Our approach to your privacy
We want you to feel confident about sharing your personal data with us and to know that your information will be handled correctly. We work to be clear about what we do with your personal data, to keep your information secure and to earn your trust.
This notice tells you about who we are and what we do with your data.What is this privacy notice for?
Scotland Innovates is the name of the web-based portal allowing individuals [over 18]:
- to access information on innovation for the public sector in Scotland
- to register and, once registered, to submit proposed innovations that they wish to have assessed by representatives of the Scottish public sector.
Who we are
Scotland Innovates is a website provided by NHS National Services Scotland (NHS NSS for short). We are part of NHS Scotland and provide support services on behalf of the Scottish Government. NSS operate this portal on behalf of the Scottish Government and we are joint data controllers with the Scottish Procurement and Property Directorate (SPPD) of the Scottish Government. NSS and the SPPD are joint data controllers of this service.
The term "data controller" means that we are responsible for what happens to your personal data when you use this service.
In providing this service we use the services of other organisations as listed below. These organisations are “data processors”. A processor is an organisation responsible for processing personal data on behalf of a controller.
Microsoft Azure - Microsoft Azure provides IT systems that we use to host the service portal. Microsoft Azure Cloud Services provide the platform that the Scotland Innovates portal operates upon. Microsoft Azure does not have direct access to your personal information.
Gov.Uk Notify – is used to send notifications by the system. Gov.Notify provides a notification service that has been built for the needs of government services. It has processes in place to protect your data (e.g. email and text messages encrypted). Staff have Security Check (SC) clearance from United Kingdom Security Vetting (UKSV).
The Scotland Innovates service collects your personal data when you use the website, including when you register as an innovator or assessor of innovations. The rest of this privacy notice tells you more about what we collect and what we do with it.
(Note: Sometimes we refer to your information as "personal data")
The data we need and how we will use it
The Scotland Innovates service collects the following personal data about you on this website:
- Data that you give us voluntarily by registering as a user and completing and submitting online forms.
- Data that we collect about you by automatically logging some technical information about all visits to the site. This includes, for example, the type of device you use to access the site and the IP address used to connect your device to the Internet, browser type and version, time zone setting, browser plug-in types and versions, operating system you are using. In this document, we refer to this information we collect as Technical Information. Technical information is not normally used in a way that can be used to identify you as an individual.
Any information, which you provide via this website is not made available to any third parties other than to approved assessors who are registered with the service, to whom we will give information about your assessment.
Any information provided to us is used for the purpose of responding to and processing your innovation submissions and for communicating with you in regard to these.
We collect some data about the use and performance of the service – we use cookies to do this. In general, we use information from cookies to maintain consistency within a user’s session and to give us information on how the service is used to enable us to make informed improvements to it. Please see our cookie statement for details on the purpose and use of the individual cookies that we use.
If you choose to register as an innovator or assessor of innovations, we collect some more information. Registering as a user is voluntary and we only collect and store this information when you complete the online registration forms.
The personal data you give us will be used to associate the innovations you submit with you and to contact you in relation to the progress of your innovation through the innovation process.
When you register, we collect the following personal information:
Account Information
Unique Username: we use your email address as your unique user name for the system.
Password: This is a password chosen by you
Contact Information
Your name
Your contact email address: this is used as your username within the system
Your contact phone number
Other Information
Details of the organisation you are associated with, if relevant.
We also collect the information that you wish to give us when you submit an innovation and your confirmation that you accept the terms and conditions of the service. You will only be able to register as a user on acceptance of these terms and conditions.
Retaining your data
If you have submitted an innovation for consideration, we will continue to hold your name and organisation affiliation in association with the submission for 5 years after the completion of the assessment of your submission. Thereafter it will be deleted.
We will hold your user profile information you give us only for as long as you are registered as a user of the system (5 years). We will hold information provided through a submission for 5 years, and then it will be deleted. Lastly, if your submission is partially complete, and the responsibility sits with the innovator to provide more information, where this is incomplete for more than 3 months it will be deleted.
We may retain non-personal information relating to your enquiry for the purposes of measuring the performance of the service, such as how long it took to resolve your query. This will not contain any of your personal information.
Your rights
Under the UK GDPR and Data Protection Act 2018, you have the following rights:
- The right to be informed.
- The right of access.
- The right to rectification.
- The right to erasure.
- The right to restriction of processing
- The right to data portability
- The right to object.
- Rights in relation to automated decision-making.
- The right to lodge a complaint with the supervisory body.
Some of these rights are not absolute and may not apply in all circumstances. Requests are considered on a case-by-case basis.
Purpose and legal basis for processing
The purpose of this website is to assist the public in submitting information on an innovation so that it can be assessed for suitability for further action within the public sector in Scotland.
The legal basis for processing is the performance of a public task, that is to say that it is carried out in line with :
“processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller” in article 6 1 (e) of GDPR UK https://www.legislation.gov.uk/eur/2016/679/article/6
Keeping information secure
We invest significant resources to protect your personal information, from loss, misuse, unauthorised access, modification or disclosure. However, no internet-based site can be 100% secure and so we cannot be held responsible for unauthorised or unintended access that is beyond our control.
This website Data Controller
For enquiries related to data protection please contact the Scotland Innovates team in the first instance, then NSS.dataprotection@nhs.scot and DataProtectionOfficer@gov.scot
To raise a complaint with the Information Commissioner’s Office (ICO) as the supervisory body in the UK, contact:
Information Commissioner’s Office
Postal Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone number: 0303 123 1113
Website: www.ICO.org.uk