Privacy notice

The Scottish Women’s Rights Centre is a collaboration between Rape Crisis Scotland, JustRight Scotland and the University of Strathclyde Law Clinic. This means that your personal information may be shared with these organisations.

JustRight Scotland use the law to defend and extend people’s rights. They are human rights lawyers, working towards a model of collaborative social justice: working together with non-lawyers to pool expertise and resources towards the common goal of increasing access to justice and reducing inequality. JustRight Scotland provide the legal services for the centre. They will therefore have access to information about legal casework, helpline calls and legal surgery appointments to allow them to monitor the legal services being provided and to allow them to co-ordinate, administer and develop the work of the centre.

JustRight Scotland is a Scottish Charitable Incorporated Organisation (SCIO) (registration number SC047818). JustRight Scotland provides legal advice through its limited liability partnership, JustRight Scotland LLP which trades as JustRight Scotland (SO 305962). This provides legal services exclusively to JustRight Scotland. This firm has been authorised to act as solicitors by the Law Society of Scotland from 1 May 2017 (Registered No 53703).

Rape Crisis Scotland co-ordinates the Scottish Women’s Rights Centre.

Rape Crisis Scotland (RCS) is the national office of the rape crisis movement in Scotland. RCS supports the work of local centres and develops new centres in areas where there are no or few specialist services. RCS also works with other agencies such as the police, Crown Office and health services providing training and consultancy to improve the response to those who are affected by and who perpetrate sexual violence. Through its campaigns, briefings and publications they raise awareness of sexual violence, challenge attitudes and press for legal change.

Rape Crisis Scotland is a charitable company limited by guarantee (registration number 258568). It is recognised by the Inland Revenue as a Scottish Charity (Scottish Charity No SC025642).

The University of Strathclyde Law Clinic may have oversight of cases in terms of assessing risk and strategy in case management. The clinic does not collect or retain any data about cases or in relation to helpline calls or surgery appointments. The clinic also provides law students to assist with legal casework and legal outreach work. When doing so, the students operate under the supervision of JustRight Scotland and on behalf of that organisation as volunteer members of staff.

The Scottish Women’s Rights Centre is funded by the Scottish Government and by the Scottish Legal Aid Board. However, the Scottish Legal Aid Board and the Scottish Government collate anonymised information from each contact that the centre has. This information is taken in order to allow the Scottish Legal Aid Board, the Scottish Government and the Scottish Women’s Rights Centre to monitor the demand for its services and understand better the justice gaps and needs for women affected by violence in Scotland.

Both JustRight Scotland (SCIO) and JustRight Scotland LLP are registered with the Information Commissioner’s Office (ICO) as data controllers. JustRight Scotland’s Data Protection Officer is Jenny Cook, who you can contact at jenny@justrightscotland.org.uk.

Rape Crisis Scotland is registered with the Information Commissioner’s Office (ICO) as a data controller (registration number Z3107014). Rape Crisis Scotland’s Data Protection Lead in respect of Scottish Women’s Rights Centre data is Sarah Gurney who you can contact at Sarah.Gurney@rapecrisisscotland.org.uk.

The Scottish Women’s Rights Centre supports women who have suffered gender-based violence in Scotland by offering the following services:

• Providing direct legal information, advice, representation and signposting
• Providing direct advocacy assistance
• Supporting legal surgeries and other legal outreach (such as helplines, email advice and second-tier advice)
• Delivering professional training and public legal education
• Contributing to research, advocacy and policy
• Providing participation opportunities in our Lived-Experience Panels and Accountability Committee
• FollowItApp is delivered by RCS in partnership with media co-op. FollowItApp has a separate privacy notice.

In order to fulfil our aims, and support our projects, we may need to collect personal information from individuals seeking advice, or participating in our training, participation events, accountability committee and outreach events.

We may request personal information from you, such as your name and contact details, to provide you with legal advice, either directly or through our legal surgeries or helplines. We might also request sensitive personal information, such as your racial or ethnic origin, details of your health, or harm you may have suffered, if this is relevant to the advice, we require to give you or the services we provide.

While using SWRC’s services, we may ask you to provide certain personally identifiable information through our contact forms so that we can contact or identify your contact record if you’ve previously been in touch. Personal information asked for may include, but is not limited to:

• First name and last name
• Age
• Phone number
• Email address
• The first four digits of your postcode
• Safety concerns SWRC should be aware of when making contact with you
• What form of Gender-Based Violence you have experienced
• Description of your legal issue
• What other support, if any, you have accessed
• Your need for an interpreter
• To provide and maintain our Service, including monitoring the usage of our service

If you complete a feedback form on accessing SWRC services or engage with our participation panels we may ask you for permission to use anonymised quotes, or if you would be willing for your contact with SWRC to inform an anonymous case study, for us to provide to funders or use in training or other legal education, or for use in research or reports. Direct experiences from women using the SWRC services offer unique feedback on both our service and on legal issues which could be used to inform our service development and provision and to inform our strategic aims. No identifiable personal or sensitive personal information will be used by the Scottish Women’s Rights Centre in quotes or case studies unless express consent is provided.

We will always seek to obtain this information directly from you (either in writing or orally). You have the right to withhold certain information, if you wish. We may still be able to provide you with a service, even if you choose to withhold information, but this will depend on the service you are accessing at the time.

If you wish to withhold information, please tell us as soon as possible, and we will explain what this means in terms of whether we can continue to work with you.

If you contact the SWRC Helplines our welcome message provides important information to you on how we collect data.

If you have requested an appointment at a legal advice surgery, we may request information to arrange your surgery appointments, such as your name, contact details and the nature of the advice you are seeking.

We use online forms in certain circumstances to request information.

We may also request feedback from you on the services provided.

You may also contact us by other means such as by email or telephone which may provide us with this information.

If you register interest on our website or attend SWRC training, we will request your name and a contact email address. We may also contact you directly to obtain consent for our signposting network.

We may also contact you about registering your interest in the participation work of SWRC which includes our Lived-Experience Panels. If interested, we may then contact you to pass on more information about the participation projects and keep you up to date with future meetings and results.

Our Accountability Committee is made up of organisations that represent under-represented communities. The committee provides insight and expertise into how SWRC can support under-represented individuals and reduce their barriers to accessing justice. The Accountability Committee is through organisational invite so we may ask for your name, professional email address, and work contact number to invite you to the committee meetings.

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to perform a service we have entered into with you.
• Where we need to comply with a legal obligation.
• Where you have given us your consent to do so.

We will use the personal information you have given us to provide you with the service we have offered to you. As the SWRC is a collaboration between three organisations, this means that the information we take from you could be shared with these organisations and this includes personal details. We will explain to you specifically what purposes we will use your information for, and who it will be shared with, at the time we take your information. These specific terms will apply in place of any, more general, terms contained in this Privacy Notice.

Generally, however, we use the information to provide you with accurate legal advice or advocacy services for your situation. As explained above we may also use some of this information for research, policy work or to write reports, but would only do so anonymously, so that you cannot be identified (see para Scottish Government/Scottish Legal Aid Board / the Legal Education Foundation) Anonymised, aggregate data is drawn from the database to provide statistical reports to funders.

We will only use your personal information for the purposes for which we collected it unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose or if we have a legal obligation or public interest requirement to do so. This may include situations where the action is required to prevent self-harm, harm to a child or vulnerable adult or to prevent the commission of a criminal offence. If we wish to use your personal information for any other purpose, we will contact you to explain this purpose, and, where appropriate, ask for your explicit permission.

If you have registered interest on our website for SWRC training, we will use this information to contact you when a delivery date is scheduled.

If leaving a message for SWRC on the office telephone, your message will be transferred to relevant SWRC staff members to handle your query and your message on the office voicemail may be retained for up to 10 days on the system.

Emails or submitted contact forms get automatically sent to the designated email addresses for the associated services i.e. helpline messages, surgery booking forms and legal and advocacy take-on referral forms. / contact@scottishwomensrightscentre.org.uk.

We ensure to use an encrypted format when sending or transferring emails with sensitive information. Blind Carbon Copies (Bcc) are also used for added anonymity. Our emails are kept for a year. If the information is still required after 1 year, this should be stored securely as part of your case file or archived within our OASIS database.

JustRight Scotland (JRS) uses secure online cloud-based servers, and this is where JRS stores all information relating to its legal casework, including email communications, as well as other training, research and policy work. The data is securely stored and access is restricted to only members of JRS staff, their IT services provider, and the case management system provider, who require this information to do the work.

JRS also stores some personal information in paper files held in locked filing cabinets. JRS has an Information Governance and Data Protection Policy to ensure that its staff are aware of their obligation to handle data securely, including if they require to work remotely, and setting out procedures in the event there is a data breach.

RCS also stores some personal information in paper files held in locked filing cabinets. RCS has a Data Protection Policy to ensure that its staff are aware of their obligation to handle data securely, including during remote working and setting out procedures in the event there is a data breach.

Rape Crisis Scotland (RCS) and JRS manage the SWRC online case management database. This is where we store all information relating to advocacy assistance, helpline calls, surgery appointments and email advice enquiries. The data is securely stored and access is restricted to only relevant members of RCS and JRS staff and the case management system provider, who require this information to do the work. Consent to record your information will always be sought at the beginning of you contacting the service, whether in person, online or by telephone. Where consent to record data is not provided that particular information is not recorded and will not be included in the contact record. If no personal information is provided, an anonymous record will be created.

The database has an archive of cases and calls received before 1/10/2022. The cases recorded here cannot be edited or changed notwithstanding your right to deletion.

Cases and calls received after 1/10/2022 are securely stored in two distinct sections.

• a dedicated advocacy section, managed by RCS.

• a dedicated legal section, managed by JRS.

Legal and advocacy teams then have read-only permissions in the opposite team’s files, to enable both teams to keep up to date and view work already completed, but they are unable to create, edit, maintain or add to files saved by the other team. This ensures that the data is kept autonomous and differentiated and minimise any errors, duplication or repetition.

Senior managers of SWRC have access and permissions to delete or amend archived records if personal data requests are made.

USLC does not collect or retain any data about SWRC cases or about helpline calls or surgery appointments, however, the USLC may have oversight of cases in terms of assessing risk and strategy in case management.

Both JRS and RCS have a hybrid and remote working pattern when needed. This means they may have secured remote access to shared drives and servers where your data is held. Your consent to our privacy policy followed by submission of personal and identifiable information is an agreement to that access of personal data during hybrid or remote working.

When booking a legal surgery appointment, the booking process involves two steps to complete. The first part of the process asks for the support worker’s contact details and the initials of the service user or you as a service user if booking the appointment yourself. Information gathered at step one of the booking process is held by Calendly, a third-party party so therefore does not adhere to SWRC’s privacy policy. You can read how Calendly store and use your personal data through their own privacy policy here.

Step two of the booking process involves asking for the service users contact details if they are booking a surgery appointment independently. If doing so through a support worker, we ask that the worker’s details are specifically inputted as we cannot record the service users’ details without their specific consent to our privacy policy. As a service user, consent to record your information will always be sought at the beginning of your making contact with the surgery whether in person, online or by telephone.

SWRC will take all steps reasonably necessary to ensure that your data is treated securely and by this Privacy Policy.

Rape Crisis Scotland (RCS) uses a third-party mailing website to securely store your information when you register interest in training or events, including the SWRC's 2-day approved Domestic Abuse training.

Rape Crisis Scotland uses a third-party event registration and ticketing site (Eventbrite) to register attendees for SWRC training events and process the agreed payment for a place. We may request personal information such as name, contact details and payment details to be able to process your order and record your attendance after the event.

If you provide consent for inclusion in our signposting network, your written consent will be retained by RCS for the SWRC for as long as you remain on the signposting network.

We will only store your information for as long as necessary, or as long as we are required to meet your service needs and comply with any legal obligations i.e. if we are required to retain your data to comply with applicable laws, resolve disputes and implement other legal arrangements or policies. To comply with Law Society of Scotland retention period requirements, casefiles on OASIS should be archived and kept for 10 years.

You have the right to ask us to delete all information we hold about you, at any time, as explained further below.

If you have registered interest in the SWRC's training, we will generally store your information until the next scheduled delivery date. If you attend our training your information may be held for longer in particular if you provided us with feedback or if you provided consent to be included in our signposting network.

Anonymised data may be used for funder reports and to inform improved service delivery.

You may request to delete information held about you as explained further below.