Privacy policy

Introduction

We take the security and privacy of your personal information very seriously. This privacy policy will give you a clear understanding of what kinds of personal information we collect, how we use the personal information that you provide and our measures for protecting it. The policy will also outline your subject access rights and the options you have to control your personal information and protect your privacy.

GENERAL PRIVACY POLICY

Policy Content:

Who We Are
Personal Information We May Collect About You
How We Collect Your Personal Information
How We Use Your Personal Information
How We Protect Your Personal Information
Who We May Share Your Personal Information With
How Long We Keep Your Personal Information
Information for Job Applicants
Information for Former Employees
Your Individual Rights
Our Cookies
Contact Us

Who We Are

This privacy policy applies to MDS Group Investments Ltd and its subsidiaries and affiliated entities, and are collectively referred to as “MDS Group Investments Ltd,” “we,” “us” or “our” in this policy.

Any questions in relation to this privacy policy should be sent to dataprotection@buccleuch.com or addressed to Data Protection, 27 Silvermills Court, Henderson Place Lane, Edinburgh, EH3 5DG.

Personal Information We May Collect About You

We will only collect the personal information that we need, and this may include:

Information about who you are e.g. your name, date of birth and contact details
Information in connection with specific activities such as event registration, donations, volunteering, employment etc.
Information about your correspondence with us e.g. meetings, phone calls, emails/letters
Information that is automatically collected e.g. via cookies when you visit one of our websites
Information that is automatically collected via log files e.g. IP address, browser type, Internet service provider, referring/exit pages, and date/time stamps.
Information if you visit one of our sites e.g. visual images collected via (CCTV)
Information classified as ‘sensitive’ personal information e.g. relating to your health, marital or civil partnership status. This information will only be collected and used where it is needed to provide the product or service you have requested or to comply with our legal obligations.

How We Collect Your Personal Information

We collect your personal information in a number of ways, and depends on how you interact with us.
When you contact us (email, call or write to us).
When you register for an event or sign up for one of our services.
When you visit our website or engage with our social media channels.
When you sign up to receive email updates or our e-newsletter subscription list.
When you participate in any of our competitions or promotions.
When you make a purchase from us.
When you apply for a job or volunteer for us.

How We Use Your Personal Information

We take your privacy and the protection of your personal information seriously, and we will only ever collect and use personal information where it is necessary, fair and lawful to do so. We’ll collect and use your personal information for a variety of different purposes, including:

To respond to any correspondence including your requests, enquiries, or comments.
To engage with you in relation to any events, promotions, services, etc., that you have signed up for.
To send you marketing communications on the provision that you have provided consent to do so.
To process any applications that you send us; volunteering applications, etc.

How We Protect Your Personal Information

We take the security of your personal information very seriously. We have adopted appropriate safeguards to ensure the data we collect, store or process, whether on paper, online or any other media, is protected in line with our data protection obligations.

We have implemented appropriate technical and organisational security measures, including on- going training, to protect your personal information against any unauthorised or unlawful processing and against any loss or damage through accident, negligence or deliberate actions.

Our security measures have been developed in line with industry standards and good practice, safeguarding against the risks to the privacy, integrity and availability of your personal information.

Who We May Share Your Personal Information With

We do not sell your personal information; however, we do share it with third parties when necessary. When sharing your information, we ensure to maintain control of what they can access, how long they can access and what they are permitted to do.

Where necessary, personal information collected and processed by us may be shared with the following:

MDS Group Investments Ltd employees and volunteers.
Third party hosting and IT infrastructure providers who host the website and provide IT support in respect of the website.
Third party marketing communication providers.

How Long We Keep Your Personal Information

We will only use and store your information for as long as it is required for the purposes it was collected for. How long it will be stored for depends on the information in question, what it is being used for and, sometimes, statutory legal or regulatory requirements.

We look to find ways to reduce the amount of information we hold and the length of time that we need to keep it. For example:

We aim to utilise a paperless approach where possible and securely destroy any paper correspondence we receive in accordance with our data retention policy, with the exception where we are required to retain it for evidential or legal purposes.
We retain a marketing suppression list of individuals who no longer wish to be contacted by us indefinitely. We require this information to comply with their wishes not to contact them in future.

Information for Job Applicants

As part of our candidate application and recruitment process we will only collect, process and store personal information about you that is required to manage and progress your application, consider your suitability for employment, respond to queries, consider you for alternative roles, demonstrate a fair recruitment process or as required by law or other regulatory obligations.

Information we collect will include your name and contact details, work history, education history and professional qualifications and skills, former employer feedback, right to work information, photographs or images from onsite CCTV if you attend an interview, results of pre-employment screening checks such as criminal records checks where permitted under law, assessment results
e.g. psychometric assessment results where applicable; and any other information you provide directly, via an agency or is provided by a referee on your behalf.
We may also collect, process and store personal information relating to your health or disability in order to make reasonable adjustments to enable you to apply for a role and to assess adjustments required to fulfil the requirements of the role.

We will share your information internally within the HR team and with managers or other employees who are involved in the recruitment and selection process. In some cases we may need to share your information with third parties including:

Companies who provide assessment services
Organisations who carry out background checks permitted within the law, such as criminal record or fraud checks
Academic institutions in validating information you have provided about your qualifications
Referees that you provide in order to obtain a reference
Our employment lawyers if we are required to demonstrate a fair recruitment and selection process
Other third party organisations who provide services that allow us to determine the suitability of your appointment to a role.

For unsuccessful candidates, we will store your data for up to one year in order to be able to demonstrate a fair recruitment process, respond to your queries and consider your suitability for alternative roles.

For successful candidates, information collected during the recruitment process will form part of your employment record and held in accordance with an employee privacy notice that we will make available to you.

Information for Former Employees

When your employment ends, we will store your data gathered throughout your employment for up to 7 years, and in some cases beyond. Your data may include some or all of:

Your contact details
Personal details such as marital status, sex, nationality and date of birth
Evidence of your right to work in the UK
Your employment history, contractual changes and information relating to your education, qualifications, professional membership and training
Information about your performance
Absence records
Information relating to your beneficiaries, emergency contacts and dependent children
Financial data, including your bank account details, pension records, payroll records, payments we have made to you, deductions (both statutory and voluntary), wages arrestment orders and national insurance and tax records
Your image by way of photographs or captured by CCTV
Criminal convictions (where permitted by law)
Information about health conditions and disabilities
Details of any disciplinary or grievance matters you were subject to or witness to
Membership of employee benefit schemes.

This information will have been collected during your employment from you, your manager or other appropriate employee, or third party organisations such as HMRC or DVLA.

We will retain this information after your employment for up to seven years in order to communicate with you as required, provide references on your behalf, comply with our statutory or regulatory obligations, fulfil outstanding contractual obligations with you, defend a claim made against us and otherwise in the legitimate interests of our business in compliance with GDPR.
We will retain information beyond seven years if required to comply with a statutory or regulatory obligation to do so, for example, information relating to pension records, certain safety training or records of accident or injury you were involved in or witness to; and in order to provide a reference when your new employer requests one from us.

Your information is retained in order to fulfil any statutory or regulatory obligations, demonstrate compliance with statutory or regulatory obligations and to defend any action brought against the company relating to you, or a matter you were involved in or witness to, and in the legitimate interest of our business as defined by GDPR.
We may share your information with third parties after your employment where there is a statutory or regulatory obligation for us to do, when asked to provide a reference or with our legal advisors in so far as the information relates to a legal matter or claim against us.

Your Individual Rights

There are several rights as a customer, visitor, job applicant, former employee or any other type of data subject, you have to gain access to or amend the information that we hold on you. These rights are:

Right to be Informed;
Right of Access to your data;
Rights related to automated decision making including profiling;
Right to object;
Right to be forgotten / erasure;
Right to data portability;
Right to restrict processing;
Right for your information to be rectified

If you would like further information on your rights, or you wish to exercise the rights mentioned above then please do not hesitate to contact us at:

Data Protection,
27 Silvermills Court, Henderson Place Lane, Edinburgh,
EH3 5DG

Or email us at: dataprotection@buccleuch.com

Our Cookies

Cookies are small, often encrypted, text files, which are stored on your computer when you visit some websites. They are used to remember useful information which allows certain functionality within the website to work, for example remembering where you have reached within an order process, or if you’ve logged in to a site. Cookies can’t harm your computer.

Most web browsers allow some control of most cookies through the browser settings. To find out more about cookies, including how to see what cookies have been set, visit www.aboutcookies.org or www.allaboutcookies.org.

Find out how to manage cookies on popular browsers:

To find information relating to other browsers, visit the browser developer’s website. To opt out of being tracked by Google Analytics across all websites, visit http://tools.google.com/dlpage/gaoptout.

Contact Us

If you have any questions, would like to report a problem or exercise your subject access right, please contact us by email at dataprotection@buccleuch.comor in writing at:

Data Protection,
27 Silvermills Court, Henderson Place Lane,
Edinburgh,
EH3 5DG.

Date: 15^th January 2025

Review

This Policy will be reviewed, and if appropriate updated annually. This Policy was last updated on 15^th January 2025.

Interested in finding out more?