GDPR and your Data Rights

Click the play button below to play the audio version of this document.

The type of personal information we collect

We currently collect and process the following information:

Personal identifiers, contacts and characteristics (for example, name, email, telephone number, social media account information, details of volunteering history and other contact details)

Voluntarily submitted photographs of persons awarded under the Spotlight Awards programme for inclusion on awardee profiles and any authorised announcements on social media and the press

Reference contact details if we are having difficulty corroborating a nominees volunteer history and associated details

Details of awardees other organisation, group or charity memberships

Web links to blogs or other websites owned by or managed by nominees and awardees.

How we get the personal information and why we have it

Most of the personal information we process is provided to us directly by you for one of the following reasons:

The administration of the Spotlight Awards programme

To validate the information you have provided to us

To confirm the award and set up and manage your awardee profile on our website

We also receive personal information indirectly, from the following sources in the following scenarios:

Personally identifiable information including your name, email address, social media account information and any other information provided by nominees who submits a nomination form on our website

Volunteer history and achievements as provided by nominees or by you as part of the set up of your awardee profile

Any information you submit for inclusion on your awardee profile.

We use the information that you have given us in order to:

Check that the nomination submitted is accurate and that your volunteer history matches with the information submitted by the nominee or by yourself

Judge that you meet the criteria for an award and if so, judge the level of award you should receive

Judge if you meet the requirements in the Awardee Code of Conduct which can be found at conduct.spotlight.scot

We may share this information with:

Any person, organisation, group, charity or entity that you either ask us to or explicitly agree to being shared

The police or courts if we are required to by law

Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing this information are:

Your consent. You are able to remove your consent at any time. You can do this by contacting us at gdpr@spotlight.scot

We have a legitimate interest to collect information from you to provide and confer the award and to maintain these details on a public list of awardees unless you specifically ask us not to.

How we store your personal information

Your information is securely stored and the public awardee profile is opt-in. Access to your personal details (other than those which are on an awardees profile) is controlled by authorised username, password, two-factor authentication token and encryption both at rest and in transit.

We keep your name, email address, social media profiles, photograph (if submitted) and your volunteering history and achievements for as long as you remain an award holder and have a public awardee profile. We will of course delete any information held on demand. In the event of such a request being made, we will delete the awardee profile and all of the information we hold about you within 14 days of the receipt of your request.

Your data protection rights

Under data protection law, you have rights including:

Your right of access - You have the right to ask us for copies of your personal information.

Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate.

You also have the right to ask us to complete information you think is incomplete.

Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing - You have the the right to object to the processing of your personal information in certain circumstances.

Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us at gdpr@spotlight.scot if you wish to make a request.

How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us at gdpr@spotlight.scot.

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:

Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF

Helpline number: 0303 123 1113 ICO website: https://www.ico.org.uk