Our Privacy Policy

‘Personal data’ is a legal term that means any information about an individual from which that person can be identified.

We may collect and use different kinds of personal data about you, which we have grouped together in the table below.

It is important that any personal data we hold about you is accurate and current.  Please keep us informed if your personal information changes during your relationship with us, for example if you have a new address or email.

We also collect, use and share Aggregated data, such as statistical or demographic data which is not personal data as it does not directly (or indirectly) reveal your identity.

We only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.   If you ever wanted an explanation about how the processing for the new purpose is compatible with the original purpose, please contact us.

We collect information from and about you in different ways, as summarised in this table.

Under UK data protection law, we must always have a “lawful basis” for collecting and using your personal information. Information about lawful bases is available on the ICO’s website.  Most commonly, we use it where the following lawful bases are available:

Note that we may use your personal data for more than one lawful basis listed in the section above, depending on the specific purpose for which we are using your data. Please contact us if you require further information.

Generally, we do not rely on consent as a legal basis for processing personal data, but we will get consent in some situations.  We would obtain your consent before sending fundraising or marketing communications to you via email for example, and in relation to our use of your image in photographs and video for promoting our work. You have the right to withdraw consent at any time by contacting us.

Where we need to collect personal data, for example to comply with a legal obligation, or to perform the contracts we have entered into, and you do not provide it, we may not be able to provide the services that you expect.  We would contact you to further discuss any situations like that if they occur.

Below is an overview of the main purposes for which we use personal data about different categories of individuals:

We may, as described in this policy, process special category personal data, as defined by law.  This includes personal data about health and welfare for care and education purposes.  It arises also in relation to those involved with our fundraising activities, since for example, we may make a record that a person is in a vulnerable circumstance to comply with requirements under charity law and the Code of Fundraising Practice.

We may also use criminal offence data, as defined by law, which covers a wide range of information about offenders or suspected offenders in the context of criminal activity, allegations, investigations and proceedings.   It includes personal data relating to criminal convictions and offences or related security measures.

We use these sensitive types of personal information to comply with our legal obligations and we always treat it with particular care. It is essential that we have such information: it is used to ensure your welfare, and it is used only when necessary and with absolute respect to individual privacy and confidentiality.

We have in place appropriate safeguards which we are required by law to maintain when processing such data, which we may process in the following circumstances where it is necessary to use that information and the law allows us to do so:

1. To protect your vital interests in the event of a medical or other emergency or to protect your vital interests or those of another individual where you or the other individual is incapable of giving consent.
2. For the provision of health and social care and the management of health and social care services and assessment of service users’ capacities and needs.
3. When it is necessary for reasons of public health including ensuring high quality care standards.
4. The processing is necessary for reasons of substantial public interest.  Those would include, for instance, equality of opportunity or treatment, preventing or detecting unlawful acts, protecting the public, regulatory requirements, supporting individuals with a particular disability or medical condition, counselling, safeguarding of children and individuals at risk, safeguarding of economic well-being of certain individuals, insurance purposes.
5. In the course of our legitimate activities as a not-for-profit organisation in situations where the use relates to those who have regular contact with us in connection with our organisation’s purpose.
6. In relation to legal claims.
7. Where you have already made the information public.
8. For archiving, research and statistical purposes.

Less commonly, we would seek explicit consent from you.  In limited circumstances where we request your explicit consent, we will provide you with full details, explaining the information that we would need to use and the reason for doing so.  This allows you to carefully consider whether you wish to agree. You should be aware that it is not a condition of any contract you have with us that you agree to any request for consent from us.

We are not required to get your consent if we process personal data in accordance with our written policies to carry out our legal obligations or exercise specific legal rights as outlined above.

Automated decision-making is the process of making decisions by automated means without any human involvement.

We do not make decisions about you based solely on automated processing that would have legal, or similarly significant, effects for you. We will notify you if this position changes.

We are committed to using artificial intelligence thoughtfully and responsibly, with the dual aim of helping us work more efficiently while safeguarding ourselves, the children and young people we support and the data we hold from the risks that AI can pose when not used properly. Use of AI will have appropriate human oversight with humans being responsible for making all final decisions on their output.

We use AI tools to enhance efficiency and protect privacy e.g. creating first drafts of summary reports, data analysis, amending images to protect privacy when used in a public space.  

Personal, sensitive and confidential data will only be used within pre-approved AI tools that do not share data outwith our systems.

We love to share with our supporters the progress we are making with the children and young people with whom we work.   We want to share how much your support helps and explain ways you can help in the future, whether that’s through volunteering, events or fundraising. Whatever it is about Harmeny you are interested in, we really want to be as tailored as we can in our communications to you.

If you have supported our work via fundraising, donating or volunteering we may send you updates by post on the impact of your support and the exciting ways you can support us in the future.  We may also contact you by phone unless you are registered with the Telephone Preference Service.

We will only contact with updates via email if you have consented to receive emails from us. Any e-newsletters will also have a link to unsubscribe from future electronic communications, so you can manage your own communication preferences.

You can change how we contact you at any time; it’s quick and easy to opt out of a particular method of communication or let us know that you no longer want to hear from us. To do this please contact our Fundraising team on 0131 449 3938 or email fundraising@harmeny.org.uk

We will respond to your wishes in a sensitive, timely, courteous and professional way.  If you make any changes to your consent, we will update your record without undue delay and at the latest within one month of receipt. It may take up to 60 days for our systems to update and stop any postal communications being sent to you. Email communications will, however, be stopped immediately.

7.1 How we communicate with you

We send the following marketing materials:

a) Updates about Harmeny’s work, including newsletters, e-newsletters and other publications informing you about our work.

b) Appeals and fundraising activities, including requests for donations, information about how you can leave us a gift in your will, how you can raise money on our behalf, attend or take part in a fundraising event, and updates on the impact that your fundraising activities have had on our work. From time to time, we may also send information about appeals, asking for a donation to help continue our work to support children and young people.

c) Events, including details of our challenges, such as fundraising events organised by Harmeny or other sponsored runs and activities. (Please note that if you sign up to a Harmeny event, we will also send you administrative communications about how you can take part. On occasion, we will also send you a reminder about the same event in future years, in case you want to participate in it again).

d) Volunteering, including information about how you can help support Harmeny by giving up your time or using your influence to progress our aims, along with updates on the impact of your volunteering.

Please be assured that we take appropriate measures to keep your personal information safe and secure, and we promise not to contact you excessively.

We use a third-party company, MailChimp, to deliver our updates via email, including our e-newsletter. This allows us to share information efficiently and cost-effectively.  If you receive an email, open it, don’t open it, select a link and/or browse our website, we collect this information via MailChimp to ensure that the information that we send to people is received and relevant.

We may use a third-party supplier to manage mailings for fundraising appeals, processing donations, e-newsletters, conduct research surveys or storage of your personal information on our behalf, and to provide some of our advice and support services to you. You can find out more about the suppliers that we use by getting in touch with us. We actively screen and monitor these companies to maximise the protection of your privacy and security. They are only permitted to use the data in accordance with relevant data protection legislation, under strict instructions from us, and in accordance with a data processing agreement entered into between Harmeny and the supplier.

We never share or sell your personal data to a third-party organisation for its marketing, fundraising or campaigning purposes.

7.2 Administrative communications to supporters

If you tell us that you do not wish to receive marketing or fundraising communications, you may still receive transactional and service-based communications confirming and servicing other relationships you have with us.

Separate to fundraising and marketing communications that you receive from Harmeny, we communicate by post, telephone, and email in relation to administrative and transactional matters.

We will need to continue these communications when you have opted out of marketing communications. For example,

• We will call after you have set up a Direct Debit to confirm your details and upon cancellation.
• There may also be other occasions where we need to contact you about your donation; for example, if there is a problem with a payment, or in relation to your gift aid declaration.
• On occasion, we will also contact you about an event that you have signed up to participate in; for example, to check that online fundraising pages have been set up and to provide any other necessary information.

7.3 Supporter research and analysis

Before accepting or seeking major donations, we are required to conduct a minimum level of due diligence. This is in accordance with our legal and regulatory obligations and our internal risk management policies and procedures.

Separately, we may use profiling and database segmentation techniques to analyse your personal information, and create a profile of your interests, preferences and ability to donate. This also allows us to ensure communications are relevant and timely, to provide an improved experience for our supporters. It can help us understand the background of our supporters so that we can make appropriate requests to those who may be willing and able to donate more than they already do or leave a gift in their will. This enables us to raise funds quicker and in the most cost-effective way.

We will use information that is already in the public domain (information that has been published in print or online) to identify high net worth individuals who may be interested in supporting our work with a major gift.

These publicly available sources of information include Companies House, the electoral register, the phone book, the Charity Commission and Scottish Charity Regulator (OSCR) Register of Charities, Who’s Who, LinkedIn, company annual reports, and articles in newspapers and magazines. We may also use any publicly available data that you share on social media.

We also carry out research to identify existing supporters who may be able to join our major donor programme. This is based both on publicly available information, and information our supporters have given us voluntarily (e.g. where a person lives, who they bank with, what their occupation is and their age). Under data protection legislation, individuals have the right to object to your data being processed in this way. If you wish to opt out of being identified as a high net worth individual, please contact call 0131 449 3938 or email fundraising@harmeny.org.uk

We share data within Harmeny with people who need to see it in order to provide you with services and support.

We also share personal data with other individuals or third parties, including third-party service providers.  We may share it with the local authority that pays for your service, for example, or with external agencies that inspect or are associated with our work. This may arise where sharing required by law, or to protect the vital interests of you or someone else, or where it is necessary to perform our contract and our obligations to you, or where we have another legitimate interest in doing so.  We share personal data in line with our policies.

When we need to share your personal data with third party service providers, we do not allow the service provider to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions and provided they apply appropriate measures of security that comply with our policies and the Data Protection Laws.

“Third parties” may include:

• Local authorities
• Social services or child protection services
• Healthcare providers including, doctors, emergency services and first aid providers and other medical practitioners
• Organisations with whom we need to share information for safeguarding reasons
• Regulatory bodies, external auditors or inspectors, such as the Care Inspectorate HMIE and the HSE – for ensuring compliance and the safety and welfare of service users. This would include the Office of the Scottish Charities Regulator (OSCR), Companies House, and HM Revenue & Customs
• Professional bodies such as the Scottish Social Services Council and the General Teaching Council for Scotland
• Any relevant accreditation body or trade association for the purpose of obtaining and maintaining accreditation standards
• Any organisation or individuals with whom we are legally obliged to share personal information, for example by a court order, such as any law enforcement agency, or other relevant governmental or regulatory authority, Police Scotland, external investigators and/or the Procurator Fiscal, in relation to any suspected or alleged fraudulent or criminal activity
• Governmental and judicial authorities, such as the courts and tribunals in the event of investigation or prosecution of crime or legal claims.
• Credit reference agencies and fraud prevention agencies, in connection with fundraising
• Professional advisers including bankers, accountants, legal advisors, auditors and insurers who provide consultancy, banking, insurance, legal advice and accounting services.
• Researchers, providers of statistical or analytical services – for reviews, planning and assessment (and we will in such cases anonymise all data where possible prior to sharing).
• Service providers who provide services essential for the running of our organisation and provision of service to you. These providers include:
  • IT, including cloud storage providers
  • IT security
  • HR and system administration services
  • Card payment processing
  • Photo storage and editing services
  • Management of mailing and distribution,
  • Fundraising and marketing
  • CRM and database management providers
  • Event organisers e.g. fundraising event providers
  • Document storage and archiving

Sometimes Harmeny is also required to transfer your data to the local authority who have commissioned us to provide your service, or to another organisation providing you with a service. Information can be provided, on request, which will give you more details about what will happen to your data.

There may be occasions when we will ask you for consent to share your data outside of Harmeny: for example, to help us to inform the public about our work. If this is the case, we will explain to you what your data will be used for. You can withdraw your consent at any time, and wherever possible, any of your data that has been used for those purposes will be deleted, unless we have another legal basis to continue processing it.

We have a legal obligation to share data from 1958 to 1995, relating to former pupils placed at Harmeny during this period, as well as documents relating to the running of the school from then, with Save the Children Fund, who ran the school during this period.

When we transfer data to service providers that carry out certain functions on our behalf, it may involve transferring personal data outside the UK to countries which have laws that do not provide the same level of data protection.

We ensure a similar degree of protection is afforded by ensuring that the following safeguards are in place:

• In most cases, we will only transfer your personal data to countries that have been deemed by the UK to provide an adequate level of protection for personal data. For example, we use Microsoft Office 365, a multi-tenant cloud service, for our internal office use. This means that internal documents and information generated by us are stored in cloud services hosted within the European Economic Area (EEA) which the UK government considers to have adequate equivalent protections.
• However, in some limited cases, we may use service providers that process and/or store data outside of the EEA – for example, payment processors such as Stripe, GoCardless and the email marketing service, MailChimp.  In these cases, we will take reasonable steps to ensure that the recipient implements appropriate measures to protect your information, for example, by entering into a contract that includes specific standard contractual terms approved for use in the UK which give similar protections, namely the International Data Transfer Agreement or The International Data Transfer Addendum to the European Commission’s standard contractual clauses for international data transfers.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality. Any disclosures and data sharing will be done in accordance with the law or relevant contractual arrangements. All other third parties are required to take appropriate security measures to protect your personal data. We only permit them to process your personal data for specified purposes and in accordance with our instructions. They are not allowed to use your personal data for their own purposes.

We undertake regular reviews of who has access to information that we hold to ensure that your information is only accessible by appropriately trained staff, volunteers and contractors.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

We will only keep your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements.

We may retain your personal data for a longer period in the event of a complaint, or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.  For example, the length of time may depend on the reasons for which we are processing the data and on the law or regulations that the information falls under, such as Gift Aid processing.

Depending on the nature of the service and our legal obligations, this will normally be for a minimum of six years, but can extend to 100 years for certain types of work. Information can be provided, on request, which will tell you exactly how long we keep your data and why.  Details are in our internal data retention policy.  Contact us for further information if needed.

In some circumstances you can ask us to delete your data: see information about ‘Your rights’ below for more details.

In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

Once the retention period has expired, the information will be confidentially disposed of, permanently deleted, or anonymised.

If you request to receive no further contact from us, we will keep some basic information about you on our suppression list to avoid sending you unwanted materials in the future.

You have rights in relation to your personal data. These include:

a) Right of Access

You have a right to ask for a copy of the information we hold about you. If you spot any mistakes, please let us know and we will correct them.

We will supply any information you ask for, that we hold about you, as soon as possible but this may take up to one calendar month.

You may be asked for proof of identity, for example if the person dealing with your request is not a staff member you have met before. We need to be sure we are only releasing your personal data to you.

If you make a request to access our historical records, we’ll collect information to:

• Check your identity
• Keep a record of all enquiries received
• Help locate the information that you’ve requested
• Monitor our service

If you want to access your information, please send a description of the information you want to see, and proof of your identity by email to: admin@harmeny.org.uk or by post to:

Harmeny Education Trust
Mansfield Road
Balerno
EH14 7JY

We’ll never share your data with any other organisation, unless required by law or where we have another legal basis for doing so, and once we’ve acted upon your request, your identity documents will be securely destroyed.

b) Right to be informed

You have the right to be informed how your personal data will be used. This policy, as well as any additional information that is provided to you at the time that you provided your details, provides you with this information.

c) Right to withdraw consent

Where we process your data based on your consent (for example, to send you marketing texts or emails), you can withdraw that consent at any time. To do this, or to discuss this right further with us, please contact us.

d) Right to object

You also have a right to object to us processing data where we are relying on it being within our legitimate interests to do so (for example, to send you direct marketing by post). To do this, or to discuss this right further with us, please contact us.

e) Right to restrict processing

In certain situations, you have the right to ask for processing of your personal data to be restricted because there is some disagreement about its accuracy or legitimate usage.

f) Right of erasure

In some cases, you have the right to be forgotten (i.e. to have your personal data deleted from our database). This enables you to have information removed where there is no good reason for us continuing to process it.  Where you have requested that we do not send you marketing materials, we will need to keep some limited information to ensure that you are not contacted in the future.  However, we may not always be able to comply with your request for erasure for specific legal reasons which will be explained to you, if applicable, at the time of your request.

g) Right of rectification

If you believe our records are inaccurate, you have the right to ask for those records concerning you to be updated. To update your records, please get in touch with us.

h) Right to data portability

Where we are processing your personal data because you have given us your consent to do so, you have the right to request that the data is transferred from one service provider to another.

If you have any complaints about the way in which we have used your data, please get in touch with us using the details in section 1 above. We would be happy to help and discuss your concerns.  We will respond within 30 days of receipt.  You can view our complaints policy here. 

You are also entitled to make a complaint, if relevant, to the Scottish Fundraising Adjudication Panel.