Privacy Policy

Updated June 2018
This privacy policy gives you a comprehensive overview about how we handle personal information gathered through the One Scotland website. It explains what information we hold, what we do with it and when it is shared. We also explain your rights around your data and how you can contact us regarding your personal data.

Any personal data collected through the One Scotland website will be treated as confidential. We have a legal duty to protect any information we collect from you. We use leading technologies to safeguard your data, and keep strict security standards to prevent any unauthorised access to it.

Who we are

One Scotland is a Scottish Government campaign. This means that The Scottish Government is the Data Controller in respect of personal information that we gather and process in relation to

Collection and Use of Personal Information

We collect two kinds of information from visitors to this site: personal details in connection with your sign up, and site usage information from session cookies and log files.

We also collect your anonymous feedback on various monthly spotlight issues if you fill in our National Advisory Council on Women and Girls feedback form.

Why do we need it?

We need to know your basic personal data to:

  • Be able to respond to enquires submitted through the Contact Us email.
  • Monitor, measure, improve and protect the content or our website and services to provide enhanced and personal user experience for you.
  • Understand what people and organisations think about the issues raised by the National Advisory Council on Women and Girls to inform our reports and recommendations to the First Minister. This information will be anonymous.
  • Send you a round up email of the latest articles added by the National Advisory Council on Women and Girls if you sign up for this service.
  • Send you further information if you sign up to participate in a National Advisory Council on Women and Girls Wee Circle.

Legal bases for processing

In order to process and use your personal information lawfully, we rely on the following legal basis:

  • Consent – This applies if you complete a Contact Us email and submit it with your name, email address and enquiry message.
  • Consent – This applies when we store analytical cookies on your device to measure your interaction with the site so we can make improvements on your device.
  • Consent – This applies if you complete our National Advisory Council on Women and Girls monthly feedback forms.
  • Consent – This applies if you sign up by supplying your email address to receive a round up email of the latest articles added by the National Advisory Council on Women and Girls.
  • Consent – This applies if you sign up to participate in a National Advisory Council on Women and Girls Wee Circle, and supply your email address.


A user does not have to register to use the One Scotland website, but a user must register if they wish to receive a round up email of the latest articles from the National Advisory Council on Women and Girls or sign up to be part of a National Advisory Council on Women and Girls Wee Circle.

The registration information we require to allow a user to be receive a round up email of the latest articles from the National Advisory Council on Women and Girls is the user’s email address.

The registration information we require to allow a user to request to participate in a National Advisory Council on Women and Girls Wee Circle is the user’s email address.

This information is stored securely on our database until such time as a user chooses to unsubscribe from receiving further information. Users who no longer wish to receive our emails and other updates may opt-out of receiving these communications by clicking on the unsubscribe option on any email communication received or by contacting us by email at any time at

Who we share your information with

We may share your personal information with third party organisations to enable us to deliver marketing services. These third parties do not retain, share, store or use personally identifiable information for any secondary purposes and are fully appraised by Scottish Government before we enter into contracts with them. A third-party data processor is an entity that processes Personally Identifiable Information on behalf of a data controller (The Scottish Government). The data processor will not pass on the data or act upon the data without instruction from the data controller.

For example. We use a third-party service, Google Analytics, to collect information on how you use the site, using cookies and page tagging techniques. The information we – and Google – collect doesn’t identify anyone.

If we do want to collect personally identifiable information through the site, we will be upfront about it.

How long will we keep it?

We will keep your information only for as long as necessary depending on the purpose for which it was provided. When determining the relevant retention periods, we will take into account the guidelines issued by relevant data protection authorities. Otherwise, we securely erase your information once this is no longer needed.


If you contact us asking a question or giving feedback, we collect your email address and any other personal data contained in your message. If you contact us asking for information, we may need to contact other government bodies to find that information.

Once you have received a reply, we will keep a record of our message for a maximum of three months for reference and audit purposes, after which it will be deleted.

Log files

Log files stored on the Scottish Government’s web server allow the recording and analysis of users’ use of the website. Log files do not contain any personal information.


This website contains links to other sites. Please be aware that the Scottish Government is not responsible for the privacy practices of such other sites. We encourage our users to be aware when they leave our site and to read the privacy statements of each and every website that collects personally identifiable information. This privacy statement applies solely to information collected by this website.

Automated Decision-Making

We do not use your personal information for any form of automated decision-making.

How is your personal information transferred outside the EEA?

We, or our third-party service providers may host, store and handle your personal information outside of the European Economic Area (EEA).
We will only permit this to happen if adequate safeguards have been put in place to protect your personal information. This means that we will:

  • ensure that the country in which your personal information will be handled has been deemed “adequate” by the European Commission under Article 45 of the General Data Protection Regulation (GDPR);
  • include standard data protection clauses approved by the European Commission for transferring personal information outside the EEA into our contracts with those third parties (these are the clauses approved under Article 46.2 of the GDPR); or
  • (in the case of transfers from the EEA to the USA), ensure that the recipient of the personal information has certified with the US-EU Privacy Shield Framework, as permitted by Article 46.2 of the GPDR.

Your rights in relation to the personal information we process:

  • Right to be informed
    You have the right to be provided with clear, transparent and easily understandable information about how we use your personal data and your rights. This is why we’re providing you with the information in this Privacy Notice.
  • Right of access
    You have the right to obtain access to your personal data (if we’re processing it) and certain other information (similar to that provided in this Privacy Notice) by making a data subject access request. This is so you’re aware and can check that we’re using your personal data in accordance with data protection law.
  • Right to rectification
    You are entitled to have your personal data corrected if it’s inaccurate or incomplete.
  • Right to erasure
    This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your personal data where there’s no compelling reason for us to keep it. This is not a general right to erasure; there are exceptions.
  • Right to restrict processing
    You have rights to ‘block’ or suppress further use of your personal data in certain circumstances. When processing is restricted, we can still store your personal data, but may not use it further.
  • Right to data portability
    You have the right to obtain and reuse your personal data in a structured, commonly used and machine-readable format in certain circumstances. In addition, where certain conditions apply, you have the right to have such information transferred directly to a third party.
  • Right to object to processing
    You have the right to object to certain types of processing in certain circumstances. In particular, the right to object to the processing of your personal data based on our legitimate interests or on public interest grounds; the right to object to processing for direct marketing purposes (including profiling); the right to object to the use of your personal data for scientific or historical research purposes or statistical purposes in certain circumstances.
  • Right to withdraw consent
    If you have given your consent to anything we do with your personal data, you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your personal data with your consent up to that point is unlawful). This includes your right to withdraw consent to us using your personal data for direct marketing.

You have a right of access to any personal data we hold about you, by making a Subject Access Request (SAR). In addition, if you believe that the data we hold is inaccurate or incomplete you can ask us to update our records. If you are unhappy with the way in which we process your personal data you can request that we stop or restrict the processing we complete using your personal data or ask us to delete the personal data we hold about you. In some circumstances we may not be able to comply with your request. This is because some of these rights are conditional and can only be applied in certain circumstances and/or where there is no compelling reason to continue to process your personal data.


The Data Protection Officer
Data Protection and Information Assets Team
V Spur
Saughton House
Broomhouse Drive
EH11 3XD


The Information Commissioner

If you’re not satisfied with our response to any complaint or believe our processing of your information does not comply with data protection law, you can make a complaint to the Information Commissioner’s Office (ICO) using the following details:
Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone number: 0303 123 1113

Notification of Changes

We may update our Privacy Notice from time to time. If we do, we will post the changes to this privacy statement, and other places we deem appropriate so users are always aware of what information we collect, how we use it and under what circumstances. We would encourage you to visit our website regularly to stay informed of the purposes for which we process your information and your rights to control how we process it. If we are going to change the way we use personal data from that currently stated we will notify users via email.