Who we are
We are Edinburgh Agroecology Co-operative CIC.
We are the data controller, which means that we are responsible for how personal information is gathered, stored and used.
We’re a Community Interest Company (CIC), registered in the United Kingdom under company number SC668231.
Address: Lauriston Farm Road, Edinburgh EH4 5EX
About this privacy notice
We respect your privacy and your rights to control your personal information. This privacy notice explains how we gather and use personal information. It’s relevant to you as a visitor to our website, and for allotment holders, volunteers and event attendees, people who sign up to our mailing lists, micro-business partners on the farm, freelancers and contractors.
We will never sell your personal information to third parties.
We do use third party services to handle and store some of your data (eg. our mailing list provider), and our website contains links to other websites that are not covered by this privacy notice. You should check the other party’s privacy notice to make sure you understand how they collect and use your information.
What types of personal information we collect
We currently collect and process the following information:
- Contact details you voluntarily provide through our website, over the phone, by email, on signup sheets, or in any other way. The information you give us may include your name, address, email address and phone number, and (where relevant.
- CVs/work history (job applicants only)
- Special category data (sensitive information)
When you provide information, you are in control of the type and amount of information you provide. You may choose to provide information that may be classed as ‘special category data’. For example, you may choose to share information about your mental or physical health, your ethnicity, gender, sexuality, your political opinions, trade-union memberships, or your religious or philosophical beliefs.
We take photographs of events and activities at the farm. Photos that clearly show your face are a type of personal information. Whenever possible, will ask for your explicit consent before taking your photograph. You can opt out of having your photograph taken, and can also withdraw your permission for us to use a photograph of you at any time. We do not store your name or contact details with photographs. We would ask for your direct permission before sharing your name with your photograph.
- Information we collect automatically
Whenever you visit our website we may automatically collect technical and analytics information, for example the type of device you use to visit our site, the internet protocol (IP) address used to connect your device to the internet, pages you view or search for, download errors etc. This information is anonymous and not connected to your personal contact details. By visiting or using our website, you are consenting to us collecting technical and analytics information for the purposes set out in this privacy notice.
- Bank or card details (where relevant)
We store bank details of co-op members, freelancers, contractors and micro-business partners.
How we get the personal information and why we have it
Most of the personal information we process is provided to us directly by you, usually when you fill in one of our online forms, or contact us by email or phone, or in-person at events and volunteering sessions.
We also receive some personal information automatically when you use our website:
- Technical information. For example, we may collect information about the type of device you use to visit our site, the internet protocol (IP) address used to connect your device to the internet, your log-in information, browser type and version, operating system and other technology on the devices you use to visit our site.
- Analytics. Analytics services track and report on the use of our website and social media, including who uses it. We may get information from analytics services (for example, Google Analytics or Meta) which shows information such as pages visited, time spent on pages, and clicks on our Facebook and Instagram posts or links.
Here is a summary of how we may use your personal information, depending on how you interact with us:
- To send you our newsletters or blog updates
- To co-ordinate events and volunteering sessions
- To meet our obligations under any contract we have with you
- To shortlist and interview for vacancies
- To communicate with the community and a wider audience about the work of the farm (eg. posting photographs on social media)
- For research, impact assessment and reporting
- To manage and improve our website
- To produce records we must keep by law (for example, we have to produce accounting records and keep them for at least six years)
- To settle disputes
- To respond to feedback and comments
We can also provide your personal information to others if we have to do so by law, or in order to protect our own or other people’s property, safety or rights.
Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing this information are:
(a) Your consent. You are able to remove your consent at any time. You can do this by contacting firstname.lastname@example.org or speaking to any member of Edinburgh Agroecology Co-op in person at any event or volunteering session. Or,
(b) We have a contractual obligation. Or,
(c) We have a legal obligation.
How we store your information
We store your personal information on our own website, or in password-protected accounts with third party providers. We currently use:
Unless still required for the purpose(s) for which it was collected – eg. newsletter email contacts, or photographs documenting our work – we will usually remove your personal information from our records ten years after the date it was collected.
However, if you or your organisation works with the EAC, we may keep your personal information on record for longer. This exception usually applies to journalists, policy-makers, researchers, industry contacts and people working in the not-for-profit sector.
Your data protection rights
Under data protection law, you have the right to control how your personal information is used and you can do the following:
- Ask us for a free copy of the personal information we hold about you.
- Ask us to correct any personal information that we hold about you or to make any changes to your personal information (for example, if your name or contact details have changed).
- Ask us to transfer your personal information to another person.
- Ask to be kept informed of what data processing is taking place.
- In certain situations, ask us to restrict how your information is processed, or object to your personal information being processed.
- In certain situations, ask us to delete personal information we hold about you.
Sometimes we will not be able to stop using your personal information when you ask us to (for example, if we need to use it by law or to keep to any regulation). If we have shared photographs online, we can only delete them from our own social media accounts – if they have been shared onwards, we may not be able to erase all copies.
We will tell you if we cannot do what you ask, or how your request might affect you, when you contact us.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
Please contact us at email@example.com if you wish to make a request.
Where we rely on your consent to use your personal information, you have the right to withdraw that consent at any time. This includes the right to be unsubscribed from our email list at any time.
How to complain
If you have any concerns about our use of your personal information, you can make a complaint to us at firstname.lastname@example.org
If you are not satisfied with the way we have dealt with your complaint, you can contact the Information Commissioner’s Office (ICO) in the following ways.
The ICO’s address:
Information Commissioner’s Office
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk