Pensioners for Independence
This policy document contains important information about your personal rights to privacy, and our legal obligation to you under the General Data Protection Regulation (GDPR). Please read it carefully to understand how Pensioners for Independence(P4INDY) collects, stores, and uses your personal information. It also sets out your options regarding your rights.
You have the right to object to your personal data being processed.
P4INDY is a non-party political community group set up to publicise the case for independence, especially as it concerns pensioners and to provide a focus, direction and coordination as required on common initiatives
We, the P4INDY community, are committed to safeguarding your privacy. We respect any personal data that you share with us and have designed protocols to keep it safe.
What personal data do we collect from you?
Personal data is any information about you which could be used to identify you. To plan and coordinate our campaigning effectively we collect, store, and use the following kinds of personal data:
- Your name.
- Your email address
- The first part of your postcode
- An optional local group you can choose to join
We collect this information to help us communicate with our members. It is up to you to decide what information you would like to give us, and how you would like us to use it.
You may notice that we also use trackers in our email newsletters, for the purpose of improving our communication. These trackers are anonymous.
Do we process sensitive personal information?
GDPR recognises that certain categories of personal information are sensitive and therefore require more protection. This includes information about your health and medical needs, ethnicity, religious and political opinions. P4INDY is a community organisation that campaigns for Scottish independence. Therefore, if you choose to give us your personal data, or choose to campaign with us, there is an assumption that you have some interest in furthering the cause of Scottish independence. However, we are a community with diverse religious and political views.
P4INDY does not collect, store, or use information regarding your religious or political beliefs, or any other type of sensitive personal information. If in the future there was a clear reason for collecting, storing, or using sensitive personal data of this nature, we would do so only with your explicit consent.
How do we get your information?
Personal data is provided to us directly by you. This includes when you sign-up online to our mailing list, or when you complete a physical sign-up card at one of our events, meetings, or on the street.. We are contactable via our email address or Facebook.
When you sign up to our mailing list, either online or on paper, you will be contacted by email to confirm your contact details and opt-into our mailing list (this is called double opt-in).
We do not access your data through any external organisation. We will not pass your data onto any external organisation, unless required to comply with law or to obey a court order.
Why do we need your personal data?
We use your personal data to keep you informed of our campaigning activities, events, and social events. We also collect information to gain a better understanding of you to help us improve our campaign coordination and communications. We will use your personal data to send you information about:
- Our planning activities.
- Our events.
- Our social events and gatherings.
- Our campaigning activities and campaign coordination.
- Other local groups’ events or campaigning activities when the steering group considers it relevant to furthering the cause of Scottish .
We will also use your personal data for administrative purposes, such as:
- To provide you with information that you have requested.
- Handle administration and coordination of Steering Group activities (if you are on the Steering Group).
- Handle the administration of any payment that we are due you (for petty cash expenses relating to campaigning activities), or any donation that you make to us via credit card/ debit card/ cheque/ standing order/ or BACS transfer.
- Collect payment from or to you, and send your statements and/or receipts.
- Deal with enquiries and complaints.
- Audit or administer our accounts.
- Comply with any legal obligations required of us, and to comply with court orders.
How do we coordinate our campaigns?
We are a community of activists and volunteers. Most of our communication occurs through bulk email. However, should you wish to contact us to volunteer to campaign with us then we will ask you if we can pass on your contact details to a Point of Contact (PoC) within your geographic area. If you agree then your PoC and fellow activists in your area will contact you, usually by text or email. However, these are self-organising activist communities and so activist coordination at the street level is done outside of P4INDY. Therefore, if you chose to unsubscribe from our mailing lists your data will be automatically deleted and you will no longer receive emails from P4INDY, but you may still be contacted by your fellow activists. You will need to tell them separately if you do not wish to be contacted by them anymore.
Do we share your personal data with external organisations?
No, we will not share your personal information with any external organisation unless you give us permission to, or we are required by law or to comply with a court order.
Where is my data stored?
We primarily communicate via the bulk email system directly from our website. which is password-protected and hosted on GDPR-compliant hosts Inmotion Hosting.
When campaigning we also communicate with each other via email. Our contact email addresses is firstname.lastname@example.org?subject=membership%20informationWe also use the ‘Slack’ online forum, which members of the P4INDY community will be encouraged to join to contribute to our planning, coordination, and discussions.
We are a self-organising community of individuals. P4INDY is not responsible for communication between you and your fellow campaigners if you choose to share your personal details with them.
How long is my data stored?
In general, unless still required in connection with the purposes for which it was collected and/or process, we will remove your personal information from our records two years after the date it was collected. However, we will remove your personal information before this if (i) you exercise your right of erasure, (ii) we are no longer lawfully entitled to process it, or (iii) your personal information is no longer required in connection to our campaigning objectives (ie, after Scotland formally redeclares itself a sovereign state).
How old do you have to be to consent to your collecting and storing my data?
In Scots law you must be 16 years old to consent to having your data collected, stored and used. We do not knowingly process data of any person under the age of 16. If we discover, or have reason to believe, that you are 15 years old or younger, and we are holding your personal information, we will delete your personal information.
What security arrangements do we have?
We endeavour to ensure that we have appropriate technical and organisational measures to prevent loss, destruction, misuse, alteration, unauthorised disclosure of, or access to, your personal information. Your information is stored on host servers which are GDPR-compliant. Our accounts are protected with robust passwords. Direct access to the database is limited to those who are elected onto the Steering Group. Those who have access to the databases have undergone GDPR-training. We do not share your information to any other external organisation.
What if you want to donate to us, or we owe you money?
Financial transactions are carried out via our bank account or via Paypal. If we owe you money then we use your banking details in order to facilitate a bank transfer. We do not store your banking details after the transaction is complete.
What about law enforcement?
We will disclose your personal information to regulatory and/or government bodies and/or law enforcement agencies upon request and when required to do so to satisfy legal obligations which are binding on us.
Where we rely on consent to collect, store and use your personal data, you have the right to withdraw that consent at any time, and without reason. This includes the right to ask us to stop using your personal data to connect you, or to be unsubscribed from our emailing list at any time. You also have the following rights:
- Right to be informed – you have the right to be told how your personal information will be used. This policy documents and other policy statements used on our websites and in our communications provide you with this information. We seek to be as clear and transparent as possible.
- Right of access – You can access and edit or download your information by using a link included in all our email Newsletters. Or you can write to us to ask for confirmation of what information we hold on you, and to request a copy of that information. To prevent data breaches, we will ask you for a confirmation of your identity unless you are personally known to a member of P4INDY Steering Group. Once you do so, we will provide you with this information within 28 days.
- Right of erasure – you can ask us for your personal information to be deleted from our records. Doing so prevents us from communicating with you.
- Right of rectification – if you believe our records of your personal information are inaccurate, or if your information has changed, you have the right for those records to be corrected and/or updated. You can do this by using the link to your profile included in all our email communictaions or by writing to us.
- Right to object – you have to right to object to your information being processed. To prevent data breaches, we will ask you for a confirmation of your identity unless you are personally known to a member of P4INDY Steering Group. Once you do so, we will provide you with this information within 28 days.
- Right to restrict processing – you have the right to ask for processing of your personal data to be restricted if there is disagreement about its accuracy or legitimate usage.
- Right to data portability – P4INDY does not automate data processing. We can provide your personal information to you in a machine-readable format.
- Right to complain to the Information Commission Office if you believe there is a problem with the way P4INDY handles your data.
For more information on your rights, see here [– https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/]
To exercise these rights, please send us a description of the personal information in question using the details at the bottom of this page, along with your personal identification.
Our lawful basis for processing
We are required to have at least one lawful basis for processing your personal information:
- Personal information is processed on the basis of a person’s consent.
- Personal information is processed on the basis of a contractual relationship.
- Personal information is processed on the basis of legal obligations.
- Personal information is processed on the basis of legitimate interests.
- Consent: we will ask you for your consent to use your information to send you electronic communication such as newsletters, campaign coordination activities, meetings, events, and social events.
- Contractual relationship: Our interactions with subscribers and activists are voluntary and not contractual. However, if your purchase something via our online shop, we will have entered a contractual relationship with each other.
- Legal obligations: We may be obliged to process your personal information due to legal obligations which are binding on us. We will only do so in accordance with legal obligations and/or to fulfil a court order.
- Legitimate interests: Applicable law allows personal information to be collected and used if it reasonably necessary to our legitimate interests (so long as it is fair use, balanced, and does not unduly impact on individuals’ rights). We will rely on this ground to process your personal data when it is not practical to ask for consent.
You can check the personal data we hold about you, and ask us to update it where necessary by emailing us at: email@example.com
Data protection officer
We are not required by law to have a “Data Protection Officer”. However, we have a data protection manager, Iain Black. Please let us know if you have any queries or concerns whatsoever about the way in which your data is being processed by either emailing us at firstname.lastname@example.org