Leave this website quickly.

The Promise Scotland Ltd – (Non-Worker) Privacy Notice

This privacy notice explains what personal information we collect, how we use your personal information, and your legal rights relating to your personal information. The Promise Scotland is committed to protecting and respecting your privacy.

Information you supply will be processed by The Promise Scotland in accordance with the requirements and principles of the UK GDPR and the Data Protection Act 2018.

Who are we?

The Promise Scotland Ltd

Our contact details


The Promise Scotland Ltd


Charlotte House
2 South Charlotte Street



Our status as data controller

The Promise Scotland is the controller in relation to the processing of your personal information for the following:

· The Promise Scotland Website ( https://thepromise.scot/)

We are required by law to treat your personal information legally and fairly. We must also give you the means to correct it if it is wrong, allow you to object to our processing it and, in some instances, delete it from our systems if you ask us to do so.

What information do we collect about you?

In this notice, personal information means personal data about you from which you can be identified.

Your personal information does not include personal data where identifiers that associate that data with you have been removed. We term this anonymous data.

We also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data could be derived from your personal information but is not considered personal data in law as this data will not directly or indirectly reveal your identity.

Special categories of personal data include personal information about:

  • your racial or ethnic origin;
  • political opinions;
  • religious or philosophical beliefs;
  • trade union membership;
  • health;
  • sex life or sexual orientation;
  • genetic data; or
  • biometric data for the purpose of uniquely identifying you.

We do not collect any special categories of personal data, nor any information about criminal convictions or offences.

We collect and process personal information about you in different ways, depending on the service or nature of your contact with The Promise Scotland.

A question mark.

How do we collect your personal information?

We collect personal information through the following services:

  • Contacting us via our website or dedicated email addresses,
  • Our newsletters,
  • Surveys that we run,
  • Our website, and
  • Event registrations.

Please refer to the relevant section below for details on what personal information we will collect.

The sections below also set out:

  • the personal information that we collect,
  • where we collect it from, and
  • the reasons we rely on in doing so.

Where these reasons include legitimate interests, we explain what these legitimate interests are.

A question mark.

Contacting us

Personal information you give us when you contact us:

  • Name,
  • Email address,
  • Phone number,
  • Organisation Name,
  • Organisational Role,
  • Any supplementary information you choose to submit.

If you want to contact us, you can do so using a form on our website. To allow us to contact you and keep you up to date with your request you must give us a valid email address.

You can also contact us directly by email at hello@thepromise.scot.

We will store your personal information securely on our server and use it to follow up on any requests or to contact you for more information.

Arrows pointing forwards and upwards, suggesting progress.


Personal information you give us when you complete one of our surveys:

  • Name,
  • Email address,
  • Organisation Name,
  • Organisation Role and Function.

We will use Microsoft Forms for sending out surveys, may also use other software packages for this purpose.


We use Matomo to collect standard internet log information and information about how you use the site. The information we collect is:

  • Which web browser you are using,
  • The pages on our website that you visit,
  • The address of the website that you reached us from, including any search term used,
  • Cookie data used to distinguish one user from another,
  • IP addresses, with two bytes anonymised.

The Promise Scotland retains ownership of this information and will not pass it on to third parties.

Arrows pointing forwards and upwards, suggesting progress.


Personal information we collect about you when you organise or register for an event:

  • Name,
  • Email address,
  • Phone number,
  • Address,
  • Job title,
  • Organisation,
  • Dietary requirements,
  • Accessibility requirements.

We may use Eventbrite to collect event registration information, and your personal information will be stored on Eventbrite servers. Access the Eventbrite privacy policy here.

Our legal basis for processing your personal information if you are registering to attend an event is legitimate interest, so we can administer our event and provide you with the information required to attend our event.

Arrows pointing forwards and upwards, suggesting progress.

How do we use the information we collect?

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

  • Where we need to perform the contract we are about to enter into or have entered into with you.
  • Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
  • Where we need to comply with a legal obligation.

The information below explains how we use your personal information and the legal basis that we rely on in doing so.

Where these reasons include legitimate interests, we explain what these legitimate reasons are.

What we use your information for

To deliver our services to you

Our reasons:

  • Legal obligations, and
  • Contractual performance.

To run our organisation in an efficient and proper way

This includes:

  • managing our business capability,
  • planning,
  • communications,
  • corporate governance, and
  • audit.

Our reasons:

  • Legitimate interests, and
  • Legal obligations.

Our legitimate interests:

  • Begin efficient about how we fulfil our legal duties, and
  • Complying with regulations that apply to us.

To exercise our rights set out in contracts and agreements

Our reasons:

  • Contractual performance.

To register your attendance for events

Our reasons:

  • Contractual performance, and
  • Legitimate interest.

Our legitimate interests:

  • Book conference centre space,
  • Provide you with facility updates,
  • Generate and process a contract, invoice or payment,
  • Provide specific requirements, such as those around diet or accessibility,
  • Analyse attendance and usage of the conference centre facilities, and
  • Resolve complaints, queries or disputes, and handle any legal claims.

To administer and run our website

Among what this category includes is:

  • troubleshooting,
  • data analysis,
  • testing,
  • system maintenance,
  • support, and
  • reporting and hosting of data.

Our reasons:

  • Legitimate interest.

Our legitimate interests:

  • To develop and improve the website and the services we offer.

    As The Promise Scotland retains control of the data processed by Matomo, it isn’t used to benefit a third party company. It also isn’t used for profiling, so the impact of processing personal data is very low.

To allow you to sign up for mailing lists

Signing up to a mailing list allows us to send you information about:

  • what we are doing, and
  • meetings and events which you might be interested in.

Our reasons:

  • Legitimate interests, and
  • Contractual performance.

Our legitimate interests:

  • To develop and improve our services.

To help you with any queries you may have

You may have queries around The Promise Scotland, or around the services we offer.

Our reasons:

  • To help you with any queries you may have in relation to The Promise Scotland and the services we offer.

Our legitimate interests:

  • Contractual performance.
Dominoes starting to fall, suggesting impact.

How do I object to the processing of my personal information?

We strive to provide you with choices regarding certain personal data information uses, particularly around marketing and advertising.

You can object at any time to the processing of your Personal Information for direct marketing purposes, and you can do so by “opting-out” of marketing or promotional communications in accordance with the instructions included in the specific communication. If you have questions about how we determine whether the processing is for our legitimate interests, or if you want to object to our processing on that basis, please contact us at DataProtection@thepromise.scot .

Where you ask us to stop sending marketing messages, we may still process your personal information for other purposes in accordance with the terms of this notice.

A question mark.

Disclosure of your personal information

We will not sell your information or disclose it for direct marketing purposes.

We will disclose the personal information we process about you to the following third parties for the purposes indicated below:

Mailchimp email service

Personal information requested

  • name
  • email address
  • IP address


To send you newsletters periodically

The Microsoft Forms service

Personal information requested

Name and email address (if requested)


To allow you to participate in our surveys


Personal information requested

  • name
  • email address
  • address
  • job title
  • organisation
  • phone number
  • access and dietary requirements


To register you for one of our events.

The Promise Scotland Stakeholder Management System (Tractivity)

Personal information requested:

  • name
  • email address
  • address
  • organisation
  • job title
  • organisation
  • phone number
  • access and dietary requirements


  • To register you for one of our events
  • To book a space at the conference centre

Employers’ Organisation

Personal information requested:

  • username,
  • email address,
  • organisation


  • To allow you to access secure area of site,
  • to invoice you for use of service

Disclosure to other parties

In addition, we may disclose your personal information to third parties:

  • If we are under a duty to disclose or share your personal information in order to comply with any legal or regulatory obligation or request.
  • In order to enforce or apply any Terms of Use or other agreements you have agreed to with us or to investigate potential breaches.
  • In order to protect the rights, property or safety of our users or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection.
An exclamation mark.

Where we store your personal information

Personal information you provide to us is stored on computer equipment in the UK with the following exceptions:

  • We use the Mailchimp service to send you periodic newsletters/emails and this means that some of your personal information is transferred to servers in the USA.
  • The Mailchimp service is covered by both the EU-US and Swiss-US Privacy Shield regimes and is used by many EU and worldwide businesses. As such, in our opinion, it poses a minimal threat to your privacy rights and freedoms.

Read more about Mailchimp’s privacy measures on its website.

We use Eventbrite to handle registrations for events. This means that some of your personal information is transferred to the US.

Eventbrite has certified its compliance with the EU-US Privacy Shield regarding collection, use and retention of customer data. As such, in our opinion, it poses a minimal threat to your privacy rights and freedoms.

A dot inside a ring, suggesting safety.

How long will we keep your personal information for?

The following shows what personal information we hold and how long it is held for.

Contact form data

Held for: For as long as it is absolutely necessary

Website analytics logs

Analytic data about our visitors are used to improve our website and services.

Processing of analytic data collected before October 2022

Held for: Analytic data collected before October 2022 was processed and held by Google Analytics, and will be deleted by the end of November 2023.

This may have included processing of visitor personal data, specifically:

  • IP address, and
  • user/device/client/cookie identifiers.

Processing of analytic data collected after October 2022

Held for: Analytic data collected after October 2022 is processed by Matomo on behalf of the Promise Scotland. The Promise Scotland holds ownership of this data, and will retain it for 24 months— after which it will be deleted.

Any personal data – for example IP address or other identifiers – are anonymised.

Event registrations

Held for: Until the event has taken place

A question mark.

Protecting your personal information

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal information, we cannot guarantee the security of your personal information in transit; any transmission is at your own risk.

Once we have received your personal information, we will use strict procedures and security features as outlined above to try to prevent unauthorised access to your personal information.

Third party websites

Our website may, from time to time, contain links to and from the websites of third parties. If you follow a link to any of these websites, please note that these websites and any services that may be accessible through them have their own privacy notices— and that we do not accept any responsibility or liability for these notices, or for any personal information that may be collected through these websites or services, such as contact and location data. Please check these notices before you submit any personal information to these websites or use these services.

A dot inside a ring, suggesting safety.

Your rights

Access to your information

You have the right to request a copy of the personal information about you that we hold.

Correcting your information

We want to make sure that your personal information is accurate, complete and up to date and you may ask us to correct any personal information about you that you believe does not meet these standards.

Deletion of your information

You have the right to ask us to delete personal information about you where:

  • You consider that we no longer require the information for the purposes for which it was obtained
  • We are using that information with your consent and you have withdrawn your consent – see Withdrawing consent to using your information below
  • You have validly objected to our use of your personal information – see Objecting to how we may use your information below
  • Our use of your personal information is contrary to law or our other legal obligations.

Objecting to how we may use your information

You have the right at any time to require us to stop using your personal information for direct marketing purposes. In addition, where we use your personal information to perform tasks carried out in the public interest or pursuant to the legitimate interests of us or a third party then, if you ask us to, we will stop using that personal information unless there are overriding legitimate grounds to continue.

Restricting how we may use your information

In some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to our use of your information. The right might also apply where this is no longer a basis for using your personal information but you don't want us to delete the data. Where this right to validly exercised, we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.


If we process personal information that you provide to us on the basis of consent or because it is necessary for the performance of a contract to which you are party, and in either case that processing is carried out by automated means, then you have the right to have that personal information transmitted to you in a machine-readable format.

Where technically feasible, you also have the right to have that personal information transmitted directly to another controller.

Automated processing

If we use your personal information on an automated basis to make decisions which significantly affect you, you have the right to ask that the decision be reviewed by an individual to whom you may make representations and contest the decision.

This right only applies where we use your information with your consent or as part of a contractual relationship with you

Withdrawing consent using your information

Where we use your personal information with your consent you may withdraw that consent at any time and we will stop using your personal information for the purpose(s) for which consent was given.

Exercising your rights

Please contact us in any of the ways set out in the Contact section if you wish to exercise any of these rights.

Please note that, in certain cases, we may continue to process your personal information after you have withdrawn consent or requested that we delete your personal information, if we have a separate legal basis to do so. For example, we may retain certain information if we need to do so to comply with an independent legal obligation.

Where you have any of these rights under applicable privacy law, we will comply with them. Please note, however, that the scope and detail of particular rights are governed by the law under which they arise and these rights may be qualified and so are not absolute.

If your personal information has been shared with a third party, as described elsewhere in this notice, then that third party has received its own copy of your data. If you have been contacted by one of these third parties and wish to correct or delete your personal information, please contact them directly.

No fee usually required

You will not normally have to pay a fee to access your personal information or to exercise any of the other rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights.)

This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated. To submit a request, please contact us as set forth in the Contact section below.

Two interlocking rings, representing the concept of partnership.

Further information

Changes to privacy notice

Any changes we may make to our privacy notice in the future will be posted on our website and, where appropriate, notified to you when you next visit. The new terms may be displayed on-screen and you may be required to read and accept them to continue your use of our services.


The Senior Operations Manager has responsibility for data protection, and can be contacted by email.


We seek to directly resolve all complaints about how we handle personal information, but you also have the right to lodge a complaint with the Information Commissioner’s Office:


By phone: 03031231113

By post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

Two columns holding up a downward pointing triangle, suggesting support.