Economic Development Association Scotland Privacy Notice
Who We Are
Economic Development Association Scotland (EDAS)
The Economic Development Association Scotland (EDAS) is the independent voice of economic development in Scotland. EDAS is the country’s foremost membership driven association for all organisations and individuals with an interest in economic development.
We aim to facilitate a substantial improvement in the effectiveness of economic development activity in Scotland by helping to raise the knowledge, skills and networks of those involved in all aspects of economic development. Our activities include networking seminars on key economic development issues; independent, collaborative policy work; CPD training courses in economic development; and larger events and conferences.
In order to be able to undertake our work and inform our network about the activities and resources available to practitioners of economic development, we make use of personal information – almost wholly basic contact details – which users provide us with. In this notice you can read how we collect and use personal information, as well as your rights in relation to this. If you have any questions, please don’t hesitate to contact us.
Importantly, any personal data collected through this website and held by EDAS, Brightstar Scotland or its associates is treated in line with the principles of the DPA (Data Protection Act) 2018 and UK GDPR (General Data Protection Regulation).
The website for EDAS is hosted by WordPress (https://edas.org.uk/). Our customer relations management system (CRMS), event management and newsletters are processed by Constant Contact. Constant Contact complies with EU-US Swiss Sae Harbor Frameworks regarding data protection requirements and has been awarded a TRUSTe’s Privacy Seal.
Processing and Use of Personal Information
Lawful Basis for Processing Personal Data
GDPR Art 6 (1) (a) Consent: the individual has given consent to the processing of his or her personal data for one or more specific purposes.
Where users have previously bought or solicited products or services from EDAS, ‘legitimate interests’ (GDPR Art 6 (1) (f)) may also act as a basis for legal processing and communication.
Data will be held in compliance with the GDPR as set out in our privacy policy and used in accordance with the specified purposes as set out in this policy.
Purposes of Data Processing and Storage
To inform about news, events, projects and other initiatives related to the work of EDAS or economic development issues of likely interest to its network.
To inform our members of information regarding membership benefits and the annual member renewal process.
To hold and process invoices sent by users to EDAS for membership or event booking payments.
Communication from EDAS may take the form of direct email correspondence, or bulletins sent via our Constant Contact account. Notices may also include information about the activities of our member and partner organisations.
Data Retention and Rights of the Data Subject
EDAS will keep personal information as long as it is necessary for the purpose for which it was obtained, in compliance with existing regulations and unless asked to delete it at an earlier time. Data subjects have the following rights, including the right to erasure (the ‘right to be forgotten’) as set out in GDPR Articles 12-23.
It is the responsibility of the Joint Controllers to observe these rights and act upon requests in relation to these rights from individuals whose personal data is held by EDAS.
Data Controllers and Processers
The Joint Controllers and Processers of personal data on behalf of EDAS are Brightstar Scotland and associates. The lead Joint Controller is Elaine Bone, contactable at: [email protected]. A full list of data controllers is specified in EDAS’ data audit, which is available upon request.
Furthermore, EDAS’s appointed accountants, Soroban, will have access to personal data required for the purposes of processing event and membership invoices.
Data Storage and Protection
Personal information may be stored in one of the following locations: EDAS Dropbox Folder; EDAS Constant Contact; EDAS email; Brightstar Scotland Amazon File Storage, Google Drive, One Drive, Brightstar Associate hard-disk and Xero.
Users are encouraged to read the privacy and data protection policies of our data storage services, which can be found here: Dropbox Privacy Policy; Constant Contact Privacy Policy; Google Privacy Policy; Amazon Web Services Privacy Policy; Microsoft Privacy Policy;Xero Privacy Policy.
Under GDPR regulations, EDAS staff, Data Controllers and Data Processors have a duty to report any data breach to the UK Information Commissioner’s Office.
Data Audit
EDAS retains an audit of the type of personal information held, where this data is held, and the purpose and legal basis for processing this data. This can be provided upon request.
Information Sharing and Third Parties
EDAS does not share personal information with third party organisations. Though we make every effort to preserve user privacy, we may need to disclose personal information when required by law wherein we have a good-faith belief that such action is necessary to comply with a current judicial proceeding, a court order or legal process served on our web site.
Information We Collect
EDAS uses the Constant Contact platform as our customer relationship management system (CRMS) to organise our community of members and other opted in parties, as well as our service to send out email bulletins. You can read more about that company, features and policies at www.constantcontact.com. You can also access its Privacy Statement and Terms and Conditions here.
User-Provided Information
You can provide us with information about yourself, such as your name and e-mail address, by contacting us via www.edas.org.uk. This can also be completed through the WordPress hosted membership enquiry form and by subscribing to receive email bulletins via www.constantcontact.com as linked on www.edas.org.uk. If you correspond with us by email, we may retain the content of your email messages, your email address and our responses. We may also retain any messages you send through www.edas.org.uk.
Newsletter Registration
A user does not have to register to use EDAS’s website, but a user must sign-up if they wish to receive information and updates via email, which can be done via our website.
We use a third-party provider, Constant Contact, to deliver our newsletter. We gather statistics around email opening and clicks using industry standard technologies to help us monitor and improve our e-newsletter. For more information, please see Constant Contact’s privacy notice.
The registration information we require to allow a user to register is the full name and email address of the user if they wish to receive email updates. This information is stored securely on our database until such time as a user chooses to unsubscribe from receiving news stories. Users who no longer wish to receive our newsletters and other updates may opt-out of receiving these communications by clicking unsubscribe option on any email communication received or by contacting the Joint Controllers or EDAS via the ‘contact us’ form on our website.
Event Ticketing and Membership Subscriptions
Event bookings and event ticketing are routed through EDAS’s Constant Contact account. Those wishing to book for an event must complete the RSVP form detailing first name, last name and email address. Optional information may be provided by the user as displayed. To “pay by invoice”, users will also need to enter either an email address for an email invoice, or a postal address for a hard copy invoice.
Constant Contact users have the option to purchase event tickets via an invoice request through Constant Contact [see website and privacy information below], or via PayPal. If using PayPal, users submitting financial information are encouraged to read the Privacy Policy for PayPal Services.
Membership subscription requests made via www.edas.org.uk are sent directly to EDAS email accounts for processing by invoice. We hold membership details in our Dropbox account, and our appointed accountant, Soroban, will have access to personal data required for the purposes of processing both event and membership invoices. Invoices include options to pay by BACs, Cheque and PayPal. We also offer members a Direct Debit through GoCardless, and users submitting financial information through this Direct Debit services are encouraged to read their Privacy Policy for GoCardless Services.
Financial information for both membership and events services is held on Xero Accounting Software, and is accessed by the Data Controller and our appointed accountants, Soroban. More information on Xero can be found in the Xero Privacy Policy.
In-Person Events
We typically provide an attendee list of names and organisational affiliation at our events to aid delegates with networking. Furthermore, we take photographs of proceedings in order to highlight or showcase EDAS Partnerships activities. You will be asked to provide consent for this use of your data in this way when signing up for events, and are freely able to refuse to provide this.
Surveys
From time-to-time, we may request information from users via surveys or contests. Participation in these surveys or contests is completely voluntary and the user therefore has a choice whether or not to disclose this information. The requested information typically includes contact information (such as name and address), and geographic information (such as postal code). Contact information will not be shared with any third parties unless we give prior notice and choice. Though we may use an intermediary to conduct these surveys or contests, they may not use users’ personally identifiable information for any secondary purposes.
Information Sharing – Legal Disclaimer
Though we make every effort to preserve user privacy, we may need to disclose personal information when required by law wherein we have a good-faith belief that such action is necessary to comply with a current judicial proceeding, a court order or legal process served on our web site.
Website and Third Parties
Disclaimer
Economic Development Association (Scotland) Ltd seeks to ensure that the information published on its website is up to date and accurate. However, the information on the website does not constitute legal or professional advice and EDAS cannot accept any liability for actions arising from its use. EDAS cannot be held responsible for the contents of any pages referenced by an external link.
Any personal data collected through this website and held by EDAS, Brightstar Scotland or its associates will be treated in line with the principles of the General Data Protection Regulation 2016. The website for EDAS is hosted by WordPress (https://edas.org.uk/). Our customer relations management system (CRMS), event management and newsletters are processed by Constant Contact. Constant Contact complies with EU-US Swiss Sae Harbor Frameworks regarding data protection requirements and has been awarded a TRUSTe’s Privacy Seal.
Web Services
When you visit www.edas.org.uk, the website may send one or more cookies – a small text file containing a string of alphanumeric characters – to your computer that uniquely identifies your browser and lets the website help you log in faster and enhance your navigation through www.edas.org.uk. A cookie does not collect personal information about you. A persistent cookie remains on your hard drive after you close your browser. Persistent cookies may be used by your browser on subsequent visits to the site. Persistent cookies can be removed by following your web browser’s directions. A session cookie is temporary and disappears after you close your browser. You can reset your web browser to refuse all cookies or to indicate when a cookie is being sent. However, some features of www.edas.org.uk may not function properly if the ability to accept cookies is disabled.
Google Analytics
EDAS uses Google Analytics to help understand use of www.edas.org.uk. This service collects the information sent by your browser as part of a web page request, including cookies and your IP address, and their use of it is governed by their Privacy Policy. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website.
Cookies and Website Traffic Analysis
When users enter the EDAS website, their device will automatically be issued with ‘cookies’. Cookies are text files which identify users’ computers to the EDAS server. The website then creates “session” cookies to store some of the preferences of users moving around the website, e.g. retaining a text-only preference. Cookies in themselves do not identify individual users but identify only the device used and they are deleted on departure from the website. Many websites do this to track traffic flows, whenever users visit those websites.
EDAS website uses third-party cookies to measure use of the website including number of visitors, how frequently pages are viewed, and the city and country of origin of users. This helps to determine what is popular and can influence future content and development. For this purpose, EDAS website uses Real-time Analytics to measure and analyse usage of the website. The information collected by EDAS will include IP Address, pages visited, browser type and operating system. The data will not be used to identify any user personally.
Users have the opportunity to set their devices to accept all cookies, to notify them when a cookie is issued, or not to receive cookies at any time. The last of these means that certain personalised services cannot then be provided to that user.
Links
This Website contains links to other sites. Please be aware that EDAS is not responsible for the privacy practices of such other sites, and additionally cannot verify the accuracy of the information contained on external sites – by linking to them, we are not endorsing them. We encourage our users to be aware when they leave our site and to read the privacy statements of each and every Website that collects personally identifiable information. This privacy statement does not apply to information collected by other websites.
Online Events
EDAS holds online events and meetings via Zoom and Microsoft Teams. Any personally-identifiable data shared by users during these events is protected by these companies’ privacy policies. Read Microsoft’s Privacy Statement and Zoom’s Privacy Statement for more information.
EDAS will inform users of our intention to capture or store any personally identifiable information in advance or at the beginning of our online video meetings or events, and participants will be free to withdraw their consent at any time. EDAS will handle user data received via these platforms in line with GDPR regulations, only collecting and processing data in line with Article 5 and the lawful bases in Article 6 cited above. Following online video meetings, EDAS’ data processers wish to save personally-identifiable information for internal reference (such as meeting recordings or comments left in the chat box). These will be protected by the privacy policies cited above. Where EDAS wishes to share personally-identifiable information publicly (such as a screenshot for social media or video recording for promotional purposes), this will only be done with the express advance permission of the participants concerned.
Changes and Notifications
Access and Changes to Your Personal Information
You have the right to request, change, or delete personal information we hold about you (such as postal code, phone, email or postal address). This can be done by sending a request to [email protected] or contacting EDAS via its website.
Under the General Data Protection Regulation, individuals whose personal data is held by EDAS have the right make a subject access request for their personal data processed by EDAS for stated purposes. As stated earlier in this notice, data subjects have the following rights, including the right to erasure (the ‘right to be forgotten’) as set out in GDPR Articles 12-23.
Notification of Changes
If we decide to change our privacy policy, we will post those changes to this privacy statement, and other places we deem appropriate, so our users are always aware of what information we collect, how we use it, and under what circumstances, if any, we disclose it. If, however, we are going to use users’ personally identifiable information in a manner different from that stated at the time of collection we will notify users via email or by posting a notice on our Web site for 30 days.
Contact Information
If users have any questions or suggestions regarding our privacy policy, please contact Alison Jones [email protected]
Policy last updated: October 2021