Privacy

We take the security and privacy of your personal information very seriously. This privacy policy will give you a clear understanding of what kinds of personal information we collect, how we use the personal information that you provide and our measures for protecting it. The policy will also outline your subject access rights and the options you have to control your personal information and protect your privacy.

 

Privacy Policy Content

1. Who We Are
2. Personal Information We May Collect About You
3. How We Collect Your Personal Information
4. How We Use Your Personal Information
5. How We Protect Your Personal Information
6. Who We May Share Your Personal Information With
7. How Long We Keep Your Personal Information
8. Information for Job Applicants
9. Information for Former Employees
10. Your Individual Rights
11. Our Cookies
12. Contact Us

 

1. Who We Are

This privacy policy applies to The MDS Estates Ltd and its subsidiaries and affiliated entities, and are collectively referred to as “The MDS Estates Ltd,” “we,” “us” or “our” in this policy.

Any questions in relation to this privacy policy should be sent to dataprotection@buccleuch.com or addressed to Data Protection, 27 Silvermills Court, Henderson Place Lane, Edinburgh, EH3 5DG.

 

2. Personal Information We May Collect About You

We will only collect the personal information that we need, and this may include:

• Information about who you are e.g. your name, date of birth and contact details.
• Information in connection with specific activities such as event registration, donations, volunteering, employment etc.
• Information about your correspondence with us e.g. meetings, phone calls, emails/letters.
• Information that is automatically collected e.g. via cookies when you visit one of our websites.
• Information that is automatically collected via log files e.g. IP address, browser type, Internet service provider, referring/exit pages, and date/time stamps.
• Information if you visit one of our sites e.g. visual images collected via (CCTV).
• Information classified as ‘sensitive’ personal information e.g. relating to your health, marital or civil partnership status. This information will only be collected and used where it is needed to provide the product or service you have requested or to comply with our legal obligations.

 

3. How We Collect Your Personal Information

We collect your personal information in a number of ways, and depends on how you interact with us.

• When you contact us (email, call or write to us).
• When you register for an event or sign up for one of our services.
• When you visit our website or engage with our social media channels.
• When you sign up to receive email updates or our e-newsletter subscription list.
• When you participate in any of our competitions or promotions.
• When you make a purchase from us.
• When you apply for a job or volunteer for us.

 

4. How We Use Your Personal Information

We take your privacy and the protection of your personal information seriously, and we will only ever collect and use personal information where it is necessary, fair and lawful to do so. We’ll collect and use your personal information for a variety of different purposes, including:

• To respond to any correspondence including your requests, enquiries, or comments.
• To engage with you in relation to any events, promotions, services, etc., that you have signed up for.
• To send you marketing communications on the provision that you have provided consent to do so.
• To process any applications that you send us; volunteering applications, etc.

 

5. How We Protect Your Personal Information

We take the security of your personal information very seriously. We have adopted appropriate safeguards to ensure the data we collect, store or process, whether on paper, online or any other media, is protected in line with our data protection obligations.

We have implemented appropriate technical and organisational security measures, including on-going training, to protect your personal information against any unauthorised or unlawful processing and against any loss or damage through accident, negligence or deliberate actions.

Our security measures have been developed in line with industry standards and good practice, safeguarding against the risks to the privacy, integrity and availability of your personal information.

 

6. Who We May Share Your Personal Information With

We do not sell your personal information; however, we do share it with third parties when necessary. When sharing your information, we ensure to maintain control of what they can access, how long they can access and what they are permitted to do.

Where necessary, personal information collected and processed by us may be shared with the following:

• The MDS Estates Ltd employees and volunteers.
• Third party hosting and IT infrastructure providers who host the website and provide IT support in respect of the website.
• Third party marketing communication providers.

 

7. How Long We Keep Your Personal Information

We will only use and store your information for as long as it is required for the purposes it was collected for. How long it will be stored for depends on the information in question, what it is being used for and, sometimes, statutory legal or regulatory requirements.

We look to find ways to reduce the amount of information we hold and the length of time that we need to keep it. For example:

• We aim to utilise a paperless approach where possible and securely destroy any paper correspondence we receive in accordance with our data retention policy, with the exception where we are required to retain it for evidential or legal purposes.
• We retain a marketing suppression list of individuals who no longer wish to be contacted by us indefinitely. We require this information to comply with their wishes not to contact them in future.

 

8. Information for Job Applicants

As part of our candidate application and recruitment process we will only collect, process and store personal information about you that is required to manage and progress your application, consider your suitability for employment, respond to queries, consider you for alternative roles, demonstrate a fair recruitment process or as required by law or other regulatory obligations.

Information we collect will include your name and contact details, work history, education history and professional qualifications and skills, former employer feedback, right to work information, photographs or images from onsite CCTV if you attend an interview, results of pre-employment screening checks such as criminal records checks where permitted under law, assessment results e.g. psychometric assessment results where applicable; and any other information you provide directly, via an agency or is provided by a referee on your behalf.

We may also collect, process and store personal information relating to your health or disability in order to make reasonable adjustments to enable you to apply for a role and to assess adjustments required to fulfil the requirements of the role.

We will share your information internally within the HR team and with managers or other employees who are involved in the recruitment and selection process. In some cases we may need to share your information with third parties including:

• Companies who provide assessment services.
• Organisations who carry out background checks permitted within the law, such as criminal record or fraud checks.
• Academic institutions in validating information you have provided about your qualifications.
• Referees that you provide in order to obtain a reference.
• Our employment lawyers if we are required to demonstrate a fair recruitment and selection process.
• Other third party organisations who provide services that allow us to determine the suitability of your appointment to a role.

For unsuccessful candidates, we will store your data for up to one year in order to be able to demonstrate a fair recruitment process, respond to your queries and consider your suitability for alternative roles.

For successful candidates, information collected during the recruitment process will form part of your employment record and held in accordance with an employee privacy notice that we will make available to you.

 

9. Information for Former Employees

When your employment ends, we will store your data gathered throughout your employment for up to 7 years, and in some cases beyond. Your data may include some or all of:

• • Your contact details
  • Personal details such as marital status, sex, nationality and date of birth
  • Evidence of your right to work in the UK
  • Your employment history, contractual changes and information relating to your education, qualifications, professional membership and training
  • Information about your performance
  • Absence records
  • Information relating to your beneficiaries, emergency contacts and dependent children
  • Financial data, including your bank account details, pension records, payroll records, payments we have made to you, deductions (both statutory and voluntary), wages arrestment orders and national insurance and tax records
  • Your image by way of photographs or captured by CCTV
  • Criminal convictions (where permitted by law)
  • Information about health conditions and disabilities
  • Details of any disciplinary or grievance matters you were subject to or witness to
    • Membership of employee benefit schemes

This information will have been collected during your employment from you, your manager or other appropriate employee, third party organisations such as HMRC or DVLA.

We will retain this information after your employment for up to seven years in order to communicate with you as required, provide references on your behalf, comply with our statutory or regulatory obligations, fulfil outstanding contractual obligations with you, defend a claim made against us and otherwise in the legitimate interests of our business in compliance with GDPR.

We will retain information beyond seven years if required to comply with a statutory or regulatory obligation to do so, for example, information relating to pension records, certain safety training or records of accident or injury you were involved in or witness to; and in order to provide a reference when your new employer to request one from us.

Your information is retained in order to fulfil any statutory or regulatory obligations, demonstrate compliance with statutory or regulatory obligations and to defend any action brought against the company relating to you, or a matter you were involved in or witness to, and in the legitimate interest of our business as defined by GDPR.

We may share your information with third parties after your employment where there is a statutory or regulatory obligation for us to do, when asked to provide a reference or with our legal advisors in so far as the information relates to a legal matter or claim against us.

 

10. Your Individual Rights

There are several rights as a customer, visitor, job applicant, former employee or any other type of data subject, you have to gain access to or amend the information that we hold on you. These rights are:

• Right to be Informed;
• Right of Access to your data;
• Rights related to automated decision making including profiling;
• Right to object;
• Right to be forgotten / erasure;
• Right to data portability;
• Right to restrict processing;
• Right for your information to be rectified

If you would like further information on your rights, or you wish to exercise the rights mentioned above then please do not hesitate to contact us at:
Data Protection,
27 Silvermills Court,
Henderson Place Lane,
Edinburgh,
EH3 5DG

Or email us at: dataprotection@buccleuch.com

 

11. Our Cookies

Cookies are small, often encrypted, text files, which are stored on your computer when you visit some websites. They are used to remember useful information which allows certain functionality within the website to work, for example remembering where you have reached within an order process, or if you’ve logged in to a site. Cookies can’t harm your computer.

We use the following cookies on this website:

Google cookies

Name	Data processor	Description	Expiry
_ga	.bowhillhouse.co.uk	Google Analytics: distinguishes between users	3 years
_gid	.bowhillhouse.co.uk	Google Analytics: distinguishes between users	2 days
_gat	.bowhillhouse.co.uk	Google Analytics: used to throttle request rate	1 day
CONSENT	.gstatic.com		20 years

Sharethis cookies

Name	Data processor	Description	Expiry
__stid	.sharethis.com	ShareThis is used to provide social sharing options	5 months

Tripadvisor cookies

Name	Data processor	Description	Expiry
ServerPool, TACds, TASession	.tripadvisor.co.uk	Used for viewing embedded content from TripAdvisor, including payment of referral commission fees and user tracking across websites.	None
TATravelInfo	.tripadvisor.co.uk	Used for viewing embedded content from TripAdvisor, including payment of referral commission fees and user tracking across websites.	16 days
TAUD	.tripadvisor.co.uk		16 days
TAUnique, PMC	.tripadvisor.co.uk		2 years
SRT	.tripadvisor.co.uk		None
TART	.tripadvisor.co.uk		7 days
TASSK	.tripadvisor.co.uk		6 months

Session cookies

Name	Data processor	Description	Expiry
wfvt_	.bowhillhouse.co.uk	These contain information about your general geographic location	1 day

Wordfence cookies

Name	Data processor	Description	Expiry
wordfence_verifiedHuman	.bowhillhouse.co.uk	This Wordfence cookie is a Wordfence security plug-in used to protect the Site against malicious attacks	2 days

Most web browsers allow some control of most cookies through the browser settings. To find out more about cookies, including how to see what cookies have been set, visit www.aboutcookies.org or www.allaboutcookies.org.

Find out how to manage cookies on popular browsers:

Google Chrome
Microsoft Edge
Mozilla Firefox
Microsoft Internet Explorer
Opera
Apple Safari

To find information relating to other browsers, visit the browser developer’s website.

To opt out of being tracked by Google Analytics across all websites, visit http://tools.google.com/dlpage/gaoptout.

 

12. Contact Us

If you have any questions, would like to report a problem or exercise your subject access right, please contact us by email at dataprotection@buccleuch.com or in writing at:

Data Protection,
27 Silvermills Court,
Henderson Place Lane,
Edinburgh,
EH3 5DG.

 

This Policy was last updated on 5th July 2018.