European Union General Data Protection Regulation legislation (EU GDPR) sets out comprehensive requirements for all companies handling the personal data of EU citizens. BECTU Vision (‘we’, ‘us’) complies with General Data Protection Regulations (GDPR) and any other applicable data protection legislation in the UK. We take our data privacy responsibilities very seriously at BECTU Vision and we want you to understand and feel confident about how we collect, store and handle your personal data.

About BECTU

BECTU is a sector of Prospect. In accordance with guidance issued by the Information Commissioner’s Office (ICO), Prospect is a “data controller” for the purposes of your personal data. Prospect’s main privacy policy can be found at prospect.org.uk/privacy. Prospect is committed to protecting your privacy and complying with our obligations under the GDPR and Data Protection Act 2018.

Data Collection and Retention

We hold the following details of people who have signed up to our mailing list(s):

• Name and email address

Those on the mailing list can unsubscribe at any time.

We hold the following details of people who have have requested or received 1:1 advice:

• Contact details
• Records of email exchanges and phone calls
• CV

These details will be held for 2 years in order to support new entrants with their early career development.

We hold the following details of people who have applied for, and/or attended our training courses or events:

• Address and contact details
• Copies of completed application and registration forms
• Records of which courses and events they applied to and/or attended
• Records of email exchanges and phone calls

These details will be kept for 5 years which allows us to track course attendances – and let unsuccessful applicants know if we run the course again.

We hold the following details of tutors, guest speakers and suppliers who have delivered our training courses and supported our organisation with their services:

• Address and contact details
• Fees and bank details
• Records of which courses they have delivered/services they’ve provided
• Record of email exchanges and phone calls

These details will be kept for 6 years for accounting purposes.

We collect information about the services Website & Social Media Visitors use and how you use them when you browse our website and social media platforms.  Our website collects a range of data from users who access the site. You can see our website & Social media cookies page here. We use this data to continuously improve the services and information provided on our website and social media platorms. There are some options for data tracking that you can turn off, such as the collection of Google Analytics data. Other options cannot be turned off in order for our website to function effectively. Our cookies page explains which options can be turned off.

To maintain our website and its systems and ensure their security, technicians and specialists from the companies [including ZCM Digital, TiernaByrne and Xzopia] that provide them may have access to your data while undertaking their duties. All this work is carried out under strict security protocols.

Special Personal Data

The categories of special personal data we collect include: age; race; ethnicity; gender; sexual orientation; disability; and in some cases trade union membership, caring responsibilities and socio-economic background. This is to comply with our contractual obligations with funders, including Scottish Union Learning and ScreenSkills. Individuals have the option to ‘prefer not to say’. The collected sensitive information is used solely for monitoring purposes and will be treated as confidential.

Access to Data

Any data held by us is kept under BECTU Vision’s control and can only be accessed by BECTU Vision staff. We do not pass on an individual’s information to anyone, unless required to do so legally. The third parties we share information with are listed below.

We can be contacted at the following addresses:
Postal: BECTU, 150 Brand Street, Glasgow G51 1HD
Email: vision@bectu.org.uk

Third parties

We will only share your information with our funders and partners with whom we are jointly delivering projects, including Screen Scotland, BBC and Scottish Union Learning. For more information about how our partners will use your information please see the following:
Screen Scotland Privacy Policy 

BBC Privacy Policy

SULF Short courses

Many of our short training courses are administered with the support of the Scottish Union Learning Fund (SULF). As part of the funding requirements, the Union is obliged to collect Equality and Diversity information, wherever possible. This is anonymised and shared statistically with SULF. In line with the funding requirements, this information is kept for 10 years. 

Lawful Basis for Processing

Under data protection law, BECTU Vision (Prospect) must have a ‘lawful basis’ to justify the collection, storage and use of your personal data.
The purpose of collecting your personal data is to fulfil our contractual obligations. We also have a legitimate interest in communicating with you about further training courses.

Data Storage

Data will be stored on BECTU Vision’s own internal systems in our headquarters in Scotland and London.

We also use cloud-based services to store and process data. Some of these cloud providers store data in the United States. In these cases the providers are certified under the EU-US privacy shield framework (see privacyshield.gov/welcome). In addition to this, our contracts with these providers include clauses which guarantee that they provide the same safeguards for the data and rights to our members as if the data were stored in the EU. More information about the security measures put in place by these providers is linked to below.

We may choose to use other service providers in future, if we do they will be bound by the same strict rules which guarantee that the same safeguards are in place, and individuals rights remain the same. If we change our service providers, then we will update the details on this page.

Here is a list of the current cloud-based service providers we use:

FireText.com

What data: Telephone numbers
Purpose: Updating by SMS
Data location: UK
More info: firetext.co.uk/privacy
firetext.co.uk/privacy/gdpr

Eventbrite.com

What data: Contact details and application answers
Purpose: Assessing applications and ‘signposting’ relevant resources
Data location: USA
More info: eventbrite.co.uk/l/LegalTerms/
https://www.eventbrite.co.uk/support/articles/en_GB/Troubleshooting/eventbrite-eu-data-protection?lg=en_GB

MailChimp.com

What data: Name and email address
Purpose: Keeping in touch with subscribers via email, sharing course information with participants via email
Data location: USA
More info: mailchimp.com/about/security/
kb.mailchimp.com/accounts/management/about-mailchimp-the-eu-swiss-privacy-shield-and-the-gdpr

SurveyMonkey.com

What data: Contact details and application answers
Purpose: Collating and assessing applications
Data location: USA
More info: surveymonkey.com/mp/legal/security/
surveymonkey.com/mp/legal/privacy-policy/

Zoom.us

What data: Name and email address
Purpose: Monitoring attendance, event correspondence
Data location: USA
More info: https://zoom.us/privacy
https://zoom.us/gdpr

Your rights as a data subject

These are your rights as the data subject at any point while we are in possession of or processing your personal data:

• Right of access – you can request a copy of the information we hold about you. Once we have received your request we will respond to you within 30 days.
• Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
• Right to erasure – in certain circumstances, you can ask for personal information we hold about you to be erased from our records. If you request this we will tell you if it is possible to delete the information or if we have a legal obligation to retain it.
• Restriction of processing – where certain conditions apply you can ask us to restrict the use of your personal information if it:
  • is not accurate
  • has been used unlawfully but you don’t want us to delete it
  • is not relevant anymore, but you want us to keep it for legal claims.
• Right to portability – you can get a copy of the data we hold about you in a format that can easily be re-used and ask us to transfer (where feasible) your personal information to another organisation.
• Right to object – you can object to certain types of processing such as direct marketing.
• Right to object to automated processing, including profiling – you also have the right not to be subject to the legal effects of automated processing or profiling.
• Right to judicial review – if you are not satisfied with our response or believe we are not processing your personal information in accordance with the law, you can complain to the Information Commissioners Office (ICO).
• Right to be notified of data breach – you have the right to be notified of a data security breach concerning your personal data.

Enquiries

If you want to exercise any of your rights in relation to data BECTU holds about you then please email: vision@bectu.org.uk or email or write to the Data Controller BECTU, 150 Brand Street, Glasgow G51 1HD.

Please provide details in your email/letter of what actions you would like us to take. Depending on the nature of the request, and whether or not your request comes from the email address we have on file for you, we may need to verify your identity so that we don’t give out information to the wrong person. In most cases, it helps if you are able to provide a contact phone number so that we can validate your identity and discuss the request with you.

If you have a complaint

If you are concerned about how we manage your data, or how we have handled a request to exercise your rights, then please get in touch with us to discuss it. To do this please send an email detailing your concerns to vision@bectu.org.uk.

In the event that you wish to make a complaint about how your personal data is being processed by Prospect (or by third parties) or how your complaint has been handled, please contact Prospect’s Data Protection Compliance Officer:

• Prospect, New Prospect House, 8 Leake Street, London. SE1 7NN
• Email: datacompliance@prospect.org.uk
• Phone: 0300 600 1878

Last updated 20 June 2024