Privacy notice, GDPR & cookies
SRUC's commitment
Protecting the privacy of our customers, students, alumni, faculty and staff, as well as the confidentiality, integrity, and availability of information, is important to our operations and mission.
SRUC is committed to protecting the rights and freedoms of individuals with respect to the processing of their personal data.
The Information Commissioners Office (ICO), is the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
Who we are
SRUC provides services either directly (for grant funded, non-commercial work) or through its associate company, SAC Commercial Ltd (for commercial services).
Our registration information:
- SRUC – registered in Scotland No SC103046, VAT Registration Number GB 435 8828 17. Registered address: SRUC, Peter Wilson Building, Kings Buildings, West Mains Road, Edinburgh, EH9 3JG
- SAC Commercial Ltd. – Registered in Scotland No SC148684 VAT Registration Number GB 435 8828 17
SRUC receives grant-in-aid from the Scottish Government in support of certain of its activities, particularly those with public good implications.
SRUC is a Data Controller for the purposes of data protection law. We are registered with the Information Commissioner’s Office under the following registration numbers:
- SRUC No Z7601788
- SAC Commercial Limited No Z696983X
How to contact us
If you have any questions about our privacy notice or the information we collect or use about you, please feel free to contact us.
Email: dpo@sruc.ac.uk
Telephone: 0131 535 4129
The Data Protection Officer
SRUC, Scotland’s Rural College
Peter Wilson Building
Kings Buildings
West Mains Road
Edinburgh, EH9 3JG
General Data Protection Regulation (GDPR)
The General Data Protection Regulation (GDPR) is a change in European data protection legislation that came into effect on 25 May 2018. This supersedes the Data Protection Act 1998.
This legislation applies across all member states of the EU and to all organisations processing the data of EU subjects (wherever geographically based). It is likely, on exit from the EU, Britain will adopt the principles of GDPR under the Data Protection Bill currently being processed through Parliament.
GDPR provides increased rights to individuals on what data organisations hold, how they process it and how transparent they need to be.
It also increases the fines that can be imposed on organisations which fail to comply with the legislation and/or to protect data adequately.
Privacy notice
Purpose of this privacy notice
SRUC is committed to protecting your personal data and your privacy. This notice contains important information about:
- what personal details we collect
- what we do with that information
- who we may share it with and why
- your choices and rights when it comes to the personal information you have given us
It is important that you read this Privacy Notice together with any other notice we may provide on specific occasions when we are collecting or processing personal data about you. For example, when producing data for research purposes you will be issued with additional information, such as a covering letter.
This is so you are fully aware of how and why we are using your data. Any other notice will supplement (not override) this privacy notice.
The structure of this privacy notice
Our privacy notice contains sections that apply to different categories of activities we undertake, and the people we deal with as part of this work.
Please refer to the specific sections that will expand on certain topics mentioned throughout the document. For example, cookies and lawfulness of processing. All other sections of this privacy notice apply to everyone (all people with whom we interact, in our day to day business).
Changes to this privacy notice
We may need to make changes to our privacy policies, so please check our website for updates from time to time. If there are important changes such as changes to where your personal data will be processed we will contact you to let you know.
Privacy notice
For details about what personal data we obtain and how we use it, please consider which of the category/categories apply to you.
Your individual rights as a data subject
You have several rights in relation to how SRUC uses your information.
Right to be informed: You have a right to receive clear and easy to understand information on what personal information we have, why and who we share it with.
Right of access: You have the right of access to your personal information. If you wish to receive a copy of the personal information we hold on you, you may make a Subject Access Request (SAR) as described below.
Right to request that your personal information be rectified: If your personal information is inaccurate or incomplete, you can request that it is corrected.
Right to request erasure: You can ask for your information to be deleted or removed if there is not a compelling reason for SRUC to continue to have it.
Right to restrict processing: You can ask that we block or suppress the processing of your personal information for certain reasons. This means that we are still permitted to keep your information, but only to ensure we don’t use it in the future for those reasons you have restricted.
Right to data portability: You can ask for a copy of your personal information for your own purposes to use across different services. In certain circumstances, you may move, copy or transfer the personal information we hold to another company in a safe and secure way.
Right to object: You can object to SRUC processing your personal information where it’s based on our legitimate interests (including profiling), for direct marketing (including profiling), and if we were using it for scientific/historical research and statistics.
Rights related to automatic decision making including profiling
You have the right to ask SRUC to:
- give you information about its processing of your personal information
- request human intervention or challenge a decision where processing is done solely by automated processes
- carry out regular checks to make sure that our automated decision making and profiling processes are working as they should
If you wish to exercise any of these rights, please contact us using the details provided above.
We may need to request information of you to confirm your identity and ensure your right to access any personal data requested. We may also need to contact you to ask for further information relating to your request to allow us to respond in a timely manner.
You will not normally have to pay a fee for any request, however, we may charge a reasonable fee in circumstances such as repetitive or excessive requests for information. We may also refuse to comply with a request in these type of circumstances.
Subject access request (SAR)
Under the new legislation, the data subject is entitled to, amongst other rights, request information relating to their personal data (Right of Access). This request has to be submitted in writing as per the regulation.
Should you wish to submit a request like this, SRUC provides a template form that you can use, to make the request process as effective as possible for everyone involved. You can send this to us either by email dpo@sruc.ac.uk or by post:
Data Protection Officer
Scotland’s Rural College
Executive Office
Peter Wilson Building
Kings Buildings
West Mains Rd
Edinburgh
EH9 3JG
Please include:
- Your name
- Address
- Full details of the information you expect to receive
- Telephone number, so we can contact you to clarify any details, if necessary
Our charging policy
SRUC does not normally charge for information but we retain the right to do so under the conditions of the GDPR legislation.
What information we may have to withhold
There are certain circumstances where it may not be possible for us to provide the information requested. For example:
- where there is a risk to national security
- causing a criminal offence or where criminal proceedings already involve the data asked for
Timeline for processing Right of Access Requests
The GDPR legislation states organisations have 30 days from the date the request is received, with which to reply. Should we have to request additional information from you in order to progress your request, we will do so promptly.
Any time however, where we can’t progress the request due to waiting on information, will be taken into account in the 30 day timeline.
We will always make you aware of the dates we are working to so any potential concerns can be addressed quickly.
Data Protection Officer
You can contact us for assistance with any aspect of this subject. When writing to us, please include your name and address and full details of the information you expect to receive. Please also include a telephone number so we can contact you to clarify any details, if necessary.
Email: dpo@sruc.ac.uk
Address: Scotland’s Rural College, Executive Office, Peter Wilson Building, Kings Buildings, West Mains Road, Edinburgh EH9 3JG
Cookie policy
A cookie is a small file. It’s saved onto your computer or other device when you visit our website. Cookies store small pieces of information. For example, they will remember you've visited our website or performed a certain action.
We use cookies to help us improve your experience when you visit our website. For example, a cookie might store information so you don't have to keep entering it. Cookies also let us know which pages of our website you visited. They help us develop and market our products and services. They also help us track sales.
'Persistent cookies' stay valid, and will work until their expiry date (unless you delete them before they expire). 'Session cookies' expire when you close your web browser.
SRUC operates many different websites, where we use, store and process your information in a way that is specific to that application. As a consequence we have many different cookie policies and these can be accessed on each individual website.
Glossary of terms
Processing: any action taken against personal data, automated or otherwise. This can include collecting, recording, updating, storing or erasing.
Personal data: information relating to an identified or identifiable natural person through information such as a name, identification number, location data, genetic, or social identity.
Special category data (or sensitive personal data): information about racial or ethnic origin, health, sexual orientation or sex life, political, philosophical or religious beliefs, trade union membership and genetic or biometric data. Criminal data is not classed as special category data, it is categorised in its own right.
Data controller: determines the purpose for which, and the manner in which, personal data is to be processed.
Data subject: the person to whom the personal data relates.
Profiling: analysing or predicting patterns of data in relation to areas such as location or behaviour.
Legitimate interests: interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).
Find out more about SRUC
Find an expert
Browse our staff directory and get to know the experts working for SRUC. We have profiles for many of our professors, researchers, veterinary specialists, consultants and more.
Find out more
Supporting SRUC
Generosity from our alumni and friends community supports students facing financial difficulty, encourages students to further study, promotes research excellence, and enhances the student experience.