hello
SAMS Ltd./CCAP is committed to protecting the privacy and security of your personal information.
This privacy notice describes how we collect and use personal information about you during and after your relationship with us, in accordance with the General Data Protection Regulations (GDPR).
Under the terms of the GDPR, our reason for collecting data is 'Contract', whereby we collect certain personal data in order for us to effectively meet the commitments and contractual obligations of our service collection/supplier relationship.
SAMS Ltd./CCAP is a 'data controller'. This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.
This notice applies to current and former customers. This notice does not form part of any contract to provide services. We may update this notice at any time.
It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.
We shall comply with data protection law. This says that the personal information we hold about you must be:
Personal data, or personal information, means any information about an individual from which they are identifiable. It does not include data where the identity has been removed (anonymous data).
We typically collect personal information through the customer ordering process, and via applications to deposit strains etc.
Before you disclose to us the personal information of another person, you must obtain that person's consent to both the disclosure and the processing of that personal information in accordance with this policy.
We shall only use your personal information when the law allows us to. Most commonly, we shall use your personal information in the following circumstances:
1. Where we need to perform the commitments we have made you.
2. Where we need to comply with a legal or regulatory obligation.
3. Where it is necessary for our legitimate interests and your interests and fundamental human rights do not override those interests.
We may also use your personal information in the following situations, which are likely to be rare:
1. Where we need to protect your interests (or someone else's interests).
2. Where it is needed in the public interest or for official purposes.
You can inform us at any time if you no longer wish to receive any or specific communication from us. [Please contact us by email at DPE@sams.ac.uk, or by writing to the Data Privacy Manager.]
We shall not, without your express consent, supply your personal information to any third party for the purpose of their own, or any third parties direct marketing.
If you fail to provide certain information when requested, we may not be able to perform the commitments of our service collection/supplier relationship with you.
We shall only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.
If we need to use your personal information for an unrelated purpose, we shall notify you and we shall explain the legal basis that allows us to do so.
We may disclose your personal information to any of our officers or agents insofar as reasonably necessary for the purposes set out in this notice.
We may have to share your data with third parties, including third-party service providers. If so, we require third parties to repect the security of your data and to treat it in accordance with the law.
We may transfer your personal information outside the EU. If we do, you can expect a similar degree of protection in respect of your personal information.
We may disclose your personal information:
We may transfer your personal information outside of the European Economic Area (EEA) for the purposes described in this policy. If we do this, we shall do so using one of the adequate safeguards permitted by regulators for transfers of personal data outside of the EEA.
Personal information that you submit for publication on our website may be available, via the internet, around the world. We cannot prevent its use or misuse by others.
Our website includes hyperlinks to, and details of, third party websites, some of which may be hosted outside of the EEA. We have no control over, and are not responsible for, the privacy policies and practices of third parties.
We have put in place measures to protect the security of your information. Details of these measures are available upon request from our Data Privacy Manager through DPE@sams.ac.uk
Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and keep it secure.
We shall take reasonable technical and organisational precautions to prevent the loss, misuse or alteration of your personal information.
We shall store all the personal information you provide on secure (password- and firewall-protected) servers. A third party may operate these.
Transmission of information over the internet is inherently insecure, and we cannot guarantee the security of data sent over the internet.
All electronic financial transactions entered into through our website will be protected by encryption technology.
Website financial transactions are handled through our payment services provider. You can review their privacy policy at: SAMS WEBSITE HAS BoS DETAILS - OURS IS WHAT, SECPAY? We shall share information with our payment services provider only to the extent necessary for the purposes of processing payments you make via our website, refunding such payments and dealing with complaints and queries relating to such payments and refunds.
We use cookies on our website to enable the use of a shopping cart for culture/media purchase and to improve the website's useability. (AND TO GATHER WEBSITE USAGE DATA?) Cookies do not typically contain any information that personally identifies a user, but personal information that we store about you may be linked to the information stored in and obtained by cookies. [If you block cookies, you may not be able to use all the features on our website.]
Where payment is made via bank transfer, details are held by the bank on the Bank of Scotland's secure server. We do not have access to account details of any payees paying us through the bank.
This section sets out our data retention policies and procedure. These are designed to help ensure that we comply with our obligations in relation to the retention and deletion of personal information.
We shall only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal (including fraud), accounting or reporting requirements. This will generally be for no more than seven years.
In some circumstances, we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notic to you.
Under certain circumstances, by law you have the right to:
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights).
You have the right to access your personal data held by SAMS Ltd./CCAP. If you wish to receive a copy of your personal data, please submit a Data Access Form LINK.
One of the fundamental principles underpinning data protection is that the data that SAMS Ltd./CCAP processes about you will be accurate and up to date. You have the right to have your data corrected if it is inaccurate or incomplete. If you wish to have your data rectified, you should do so by completing the Data Rectification Form LINK.
SAMS Ltd./CCAP will respond to a data rectification request within one month. Where the data rectification request is complex, SAMS Ltd./CCAP may extend the timescale for response from one month to three months. If this is the case, SAMS Ltd./CCAP will write to you within one month of receipt of the request explaining the reason for the extension.
If the response to your request is that SAMS Ltd./CCAP will take no action, you will be informed of the reasons and of your right to complain to the Information Commissioner's Office (ICO).
Where any data that has been rectified was disclosed to third parties in its unrectified form, SAMS Ltd./CCAP will inform the third party of the rectification where possible. SAMS Ltd./CCAP will also inform you of the third parties to whom the data was disclosed.
You have the right to have your data deleted and removed from our systems where there is no compelling business reason for SAMS Ltd./CCAP to continue to process it. If you wish to make a request for data deletion, you should complete the Data Deletion Request LINK.
Upon receipt of a request, SAMS Ltd./CCAP will delete the data unless it is processed for SAMS Ltd./CCAP to comply with a legal requirement or in the performance of a task carried out in the public interest or exercise of official authority.
Where the data which has been deleted has been shared with third parties, SAMS Ltd./CCAP will inform those third parties where this is possible. However, where this notification will cause a disproportionate effect on SAMS Ltd./CCAP, this notification may not be carried out.
SAMS has appointed a Data Privacy Manager to oversee compliance with this privacy notice. If you have any questions about how we handle your personal information, please contact the Data Privacy Manager: DPE@sams.ac.uk. You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues.
We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.
In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact the Data Privacy Manager, through DPE@sams.ac.uk. Once we have received notification that you have withdrawn your consent, we shall no longer process your information for the purpose(s) you originally agreed to, unless we have another basis for doing so in law.
If you have any questions about this privacy notice, please contact the Data Privacy Manager, through DPE@sams.ac.uk or in writing.
Last updated: 30 May 2018