All organisations registering a respectme Reward Account will be asked to accept and agree to the following data sharing terms and conditions.
These data sharing terms and conditions are between:
- Scottish Action for Mental Health, a company incorporated in Scotland and a registered charity with company number SC082340 and charity number SC008897, and registered office at Brunswick House, 51 Wilson Street, Glasgow, G1 1UZ (“SAMH”), and
- An organisation seeking to register a respectme Reward Account (as defined below) with respectme, Scotland’s anti-bullying service managed by SAMH (“Participating Organisation”),
(each a “Party” and together the “Parties”).
BACKGROUND
respectme, Scotland’s Anti-Bullying Service managed by SAMH, have set up a respectme Reward Website for the purposes of providing a validated self-assessment toolkit for organisations to benchmark, measure and improve their work on anti-bullying policy and practice. Registering and operating a respectme Reward Account may involve some sharing of personal data between the Parties.
TERMS AND CONDITIONS
1. Definitions and Interpretation
1.1 In addition to definitions of the Parties provided above, capitalised terms and expressions shall have the following meaning:
1.1.1 “Data” means the information which contains personal data as further described in clause 3;
1.1.2 “Data Protection Laws” means Data Protection Act 2018, UK GDPR, all applicable laws and regulations relating to the processing of personal data and privacy, and, where applicable, the guidance and codes of practice issued by the UK Information Commissioner’s Office or any other relevant supervisory authority;
1.1.3 “Purpose” means the purposes of the data sharing as defined in clause 4;
1.1.4 “respectme Reward Account” means an account registered on respectme Reward Website;
1.1.5 “respectme Reward Website” means the digital location developed by SAMH which provides information, access and account registration to participants of the respectme Reward programme; and
1.1.6 “UK GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018.
1.2 The terms “controller”, “data subject”, “personal data”, “processing”, “processor” and “supervisory authority” shall have the same meaning as in the UK GDPR, and their cognate terms shall be construed accordingly.
1.3 References to SAMH shall include references to respectme.
2 Parties’ Roles
2.1 The Parties agree that the relationship between them is such that any anticipated processing of the Data for the Purpose shall be as independent data controllers.
2.2 Should either Party act as a data processor for the other Party at any point in time, a data processing agreement shall be put in place in accordance with the Data Protection Laws.
2.3 Each Party shall ensure that it processes the Data fairly and lawfully in accordance with all applicable Data Protection Laws and complies with the obligations incumbent on it as a data controller (including responding to any data subject requests).
2.4 If either Party discovers an error in the Data, the error shall be notified to the other Party as soon as practicable so that the records can be corrected.
3 Data
The Parties may share the following information:
|
Personal data
|
Data subjects
|
- Staff/volunteer email addresses
- Names of students (where relevant, minimal and with their consent)
- Information included in files uploaded by staff or volunteer users, which may include stories by students or other personal data
|
- Participating Organisation’s staff and volunteers
- Participating Organisation’s students, members or service users
- Participating Organisation’s adult stakeholders, e.g. parents/carers
|
4 Purposes and Legal Bases
The Parties agree to share the Data for the following purposes (the “Purpose”):
|
Purpose description
|
Primary/secondary purpose
|
|
To enable the Participating Organisation to use interactive tools to undertake respectme reward activities
|
Primary
|
|
To enable SAMH to analyse data and monitor progress towards its funded outcomes
|
Primary
|
|
To enable SAMH to monitor usage of the respectme Reward Website
|
Secondary
|
|
To enable SAMH or an independent consultant to undertake evaluation of the respectme Reward Website
|
Secondary
|
|
To enable SAMH to provide individualised support to the Participating Organisation from time to time as agreed by the Parties
|
Secondary
|
5.Transfer, Use and Storage of Data
5.1 Data Transfer
|
The Data will be transferred between the Parties in the following ways:
|
|
The respectme Reward Website enables the Participating Organisation to enter and upload information relating to their progress and to support internal planning and communication. It will be at Participating Organisation’s discretion to decide what Data will be uploaded, and therefore made available to SAMH.
The Parties may also exchange Data via email on rare occasions and, when this is the case, the Data will be password-protected.
|
5.2 Use of Data
|
The Data will be processed/ used by the Parties in the following ways:
|
|
The Participating Organisation will upload information on respectme Reward Website in order to engage in the respectme reward programme.
SAMH will have access to uploaded information and will use it to recognise, assess and validate the anti-bullying policy and associated practice. Overall findings for Participating Organisation will not be shared externally by SAMH but may be aggregated up to Local Authority or national level datasets. No schools, settings or individuals will be identifiable within these findings.
The surveys embedded within the respectme Reward Website are for the Participating Organisation to use with staff/volunteers, children and young people and parents/carers, to gather information such as perceptions of issues relating to bullying, experience of bullying and confidence in challenging or reporting any form of bullying behaviour. The surveys are for anonymous completion and there are no free text fields into which comments or personally-identifying information can be entered.
|
5.3 Data Storage and Retention
|
The Data will be stored by the Parties in the following ways:
|
|
Sections of the respectme Reward Website where Data may be held:
- Application Process
- Surveys
- Evidence-based Practice Portfolio/Storyboard
- Self-Assessment of Impacts and Outcomes
- Validation, Recognition and respectme reward
SAMH will retain the Data as long as the Participating Organisation maintains its respectme Reward Account. Should Participating Organisation close its respectme Reward Account, SAMH will retain Data for the period of time required to complete monitoring activities (usually the lapse of the current grant funding cycle).
Should Participating Organisation request SAMH to delete all or part of the Data at an earlier point SAMH may at its discretion grant this request, except in relation to any Data which is anonymised.
Should Participating Organisation’s respectme Reward Account remain inactive for a prolonged period, SAMH may contact Participating Organisation to ask if it wishes to retain the account. If no response is received after 3 attempts to contact, SAMH may close the account and the Data will then be deleted within 12 months from the time of closing the account.
|
6 Further Information
If you would like to make a comment or have a question about these terms and conditions, please contact DataProtection@samh.org.uk
