Contacting the Scottish Government: handling your data

We take your privacy seriously. You may have written to us, or contacted us by phone, because you have a question or want to make a complaint. This notice sets out how we use your personal data, and your rights when communicating with us.

If you contact us by phone or in writing, you control the personal data you include in your correspondence, or that you tell us about. We advise you to limit the amount of personal data you include in your correspondence as much as possible.

Your personal data and the personal data of any other people that can be identified from your correspondence will be handled as follows:

Data control and processing

When you write to us or call us, your enquiry will usually be first handled by our central enquiry unit or public enquiry unit. They will then send it to a specific team within the Scottish Government so that your question can be answered, or your complaint resolved.

The Scottish Government is the data controller (holder of data) for all of the personal data it collects and processes. A data controller may share data:

• with another organisation(s)
• among different parts of its own organisation

Purpose for processing

When you write to us or call us with an enquiry or complaint your personal data will only be used for the purpose of handling, investigating and resolving your issue. We will use the contact details you provided to respond to your correspondence. If you have made a complaint about a third party, we may use the contact details you have provided for them to investigate your issue.

Who we share data with

Often your complaint or enquiry will need specialist advice, and will be passed to the relevant team within the Scottish Administration for consideration and input.

Retention of personal data

The data will be held in line with Scottish Government records management policy.

Legal basis for processing

The legal basis for processing your data is that:

• it is necessary for the performance of a task, which is carried out in the public interest or in the exercise of official authority vested in the Scottish Government (the controller)  - Article 6(1)(e)
• processing is necessary for compliance with a legal obligation - Article 6(1)(c)

This privacy notice is made under under Article 13 of the General Data Protection Regulation (GDPR).

Your rights

The GDPR provides certain rights that you may exercise in respect of your own personal data:

• you have a right to request a copy of any personal data we hold about you, by making a subject access request
• you can ask us to update our records if you believe that the data we hold is inaccurate or incomplete
• you can request that we stop or restrict the processing we complete, however this may mean that we will not be able to respond to your enquiry or complaint
• you can ask us to delete the personal data we hold about you

There may however be some circumstances in which we cannot comply. Such as, if we have a legal duty to keep data, or to process it in a particular way.

Please contact us if you have any queries relating to your rights and how we use your personal data. We handle all requests to exercise GDPR rights on a case-by-case basis:

The Data Protection and Information Assets Team
Information and Technology Services (iTECS)
V Spur
Saughton House
Broomhouse Drive
Edinburgh
EH11 3XD

Email: dpa@gov.scot

If you have a complaint about the way we’re managing your personal data, you can let us know in the first instance by contacting the data protection and information assets team.

If you’re still dissatisfied, you can raise your concerns with:

The Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Find out more about your rights on the Information Commissioner's site.

Changes to this privacy policy

If this privacy notice changes in any way, we will update this page. Regularly reviewing this page ensures that you are always aware of what information we collect, how we use it and under what circumstances we share it with other parties.