St. Andrew’s Children’s Society (registered address 7 John’s Place, Leith, Edinburgh, EH6 7EL) through the course of providing our services to you will collect and store information about you. We are committed to protecting and respecting your privacy and complying with Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations (Amendment) 2016 and the GDPR Regulation 2018.

This Privacy Statement sets out the basis on which any personal data we collect from you will be processed by us. Please read the following carefully to understand our practices regarding your personal data. By contacting us to access our adoption or foster care services you are accepting and consenting to the practices described in this statement.

Lawful Basis

Our main activities are concerned with providing Fostering and Adoption Services including Adoption Support. Therefore most of the information we gather about our service users is required by adoption and foster care legislation and associated regulations and guidance. The Children (Scotland) Act 2007, The Looked After Children (Scotland) Regulations 2009, the Adoption and Children (Scotland) Act 2007 and the Adoption Agencies (Scotland) Regulations 2009. Where we rely on our legitimate interest to process your personal data, we will explain what that interest is.

Information we may collect from you

Any information we collect about you is done so under our obligation as a registered voluntary adoption and foster care service. We obtain information about you when you use our services or access our website, for example, when you contact us about our services. The type, amount and sensitivity of the information we gather will vary widely depending on the reason we are gathering it, but will always be the minimum we need to provide the service or activity you require. We will explain the reason for which we are collecting and processing your information, and we will restrict the use of your information solely for the purpose we have explained.

When you contact us we will collect the following data:

Personal information such as your name, postal and email address (for the past 10 years), telephone number, date of birth, drivers licence number, National Insurance number , employment history and references, passport details, sexual orientation, ethnicity, health and medical history, religious beliefs, convictions and finance. We will use the personal data that we collect about you for the purposes of providing you with and adoption or foster carer service. We may consider gathering information about you that is in the public domain (social and other media sources).

How long do we keep this information for?

• If you enquire with us about adoption and foster care with us we are legally required to retain this information for 10 years
• If you are assessed by us as a prospective adopter or foster carer but do not have a child placed we are legally required to retain this information for 10 years
• If you are assessed and approved by us as an adopter and you have a child placed with you we are legally required to retain this information for 100 years
• If you are assessed and approved by us as a foster carer and you have a child placed with you we are legally required to retain this information for 25 years.
• You can request that your data is deleted, and that you are ‘forgotten’ by us, and we will where we are legally at liberty to do so.

How we look after your Data

• Security precautions are in place to prevent the loss, misuse or alteration of your information.
• When you give us personal information, we take stringent steps to ensure that it’s treated securely.
• We only gather the data we need to provide you with a service.
• We encrypt or anonymise data wherever possible to make it more secure.
• We back up all data both locally and remotely to preserve it from loss.
• We employ secure servers that store all data within EU jurisdiction.
• We destroy information securely once our retention periods elapse, and we can verify that this has been done.

Disclosure of your information

We will not share the personal data that you give us outside our organisation unless:
• It is required in the linking/matching process between you and a child and you will always be told when this information is being shared.
• We are under a duty to disclose or share that information in order to comply with any legal obligation; particularly relating to Child Protection/Safeguarding or the protection of other vulnerable people. Such disclosure is necessary to protect the rights of those vulnerable people and to ensure we operate within the laws that pertain to Child Protection/Safeguarding.

Where we store your personal data

We keep your data secure in our database with appropriate security mechanisms in place.

Access to information

You have the right to access personal data held about you. Your right of access can be exercised in accordance with Data Protection Act 1998 and the Privacy and Electronic Communications (EC Directive) Regulations (Amendment) 2016 and the GDPR Regulation 2018. This access excludes information lawfully gathered from third parties such as health and social worker professionals.
You have the right to request that information held on you is refined or destroyed and this will be considered in terms of our statutory responsibilities to retain information about adoption and foster care.

Your rights

The law requires us to tell you that you have a variety of rights about the way we process your data. These are as follows:
• You may request a copy of the data we hold about you.
• Where we obtain data as part of our legal requirement in relation to adoption and foster care you do not have an automatic right of access. However we are always open to discussing this on an individual basis.
• Where our use of your data requires consent, you may withdraw this consent at any time.
• Where we rely on our legitimate interest to process data, you may ask us to stop doing so.
• If you are not satisfied with the way we have processed your data then you can complain to the Office of the Information Commissioner.

Changes to our privacy statement

We may change this privacy statement at any time, and such changes will take immediate effect. This policy was last updated in May 2018.

Complaints

As well as being able to make a complaint to us directly, you have the right to complain to the Information Commissioner’s Office if you are unhappy about how we have managed your personal data. The ICO can be contacted at scotland@ico.org.uk or www.ico.org.uk

Contact

Questions, comments and requests regarding this privacy statement should be addressed to info@standrews-children.org.uk