Privacy Policy

Nutrition Scotland is committed to safeguarding your privacy. This policy explains how we collect, use, store, and share your personal data, and your rights under UK data protection law.

If you have any questions or concerns about how we handle your personal data, please contact us at info@nutritionscotland.org.

By using our website or services, you agree to the processing of your personal data as described in this policy.

1. Definitions

• Personal data – any information relating to an identified or identifiable natural person.
• Processing – any operation performed on personal data, such as collection, storage, use, or disclosure.
• Data subject – a natural person whose personal data is being processed.
• Child – a natural person under 16 years of age.
• We/us – Nutrition Scotland.

2. Data protection principles

We follow the UK GDPR data protection principles:

1. Processing is lawful, fair, and transparent.
2. We collect personal data only for specified, explicit, and legitimate purposes.
3. We collect only the data we need for those purposes.
4. We keep data only as long as necessary.
5. We keep data accurate and up to date.
6. We protect data with appropriate security measures.

3. Your rights

Under the UK GDPR and Data Protection Act 2018, you have the right to:

• Be informed about how we use your personal data.
• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your personal data in certain circumstances.
• Restrict how we process your data in certain situations.
• Object to processing, including for direct marketing.
• Data portability – receive your data in a machine-readable format or have it transferred to another organisation.
• Not be subject to automated decision-making or profiling that has legal or similarly significant effects.
• Withdraw consent at any time, where we rely on consent as our lawful basis.
• Lodge a complaint with us or with the Information Commissioner’s Office (ICO) if you believe your rights have been breached.

To exercise your rights, see the Contact Information section at the end of this policy. We will respond within one month.

4. Data we collect

We collect personal data in the following ways:

• Information you provide directly, such as your name, email address, billing address, organisation, course registrations, survey responses, or download requests.
• Information collected automatically, such as IP address, browser type, pages visited, and cookie preferences.
• Information from partners, such as training accrediting bodies, where you have registered through them for our courses.
• Publicly available information, for example, from your organisation’s website.

5. How we use your personal data

We will always tell you why we are collecting your information and what lawful basis applies.

Purpose: Provide you with resources you request (e.g., Scottish Eatwell Guide)
Lawful basis: Contractual necessity

Purpose: Deliver training courses, issue certificates, process payments, issue invoices, and maintain financial records
Lawful basis: Contractual necessity

Purpose: Send newsletters, updates, or event information
Lawful basis: Consent

Purpose: Invite you to take part in research studies (e.g., SEWG with Robert Gordon University)
Lawful basis: Consent

Purpose: Collect feedback and evaluations
Lawful basis: Legitimate interests (anonymised where possible)

Purpose: Monitor and improve our services and website performance
Lawful basis: Consent (non-essential cookies)

Purpose: Respond to enquiries
Lawful basis: Legitimate interests

You can withdraw consent at any time.

6. Further processing

We may process your personal data for purposes compatible with the original reason it was collected. Before doing so, we will ensure that:

• The new purpose is related to the original purpose,
• It will not cause harm to your interests, and
• Appropriate safeguards are in place.

We will inform you of any such further processing.

7. Who we share your data with

We do not sell your personal data. We share it only with trusted third parties where necessary to deliver our services, comply with legal obligations, or where you have given consent.

Examples include:

• Website hosting and maintenance – 20i and Passion 4 Social CIC (hosting, security, and technical support).
• Website analytics and tools – Google Analytics, Google Fonts, Google Maps, Font Awesome, YouTube (used to improve website performance and display content).
• Mailing list management – Mailchimp (manages newsletter subscriptions and communications).
• Payment processing – PayPal and Stripe (used for processing donations, course fees, and other payments; we do not store card details).
• Accrediting bodies – RSPH and REHIS (for training course delivery, assessment, and certification purposes).
• Research partners – research institutions such as Robert Gordon University (only where you have consented to take part in a specific research project).

Anonymised data – Once data is anonymised so it can no longer identify you, it may be used for research, reporting, or statistical purposes without further notice to you.

We only work with partners who can provide adequate protection for your data, and we ensure appropriate data sharing agreements are in place where required.

8. How long we keep your data

We keep personal data only as long as necessary for the purposes collected:

• Financial records – 7 years (for legal and tax purposes)
• Training records – as required by the accrediting body
• Research participation records – for the duration of the project and in line with the partner’s ethics policy
• Mailing list data – until you unsubscribe or withdraw consent
• Enquiry correspondence – up to 12 months unless needed longer to resolve the enquiry

When no longer needed, we securely delete or anonymise data.

9. How we protect your data

We use secure communication protocols (e.g., HTTPS), limit access to personal data, and apply multiple security layers to our website.

While we cannot guarantee complete security, we will notify the ICO and affected individuals in the event of a data breach.

10. Children

We do not knowingly collect personal data from children under 16. If we become aware that we have collected such data without consent from a parent/guardian, we will delete it.

11. Cookies

We use cookies to improve your website experience. You can control or disable cookies through your browser settings. Non-essential cookies (including analytics) are set only if you consent.

See our Cookie Policy for more details.

12. Contact information

Site Owner/Data Controller

Nutrition Scotland
Email: info@nutritionscotland.org

Supervisory Authority

Information Commissioner’s Office
Queen Elizabeth House, Sibbald Walk, Edinburgh, EH8 8FT

Phone: +303 123 1115
Email: scotland@ico.org.uk
Website: Information Commissioner’s Office

13. Changes to this policy

We may update this policy from time to time. The latest version will always be published on our website, with the date of the most recent change shown at the bottom.

Last updated: 21 August 2025