Riverwoods Privacy Notice  

1. Who we are  

Riverwoods is a partnership initiative collaboratively working towards ecosystem recovery through the restoration and creation of river woodlands. 

Riverwoods partners hold a shared vision of a network of riparian woodland and healthy, resilient river systems throughout Scotland delivering a range of environmental, socio-economic and financial benefits. To realise this ambitious vision, Riverwoods unites, supports, and delivers project work that spans across disciplines, scales, and timelines under one banner of collaboration to ensure an effective and strategic approach to our vision.    

Riverwoods is led by the Scottish Wildlife Trust in partnership with Fisheries Management Scotland, Tweed Forum, Scotland the Big Picture, NatureScot, Scottish Forestry, Scottish Land & Estates, Marine Scotland, Green Action Trust, Involve, SEPA, The James Hutton Institute, Forestry and Land Scotland, Confor, Scottish Water, Centre for Sustainable Forests and Landscapes, Buglife, Woodland Trust Scotland, Forth Rivers Trust, Forest Research and other partner organisations which may change from time to time. 

2. Our commitment to your privacy  

We are committed to the safekeeping of personal details of our partners, volunteers, supporters and anyone else whose information we hold. This notice explains how and why we use your personal data, to ensure that you remain informed and in control of your information. 

Any references to the Scottish Wildlife Trust, the Trust, or to ‘we’ or ‘us’ refer to The Scottish Wildlife Trust – a Scottish registered charity (charity number SC005792) and a company limited by guarantee and registered in Scotland (registered number SC040247). 

We will never sell your personal data. 

3. Why do we collect your personal data?  

We collect your personal data in order to: 

• connect you with resources, tools, and other contacts involved in river woodland restoration and creation via our digital centre of excellence,  
• Allow you to upload information regarding your project, 
• to seek your input on river woodland related topics through surveys,   
• to keep in touch with you, and/or 
•  for some other legitimate purpose. 

We will only ever collect, store and use your personal data when we have an identified purpose and reason to do so. The ICO refers to this as a ‘lawful basis’. Further information about why we collect your personal data is outlined below. 

a) To send you information about our work

We collect your personal data so that we can send you information about our work that we feel will be of interest to you. This may include general project updates, fundraising appeals, campaigning opportunities, services, products, newsletters, opportunities to engage in project design, invitations to events, and competitions. 

This information is defined as ‘direct marketing’ by the ICO. 

We use a number of different lawful bases as defined by the ICO for processing your data for ‘direct marketing’ purposes: 

i) Legitimate interest

This is where we have identified a genuine and legitimate reason for contacting you, which crucially does not override your rights or interests. 

We use legitimate interest to send you the information listed above by post or telephone (if you are not registered with the Telephone Preference Service, and you have given us your telephone number). 

ii) Opt-in consent

This is where you have given us express permission to contact you by particular communication channels. 

We use opt-in consent to send you the information listed above by post, email, text message (SMS) or telephone (if you are registered with the Telephone Preference Service) 

iii) Contractual 

This is where we have agreed to send you information in relation to contractual agreements such as when assisting with grant applications. 

We respect your right to update the way we get in touch with you about our work at any time.
 

b) To get to know you better

Your personal data also helps us get to know you better and to develop a ‘profile’ of you on our secure database. This ‘profile’ enables us to send you the information listed above in a timely and relevant way, to suit you. For example, providing information on activities in which you have registered an interest or connecting you with relevant parties. 

We use the ICO’s definition of ‘legitimate interest’ for the lawful basis for processing your data for these purposes. 

 

c) To enable you to volunteer with us

If you are a Riverwoods partner, project participant or volunteer, we collect your personal data so that we can keep in touch with you about, for example: 

• changes to planned projects or programmes that you may be taking part in, 
• the positive impact you have on our work, by sending you our newsletter and relevant updates, 
• events 

We will also collect personal data to facilitate your participation or volunteering, for example: 

• application, reference, skills and disclosure details 

• role capacity 
• declaration of interests 
• attendance, training and performance management 
• vehicle checks 
• accident and near miss reports 

 

Where you support our activities in other ways, we might collect, for example: 

• Monitoring and measuring data  
• photographs 
• information about your volunteering activities  

 

As defined by the ICO, the lawful basis for processing your data for these purposes is ‘contractual’ (where administering your volunteer record) and ‘legitimate interest’ (where we have identified a genuine and legitimate reason for collecting this information, which crucially does not override your rights or interests ). 

We may also request and hold sensitive information about you (e.g. about any health issues that may impact your volunteering work) but only with your explicit consent. 

 

d) To process your data and enable you to use our digital hub 

When you sign up to be a part our Riverwoods network, via the digital centre platform (“Digital Centre”) or project register, we collect your personal data so that we can connect you to the most relevant parties, tools, and resources and allow you to upload your own project data. Our database is currently managed by the Scottish Wildlife Trust and will be shared with relevant partners of the Riverwoods initiative who take on lead project roles where necessary as well as other organisations who facilitate management and maintenance of our digital hub (see Section 5 – Sharing your data or receiving data from others).  

As a registered user of the Digital Centre or project register, we collect your personal data for administration purposes, for example: 

• To enable you to have a personal login and account 
• To enable you to change your password 
• To enable you to sign up for opportunities such as events, volunteering, and networking  
• To connect you to relevant parties  

 

There may be some instances where you can upload details of your river woodland project along with your name and contact details. This is to allow other partners, funders and project leaders to connect with you. Your contact details will only be accessible on our public platform where you have supplied these to us and provided your specific and informed consent for us to do this. If you want us to remove your contact details from the public platform at any time you can do this by writing to us at: Data Protection Officer, Harbourside House, 110 Commercial Street, Edinburgh EH6 6NF. 

If you have signed up to receive our newsletter, your name and contact information will not be automatically registered on the Digital Centre platform, however we may contact you to invite you to share your details on our open access platform.  

 

4. What kind of information do we collect? 

a) Basic information

We will usually collect basic information about you, including your name, postal address, telephone number, email address 

Most of the time, we collect this data from you directly. Sometimes this is in person; other times, it is over the telephone, in writing or through an email, through sign up forms on our website, and through the online Digital Centre.
 

b) Getting to know you better

We also collect information about you that helps us to get to know you better. This may include: 

• information about your interests 
• your preferences of how you would like us to contact you 
• ways you have engaged in activities relevant to river woodland restoration and creation  
• records of events you’ve attended, or campaigns or activities that you’ve been involved in 

 

Sometimes we will collect other information about you such as your date of birth and gender. When we do so, we will be very clear as to why we are collecting such information, and we will only do so with your specific consent and permission. 

Once again, most of the time we collect this data from you directly. Occasionally the information we hold for you may be checked against data from external sources. For example, the Royal Mail’s National Change of Address database may be checked to ensure that the address we have listed for you is up to date. We know moving to a new house can be a busy time and appreciate that you don’t always have the chance to send us your new address. By undertaking this exercise, we can find out your new address if we consider it is in your interest to be given the opportunity to continue to be involved. It is also in our interest to do this as it saves money and resources. 

Other ways in which we collect personal data to get to know you better include: 

i) Our website

Our website uses ‘cookies’ to help provide you with the best experience possible. Cookies are small text files that are placed on your computer or mobile phone when you browse websites. 

Our cookies help us: 

• Make our website work as you’d expect 
• Remember your settings during and between visits 
• Improve the speed/security of the site 
• Allow you to share pages with social networks like Facebook 
• Continuously improve our website for you 
• Track traffic levels on the website and on particular pages 

 

ii) Third parties

From time to time we may obtain contact details from project partners or from a third party for people who might be interested in hearing from us in the future. Before we process such contact information, we will always check that there is a lawful basis for us to do so – e.g. that each person has given sufficient permission for their data to be shared with us, or that the third party is acting in good faith and we have  a legitimate interest in processing the information. 

You should check third party organisations Privacy Policies carefully to understand fully how and why they will process and share your data. 

 

c) Sensitive personal data

We do not normally collect or store sensitive personal data (such as information relating to health, beliefs or political affiliation) about supporters, participants, and volunteers. However, there are some situations where this will occur. 

When we do so, we will be very clear as to why we are collecting such information (e.g. dietary requirements for an event you are attending), and we will only do so with your specific consent and permission. In these situations, we will normally collect the data from you (or your parent/guardian) directly. 

If you are a direct participant in a project or a volunteer then we may collect extra employment information about you in order to process your application, verify your identity and for safeguarding purposes, for example: 

• references 
• criminal records checks 
• details of emergency contacts 
• medical conditions 

We may also collect sensitive personal data if you have an accident whilst on Trust premises. This information will be retained for legal reasons, for safeguarding purposes and to protect us (including in the event of an insurance or legal claim). If this does occur, we’ll take extra care to ensure your privacy rights are protected and only keep the data for as long as necessary. 

 

d) Children and young people

In line with data protection law, we will not collect, store or process your personal details if you are under 13 years of age; unless we have the express permission from your parent or guardian to do so. 

For further information, please see the Scottish Wildlife Trust’s Safeguarding Policy. 

 

5. Sharing your data or receiving data from others 

We work with a number of trusted third-party service providers who we may need to share your data with to carry out specific functions when we ask them. We require them to have appropriate controls in place and to agree to act only in accordance with our instructions to ensure your data is secure and appropriate controls are in place. All third parties that we work with in this way are subject to pre-contract scrutiny and, where possible, we will always have a written contract in place with clear data protection clauses before we share any data with them. 

The third parties we work with at no point ‘own’ your data, so you will never hear from them independently and they will always delete your data from their systems when they have completed the task in hand. We always send your data to partner organisations securely, to minimise the risk of it being intercepted by unknown individuals and/or organisations. 

We only share your information with third party service providers in the following circumstances: 

i) with your consent;

ii) to agencies engaged to administer fundraising and marketing activities on our behalf;

iii) to agencies engaged in advertising on our behalf (e.g. Facebook, Google), for example to exclude existing members from membership recruitment advertisements; 

iv) to agencies who require aggregate information about our users in order to carry out the work that we are contracting them to do. For example, marketing consultants, advertisers and our website developers. Note that aggregated information is always anonymous;

v) to any successor organisation carrying on our charitable activities under the Riverwoods initiative;

vi) if we require to do so in order to comply with a legal or regulatory obligation; to enforce the legal terms applying to the use of this site, or to protect the rights of the Scottish Wildlife Trust or users of the site. This includes exchanging information with other organisations to help prevent the risk of fraud or credit risk; or

vii) to funder organisations if we are required to provide information (e.g. supplier invoices) as a condition of funding in order to substantiate costs relating to a project. 

Project Partners 

In order to maximise collection and use of information collected on the Digital Centre we allow our  project partners access to input, view and use data for project purposes.  Our project partners may change from time to time but typically include organisations with similar aims and aspirations to us (for example, third sector bodies such as charities and trusts, local and national government agencies). We have agreements in place with our project partners and we share data in a secure way and only for agreed purposes. At some point in the future we may transfer leadership of the Riverwoods project to one of our project partners. If you want to know more about how project partners look after your personal data please visit their websites to view their privacy policies. 

A list of our trusted partners will be kept up to date on our website www.riverwoods.org.uk  

 

6. How do we store your data 

a) Security

All the personal data we process is processed by our staff in Scotland. However, for the purposes of IT hosting and maintenance, your information may be situated outside of the UK or European Economic Area (EEA). Where we transfer any personal data outside the UK or EEA we will ensure that appropriate safeguards are in place in order to protect your personal data and only transfer data in compliance  with guidance issued by the Information Commissioner’s Office. 

Electronic data and databases are stored on secure computer systems and we control who has access to information (using both physical and electronic means). Our staff receive data protection training and we have a set of detailed data protection procedures which personnel are required to follow when handling personal data. 

 

b) Payment security

Donations to Riverwoods can be made through the Scottish Wildlife Trust website (scottishwildlifetrust.org.uk). The following outlines the Trust’s payment security policy. 

All electronic Scottish Wildlife Trust forms that request financial data will use the Secure Sockets Layer (SSL) protocol to encrypt the data between your browser and our servers. 

If you use a credit card to donate, purchase a membership or purchase something online, some of the information you provide to us (name/address/transaction amount) will be passed securely to our payment provider (WorldPay) who will then ask you to provide your credit card details. Once your credit card details have been processed, our payment provider will provide us with the payment status – i.e. if the transaction has been successful or not. Other payment methods (e.g. Paypal) are handled in a similar manner. 

The Scottish Wildlife Trust website does not collect or process your credit card details. The payment method is recorded on our supporter database; but no credit card information is ever stored by the Trust. 

Of course, we cannot guarantee the security of your home computer or the internet, and any online communications (e.g. information provided by email or our website) are at the user’s own risk.
 

c) CCTV

Some of our premises have CCTV and you may be recorded when you visit them. CCTV is there to help provide security and to protect both you and the Scottish Wildlife Trust. CCTV will only be viewed when necessary (e.g. to detect or prevent crime) and footage is only stored temporarily. Unless it is flagged for review CCTV will be recorded over. 

The Scottish Wildlife Trust complies with the Information Commissioner’s Office CCTV Code of Practice, and we put up notices, so you know when CCTV is in use.
 

d) Data retention policy

We will only use and store information for as long as it is required for the purposes it was collected for. We continually review what information we hold and delete what is no longer required. 

For further information, please see the Scottish Wildlife Trust’s Data Retention Policy. 

 

7. Your Rights 

 

We respect your right to control your data. Your rights include: 

i) The right to be informed

This privacy notice outlines how we capture, store and use your data. If you have any questions about any elements of this notice, please contact us. 

ii) The right of access

If you wish to obtain a record of the personal data we hold about you, through a Subject Access Request, we will respond within one month. 

iii) The right to rectification 

If we have captured information about you that is inaccurate or incomplete, we will update it. 

iv) The right to erase

You can ask us to remove your personal details from our records. 

v) The right to restrict processing

You can ask us to stop using your personal data (but we may continue to hold it where we have a lawful basis) . 

vi) The right to data portability

You can ask to obtain your personal data from us for your own purposes. 

vii) The right to object 

If you feel that the processing impacts on your fundamental rights and freedoms . You can also ask to be excluded from marketing activity. 

viii) Withdraw consent 

Where we are relying on consent to process your personal data. 

(ix) Rights in relation to automated decision making and profiling 

We respect your right not to be subject to a decision that is based on automated processing. 

Please note we do not take any decisions about you where none of our employees or any other individuals have been involved in the process. 

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. 

 

For more information on your individual rights, please see the Information Commissioner’s Office. 

If you would like to exercise any of these rights, please contact: 

Data Protection Officer 

Harbourside House, 110 Commercial Street, Edinburgh EH6 6NF 

 

8. Making a complaint 

The Scottish Wildlife Trust want to exceed your expectation in everything we do. However, we know that there may be times when we do not meet our own high standards. When this happens, we want to hear about it, in order to deal with the situation as quickly as possible and put measures in place to stop it happening again. 

We take complaints very seriously and we treat them as an opportunity to develop our approach. This is why we are always very grateful to hear from people who are willing to take the time to help us improve. 

Our policy is: 

• To provide a fair complaints procedure that is clear and easy to use for anyone wishing to make a complaint. 
• To publicise the existence of our complaints procedure so that people know how to contact us to make a complaint. 
• To make sure everyone in our organisation knows what to do if a complaint is received. 
• To make sure all complaints are investigated fairly and in a timely way. 
• To make sure that complaints are, wherever possible, resolved and that relationships are repaired. 
• To learn from complaints and feedback to help us to improve what we do. 

 

Confidentiality 

All complaint information will be handled sensitively, in line with relevant data protection requirements. 

Responsibility 

Overall responsibility for this policy and its implementation lies with the Scottish Wildlife Trust Chief Executive. 

Information Commissioner’s Office 

For further assistance with complaints regarding your data, please contact the Information Commissioner’s Office, whose remit covers the UK. 

Wycliffe House, Water Lane, Wilmslow SK9 5AF 

Telephone: 0303 123 1113 

Email: casework@ico.org.uk 

 

9. Leaving our website 

We are not responsible for the privacy practices or the content of any other websites linked to our website. If you have followed a link from this website to another website you may be supplying information to a third party.