The Scottish Association for Marine Science (SAMS) is committed to protecting the privacy and security of your personal information.
This privacy notice describes how we collect and use personal information about you during and after your relationship with us, in accordance with the General Data Protection Regulations (GDPR).
Under the terms of the GDPR (General Data Protection Regulation) our reason for collecting data is ‘Consent’, whereby you consent to us collecting certain personal data in order for us to effectively meet our commitments of our membership relationship.
SAMS is a ‘data controller’. This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.
This notice applies to current and former users of the MyHABs app. This notice does not form part of any contract to provide services. We may update this notice at any time.
It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.
We shall comply with data protection law. This says that the personal information we hold about you must be:
Personal data, or personal information, means any information about an individual from which they are identifiable. It does not include data where the identity has been removed (anonymous data).
There are "special categories" of more sensitive personal data that require greater protection.
We may collect, store, and use the following categories of personal information about you:
We typically collect personal information about MyHABs users through the registration process.
Before you disclose to us the personal information of another person, you must obtain that person's consent to both the disclosure and the processing of that personal information in accordance with this policy.
We shall only use your personal information when the law allows us to. Most commonly, we shall use your personal information in the following circumstances:
We may also use your personal information in the following situations, which are likely to be rare:
Providing you with benefits of direct relevance to your membership of SAMS, e.g.:
You can inform us at any time if you no longer wish to receive any or specific communications from us. [Please contact us by email at DPE@sams.ac.uk, or by writing to the Data Privacy Manager.]
We shall not, without your express consent, supply your personal information to any third party for the purpose of their own, or any third parties' direct marketing.
We shall only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.
If we need to use your personal information for an unrelated purpose, we shall notify you and we shall explain the legal basis that allows us to do so.
We may disclose your personal information to any of our officers or agents insofar as reasonably necessary for the purposes set out in this notice.
We may have to share your data with third parties, including third-party service providers. If so, we require third parties to respect the security of your data and to treat it in accordance with the law.
We may transfer your personal information outside the EU. If we do, you can expect a similar degree of protection in respect of your personal information.
We may disclose your personal information:
We may transfer your personal information outside of the European Economic Area (EEA) for the purposes described in this policy. If we do this, we shall do so using one of the adequate safeguards permitted by regulators for transfers of personal data outside of the EEA.
Personal information that you submit for publication on our website may be available, via the internet, around the world. We cannot prevent its use or misuse by others.
We have put in place measures to protect the security of your information. Details of these measures are available upon request from our Data Privacy Manager through DPE@sams.ac.uk
Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.
We shall take reasonable technical and organisational precautions to prevent the loss, misuse or alteration of your personal information.
We shall store all the personal information you provide on secure (password- and firewall-protected) servers. A third party may operate these.
Transmission of information over the internet is inherently insecure, and we cannot guarantee the security of data sent over the internet.
You are responsible for keeping the password you use for accessing our website confidential; we will not ask you for your password (except when you log in to our website).
This section sets out our data retention policies and procedure. These are designed to help ensure that we comply with our obligations in relation to the retention and deletion of personal information.
We shall only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal (including fraud), accounting or reporting requirements. This will generally be for no more than three years.
It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your membership.
Under certain circumstances, by law you have the right to:
You can exercise these rights by contacting the data privacy manager in writing.
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clarly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights).
You have the right to access your personal data held by SAMS. If you wish to receive a copy of your personal data, please submit a Data Subject Access Form (GDPR Appendix A).
One of the fundamental principles underpinning data protection is that the data SAMS processes about you will be accurate and up to date. You have the right to have your data corrected if it is inaccurate or incomplete. If you wish to have your data rectified, you should do so by completing the Data Rectification Form (GDPR Appendix B).
SAMS will respond to a data rectification request within one month. Where the data rectification request is complex, SAMS may extend the timescale for response from one month to three months. If this is the case, SAMS will write to you within one month of receipt of the request explaining the reason for the extension.
If the response to your request is that SAMS will take no action, you will be informed of the reasons for this and of your right to complain to the Information Commissioner’s Office.
Where any data that has been rectified was disclosed to third parties in its unrectified form, SAMS will inform the third party of the rectification where possible. SAMS will also inform you of the third parties to whom the data was disclosed.
You have the right to have your data deleted and removed from our systems where there is no compelling business reason for SAMS to continue to process it. If you wish to make a request for data deletion, you should complete the Data Deletion Request (GDPR Appendix C).
Upon receipt of a request, SAMS will delete the data unless it is processed for SAMS to comply with a legal requirement or in the performance of a task carried out in the public interest or exercise of official authority.
Where the data which is to be deleted has been shared with third parties, SAMS will inform those third parties where this is possible. However, where this notification will cause a disproportionate effect on SAMS, this notification may not be carried out.
We have appointed a Data Privacy Manager to oversee compliance with this privacy notice. If you have any questions about how we handle your personal information, please contact the Data Privacy Manager. You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues.
We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.
In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact the Data Privacy Manager, through DPE@sams.ac.uk. Once we have received notification that you have withdrawn your consent, we shall no longer process your information for the purpose(s) you originally agreed to, unless we have another basis for doing so in law.
If you have any questions about this privacy notice, please contact the Data Privacy Manager, through DPE@sams.ac.uk or in writing.
SAMS response MPZ consultation
Last updated: 17 Feb 2023