At Midlothian Voluntary Action (MVA), we take your privacy seriously. Because we collect and process personal information about you, we are registered as a ‘data controller’ with the Information Commissioner’s Office (registration Z1190096). Under GDPR (General Data Protection Regulation), you have a right to know how MVA collects, uses and shares your personal data. The information below provides a general description of the kind of personal data we collect, and how we might use and share it.

Our privacy promise

We promise to collect, process, store and share your data safely and securely.

What kinds of personal data do we collect?

The personal data we collect may include your:

• Name
• Date of birth
• Address
• Phone number
• Email address

We sometimes also collect what is called ‘special category’ data – that is, sensitive information such as:

• Medical/health information
• Racial or ethnic origin
• Sex or gender

We will always make it clear what information we are collecting, how we will use it, and why and with whom we will share it.

How do we protect your personal data?

The protection of your personal data is taken seriously at MVA. Any paper forms with your information on it are stored securely. Any personal information we enter on databases are password protected and can only be accessed by MVA staff. All backups are encrypted.

How do we collect your personal data?

Your information may be collected in a number of ways including:

• You have signed up to receive information from us either through the website, an email to staff, or a paper form.
• You have given us information to allow us to deliver a service to you, for example, a training session, or one-to-one support.

How do we use your personal data?

Your personal data may be used and processed so that MVA can deliver its main functions. These functions include:

• Activities aimed at supporting and representing third sector organisations, for example, the provision of training and funding support.
• Activities aimed at ensuring individuals have a voice in community planning.
• Activities aimed at supporting older people and carers.
• Provision of monitoring and evaluation information to funders and other stakeholders.

Why do we share your personal data?

We may share data with other organisations in the form of statistical information that in no way identifies you (for example: number of volunteers aged between 60 and 70). We will only pass your personal information to other organisations with your explicit consent. Your personal information will not be transferred outside of the UK.

With whom do we share your personal data?

We may share your personal data with your explicit consent to other organisations to help you connect with them and share information/ideas. Way may also share your data in the form of statistical information that in no way identifies you with Midlothian Council, Scottish Government, other charities, NHS, and schools. 

How long do we keep your personal data?

We will endeavour to keep your information accurate and up to date and not keep it for longer than is necessary.

Your personal data is kept in line with MVA’S Retention Schedule. The retention schedule sets out the kinds of information MVA creates and uses, how long it should be kept, and what should be done with it at the end of its ‘life’. You can request a copy of our retention schedule by contacting info@mvacvs.org.uk

Marketing and research

From time to time MVA conducts surveys using online and paper questionnaires. We do this in order to develop new services and improve the delivery of existing services. We will only use your personal information collected through this method for the above stated purposes. We will only send you e-bulletins, questionnaires and marketing information if you have given us explicit consent to do so.

Requesting access to your personal data

You may have the right to request access to the personal data we hold about you.

Request a copy of your personal data

To request a copy of your personal data please email info@mvacvs.org.uk. We will verify the identity of the person making the request and will provide a copy of the information free of charge. However, we can charge a ‘reasonable fee’ if requests are made often by the same individual. Your information will be provided within one month of receipt. We will provide your personal information in a readable format. We will not edit the information before sending.

Letting us know if your personal information is incorrect

If you believe the personal data we hold about you is inaccurate or incomplete you may have the right to rectify this. Please contact us using the details below and we will take reasonable steps to check its accuracy and correct it.

What if you want us to stop using your personal information?

You may have the right to object to our use of your personal information, or to ask us to delete, remove, or stop using your personal information if you think there is no need for us to keep it. There may be legal obligations or other official reasons why we need to keep your data. We may sometimes be able to restrict the use of your data. You can ask us to restrict the use of your personal information if:

• It is not accurate
• It is not relevant any more

Automatic processing

You have a right to ask if any of your personal information is being subjected to automatic profiling or decision making. We do not use profiling or automated decision-making processes.

You can find more information on your rights under data protection on the Information Commissioner’s website. www.ico.org.uk