Data Privacy Notice for Subscribers to the SACC Email Newsletter

This page is about information we collect when you sign up to receive our email newsletter.

In Brief

In giving us your personal data when you sign up for our email newsletter, you consent to SACC holding and processing this data. You also consent to SACC sending you our email newsletter.

SACC may store your data in various databases located within the EU or in countries to which data transfers are allowed, without derogation, under EU and UK regulations. Additionally, you consent to SACC storing your email address (and, if you have supplied it, your name) on servers operated by riseup.net that are located in the USA, and you consent to us including the riseup.net mailing list service amongst the services we may use to send you our newsletters. Riseup.net is not party to the Privacy Shield framework agreed by the European Commission for data transfers to the USA. It is run by and for political activists and we believe that it provides excellent protection for your privacy. However, you should be aware that there may be no way to legally enforce this protection. You agree to accept any risk to your privacy arising from riseup.net's status outside the Privacy Shield framework.

You may at any time withdraw your consent for us to hold your information by contacting us or by following the "unsubscribe" instructions in our email newsletter.  SACC does not accept subscriptions to our email newsletter from anyone under 13 years of age.

More Information

Who are we?

Scotland Against Criminalising Communities (SACC) is the controller of the data you provide when you sign up to the SACC email newsletter. That means that we (SACC) determine the purposes and means of processing your personal data.
Contact SACC

What information do we collect from you?

When you sign up to receive our email newsletter, we collect your email address and your certification that you are 13 years of age or more at the time of signing up. We collect the following additional information from you if you choose to provide it: your name, postal address and telephone number.

If you sign up using our online form, we do not collect your IP address.

The IP address that you used in signing up is potentially personal data. It is capable in some circumstances of identifying you as an individual. It could be also used to determine the apparent geographical location from which you signed up.

If you signed up using our online form before 25 April 2018, we will have collected your IP address and it will form part of our record of your consent to receive our newsletters.

The IP address of everyone accessing our online form is recorded  in log files as part of the normal operation of our website and could potentially be linked to your subscription to our newsletter. We will not normally attempt to do this, and your IP address will in any case not form part of our record of your consent to receive our newsletters.

If you sign up by email, by letter or in any similar way, we will collect any information you provide and it will form part of our record of your consent to receive our newsletters.

Unless you explicitly ask us to, we will not attempt to use any information you give us besides your name, email address, postal address and telephone number. In documenting your consent we cannot easily avoid recording additional information that you provide.

For what purposes do we collect this information?

We need your email address in order to send you our free email newsletter and to contact you on matters relating to your subscription to the newsletter (for example, to confirm the information you have given us or to inform you of a problem). Our email newsletters provide you with event announcements, action alerts, appeals, news items, links to articles and other information relating to SACC's aims or likely to be of interest to people who support SACC. Exceptionally, we may use your email address to contact you about matters related to SACC's aims that do not arise directly from your subscription to our newsletter.

We need to know that you are aged 13 or more because, under UK law, only children aged 13 or over are able provide their own consent to the processing of their personal data.

We collect your name (if you choose to provide it) so that we can personalise some of our communications with you.

We collect your postal address (if you choose to provide it) for two reasons:

1. So that we can send you occasional news about local campaigns and issues, for example by asking you to contact your MP or MSP.
2. So that (if you consent to us using your postal address for this purpose) we can contact you if we experience difficulties with your email address.

We collect your telephone number (if you choose to provide it) so that we can contact you if we experience difficulties with your email address.

What is the legal basis for our processing of your personal data?

We process personal data that you give us when you sign up to receive our email newsletter on the basis of your consent, as provided for (from 25 May 2018) under Article 6 of the General Data Protection Regulation (GDPR). Your consent is currently given via the online subscription form for our email newsletter or via a similar offline form, or an email message conveying the same information.

How do we process your personal data?

Information you provide may be held in databases of various kinds. We will take reasonable, proportionate steps to prevent unauthorised access to your personal data. But we cannot absolutely guarantee the security/privacy of information you provide, and cannot be responsible for breaches of security.

Please be aware that information you provide to us via our website is currently sent to us in unencrypted form and could in principle be intercepted.

Please be aware that SACC does not own or control the server on which our website is hosted. IP addresses and other data (browser, computing platform etc) about visitors to our site are logged by our web host. This is a normal procedure followed by most websites.

For maximum protection against hackers etc, we currently avoid long-term storage of any information except your email address and name on web servers or web-accessible list servers. All other personal details are stored offline in an encrypted form.

Who might we share your personal data with?

Your information will only be available to SACC members responsible for distributing our email newsletter and managing our records. It will not knowingly be made available to anyone else except with your explicit permission or under legal compulsion.

Will we transfer your data outside the EU?

We will store your email address and (if you provide it) your name on servers operated by riseup.net that are located in the USA. We do this so that we can use the riseup.net mailing list service as one of the ways we can circulate our email newsletter. Your name and email address are accessible only to you and to SACC members responsible for managing your data.

Riseup.net is not party to the Privacy Shield framework agreed by the European Commission for data transfers to the USA. When you subscribe to our email newsletter, we ask that you give your informed to consent for us to transfer your data outside the EU to riseup.net, as provided for (with effect in the UK from 25 May 2018) under Article 49 of the General Data Protection Regulation (GDPR).

Riseup.net is run by and for political activists. It operates in a flexible way that harmonises with our procedures better than commercial alternatives. We believe that it in some important respects it provides more effective protection for your data than that guaranteed under Privacy Shield frameworks agreed by GPDR. For example, riseup.net says: "We will actively fight any attempt to subpoena or otherwise acquire any user information or logs."
Riseup's privacy policy
Riseup's political principles
Riseup and Government FAQ

You should be aware that the legal framework under which we store data with riseup.net has not been covered by an adequacy decision by the European Union and therefore lacks the safeguards considered appropriate by the EU and UK authorities. There may be no way of legally enforcing the privacy of data held by riseup.net.

In providing us with your email address and name, you accept that our use of riseup.net is a derogation for our specific situation, as provided for under Article 49 of the General Data Protection Regulation (GDPR), and you agree to accept any consequent risk to your privacy.

We may sometimes use Elastic Email as an email relay to circulate our newsletters. Elastic Email is headquartered in Canada. Some personal data (your email address and any personal data contained in the body of emails relayed via Elastic Email) is transferred to Elastic Email in the course of our use of its service. Elastic Email is working towards GPDR compliance and we will review our use of its service after GPDR come into effect in the UK on 25 May 2018.

Elastic Email states: "Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) requirements are quite similar to the GDPR and with Elastic Email being a Canadian Corporation we already have a number of well-defined data management policies in place. We are working with our legal team to fill any gaps identified in order to be fully GDPR compliant by May 25, 2018."

Elastic Email also states: "Elastic Email’s data centers are mostly hosted in the EU, and it is possible to ensure that ALL of your data remains physically in the EU."

What decision-making processes do we apply to your data?

We do not carry out any automated decision-making (making a decision solely by automated means without any human involvement) based on your personal data.

We may use your postal address to determine your parliamentary constituency and council ward, and to find the names of your MP, MSPs, MEPs and councillors. We may also use your postal address to send you locally-relevant information, alerts and news.

Apart from this, we do not use your personal data to decide what information to send to you in our email newsletters.

We do not engage in profiling (processing of personal data to evaluate certain things about an individual).

Will we do anything else with your data?

If you contact us as a result of receiving our email newsletter (eg with feedback or a request for more information), we will try to respond (though our resources are limited and we will not always be able to do so). Information that you provide us with in the course of our correspondence will be protected in line with our separate privacy policy relating to the administration of SACC affairs. We will seek your prior consent to any processing that may give you less protection than is provided in our email newsletter privacy policy, or that could have any other effect that we think you may not expect.

How long do we keep hold of your personal data?

If we remove you from our email list (at your request or otherwise), we will normally retain our record of your personal data for around 1 month in case your removal was in error. Thereafter we aim to delete our record of your personal data as soon as practicable.

What rights do you have over our use of your personal data?

The General Data Protection Regulation (GDPR) comes into effect on 25 May 2018. It re-states and expands the rights you have under the Data Protection Act 1998.  It gives you the following rights in relation to personal data that we hold on the basis of your consent:

You have a right to withdraw your consent for us to hold your personal data at any time. You can do this by contacting us or by following the "unsubscribe" instructions provided in our email newsletter.  

You have a right to lodge a complaint with a supervisory authority. In the UK, the appropriate body is the Information Commissioner's Office (ICO). Details on the ICO's page for reporting a concern.

You have a right to be informed about the collection and use of their personal data. This page, and our email newsletter sign-up procedures, are intended to help you exercise that right.

You have a right to access your personal data and supplementary information. Please contact us if you want us to send you a copy of the data we hold.

You have a right to have inaccurate personal data rectified, or completed if it is incomplete. Please contact us if you want us to rectify inaccurate data.

You have a right, in some circumstances, to have personal date erased. This right applies (amongst other situations) where personal data has been collected on the basis of your consent, as is the case in connection with our email newsletter. Please contact us if you want us to erase your personal data.

You have the right to request the restriction or suppression of your personal data, ie to request that the data is stored but not used.

You have a right to data portability, ie for data to be provided to you in a structured, commonly used and machine readable form such as a CSV file. If you want us to send you a copy of the data we hold (see above), please let us know of any preferences regarding format.

You have rights over any automatic decision-making or profiling processes that are carried out on your data. We do not carry out such processes.