SOSE Newsletter Signup

South of Scotland Enterprise is one of Scotland's economic development agencies, and a non-departmental public body of the Scottish Government. We have our registered office at Carmont House, The Crichton, Bankend Road, Dumfries DG1 4TG, United Kingdom, and operate our business from locations within the south of Scotland.

We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about the privacy notice, including any requests to exercise your legal rights in respect of your personal information, please contact the DPO using the details below.

Contact details

Maureen Malone
Data Protection Officer, Head of Governance and Assurance

Carmont
The Crichton
Bankend Road
Dumfries
DG1 4TG

• Email: dataprotectionofficer@sose.scot

Changes to our privacy notice:

This current version of our privacy notice is dated June 2024.  Any proposed changes or updates should be communicated to dataprotectionofficer@sose.scot.

Letting us know about changes to your personal information:

It is important that the personal information that we hold about you is accurate and current. Please let us know if your personal information changes during your relationship with us, by contacting our Customer Support Team

We may collect, use, store and share different kinds of personal information about you. To help you identify these, they have been grouped together as follows:

We also collect, use and store and share other information that is not personal information, including:

Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal information but is not considered personal information in law, as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal information so that it can directly or indirectly identify you, we treat the combined data as personal information, which will be used in accordance with this privacy notice.

Anonymised Data is the process of turning personal information into a form which does not identify individuals and where identification is not likely to take place.

Company Data is any information relating to a company, such as the company’s address, financial information, business plans (although these may contain elements of personal information), methodologies, project briefs etc.

We collect personal information using different types of methods and sources. We have grouped these together as follows:

Direct interactions:

Directly from you. For example, when you use our website or any of our online or other systems collecting client/customer information using appropriate systems or tools,such as MySOSE, to apply for our products and services for you or on behalf of your company or employer, create an account on our website, update your details that are held by SOSE, or request marketing materials to be sent to you, complete a survey or provide feedback, or where you are involved in reviewing information or evaluating applications.

Employer or company:

From your employer or a company you work with. For example, if your personal information is included as part of an application for funding or support, or in a bid to supply services to us, or as evidence in support of a claim for grant funding.

Public Sector Partners:

Where you or your company has engaged with our public sector partners and as part of the public sector partners’ and our public functions, they have shared personal information with us. You can read more about who our public sector partners are here.

CRM Partnership:Where we or any of our partners have input or share or use your data in the CRM shared customer relationship management system and where we share or use that data with our Public Sector Partners as part of our public task and delivery of our business functions.

MySOSE is SOSE’s separate CRM system and the CRM Partnership means the CRM systems used by other public sector partners.

Third party sources/publicly available sources:

We may receive personal information about you from various third party sources. This may include open source data, where we may have subscribed to a database, or have been provided with information from an interested third party, such as an investor. It may also come from a publicly available source (e.g. Companies House) or is available through social media (e.g. Linkedin).

Suppliers:

Any supplier we have procured to deliver a service on our behalf. Such suppliers will be under contractual obligations to process your personal information in compliance with Data Protection Laws.

South of Scotland Enterprise collects and uses personal information about you in order to provide its public task and deliver its services. In general terms, South of Scotland Enterprise collects, uses, stores and shares personal information about you to:

• deliver its services and meet its legal responsibilities
• verify your identity, where this is required
• contact you by post, email or telephone
• to register with our websites
• understand the needs of your company or organisation and how they may be met
• join with our public sector partners to deliver comprehensive services for you and your company or organisation
• as supporting evidence when making claims for funding and support
• provide you with marketing you have asked for, and to sign you up for events
• review, analyse, measure and report on SOSE’s performance
• maintain our records
• process financial transactions
• carry out background checks and due diligence where appropriate
• prevent and detect crime, fraud or corruption.

Lawful Grounds

Data Protection law  says that we must have a legal ground in order to process your personal information. These are known as lawful grounds. There are six lawful grounds, but we will generally use the lawful basis of Performance of our public task’ carried out in the public interest, or in the exercise of our official authority (Public Task).  We sometimes  use three others in other circumstances, as set out below:

MARKETING AND EVENTS

Where you wish us to provide you with marketing information (information, updates, newsletters) or wish to attend an event, your personal information will be processed as follows:

 Funding and Support

South of Scotland Enterprise provides a range of funding and support to its customers. In order to provide that funding and support we will need to process personal information from time to time. The amount of personal information required and the purpose for processing personal information varies depending on the nature and type of funding and/or support a customer needs. We have set out below, in general terms, the types and purposes for processing personal information where this relates to funding and support.

 RESEARCH

South of Scotland Enterprise undertakes research and evaluation to support improvements to our services and economic development in the south of Scotland

Enquiries

Where you make an enquiry to the South of Scotland Enterprise Enquiry Service, it will be processed as follows:

 Providing us with goods and/or services.

As a supplier to South of Scotland Enterprise, there will be a need to process personal information, either because you are the principal point of contact for your company, or your information has been included as part of a tender response. Where you are a supplier to South of Scotland Enterprise, your personal information will be processed as follows:

We do not currently subscribe to any databases.

We may share your personal information with our Public Sector Partners and our suppliers to enable them to do any of these things for, or in collaboration with, South of Scotland Enterprise, or where we are required to do so to meet our legal obligations to the Scottish Government and/or theUK Government.

Where required to do so by law, we may also share your information with law enforcement agencies.

Where we share your personal information with our Public Sector Partners, this will be done in accordance with the data sharing arrangements that we have with them. Personal information will be shared with the CRM Partnership and our Public Sector Partners on the basis that either:-

• We have jointly determined the purpose and means of processing (joint controllers); or
• We process the same personal information but for different purposes (controllers in common)

Where South of Scotland Enterprise works with international partners, and your personal data may be transferred across international borders, it may be transferred to countries that have different data protection laws from the country from where you submitted your personal data.

We will, however, ensure the transfer complies with data protection law both during transit and at the storage location and all personal data will be secure.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, our employees, agents, secondees and suppliers will only process personal information on our instructions and in accordance with this privacy  policy, contractual terms and any sharing or processing agreements.. They are also subject to a duty of confidentiality.

Access to your information – you have the right to request a copy of the personal information about you that South of Scotland Enterprise holds.

Correcting your information – South of Scotland Enterprise wants to make sure that your personal information is accurate, complete and up to date and you may ask South of Scotland Enterprise to correct any personal information about you that you believe does not meet these standards.

Deletion of your information – you have the right to ask South of Scotland Enterprise to delete personal information about you where:

• You consider that South of Scotland Enterprise no longer requires the information for the purposes for which it was obtained.
• South of Scotland Enterprise is using that information with your consent and you have withdrawn your consent – see Withdrawing consent to using your information
• You have validly objected to South of Scotland Enterprise’s use of your personal information – see Objecting to how we may use your information
• South of Scotland Enterprise’s use of your personal information is contrary to law or South of Scotland Enterprise’s other legal obligations.

Objecting to how we may use your information – you have the right at any time to require South of Scotland Enterprise to stop using your personal information for direct marketing purposes. In addition, where South of Scotland Enterprise uses your personal information to perform tasks carried out in the public interest or in exercising official authority vested in it then, if you ask it to, South of Scotland Enterprise will stop using that personal information unless there are overriding legitimate grounds to continue.

Restricting how we may use your information – in some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to South of Scotland Enterprise’s use of your information. The right might also apply where South of Scotland Enterprise no longer has a basis for using your personal information but you don't want South of Scotland Enterprise to delete the data. Where this right to validly exercised, South of Scotland Enterprise may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.

Automated processing – if South of Scotland Enterprise uses your personal information on an automated basis to make decisions which significantly affect you, you have the right to ask that the decision be reviewed by an individual within South of Scotland Enterprise to whom you may make representations and contest the decision. This right only applies where South of Scotland Enterprise uses your information with your consent or as part of a contractual relationship with you.

Withdrawing consent using your information – where South of Scotland Enterprise uses your personal information with your consent you may withdraw that consent at any time and South of Scotland Enterprise will stop using your personal information for the purpose(s) for which consent was given.

Please contact South of Scotland Enterprise in any of the ways set out in the Contact information and further advice section if you wish to exercise any of these rights.

South of Scotland Enterprise seeks to resolve directly all complaints about how it handles personal information through its complaint handling procedure, but if you are dissatisfied you also have the right to lodge a complaint with the Scottish Information Commissioner's Office, whose contact details are as follows:

Email
enquiries@itspublicknowledge.info

Post
Scottish Information Commissioner
Kinburn Castle
Doubledykes Road
St Andrews
Fife
KY16 9DS

Telephone
01334 464610