of your personal data for direct marketing activity through all channels, or selected channels. We must always comply with your request.
Checking your Identity
To protect the confidentiality of your information, we will ask you to verify your identity before proceeding with any request you make under this Privacy Notice.
If you have authorised a third party to submit a request on your behalf, we will ask them to prove they have your permission to act.
Contacting the Regulator
If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office.
You can contact them by calling 0303 123 1113, or go online to www.ico.org.uk/concerns
We hope this Privacy Notice has been helpful in explaining the way we handle your personal data and your rights to control it.
If you have any questions that haven’t been covered, please contact our staff who will be pleased to help you:
Lady Stair’s House