SCIAF works towards a world in which the rights and dignity of every person are respected. This includes the people we help through our projects around the world, and our staff, local partners, volunteers and supporters in Scotland.
Your privacy and your trust is of utmost importance to us. We’re committed to ensuring we meet the legal requirements of the General Data Protection Regulation (GDPR) and further, we aim to adhere to best practice and provide complete transparency regarding the collection, storage and use of personal data.
These are subject to change and updates due to the continually changing nature of regulations, technology and communications. When changes are made to this statement you will find the latest version here on our website.
SCIAF Privacy Statement
How do SCIAF collect personal information?
We may collect information about you directly whenever you interact with us. For example, when you contact SCIAF regarding our activities, register as a supporter or volunteer, send or receive information, register for an event, sign up to volunteer or request a visit to your school or parish, take a campaign action, engage with our social media or make a donation to us, you may provide us with your personal information.
We may also receive information about you when you interact with third parties with whom we work. For example, where you’ve made a donation to us through a third-party website (e.g., Just Giving or Virgin Money Giving) and given them permission to share your information with us.
We may supplement what we know about you with information that is available to the public. For example, in order to ensure that our communication with you is relevant and tailored to your background and interests, we may collect information about you from publicly-available sources either directly or through third-party subscription services or service providers. See 'How will we combine and analyse the information we collect about you?'
Each time we ask you to provide personal information we’ll also ask you whether and how you’d like us to contact you in future.
Likewise when working overseas, we will ask for consent from our programme participants to collect personal information. It is collected for the purposes of monitoring and measuring the programme impact at a personal and community level. On some occasions this may also be required by grant funders.
We’ll only ever use personal information where it’s been given knowingly and willingly and for specific purposes.
What personal information does SCIAF collect and store?
The information we collect from you directly or from third parties with whom we work, may include:
•bank account details
And where appropriate
•credit card details for processing credit card payments,
•employer details for processing a payroll gift,
•taxpayer status for claiming Gift Aid, and
•date of birth,(e.g., where registering for an event, such as a fun run).
We may also collect and process information about your interactions with us, including details about our contacts with you through email, post, on the phone or in person (i.e., the date, time, and method of contact), details about donations you make to us, events or activities that you register for or attend, campaign postcards and petitions signed, and any other support you provide to us. We may also collect and record any other relevant information you share with us about yourself, including your interests or your affiliations with community groups.
Where your donations have been received via your parish we will record the parish you’ve donated through – this enables us to thank the parish for the full amount they raised as well as keep accurate individual supporter records on donations and be able to claim Gift Aid, where applicable.
In order to ensure that our communication with you is relevant and tailored to your background and interests, we may supplement what we know about you with information that is available to the public. This allows us to better understand your interests, preferences, and level of potential engagement and/or donation, so that we can contact you in the most appropriate way. The information we collect and process about you from publicly-available sources may include demographic and electoral constituency information associated with your postcode. We may collect this information ourselves or through third-party service providers.
Where we have identified that you may have the capacity or affinity to support SCIAF at a higher level, we may use the information we hold about you to identify connections between you and our existing supporters. With your consent we may also review other information about you that is available to the public through internet searches, subscription services, or public databases (e.g., Companies House, the electoral register, or the land registry), such as information about corporate directorships, shareholdings, published biographic information, employment and earnings, philanthropic interests and networks, charitable giving history and motivations and relevant media coverage, so that we can engage with you in a more personalised way. We will not use third parties to complete wealth screening.
Where we are communicating with you due to a position you hold, such as parish priest or school teacher, we’ll record information about this role, such as the address or your parish or school.
Programme participant personal information may include (but is not limited to) their image, video footage and information about name, age, gender, family, education, health status and occupation. It is collected for the purposes of monitoring and measuring the programme impact at a personal and community level. On some occasions this may also be required by grant funders.
The types of personal information we collect and store are regularly reviewed to ensure that there is a clear purpose why it is required, that it is kept to a minimum, that is it accurate and that our data processing activity is clearly communicated.
Does SCIAF process ‘sensitive’ personal information?
Under data protection law, certain categories of personal information are recognised as sensitive, including health information and information regarding race, religious beliefs, and political opinions (‘sensitive personal data’). In limited cases, we may collect sensitive personal data about you. We would only collect sensitive personal data if there is a clear reason for doing so, such as where we need this information to ensure that we provide appropriate facilities or support to enable you to participate. If you register for an event, for example our fun run, we will ask for details of emergency contact and any medical conditions we may need to know about. This is so that we can provide swift assistance with emergency services on the day of the event if needed. These details remain confidential at all times and will be destroyed immediately after the event.
Programme participants data may include health details for the purposes of supplying a service as well as monitoring this going forward in order to be able to report the programme impacts.
How does SCIAF store personal information and keep it safe?
We take appropriate physical, electronic and managerial measures to ensure that we keep your information secure, accurate and up to date, and that we only keep it as long as is reasonable and necessary.
Although we use appropriate security measures once we have received your personal information, the transmission of information over the internet is never completely secure. We do our best to protect personal information, but we cannot guarantee the security of information transmitted to our website, so any transmission is at the user’s own risk. However, any payment card details (such as credit or debit cards) we receive on our website are processed securely by our payment provider according to the Payment Card Industry Security Standards.
For financial and technical reasons, we may, on occasion, need to use the services of a service provider outside the European Economic Area (EEA) – this may include a country which does not have the same level of data protection as in the United Kingdom. However, unless they are located in a country which has been assessed by the European Commission as ensuring an adequate level of protection for personal data, we will only use a service provider outside the EEA on the basis of an agreement with the service provider, designed to protect your data, in the appropriate form approved for this purpose by the European Commission. We will take all steps reasonably necessary to ensure that your data is processed securely and in accordance with this Privacy Statement.
Supporter data is entered and stored within a secure, encrypted, cloud-hosted database, compliant with legal, industry standards and best practice. Our Retention Policy ensures we do not keep personal information for any longer than absolutely necessary.
Access to personal information is restricted to staff and volunteers at SCIAF to who require the information to perform specific functions of their role. We protect your data from loss, misuse, unauthorised access or disclosure, alteration or destruction with policies and procedures which are continually reviewed and audited to keep in line with best practice and legal requirements.
Personal information on programme participants is collected, stored, processed, archived and destroyed securely and in line with policies and procedures. Where trusted overseas partners are doing this on our behalf, they are aware of their responsibilities, both to SCIAF and to the programme participants they work alongside.
How does SCIAF use personal information it stores?
We may use your information in a number of ways, including:
•To provide you with information about our work or our activities and the impact your support has;
•To process and acknowledge donations we may receive from you;
•To fundraise in accordance with our internal policies and procedures;
•For administrative purposes (for example, we may contact you regarding an event for which you have registered, to provide information requested from us, or with a query regarding a donation you may have made to us);
•For internal record keeping relating to any donations, feedback, or complaints;
•To invite you to participate in voluntary surveys or research;
•To contact you where you have been identified as a contact person for an organisation, such as a school, with your consent;
•To analyse and improve the content and operation of our website;
•To analyse and improve our internal business processes;
•To analyse the personal information we collect about you and use publicly available information to better understand your interests, preferences and level of potential donations so that we can contact you in the most appropriate way;
•To tailor advertising that is presented to you on the Internet according to your interests, preferences and other characteristics (as described below);
•To direct advertisements and other communications to other people who may have similar interests or other characteristics to yours (as described below); and
•Where we are required by law or financial regulations to disclose or otherwise use your information.
We primarily use personal information to keep in contact with you. We’ll use your address and email to send you information about our latest campaign news, fundraising appeals and to tell you about other ways you can get involved. We’ll always respect your stated preference for whether, and how, we can contact you. We will use information for the purpose it has been given to us.
We use personal information in these ways in order to ensure we’re building the best possible relationship with our supporters, and to promote SCIAF’s work as efficiently as possible, keeping costs to a minimum.
Personal information about programme participants will be used to monitor and measure the programme impact at a personal and community level. It could be used to inform the training, support, advice or materials given to the individual or community through the programme. It may also be used to contribute insight into trends on a regional or country level or help share learning on best development practices, and this information will be anonymised wherever possible.
How will we combine and analyse the information we collect about you?
In our Supporter Care Promise, we have committed to communicating with you using an approach that is right for you. This means that we carefully manage the communications we send you to ensure that we are contacting you in the most appropriate way and that we are not sending you unwanted communications. In order to do this, we may combine the information that we collect about you and analyse what we know about your interests, preferences and level of potential engagement or donation. We may also use statistical analysis to analyse this data and understand the likelihood that you will be interested in or responsive to a campaign or message. We may use third party service providers to assist us in this process.
You can opt out of your data being combined and analysed for marketing purposes by contacting us. However, this may mean that you stop receiving marketing communications from us more generally.
Who is my information shared with?
We’ll always keep your details secure and never sell or give them away to anyone.
If you have fundraised for us and you are willing to share your story and a photo, we would love to share this to motivate and inspire others. We will always ask for your consent before we share it and you are free to change your mind at any point.
There are some circumstances where your data will be shared with agencies outside SCIAF who are working on our behalf, or helping us to market and communicate our work. Agencies working on our behalf (such as mailing houses who print and send our campaign and appeal letters) do so under strict agreements regarding the security and confidentiality of your data.
Some highly beneficial schemes such as Gift Aid require us to pass some of your personal data to the UK Government in order to claim. UK Aid Match also involves sharing some data with the UK Governments but this is anonymised and for example may include the total value of donations, or number of donors by postcode region.
Sometimes we work in partnership or coalition with other organisations to achieve our charitable aims more effectively. We will always be clear before we share or pass your information to others. For example if you sign a campaign postcard this may be passed to your MP or First Minister and this will be stated on the form.
In addition to our supporter database, your personal information may be loaded into other software such as email software, or digital tools which allow us to show you adverts and news about SCIAF while you’re online or using social media.
Where you have agreed to receive emails from us, we may provide your email address or mobile phone number in an encrypted format to social media companies, such as Facebook, Instagram, Twitter or YouTube, or to digital advertising networks that are providing services to us by displaying our advertising to you on those social media platforms and other websites, as well as identifying audiences with interests similar to yours. You can opt out of your data being used to display advertising to you by contacting us. However, this will not prevent our advertisements being shown to you on a randomised basis or based on cookie data and may mean that you stop receiving marketing communications from us more generally.
When you make a donation through our website, or complete an online form your data is processed and temporarily held on third party servers until it’s added to our database. We design all our processes and select our third party tools carefully to ensure your data is secure.
When passing personal information to any agency or using your data with any 3rd party tools security and confidentiality will always be paramount, and we’ll take every precaution to encrypt and protect your data while it’s transferred to a third party.
In any circumstances where we are required by law to pass your information to a third party we must do so.
Programme participant data may be shared with trusted programme partners running similar programmes or thematic work to share and implement learning. This data will always be anonymised and transferred securely.
How can I find out what personal information SCIAF holds about me?
We’re always striving to keep your personal information up to date and accurate and we’re happy to provide a copy of the personal information we currently hold about you. To start this process please contact us
If I am under 18, can I provide personal information to SCIAF?
Yes, if you donate, fundraise or take part in one of our campaigns we will ask for your personal information regardless of your age. Children under 18 should to check with a parent or guardian before providing personal information. We will take your age into consideration when deciding what subsequent communications we send to you and how we talk to you about our work.
When seeking to take a photograph of, or including, a child (under 18years), clear Verbal Informed Consent of the parent, guardian or responsible party is required. Where it is not possible to get the parental, guardian or responsible party’s consent, images and case studies will not be recorded.
We would always ensure we have informed consent from a parent or guardian before collecting personal information or capturing photographs, video footage and case studies from under 18 programme participants.
SCIAF adhere to the Scottish Catholics Safeguarding standards and you can also download SCIAF’s own safeguarding policy.
How can I opt-out of communication from SCIAF, or change how I’m contacted?
To tell us whether, and how, you’d like to be contacted or to update your contact details/preferences please complete our online form.
If you have specific preferences about how often you’d like to hear from us or which areas of our work you’re interested in please contact us.
When you change your preferences for how we should contact you, there is a possibility you may still receive one more letter or email from SCIAF as we prepare these communications two or three weeks in advance of you receiving them. We will maintain your details on a suppression list to help ensure that we do not continue to contact you for marketing purposes. However, we may still need to contact you for administrative purposes, including (but not limited to):
- Processing a donation you have made and any related Gift Aid;
- Processing a regular donations made by direct debit;
- Providing you with the information you need in order to participate in an activity or event for which you have registered (e.g., fun run); and
- Explaining and apologising where we have made a mistake.
Similarly, if your contact details have changed or you think any information we have about you is incorrect or incomplete, you can always update or correct the information we hold about you by contacting us.
A family member or loved one has passed away. How do I notify SCIAF?
Please contact us with the details of your family member or loved one and we will make the necessary changes to our records. We remember SCIAF supporters who have passed away at an annual remembrance mass in November.
How will you use my picture on the SCIAF website or in printed material?
We’ll always ask for your consent when taking your picture to use in SCIAF material, on our website or on our social media channels. We’ll never take pictures of people who say they don’t want to be photographed or filmed, or wish to remain anonymous.
When taking a photo of a larger group (10 or more people) we may seek consent from the group more generally than asking every individual in the group for their consent.
Before we collect the image or story of a programme participant we will always ask for permission and this will only be shared following informed consent, which can be withdrawn at any time. The image and story of programme participants is an essential element of our work to educate people in Scotland on the lives and communities with which we work overseas and to motivate our supporters to unite with us to end poverty. We will always make the safety and care of our programme participants a priority, changing the original name or not giving specific location details to protect vulnerable adults and children when necessary.
SCIAF has a comprehensive Photography, Video and Case Study Policy in place to ensure that the rights and dignities of people here and overseas are respected at all times. Please contact us if you have any further questions about this.
Job and volunteer applicants and current and former employees
If you apply to work at SCIAF, we will only use the information you give us to process your application and to monitor recruitment statistics. If we want to disclose information to someone outside SCIAF - for example, if we need a reference, - we will make sure we tell you beforehand, unless we are required to disclose this information by law.
When recruiting for a post based in another country, SCIAF will sometimes need to transfer your personal information to that country to progress the recruitment. It may be that that country does not provide the same level of data protection as in the European Economic Area.
If you are unsuccessful in your job application, we will hold your personal information for 6 months after we’ve finished recruiting the post you applied for. After this date we will destroy or delete your information.
If you begin employment with us, we will put together a file about your employment. We keep the information in this file secure, and will only use it for matters that apply directly to your employment.
Once you stop working for us, we will keep this file according to our record retention guidelines. You can contact us to find out more about this.
If you apply for a job or volunteering opportunity we will also collect information so we can assess your suitability for the role.
Please contact us if you’d like further information on this.
We cannot be held responsible for the privacy of data collected by websites not owned or managed by SCIAF, including those linked through our website.
Emails aren’t always secure, and they may be intercepted or changed after they’ve been sent. SCIAF doesn’t accept liability if this happens. The contents of emails reflect their author's views and not necessarily those of SCIAF.
Please do not send SCIAF any financial data through email.
The information in emails is confidential, so if you’ve received one by mistake, please delete it without copying, using, or telling anyone about its contents.
Although not through cookies, we do measure the success of the emails we send – so we know what subject lines and stories people liked the most. We use this information to inform and improve our communications and we do not share this information with others.
What are cookies?
Cookies are text files containing small amounts of information which are downloaded to your device when you visit a website. Cookies are then sent back to the originating website on each subsequent visit, or to another website that recognises that cookie. Cookies are useful because they allow a website to recognise a user’s device and to target the content displayed to the user’s interests.
You can find more information about cookies at: www.allaboutcookies.org and www.youronlinechoices.eu for a video about cookies visit www.google.co.uk/goodtoknow/data-on-the-web/cookies
Yes. When you arrive on the SCIAF website, if you haven’t already given a preference, we will ask you to accept or decline cookies. If you accept cookies we will apply all cookies. If you decline cookies please be aware that this will stop all but strictly necessary cookies (see category 1 below).
What information do we collect using cookies?
We may collect some, or all, of the information available from cookies when you visit our website, depending on how you use it. We monitor how people use our website so we can improve it. We collect this information anonymously.
However, you can choose to use our website anonymously without giving us any information. Please see ‘Changing your cookie preferences’ below.
- the areas of the website you visit;
- the amount of time you spend on the site;
- whether you are new to the site, or have visited it before;
- the country, region, city and/or borough associated with your IP address or device;
- how you came to our website – for example, through an email link or a search engine;
- the type of device and browser you use;
- how you interact with our donation and sign up forms – for example what you select as your communication preferences; and
- any error messages that you receive on the site
Categories of cookies we use
1 ) Strictly necessary cookies
These cookies are essential for the user to move around the website and to use its features, e.g. donating.
_sciaf_session Used to identify a user, distinguishing them from other visitors currently on the site. This cookie is required to help users navigate the site, and allow browser features such as Back and Forward buttons to function correctly. This is a session cookie that lasts until the browsing session ends.
sciaf_cookies_consent Used to store a user’s cookies preference. This cookie is stored for two years.
clear Cart Used for processing your online donation. This cookie lasts 1 week.
deliveryAddress Used for processing your online donation. This is a session cookie that lasts until the browsing session ends.
oldHeading Used for processing your online donation. This is a session cookie that lasts until the browsing session ends.
ASP.NET_SessionId Used to maintain an anonymised user session by the server. This is a session cookie that lasts until the browsing session ends.
NSC_* Associated with the Netscaler load balancing service from Citrix. The cookie is used to ensure traffic and user data is routed to the correct locations where a site is hosted on multiple servers, so that the end user has a consistent experience. This is a session cookie that lasts until the browsing session ends.
NID The NID cookie contains a unique ID that Google uses to remember your preferences and other information, such as your preferred language (e.g. English), how many search results you wish to have shown per page (e.g. 10 or 20) and whether or not you wish to have Google’s SafeSearch filter turned on. This cookie lasts 6 months.
2) Performance cookies
These cookies collect information about how the user makes use of the site, e.g. which pages the user visits most. These cookies do not collect information that identifies the user.
_ga Used to collect information about how visitors use our website. We use the information to compile reports and to help us improve the website. This cookie lasts 2 years.
_gat_UA-2313047-1 Used to collect information about how visitors use our website. We use the information to compile reports and to help us improve the website. The cookies collect information in an anonymous form, including the number of visitors to the website and blog, where visitors have come to the website from and the pages they visited. This cookie lasts 24 hrs.
_gid Used to collect information about how visitors use our website. We use the information to compile reports and to help us improve the website. The cookies collect information in an anonymous form, including the number of visitors to the website and blog, where visitors have come to the website from and the pages they visited. This cookie lasts for 24 hours.
VISITOR_INFO1_LIVE A cookie that YouTube sets that measures your bandwidth to determine whether you get the new player interface or the old. This cookie lasts 8 months.
3) Functionality cookies
These cookies remember choices made by or attributes of the user and enhance the features and content you experience during your visit to our website, e.g. language, appeals visited or user’s location. This cookie is also used to remember a user's preferences for a font size, or customisable parts of a web page.
PREF This YouTube cookie stores your preferences and other information, in particular preferred language, how many search results you wish to be shown on your page, and whether or not you wish to have Google’s SafeSearch filter turned on. This cookie lasts 8 months.
YSC Registers a unique ID to keep statistics of what videos from YouTube the user has seen. This is a session cookie that lasts until the browsing session ends.
4) Targeting or advertising cookies:
These cookies collect information about the users' browsing habits. This may also include your use of social media sites, e.g. Facebook, etc. or how you interact with our website which then shows you relevant content elsewhere on the internet. NB. These may also be used to choose the advertisements that are displayed to you on our website and other websites.
GPS A YouTube cookie that registers a unique ID on mobile devices to enable tracking based on geographical GPS location. This cookie lasts 1 hour.
Changing your cookie preferences
The "Help" menu in the toolbar of most web browsers will tell you how to change your browser's cookie settings, including how to have the browser notify you when you receive a new cookie, and how to disable cookies altogether.
By clicking the links below you can also decline our cookies used for analytical reporting, but cookies which are necessary for the website to function, and third party cookies necessary to complete processes you’ve specifically requested will still be used.
When you use these links you will be taken to our homepage and your updated cookies preference will be used.
Accept cookies: www.sciaf.org.uk/cookies-accepted
Decline cookies: www.sciaf.org.uk/cookies-declined
Anne Karlin, Supporter Services Manager
19 Park Circus,
0141 354 5522
Last updated: July 2018