Privacy Policy

The Scottish Council of Law Reporting, a company registered in Scotland with the company number SC032729 and a charity registered in Scotland with the charity number SC017485, with its registered office at Darkfaulds Cottage, Perth Road, Blairgowrie, Perthshire, PH10 6PY (“SCLR, we, us, our”) strives to protect the privacy of all personally identifiable information collected during the course of our activities and it is important for you to know how we process your data. We will process your personal data under the terms of this policy and in accordance with any agreement with you.

We are a “data controller” in terms under data protection laws (including from 25 May 2018, the EU General Data Protection Regulation 2016 and the Data Protection Act 2018) (“Data Protection Laws”).

We need to process personal data relating to our council members, our trustees/directors, Session Cases Editors and Reporters, House Editor, Proofreaders and Tablers, our consultants, our Secretary, our suppliers, our customers and our subscribers in order to function effectively as an organisation, to ensure good governance, for audit purposes, to perform our business and to enable us to meet our legal obligations.

Personal data is processed for commercial, charitable, administrative and statutory purposes. All such personal data is collected and held in accordance with all applicable Data Protection Laws.

What personal data will SCLR use?

This list includes all the ways we may use your personal data, and which of the reasons we rely on to do so. This is where we tell you what our legitimate interests are.

Personal Data We May Process:	Our Reasons for Processing	Our Legitimate Interests
Council Members • Names · Work Address · Work email address · Personal email address	· Our legitimate interests	· To keep in contact with members in order to inform them of meetings, the AGM or to invite them to SCLR events
Trustees/Directors · Names · Work Address · Work email address · Personal email address · Information contained within Companies House	· Fulfilling contracts · Protecting or defending our legal rights
	· Our legitimate interests	· To keep in contact with directors and trustees · To administer our business
Session Cases Editors and Reporters, House Editor, Proofreaders and Tablers · Names · Work Address · Work email address · Personal email address · Personal data contained within contracts with SCLR · VAT numbers · Self-billing invoices · Bank details	· Fulfilling contracts – specifically to facilitate the management of the publication of Session Cases and work on Exceptional Cases and to pay Session Cases Editors and Reporters, House Editor, Proofreaders and Tablers
Consultants and Secretary · Names · Work Address · Work email address · Personal email address · Personal data contained within contracts with SCLR · Bank details	· Fulfilling contracts – specifically to facilitate the management of SCLR and to pay consultants and the Secretary
Employees of Suppliers · Names · Email addresses · Work Address	· Our legitimate interests	· Management of the production of Session Cases and other SCLR activities
Employees of Customers · Names · Email addresses · Mobile phone numbers	· Our legitimate interests	· Management of the publication of Session Cases on-line
Subscribers · Names · Email addresses · Mobile phone numbers · Institution/Business details · Invoice details · Methof of Payment · Type of Subscription	· Our legitimate interests	· Management of the business of the SCLR

Where do we obtain your information?

In the case of Council Members, we obtain your personal data on appointment to the Council and, if applicable, subsequent appointment as a Director/ Trustee.

In the case of applications (successful and unsuccessful), to be Session Cases Editors and Reporters, House Editors, Proofreaders and Tablers we obtain your personal data during the appointment or recruitment process. We may obtain information indirectly from referees during this course of action.

In the case of employees of our supplier or the employees of our customers we will obtain your personal data directly from your employers.

Processing Conditions

We process the personal data referred to above for the purposes of any contract or potential contract with our Council Members, Session Cases Editors and Reporters, House Editor, Proofreaders and Tablers, our Trustees/Directors, employees of our suppliers and the employees of our customers; or for our legitimate interests in order to function effectively as a business, to ensure good governance, for audit purposes, to perform our business activities and to enable us to meet our legal obligations that we may be subject to.

Who do we share your information with?

The information you provide to us may be accessed by the Secretary to the Council, our Trustees/Directors, our auditors, our professional advisors and carefully selected third parties such as online file hosting service providers in the course of providing services to us under suitable obligations of confidentiality.

In particular, we may share your information with the following entities:

Dropbox. Where you are a Council Member, Trustee/Director, Consultant, Secretary, Subscriber, Session Cases Editor, a Session Cases Reporter, a House Editor, a Proofreader or a Tabler, your details may be shared with Dropbox.
Eventbrite. If you register for an event which we are organising, such as a Macfadyen Lecture your details may be shared with Eventbrite in the event that you register through their site.
Thomson Reuters. Where you are a Council member or Trustee/Director, Session Cases Editor, or a Session Cases Reporter, a House Editor your details may be shared with Thomson Reuters.
LexisNexis. Where you are a Council member or Trustee/Director, Session Cases Editor, or a Session Cases Reporter, a House Editor your details may be shared with LexisNexis.
Justis Publishing Limited/vLex Networks SL. Where you are a Council member or Trustee/Director, Session Cases Editor, or a Session Cases Reporter, a House Editor your details may be shared your details may be shared with Justis Publishing Limited and/or vLex Networks SL.
Fasthosts. In the event that you email us or use our website to contact us then your details and any personal data you provide to us may be shared with Fasthosts.

Security

We employ administrative, electronic and physical security measures to ensure that the information that we collect about you is protected from access by unauthorised persons and protected against unlawful processing, accidental loss, destruction and damage.

Please be aware that unfortunately the transmission of information via the internet or by email is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of the data transmitted to us and any transmission is at your own risk.

The period for which the personal data will be processed

We will retain personal data securely and only in line with how long it is necessary to keep for the purposes or for a legitimate and lawful reason.

Our typical retention periods are as follows:

Personal Data Held Within:	Retention Period:
Council Member, Trustee/ Director correspondence	7 years from the end of the tax year in which the appointment was terminated
Contracts with Session Case Editors, Session Case Reporters, House Editor, Proofreaders and Tablers	For the full term of copyright of the works assigned to SCLR
Unsuccessful Session Case Editors, Session Case Reporters, House Editor, Proofreaders and Tablers	7 years from the date the appointment/recruitment interview was undertaken
Session Case Editors, Session Case Reporters, House Editor, Proofreaders and Tablers appointment recruitment information	7 years from the end of the tax year in which the contract/relationship was terminated or expired
Contracts with Consultants/Secretary	7 years from the end of the tax year in which the contract or relationship was terminated or expired
Supplier contracts	7 years from the end of the tax year in which the contract or relationship was terminated or expired
Customer contracts	7 years from the end of the tax year in which the contract or relationship was terminated or expired

Some personal data may be retained for longer where it is in our legitimate interest to do so, such as to protect and defend our legal rights; or for research, archiving or statistical purposes. Individuals can request that other information relating to them be erased and we will deal with such requests in accordance with the law.

Transfers outside the European Economic Area

We, or carefully selected third parties that we contract with (for example, Dropbox), may send personal data to countries outside the European Economic Area (‘EEA’). If and when this occurs, there will be protections in place to ensure the recipient protects the data to the same standard as the EEA. The protections include:

transferring to a non-EEA country with privacy laws that give the same protection as the EEA;
putting in place a contract with the recipient that means they must protect personal data to the same standards as in the EEA;
transfer personal data to organisations that are part of Privacy Shield. This is a framework that sets privacy standards for personal data sent between the US and EU countries which makes sure standards are similar to what is used within the EEA.

If the United Kingdom leaves the European Union appropriate steps will be taken to reflect any new regulatory requirements regarding the transfer of data.

Data subject’s rights

As an individual, you have the following rights as a data subject under applicable Data Protection Laws in relation to the processing of your personal data:

The right to request from us access to information held about you - (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
The right to request that inaccurate data held about you is rectified - this enables you to have any incomplete or inaccurate information we hold about you corrected.
The right to request the erasure of personal data - this enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing.
The right to restriction of processing - this enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
The right to object to processing - objection to processing of your personal data can occur where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground; and
The right to data portability.

If you want to review, verify, correct or request erasure of your personal data, object to the processing of your personal data, or request that we transfer a copy of your personal data to another party, please contact Anthony Kinahan in writing at the address given at the end of this policy.

Where we process your personal data based upon your consent, you have the right to withdraw your consent at any time.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact Anthony Kinahan at the address given at the end of this policy. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

For more information and guidance about any of these rights please go to the website of the Information Commissioner’s Office at https://ico.org.uk/.

Complaints

If you think there is an issue in the way in which we handle your personal data, you have a right to raise a complaint with the Information Commissioner’s Office. Their website contains details of how to make a complaint.

Changes to this Privacy & Fair Processing Notice

We keep our Privacy & Fair Processing Notice under regular review and reserve the right to update and amend it. This notice was last updated on 19 November 2019.

Further information and contact details

For further information about the proposed data sharing set out in this notice, or about any aspect of the processing of your personal data, please contact The Secretary to the Scottish Council of Law Reporting (currently Anthony Kinahan, Darkfaulds Cottage, Perth Road, Blairgowrie, Perthshire, PH10 6PY).