Cantraybridge
Privacy Policy
The General Data Protection Regulation (GDPR) seeks to protect and enhance the rights of data subjects. These rights cover the safeguarding of personal data, protection against the unlawful processing of personal data and the unrestricted movement of personal data within the EU. It should be noted that GDPR does not apply to information already in the public domain.
This notice applies to all individuals connected with Cantraybridge, including students, parents and carers, employees, volunteers, donors, and website visitors.
Cantraybridge is pleased to provide the following Privacy Notice:
Personal Data
Cantraybridge uses the information collected from you to provide quotations for our services, make telephone contact in the normal course of business, and email regarding fundraising activities and events, and marketing information which Cantraybridge believes may be of interest to you or your organisation. In making initial contact, you consent to Cantraybridge maintaining a dialogue with you until you either opt out (which you can do at any stage) or we decide to desist in providing our services.
Cantraybridge acts on behalf of its clients/students/employees and volunteers in the capacity of both data controller and data processor. When acting as a data processor, Cantraybridge will mainly do so under the instruction of Local Authorities, Social Work teams, parents, or guardians.
Some personal data may be collected through forms and surveys you complete, from records of correspondence and phone calls, and details of your visits to our website, including IP addresses. This data may be used to identify and track website usage statistics. The Cantraybridge website uses cookies to identify and track visitors and their website access preferences. Visitors who do not wish to have cookies placed on their computers should set their browsers to refuse cookies before using the website. Non-essential cookies will only be used with your consent.
Any information Cantraybridge holds about you and/or your business encompasses all the details we hold about you and any transactions, including any third-party information we have obtained from public sources and our own suppliers, such as credit referencing agencies.
Cantraybridge will only collect the information needed to provide you with services. We do not sell or broker your data, although there may be times when information is contained within data purchased from a third-party list broker on behalf of a client.
Legal Basis for Processing Any Personal Data
To meet Cantraybridge’s contractual obligations, we may process data to:
Support Local Authority social work departments to deliver services to clients/students (Contract).
Administer individual service funds (Contract).
Process payroll and meet legal obligations related to employees and volunteers (Legal Obligation).
Carry out fundraising activities and marketing (Consent).
Promote and deliver the services of Cantraybridge (Legitimate Interest).
Special Category Data
Where Cantraybridge processes special category data (such as health information), we rely on the conditions set out under Article 9 GDPR, including substantial public interest and social protection law, to ensure data is processed lawfully and appropriately.
Data Sharing
Cantraybridge may occasionally pass your personal information to third parties solely for processing work on its behalf. These parties are required to process the information in line with our instructions and in compliance with this notice and GDPR. We do not broker or sell personal information. However, we may disclose information to meet legal obligations or valid governmental requests.
Categories of recipients may include:
Local Authorities and Social Work teams
IT and cloud service providers (including Microsoft 365)
Payroll and HR processors
Auditors and accountants
Regulators and relevant government bodies
Data Storage and International Transfers
Personal data is held in Scotland using a local server and on Microsoft 365. While most data remains within the UK or EEA, Microsoft may process some data outside these regions. Where this occurs, appropriate safeguards such as Standard Contractual Clauses are in place to protect your information.
Retention Policy
Personal data will be stored during the duration of any service contract and for five years thereafter, solely for meeting legal obligations. After five years, data no longer required will be deleted.
Your Rights as a Data Subject
You have the right to:
• Access a copy of the data we hold about you
• Request corrections to inaccurate data
• Request deletion of your data under certain conditions
• Restrict processing where applicable
• Request data portability
• Object to processing, including direct marketing
• Object to automated processing, including profiling
We will provide reasons for any refusals and you have the right to legally challenge these decisions.
You Can Request the Following Information
• Identity and contact details of the data controller
• Purpose and legal basis for processing
• Data categories and recipients
• Data retention period
• Your rights regarding correction, erasure, objection
• How to withdraw consent
• How to lodge a complaint with the Data Protection Regulator
To Access Personal Data Held, Identification Will Be Required
We accept:
• One piece of photographic ID (passport, driving license, etc.)
• One utility bill no older than 3 months
• We may request additional information if needed.
Complaints
If you wish to complain about how your personal data is being handled, contact the CEO of Cantraybridge. If you are not satisfied with our response within 30 days, you may escalate your complaint to the Information Commissioner’s Office (ICO).
Information Commissioner’s Office
Website: www.ico.org.uk
Helpline: 0303 123 1113
Review
This policy was last reviewed in September 2025. It will be reviewed annually, or sooner if required by changes in law or organisational practice.
Dr Clare Daly
CEO
Cantraybridge
3 Cantray Square
Croy
Inverness
IV2 5PP