Yoruba Community in Scotland
Effective date: 16/12/2025
- Introduction
The Yoruba Community in Scotland (“we”, “us”, “our”) is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect personal information in accordance with:
- The UK General Data Protection Regulation (UK GDPR)
- The Data Protection Act 2018
- Guidance issued by the Information Commissioner’s Office (ICO)
This policy is designed to meet expectations commonly required by funders, banks, local authorities, and partner organisations.
- Our Legal Status
The Yoruba Community in Scotland operates as a Scottish Charitable Incorporated Organisation (SCIO)
For data protection purposes, the Yoruba Community in Scotland acts as the Data Controller, meaning we decide how and why personal data is processed.
- Contact Details and Data Protection Lead
If you have questions about this policy or how your data is used, you can contact us:
Email: [Insert contact email]
Phone: [Insert contact number]
Postal address: [Insert address]
Data Protection Lead (or Committee):
[Insert role/title – e.g. Chairperson, Secretary, Trustee]
- Personal Data We Collect
In line with the ICO’s data minimisation principle, we only collect personal data that is necessary. This may include:
- Names and contact details (email, phone number, address)
- Membership, volunteer, or trustee details
- Event registrations and attendance records
- Communications with us (emails, forms, feedback)
- Emergency contact information (where relevant)
- Photographs or video recordings (with consent)
- Financial records where required for governance or audit purposes
- Special Category Data
We may occasionally process special category data as defined under UK GDPR, such as:
- Ethnic or cultural background (to support the aims of the community)
- Health or accessibility needs (to make reasonable adjustments)
This data is only processed where:
- Explicit consent has been provided, or
- Another lawful condition applies (e.g. vital interests or safeguarding)
- How We Use Personal Data
We process personal data for the following purposes:
- Managing membership, volunteers, trustees, and supporters
- Delivering cultural, educational, and social activities
- Communicating updates, events, and opportunities
- Meeting funding, reporting, and governance requirements
- Managing safeguarding and welfare responsibilities
- Complying with legal and regulatory obligations
Personal data is not used for any purpose that is incompatible with these aims.
- Lawful Bases for Processing
In line with ICO guidance, we rely on the following lawful bases under Article 6 UK GDPR:
- Consent – where individuals have clearly agreed
- Legitimate interests – for running and managing the organisation
- Legal obligation – including charity law, financial, or safeguarding duties
- Vital interests – in emergency situations
Where consent is used, it can be withdrawn at any time.
- Sharing Personal Data
We do not sell personal data.
We may share data only where necessary and proportionate, including:
- With trustees, committee members, or authorised volunteers
- With service providers (e.g. event booking platforms, IT support)
- With funders or regulators where required
- With statutory authorities where required by law
All third parties are required to handle data securely and lawfully.
- Data Security Measures
In accordance with Article 32 UK GDPR, we implement appropriate security measures, including:
- Secure electronic storage and password protection
- Restricted access on a need-to-know basis
- Secure storage of paper records
- Training and guidance for trustees and volunteers
- Data Retention
We retain personal data only for as long as necessary, following ICO guidance and charity governance requirements:
- Membership and volunteer records: while active and up to [insert period] after leaving
- Event records: up to [insert period, e.g. 12 months]
- Financial and governance records: in line with statutory retention requirements
Data is securely deleted, destroyed, or anonymised when no longer required.
- Your Data Protection Rights
Under UK GDPR, you have the right to:
- Request access to your personal data
- Request rectification of inaccurate data
- Request erasure (where applicable)
- Restrict or object to processing
- Withdraw consent at any time
- Lodge a complaint with the Information Commissioner’s Office (ICO)
ICO contact:
Information Commissioner’s Office
Website: www.ico.org.uk
- Images, Media, and Communications
Photos or videos may be taken at events for reporting or promotional purposes. We will only use these where consent has been provided, and consent may be withdrawn at any time.
- Children and Young People
We take additional care when processing data relating to children. Parental or guardian consent will be obtained where required, and safeguarding principles are applied at all times.
- Policy Review and Updates
This Privacy Policy is reviewed regularly by the trustees or committee and updated when necessary to reflect changes in law, ICO guidance, or organisational activities.
- Contact Us
If you have any concerns about how your personal data is handled, please contact us using the details above. We aim to resolve all matters promptly and fairly.
