The NetZeroToolkit is provided by Edinburgh Science. Our Privacy Notice concerns the personal information the charity collects and processes.
Who we are
Edinburgh Science Foundation is a registered charity (SC 003790), based at Harbourside House, 110 Commercial Street, Edinburgh EH6 6NF. The charity operates its UK Festival and education work through the company Edinburgh Science Ltd (company number 106331) and under the brand Edinburgh Science. The Data Protection Act 1998 requires every data controller who is processing personal information to register with the Information Commissioner’s Office. Our registration number as a Data Controller is Z8473068.
What information do we collect?
Edinburgh Science Ltd collects personal data from you when you create an account with us and answer the the Net Zero Toolkit questions. We also collect data when you sign up for a newsletter or contact us using the Contact Us form on the website or send us email correspondence.
When we ask you to provide your personal data, we will let you know why we are asking and how your data will be used by referring you to our Privacy Notice. Personal information may include but is not limited to your name and email address. We only collect the personal information that is necessary to meet our business needs and to provide you with the services you have requested.
What does Edinburgh Science Ltd do with my personal information?
We collect personal data from you where there is a valid legal basis for doing so, such as to fulfil a contract with you or because you have given your consent. If you are beginning your NetZeroToolkit membership, this information is used to process the transaction and provide you with goods and services. It also allows us to notify you in case of any change to the services we provide.
We rely on your consent for our marketing communications. If you wish to hear from us about the other work that our charity, Edinburgh Science, does and have given us permission to contact you, we will send you information and updates on our work by your preferred channel (email / post). We may also provide you with information on our fundraising work as a charity, including requests for support. We may also send you surveys for market research purposes or events from trusted partners we feel would be of interest to you. We will only contact you if we have received your permission and you can opt out of receiving communications at any time by contacting firstname.lastname@example.org or by clicking the unsubscribe button at the end of each email communication.
Who we might share your information with
We never disclose personal data to any third parties, other than data processors carrying out work on our behalf and working with us to provide a service. This includes processing orders and card payments, email delivery and website hosting. We work with a bulk email distributor – MailChimp – to send out e-newsletters to subscribers. All of our data processors have their own data security processes and protocols in place, in compliance with the Data Protection Act 1998 and GDPR. We may share your access requirements with venue partners if you have given consent, in order to support your visit. We may also share anonymised data with GDPR compliant data companies to produce market research information. Our current list of third party data processors includes: Stripe, MailChimp, Survey Monkey, Forth Tech, We Are Everyone, Jonathan Mills Web Design.
Your data is never sold or shared commercially. It is only used by Edinburgh Science Ltd.
Our employees and data processors are legally obliged to respect the confidentiality of personal data.
How long will my data be held for?
We will retain your data for as long as we have a relationship with you and/or as long as necessary for the purpose it was collected. This covers supplying services to you (or you to us) or providing you with information about the services you request. We may also need to retain your information beyond the term of our relationship for legal and financial compliance reasons, including to evidence the relationship between us.
How can I access the information about me?
You can make a Subject Access Request for a copy of the personal data that we hold about you. We require proof of identity before we can process this, such as a driving licence. We aim to provide such information within 40 days of the request. Please send to:
The Data Protection Officer
Edinburgh Science Ltd
110 Commercial Street
Edinburgh EH6 6NF
Email : email@example.com
You may request that we correct or delete your personal information at any time by contacting firstname.lastname@example.org
Edinburgh Science Ltd processes personal data under a number of lawful basis for a variety of different reasons.
Consent: We process personal data under the lawful basis of consent for the Net Zero Toolkit newsletter and for users who create an account in the Net Zero Toolkit
Contract: We process personal data under the lawful basis of contract when an individual or a company enters into a contractual agreement with Edinburgh Science.
Our website and cookies
Our website has security measures in place to protect the information you provide us. We conform to the Payment Card Industry (PCI) Data Security Standard and use SSL (Secure Sockets Layer).
There are three types of cookies, session, analytical and share. Session cookies help the form to keep track of you and your answers. These are created temporarily and once you log-out and close the browser – ending the session – the cookies are deleted. You can choose whether or not to allow cookies using the privacy settings of your browser. However, session cookies must be enabled for the toolkit to work. The site also uses ShareThis to allow the user to share content from the website over multiple social networks. You can see more information on our cookies here.
We do use tools to monitor the effectiveness of our communications, including website and email tracking. Analytical cookies allow us to record page visits and sources so that we can measure the performance of our site. We use a service called Google Analytics and more details can be found at www.google.com/intl/en/policies/privacy.
We also analyse when an e-newsletter is opened and what links contained in that email are clicked. All of this data is used in an aggregated and anonymised form to monitor, for example, opening rates (as a percentage) or the number of visitors to the website.
The General Data Protection Regulation (GDPR) replaces the current Data Protection Act and becomes effective from 25.5.18. It includes a number of rights for individuals, including:
The right to be informed about how we collect and process data
The right to request to see full details of the personal information held
The right to ask us to stop processing your personal information and delete data
The right to withdraw consent at any time
The right to correct personal data if you feel it is inaccurate or incomplete
Please read Edinburgh Science’s data protection policy here.
What do we do if there’s a data breach?
Edinburgh Science Ltd and its data processors review the security of all data. If we are made aware of a breach of data, Edinburgh Science Ltd will inform the Information Commissioner’s Office and, if required, inform the data subject.