This privacy notice sets out how Zero Waste Scotland (company number SC436030) uses and protects your personal information, including data from your use of our website.
Zero Waste Scotland is the Data Controller for personal data about individual, corporate and community stakeholders, service users, event attendees, grant applicants, staff and newsletter subscribers. For the purpose of this document we will use the group term ‘associates’ to describe any one of these groups. Our ICO registration number is ZA054695.
Data processing is any activity that involves the use of personal data. It includes obtaining, recording or holding the data, or carrying out any operation or set of operations on the data including organising, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transmitting or transferring personal data to third parties.
Personal data is any information identifying a data subject (a living person to whom the data relates). It includes information relating to a data subject that can be identified (directly or indirectly) from that data alone or in combination with other identifiers Zero Waste Scotland possesses or can reasonably access. Personal data can be factual (for example, a name, email address, location or date of birth) or an opinion about that person’s actions or behaviour.
How we process your personal information
We do not trade personal data for commercial purposes and will only disclose it if required by law, if it is necessary to arrange a service you have asked us for, or if it is with your consent. Zero Waste Scotland uses providers (processors) based in the European Economic Area to process associate data, except where specified.
Information you give to us
This is information about you that you give us by filling in forms on our site or by corresponding with us by phone, email or otherwise. It includes information you provide when you:
- Use our site
- Subscribe to any services offered by us or register for our events
- Register to receive downloadable information, newsletters or other information
- Send us a request to contact you or when you report a problem with our site(s).
- The information you give us may include your name, position, and employer details, number of staff in your organisation, address & post code, email address and phone number.
We will use this information...
- to send you the information you have requested;
- to inform our marketing and sales activities, including market mapping, client and prospect mapping and analysis;
- to provide you with news and information which we think may be of interest to you and with information about our products and services. If you no longer wish us to use your data in this way, please let us know by clicking the unsubscribe button on our e-mail communications;
- to ensure that content from our site is presented in the most effective manner for you and for your computer.
Information we collect about you
With regard to each of your visits to our site we will automatically collect the following information:
- Technical information, including the Internet Protocol (IP) address used to connect your computer to the Internet, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform;
- Information about your visit, including items you viewed or searched for, page response times, length of visits to certain pages.
We will use this information...
- to administer our site so that it works well when you visit and we may also ask you for your opinion to help us do that, and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;
- to improve our site to ensure that content is presented in the most effective manner for you and for your computer;
- to allow you to participate in interactive features of our services, when you choose to do so; and
- as part of our efforts to keep our site secure.
Information we receive from other sources
This is the information we receive about you:
- If you create an account via our Zero Waste Scotland website or associated programme websites or web tools, delivered by Zero Waste Scotland.
- From our third party service providers (including, for example, sub-contractors in technical and delivery services, analytics providers, search information providers).
Legal basis for processing your information
We process your personal information lawfully and fairly in accordance with data protection laws. We may process your personal information where:
- it is necessary for performing our functions and providing services to you;
- you have consented to our processing of your personal information;
- we have a legal obligation to do so; or
- we have a legitimate interest to do so, for example on a business sale or for fraud prevention purposes.
Sharing your information
We may disclose your personal information to third parties, including:
- the Scottish Government, UK and devolved Governments, governmental agencies and the European Union institutions for the purpose of disclosing how we spend money in respect of grants and other funding received from any of these bodies or institutions;
- analytics and search engine providers, that assist us in the improvement and optimisation of our site;
- our professional advisers and services providers;
- If Zero Waste Scotland or substantially all of its assets are acquired by a third party, in which case personal data held by us about you will be one of the transferred assets; and/or
- If we are under a duty to disclose or share your personal information in order to comply with any legal obligation or in order to enforce or apply our website Terms & Conditions. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.
- With our partner organisations such as SEPA, Scottish Enterprise, Highlands and Islands Enterprise; Business Gateway(s), Energy Savings Trust (list is not exhaustive) with whom we work collaboratively to bring you services and information you have requested – in all circumstances this will be made clear at the time of collecting your data.
While we are not currently subject to the requirements of the Freedom of Information (Scotland) Act 2002 and the Environmental Information (Scotland) Regulations 2004, we may (in our sole discretion) choose to adhere to the principles of this legislation in respect of the disclosure of information.
Where we store your personal data
All information you provide to us is stored in our databases on a secure server located within the EEA (European Economic Area). These are cloud services hosted for us by Microsoft.
Your data may be processed by staff operating outside European Economic Area (EEA) who work for us or for one of our suppliers. This includes staff engaged in, among other things, providing the information you have requested, marketing activities and the provision of support services. We will only transfer your data outside of the EEA provided appropriate or suitable safeguards are in place to protect your data, these being either Standard Contractual Clauses or, in the case of transfers to the US, a Privacy Shield certification. Please contact us if you would like a copy of the appropriate safeguards. By submitting your personal data, you agree to this transfer.
Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.
Retention of your personal data
We will only keep your personal data within the timeframes allowed by law and for so long as is necessary to comply with our legal obligations.
Your rights under the GDPR
Access to personal information -
Access to personal information - Individuals who are the subject of personal data held by Zero Waste Scotland LTD are entitled to:
- Ask what information the company holds about them and why
- Ask how to gain access to it
- Be informed how to keep it up to date
- Be informed how the company is meeting its data protection obligations
If an individual contacts the company requesting this information, this is called a subject access request or SAR. To assist us in dealing with your request to access your information, please complete this form or contact email@example.com - Zero Waste Scotland LTD.
We will respond to Subject Access Requests within one month as is the requirement under GDPR. We will always verify the identity of anyone making a subject access request before handing over any information
Correcting personal information – Individuals may ask us to correct any personal information about them that is inaccurate, incomplete or out of date.
Deletion of personal information – Individuals have the right to ask us to delete personal information about them where:
- They consider that we no longer require the information for the purposes for which it was obtained
- We are using that information with their consent and that consent has been withdrawn – see Withdrawing consent to using your information below
- They have validly objected to our use of their personal information – see Objecting to how we may use personal information below
- Our use of your personal information is contrary to law or our other legal obligations.
Objecting to how we may use personal information – Individuals have the right at any time to require us to stop using their personal information for direct marketing purposes. In addition, where we use personal information of an individual to perform tasks carried out in the public interest then, if the individual asks us to, we will stop using that personal information unless there are overriding legitimate grounds to continue.
Restricting how we may use personal information – in some cases, individuals may ask us to restrict how we use their personal information. This right might apply, for example, where we are checking the accuracy of personal information that we hold or assessing the validity of any objection made by an individual to our use of their information. The right might also apply where there is no longer a basis for using an individual's personal information but they don't want us to delete the data. Where this right is validly exercised, we may only use the relevant personal information with the individual's consent, for legal claims or where there are other public interest grounds to do so.
Automated processing – if we use personal information on an automated basis to make decisions which significantly affect an individual, that individual has the right to ask that the decision be reviewed by an individual within our organisation to whom representations may be made concerning the decision or to contest it. This right only applies where we use information with the individual's consent or as part of a contractual relationship with the individual.
Withdrawing consent to using personal information – Where we use personal information with individual consent the individual may withdraw that consent at any time and we will stop using that personal information for the purpose(s) for which consent was given.
For queries as to whether the GDPR applies to the processing of your personal information or, if the GDPR does apply, and you wish to exercise any of these rights then please contact us - see Contact information and further advice below.
Changes to our privacy statement
We keep this privacy statement under regular review and will place any updates on this website. Paper copies of the privacy statement may also be obtained from the Data Protection Officer at the address below or requested via email: firstname.lastname@example.org.
This policy was updated in July 2020.
We seek to resolve directly all complaints about how we handle personal information but you also have the right to lodge a complaint with the ICO (Information Commissioner’s Office) who are the regulators of data protection laws in the UK. They can be contacted via the ICO website or by post:
The Information Commissioner's Office - Scotland
45 Melville Street
Telephone: 0303 123 1115
Read more about the personal data we process and store:
If you subscribe to any of our mailing lists or join our industry specific networks, you will automatically be subscribed to receive email updates. You will only receive information that you have opted in to receive.
- Depending on your preferences, we will contact you for the following reasons:
- Funding and support opportunities of relevance to you
- Opportunities to take part in market research
- Zero Waste Scotland campaigns and events about the following core programme of our work: Resource Efficiency, The Circular Economy and Resource Management
We use Microsoft Dynamics 365 and Click Dimensions to manage our customer relationship and email marketing activity. These are cloud based services which share data with third parties (sub-processors) in order to provide these services to Zero Waste Scotland. Microsoft Azure Data Centres located within the EU store and process your information and as such are deemed to be sub processors who contractually commit to the requirements of the General Data Protection Regulation (GDPR). Click Dimensions will only store your email address in their EU data center which is hosted in Microsoft Azure’s EU data center in the Netherlands in order to provide the email messaging you have opted to receive from Zero Waste Scotland.
Your personal information is never sold on by Microsoft or Click Dimensions or used for any purposes other than to provide us with these services.
You can change your email marketing preferences at any time, by clicking ‘unsubscribe’ or ‘manage preferences’ on any of our emails or by emailing your removal request to: email@example.com
If you take part in a survey on behalf of Zero Waste Scotland you may be asked to complete a web based form; a telephone survey or to send your response by e-mail. Because research is a large part of why we conduct surveys, we may use a third party processor to undertake these activities and as such we will always ensure that your information is protected under the required data protection laws by binding our processors contractually to these regulations. Many of the web-based surveys we conduct will use Click Dimensions, Survey Monkey or Smart Survey but in ALL cases, the information you provide to us or our appointed contractors will only be used for the purposes identified at the time. Additionally, you are always at liberty to not take part or to take part anonymously. We will only re-contact you following a survey if you have expressed consent and only for the purposes provided at the time.
If you prefer to submit responses to these surveys in another format, please contact firstname.lastname@example.org.
'Contact us’ web form users
If you get in touch with us via the contact form on our website or via any of the associated programme websites, we will save the details you share with us on our database. This way, if you get in touch with you in future we can refer to our previous conversations. We will not contact you or share your details unless it is necessary in order to provide you with the information or service you have requested from us.
What is a cookie?
When you land on a site your computer will automatically be issued with a cookie. Cookies are text files that identify your computer to our server. Cookies in themselves do not identify the individual user, just the computer used. Many sites do this whenever a user visits their site in order to track traffic flows. Cookies themselves only record those areas of the site that have been visited by the computer in question, and for how long. Users have the opportunity to set their computers to accept all cookies, to notify them when a cookie is issued, or not to receive cookies at any time. The last of these, of course, means that certain personalised services cannot then be provided to that user.
Any information that is supplied by cookies can help us to provide you with a better service and assists us to analyse the profile of our visitors. For example: if on a previous visit you went to, say, the User pages, then we might find this out from your cookie and highlight relevant information on a second visit. We use both first-party and third-party cookies to help us maximise the user experience and to help us target our online adverts more effectively.
- Necessary cookies - These are cookies that are required for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website.
- Re-Marketing cookies - These cookies record your visit to our website, the pages you have visited and the links you have followed. We will use this information to make our website and the advertising displayed on it more relevant to your interests. We may also share this information with third parties for this purpose. For more information about how targeted advertising works, you can visit the Network Advertising Initiative’s (“NAI”) educational page at http://www.networkadvertising.org/understanding-online-advertising/how-does-it-work.
We use Google AdWords to advertise Zero Waste Scotland across the Internet, in particular on the Google Display Network. AdWords remarketing will display ads to you based on what parts of the Zero Waste Scotland website you have viewed by placing a cookie on your web browser. The cookie is used to indicate to other websites that “This person visited a particular page, so show them ads relating to that page.” This cookie does not in any way identify you or give access to your computer or mobile device.
If you do not wish to see ads from Zero Waste Scotland you can opt-out in several ways:
- Use the Cookie Control settings on our website pages to turn off Targeting cookies.
We use the Facebook Pixel on our websites to record information from HTTP headers and Button Click data - we do not use it to record any personally identifiable information such as name or email address. If a visitor to our website interacts, by sharing/commenting on a public post or by watching a video then data about that action is collected. We use this data to show adverts on the social media platform to those who have previously visited our web site. For more information about the Facebook Pixel please visit: https://www.facebook.com/about/privacy/update.
How to Control the Cookies Zero Waste Scotland uses
When you first visit our web site you will be presented with the option to permit cookies or to set your preferences for which cookies our website uses. You are also able to change these settings at any time during your visit and subsequent visits. You can opt out of the collection and use of your information for ad targeting by setting your preferences through the Cookie Control icon on our website.
Additionally, you can access mechanisms for changing your online advertising preferences here: www.youronlinechoices.eu and www.aboutads.info/choices. You can also set your targeted advertising preferences from within whichever service is being used:
- FACEBOOK - https://www.facebook.com/settings/?tab=ads
- GOOGLE - https://www.google.com/settings/ads/anonymous
- BING - https://advertise.bingads.microsoft.com/en-us/resources/policies/personalized-ads
Users under 16
If you are under 16, please get your parent/guardian's permission beforehand whenever you provide personal information to Zero Waste Scotland's website. Users without this consent are not allowed to provide us with personal information
If you would like more detail about the methods used, however, please get in touch at email@example.com.
Social Media users
You may come across Zero Waste Scotland naturally on Facebook, LinkedIn & Twitter through your own networks, or you may be presented with an ad from us. We target adverts at audiences that look like they have an interest in our programmes. We do this to inform, educate and engage new potential associates.
Under the definitions in the General Data Protection Regulation ((EU) 2016/679) (“GDPR”), Zero Waste Scotland is the Data Controller for information we process from you to engage with you as a stakeholder. Should you decide to engage in one of our webinars, you will need to sign up to a third-party vendor service, and for your use of their service, the vendor will be the data controller. We use GoToWebinar and Zoom for our online events and their privacy information can be accessed by clicking on the links provided above.
When you attend an event co-ordinated by or on behalf of Zero Waste Scotland, we will need your name, email address and often the name and address of the business you represent. We will use this information for the purpose of administering your attendance to the event. Following your participation in some events organised by Zero Waste Scotland, we may use the contact details to share any relevant content from the event, to reply to questions asked at the event and for your views on the event as part of our monitoring and evaluation work.
Additionally, our events may be recorded using recording capabilities for on-line events or video/photographic equipment at in-person events. We may use footage from these recordings to promote our work via our website and marketing channels. For online events, if you do not wish to be recorded you should mute your microphone and turn off your webcam. If you do ask any questions via the chat facility your name will be visible and may be captured during any recordings. For our in-person events please let our staff know at the event that you do not wish to be recorded. Attendees will always be informed of this in advance and again at the time of attending and we will endeavour to accommodate requests not to be filmed/recorded where these have been expressed.
If you are a speaker at a Zero Waste Scotland event, we will publicly promote your involvement via Twitter, LinkedIn and emails to our associates. This data may continue to be processed by those platform providers after the event has ended.
Applicants who apply for funding or support
When you make an application for funding to Zero Waste Scotland, we will use the data that you have provided to assess your application and to manage your contract and our relationship with you, including for customer satisfaction monitoring and evaluation of our services. We collect, store, and process a small amount of personal data about you, for
example your name, job title, email address and telephone number, as well as details about your business, for example company size, turnover, sector and project details.
Why do we need the information?
- The information we collect is necessary for us to deliver the business support services that you have signed up to. We will check your eligibility and if applicable provide support, advice and funding to your business.
- As a government funded service we are contractually obliged to collect and monitor some baseline and impact data about your business.
- If you have agreed, we will send you information which we feel may be of interest to you and your business, for example newsletters, events and business support information. You have a right to withdraw your consent to these activities at any time – please see the section below: Your rights under GDPR.
We will also use your information to:
- Measure the quality of our services and improve them; for example, through customer satisfaction, monitoring and evaluation of our services – we may use a third party to carry this out on our behalf.
- Help us to service customers' needs more effectively and to develop and maintain meaningful relationships.
- Ensure we meet our targets and other contractual commitments.
- To prevent and detect fraud and irregularity.
Where do we store your information?
We store your information in our Microsoft Dynamics 365 Customer Relationship Management database which is hosted on secure servers in Microsoft Azure Data Centres within the EU. We also store your information within our own secure servers hosted to G-Cloud Government iL2 security standards.
We do not transfer personal information outside the European Economic Area (EEA).
How long will we hold your information?
We will store your information in line with ERDF audit requirements, which may be until 2030. After the end of the Programme your information will be securely archived and not used in any way, other than if required for audit purposes.
Who else will receive the information?
(1) Funders, auditors, advisers and authorities
Our services are funded by a number of external organisations (Funders). Your Information may be passed to those Funders, their auditors and advisers for their own purposes such as:
- Audit and monitoring;
- Detection and prevention of fraud and irregularity;
- Documentary evidence of funding;
- Production of case studies and demonstration of best practice;
We may be required to disclose information about you or your business in response to a request under the Freedom of Information Act 2000, unless an exemption applies.
We may share your information with our own advisers so we can take advice, or with our own auditors for auditing purposes. We will disclose your information to regulatory or enforcement authorities if asked to do so, or to a third party in the context of actual or threatened legal proceedings.
We may allow third-party providers and contractors who supply services to us or who process information on our behalf incidental access to your information. We will ensure that they keep your information secure and do not use it for their own purposes.
This section sets out Zero Waste Scotland’s policy on the protection of information relating to job applicants. Protecting the confidentiality and integrity of personal data is a critical responsibility that Zero Waste Scotland takes seriously at all times. Zero Waste Scotland will ensure that data is always processed in accordance with the provisions of relevant data protection legislation, including the General Data Protection Regulation (GDPR).
Fair processing principles
In processing applicants’ data the following principles will be adhered to. Personal data will be:
- Used lawfully, fairly and in a transparent way;
- Collected only for valid purposes that are clearly explained and not used in any way that is incompatible with those purposes;
- Relevant to specific purposes and limited only to those purposes;
- Accurate and kept up to date;
- Kept only as long as necessary for the specified purposes; and
- Kept securely.
Lawful processing of personal data
Personal information will only be processed when there is a lawful basis for doing so. Most commonly, Zero Waste Scotland will use personal information in the following circumstances:
- when it is needed to perform applicants’ contracts of employment;
- when it is needed to comply with a legal obligation; or
- when it is necessary for the Zero Waste Scotland’s legitimate interests (or those of a third party) and applicants’ interests and fundamental rights do not override those interests.
Zero Waste Scotland may also use personal information in the following situations, which are likely to be rare:
- when it is necessary to protect applicants’ interests (or someone else’s interests); or
- when it is necessary in the public interest [or for official purposes].
Lawful processing of sensitive personal data
Sensitive personal data is a special category of information which relates to a data subject’s racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health conditions, sexual life, sexual orientation, biometric or genetic data. It also includes personal data relating to criminal offences and convictions.
Less commonly, Zero Waste Scotland may process this type of information where it is needed in relation to legal claims or where it is needed to protect an applicant’s interests (or someone else’s interests) and the applicant is not capable of giving consent, or where an applicant has already made the information public. Zero Waste Scotland may use particularly sensitive personal information in the following ways:
- information relating to leaves of absence, which may include sickness absence or family related leaves, may be used to comply with employment and other laws;
- information about applicants’ physical or mental health, or disability status, may be used to ensure health and safety in the workplace and to assess fitness to work, to provide appropriate workplace adjustments, to monitor and manage sickness absence and to administer benefits;
- information about race or national or ethnic origin, religious, philosophical or moral beliefs, or sexual life or sexual orientation, may be used to ensure meaningful equal opportunity monitoring and reporting; and
- information about trade union membership may be used to pay trade union premiums, register the status of a protected applicant and to comply with employment law obligations.
Lawful processing of information about criminal convictions
Zero Waste Scotland envisages that it will hold information about criminal convictions that have been declared on application forms. Zero Waste Scotland will only use this information where it has a legal basis for processing the information. This will usually be where such processing is necessary to carry out Zero Waste Scotland’s obligations. Less commonly, Zero Waste Scotland may use information relating to criminal convictions where it is necessary in relation to legal claims, where it is necessary to protect an applicant’s interests (or someone else’s interests) and the applicant is not capable of giving consent, or where the applicant has already made the information public.
Consent to data processing
Zero Waste Scotland does not require consent from applicants to process most types of applicant data. In addition, Zero Waste Scotland will not usually need consent to use special categories of personal information in order to carry out legal obligations or exercise specific rights in the field of employment law.
In limited circumstances, applicants may be asked for written consent to process sensitive data. In those circumstances, applicants will be provided with full details of the information that sought and the reason it is needed, so that applicants can carefully consider whether to consent.
Where applicants have provided consent to the collection, processing and transfer of personal information for a specific purpose, they have the right to withdraw consent for that specific processing at any time. Once Zero Waste Scotland has received notification of withdrawal of consent it will no longer process information for the purpose or purposes originally agreed to, unless it has another legitimate basis for doing so in law.
Automated decision making
Zero Waste Scotland does not envisage that any decisions will be taken about applicants using automated means, however applicants will be notified if this position changes.
Collection of data
Zero Waste Scotland will collect personal information about staff members through the application and recruitment process, either directly from candidates or sometimes from an employment agency or former employer.
From time to time, Zero Waste Scotland may collect additional personal information from an applicant. If Zero Waste Scotland requires to obtain additional personal information this policy will be updated or applicants will receive a separate privacy notice setting out the purpose and lawful basis for processing the data.
Retention of data
Zero Waste Scotland will only retain applicants’ personal information for as long as necessary to fulfil the purposes it was collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
When determining the appropriate retention period for personal data, Zero Waste Scotland will consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of personal data, the purposes for which the personal data is processed, whether the Company can achieve those purposes through other means, and the applicable legal requirements.
In some circumstances, Zero Waste Scotland may anonymise personal information so that it can no longer be associated with individual applicants, in which case Zero Waste Scotland may use such information without further notice to applicants. After the data retention period has expired, Zero Waste Scotland will securely destroy applicants’ personal information.
Zero Waste Scotland has put in place appropriate security measures to prevent personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Details of these measures are available upon request.
Zero Waste Scotland may share personal information with third parties. Zero Waste Scotland requires third parties to respect the security of applicant data and to treat it in accordance with the law. Zero Waste Scotland may also need to share personal information with a regulator or to otherwise comply with the law.
Zero Waste Scotland may also share applicant data with third-party service providers where it is necessary to administer the working relationship with applicants or where the Company has a legitimate interest in doing so. The following activities are carried out by third-party service providers: payroll, pension administration, benefits provision and administration, IT services.