Privacy 

This page contains privacy documentation prepared for Scottish Mountain Rescue.

Privacy Notice

Scottish Mountain Rescue (SMR) is a membership organisation whose members are the independent MRTs that choose to affiliate. Affiliation is voluntary, free and brings the teams certain benefits in terms of representation, communication and ability to influence by attendance at facilitated meetings that guide the national and UK wide work of SMR.

It is the individual teams that respond to incidents in the wild places of Scotland, SMR is an administrative organisation with an office at Glenmore Lodge and a small staff team that works to a voluntary Executive elected from the member teams. In addition there are a number of trainers (who may be employed, contracted (self-employed) or volunteer) that deliver bespoke MR specific courses to MRT members.

What personal information do we collect?

We collect the following personal information

From Data collected
Executive members Personal data to allow administration of Executive including name, contact information and for the purposes of reimbursing legitimately incurred expenses, bank account details.

A special circumstance exists in that we are obliged by law to pass the personal data of the Medical Officer to the Home Office.

Staff (office and employed trainers) Personal data to allow administration of payroll, pension etc., including name, contact information, NI numbers and bank account details.
Representatives of teams Member teams are represented by individuals and in order to provide services to the teams we collect personal data to allow administration of the membership of SMR. Including name, contact information, team the person(s) represent.
Trainers (contracted) Personal data to allow administration of training courses and payment for their work delivering courses. Including name, contact information, UTR numbers, and bank account details.
Trainers (volunteer) A number of people that deliver training for us do so on a voluntary basis taking no payment. We collect from these people personal data to administer the training course on which they are working, including name and contact information.
Trainees on our courses We collect personal data of MRT members who book on and attend courses that SMR deliver. This includes, name, MRT that they belong to, gender, contact information and dietary preferences. We also request (but do not require) that people inform us of any relevant medical issues that may affect their attendance at the course. We use anonymised data for purposes of statistic related to our courses.
Team Opiates Servants SMR holds an opiates license from the Home Office that requires us by law to hold and provide to the Home Office personal contact of people responsible for Opiates in those MRTs that hold Opiates. These people are known as Team Opiate Servants. 
Donors and correspondents Private individuals from time to time send us donations or correspondence to our publicly available contact addresses; email or postal or donate online via our website. People also sometimes send us messages using social media channels; Facebook messenger, Twitter etc. By this means their personal data (name and contact information) comes in to our possession
Donors using third party interfaces eg Just Giving Third party interfaces eg Just Giving provide us with contact information of people who have created accounts to donate to SMR or occasionally individual team or teams.
Media contacts We have and process personal contact information for a small number of freelance journalists that use a personal email address. We use this contact information to issue, from time to time media releases.
Website users Our website may collect, usage data including IP addresses, location, browser information (type and version), source of referral, page views, path through the website, length of visit and onward destination.

Why do we need this data – contractual purposes

We hold personal data so that we can manage office staff, employees that work to deliver training courses and contractors that work to deliver training courses.

Why do we need this data – legitimate interest

We process personal data in pursuit of our legitimate interest to fulfil the purposes of our constitution and provide benefit to member MRTs this includes

  • Administration of membership of the SMR Executive
  • Administration of membership of SMR by teams; organisation of meetings, provision of circular email updates on plans, progress and opportunities
  • Delivery of training courses
  • Acknowledging receipt and offering thanks for donations
  • Issuing media releases
  • Maintenance, improvement and understanding of our web presence and it’s use by visitors.

Why do we need this data – legal obligation

We process personal date under our legal obligation to

  • Comply with audit and accounting legislation as apply to charities in Scotland
  • Provide the Home Office with personal data on Medical Officer & Team Opiate Servants

Specific Privacy Notices

Privacy notices specific to particular functions have been prepared and issued to the following people

  • Executive members
  • Staff, including employed trainers
  • Contracted & volunteer trainers
  • Teams and team representatives
  • Team Opiates Servants
  • Media contacts
  • Website

Donors and correspondents writing to us directly will receive a specific privacy notice in response to their correspondence.

Donors using a third party interface eg Just Giving to support SMR and for whom we receive personal contact information will receive a specific privacy notice and thanks for their support.

Correspondents using a third-party mechanism to contact us Facebook messenger or Twitter will have access to a privacy notice on our website and associated with our social media accounts

These privacy notices are available at links that are available further down this page.

Or by contacting the office on info@scottishmountainrescue.org or calling 01479 861370

Other uses of your personal data

We may ask if we can process personal information of team representatives or members for other purposes. If we do so we will provide relevant additional privacy information at that time.

Who we share personal data with

We may be required to share personal data with statutory or regulatory authorities to comply with statutory obligations.

In the event we share data then within the meaning of the GDPR we are the data controller and the organisation we share data with is the data processor. Data is only shared for specific purposes related to the functions of SMR. We will take reasonable steps to ensure that recipients process personal data that we share in accordance with the purpose of SMR and in relation to the provision of MR in Scotland.

We share personal information with the following third parties

  • Police Scotland, NMOC and Bristows Helicopters Limited (lists of team contacts) receive personal data to allow them to discharge and deliver their duties and responsibilities in relation to mountain rescue.
  • The Home Office, we provide the Home Office with personal data of team Opiate Servants as a legal obligation to fulfil conditions of our Opiates Licence.
  • Mountain Rescue England & Wales, to record results of Casualty Care assessments.
  • Our trainers (employed, self-employed and volunteer) to enable the delivery and management of our training courses.
  • Within our community of MRTs. From time to time team A requests contact with team B and we provide that information
  • Our insurance brokers. From time to time team A requests contact with our insurance brokers and we provide introductions. (we do not as a matter of course provide personal data to insurance brokers).

How we protect personal information

The Office 365 system employed by SMR uses servers based in the UK. Other personal information is stored on secure systems compliant with GDPR regulations. Personal data is accessed by staff and volunteers including Executive members, only for purposes consistent with the constitution of SMR and for the furtherance of MR in Scotland.

Third party suppliers with access to personal data

SMR uses a number of third party suppliers to provide services. These suppliers may process personal data on our behalf as “processors” and where appropriate are subject to written contractual conditions to only process that personal data under our instructions and protect it.

Where we share personal data we share the minimum possible for the specific purpose at hand and take reasonable steps to ensure that third parties only process the data in accordance with those purposes.

The personal data we provide to third party suppliers includes

  • We give names to accommodation providers to administer our legitimate interest of delivering training
  • We share personal data of attendees with contractors who are delivering training courses and annual conference on our behalf
  • We may share personal data with organisations or agencies, for example St John Scotland or Police Scotland with an interest in MR to facilitate communication or particular topics.
  • Our website contains functionality for people to voluntarily sign up for an occasional digital newsletter that we prepare using Mail Chimp.
  • We take bookings for training courses and annual training conference using Google Forms for both staff and trainee. When people sign up they are making their data available to Google Forms.
  • ExpertIT provide IT support including administrative functionality on our suite of Office365 applications and therefore have access to personal data.
  • HotScot provide website hosting and support

How long will we keep personal data?

We keep personal data for the minimum time possible that allows us to fulfil the business purpose for which that data is held. We comply with any and all relevant legislation applicable to charities in Scotland which on occasion has implications for data retention eg

  • Accounting legislation
  • Retention of accident books recording medical treatments given by our staff or volunteers

What rights does the individual have?

For most personal data we hold the individual may

  • Change their communication preferences or restrict processing of their personnel data in relation to specific purposes.
  • Request amendments to the data we hold if they believe it is inaccurate or incomplete
  • Request that we delete personal data
  • See the personal data we hold by making a “subject access request.”

Exceptions occur if we are obliged by law to process data in particular ways for example provision of Team Opiate Servant information to the Home Office or retention of data in our accounts. People whose personal data is treated in this way do NOT have some of these rights.

To make any of these changes or to make a subject access request people can email us on info@scottishmountainrescue.org, call us on 01479 861370 or contact us in writing at SMR, Glenmore Lodge, Glenmore, Aviemore, PH22 1QZ.

If you have cause for concern about how we handle data, you have the right to raise a complaint with the Information Commissioner’s Office www.ico.org.uk

Specific Privacy Notices and other related documents

The following privacy notices have been issued to specific audiences and are made available here

 

 

Scottish Mountain Rescue, formerly known as The Mountain Rescue Committee of Scotland, is a registered Scottish Charity – number SC045003