Layered Privacy Notice – Equate Scotland (Edinburgh Napier University):

Equate Scotland (Edinburgh Napier University), as the Data Controller, is providing you with this information as required by UK Data Protection Legislation.

Introduction to the Service:

At Equate Scotland, we make a positive difference for women in science, engineering, technology, mathematics, and the built environment STEM sectors and actively work to change cultures in organisations and academia.

Established in 2006, Equate Scotland is the national expert in gender equality throughout the STEM sectors. We make a tangible and sustainable change, enabling women studying and working in these key sectors to develop by supporting their recruitment, retention, and progression.

Our vision is of a progressive STEM labour market where women can contribute equally to advancements in science, engineering, technology, mathematics and the built environment and have fair access to the jobs of the future.

We provide free support training and event services to Women in STEM, Women STEM students and employers. We work with policy and change makers to influence the landscape for Women in STEM in Scotland.

Why are we collecting data and what are we doing with it (purposes)?

We collect this to communicate with you about any Equate Scotland event or training you plan to attend or Equate Scotland service you plan to utilise to ensure the event training or service is suitable for you and to share details with the partners who facilitate or support our events, trainings or services. We are required to report attendance information in aggregate to our funders.

Activities and processing being undertaken:

Equate Scotland works alongside other partnership organisations– where necessary, we share information with each other to offer you the best quality of support and for administrative and statistical purposes to report on our services and shape future policy, funding, opportunities, support, etc.

Examples include of this include:

  • Collecting personal data to enable us to offer support and make necessary adjustments
  • Sharing information with our funders and partner organisations for the programme you are attending.
  • Provision of advice, assistance and support.
  • Referrals to outside agencies for ongoing support.
  • Administration
  • Information is collected to evaluate the services we provide. We act on the feedback you give us and use it improve our services.

Who are we sharing your Personal Data with?

Depending on the training programme, event, or service you are utilising we may share your personal data with our funders and partner organisations. The relevant partner organisations will be highlighted to you in your initial registration form. All Equate Scotland staff have access to the registration data which is held securely on the University systems that we use to administer and manage Equate services. These systems are third-party provided systems managed by the University.

If you register for an event using Eventbrite, you are providing your personal data to an external organisation (Eventbrite) for these purposes and as such you are accepting and consenting to the practices in their Privacy Policy which can be accessed here: Eventbrite Privacy Policy | Eventbrite Help Centre. Please note that Eventbrite is based in the United States.

Edinburgh Napier University uses Eventbrite services solely for the purposes of facilitating event ticketing and registration and does not accept any responsibility or liability for personal data which you have chosen to provide to such third-party sites. If you do not wish to use Eventbrite, you can email Equate to enquire about the event using the following email address

Should the training or services we are providing be funded by Capital City Partnership (CCP), please refer to the information presented in Annex A at the end of this document. Should you require further clarification around this please email

What is the legal basis for processing?

The legal basis the University relies on primarily is Article 6(1)(e): for the performance of a task carried out in the public interest or in the exercise of the official authority vested in the controller, namely the University’s Statutory Instruments: “for the objects of providing education, carrying out research, and promoting teaching, research and general scholarship” and the administration thereof.

Additional legal bases we rely on for processing certain personal data categories, depending on the purposes for which we are collecting and processing those data are:

  • Article 6.1 (c) – for compliance with a legal obligation, principally the Equality Act 2010, but also including other legislation, such as the Modern Slavery Act 2015, “Prevent” legislation, etc.
  • Article 9.2 (g) – as permitted by under section 10(3), and Schedule 1, of the Data Protection Act 2018 for the processing of special category (sensitive) personal data for the purposes: o Part 2(6) – Statutory purposes (see 6.1,(e ) above) o Part 2(8) – Equality of opportunity or treatment
  • Article 6.1(a) – we rely on consent for sending you marketing information, but you can opt[1]out or unsubscribe from this at any time.

What information are we collecting (whose information and what type of personal data)?

We collect information from Women, Students and Employers in the STEM industries.

The range of information we collect includes:

  • Personal details, including any information that identifies the data subject and their personal characteristics, including: name, address, contact details, age, date of birth, gender, including. health conditions, impairments or learning differences as relevant to the purposes e.g reasonable adjustments.
  • Family, lifestyle and social circumstances, including any information relating to the family of the data subject and the data subject’s lifestyle and social circumstances, including current marriage and partnerships, marital history, details of family and other household members, etc., as relevant to the purposes, e.g. for assessing eligibility.
  • Education and training details, including information which relates to the education and any professional training of the data subject, including academic records, qualifications, skills, training records, professional expertise, as relevant to the purposes e.g. determining support needs.
  • Employment details, including information relating to the employment of the data subject, including employment and career history, recruitment and termination details, as relevant to the purposes e.g providing an effective service.
  • Financial details, including information relating to the financial affairs of the data subject, including income and salary as relevant to the purposes e.g providing an effective service.
  • Special category (sensitive) personal data that we may collect includes information that concerns, reveals or is about:
    • racial or ethnic origin
    • religious or philosophical beliefs
    • sex life or sexual orientation
    • health
    • criminal convictions and offences as relevant to the purposes e.g. equal opportunities monitoring.

How are we collecting this information? Equate Scotland gathers your information through a variety of means including:

  • Information will be collected from you through your direct involvement, e.g. when you fill out a registration form or application form for one of our services, training opportunities, or events.
  • Additional information may be collected from our partner organisations.

Who keeps your information updated?

We rely on you to advise us if your personal data changes and needs to be updated on our systems. Equate Scotland Staff will update your records relating to the services you use or support that you receive from Equate.

Will your information be used for any automated decision-making or profiling?

No

Is information transferred to a third country?

Outside the UK, EEA and countries not included in the adequate countries list. No, apart from the use of Eventbrite, as mentioned above.

Is any other information available?

You can access all the University’s privacy notices using the following link: https://staff.napier.ac.uk/services/governance[1]compliance/governance/DataProtection/Pages/statement.aspx

You have a number of rights available to you with regards to what personal data of yours is held by the University and how it is processed – to find out more about your rights, how to make a request and who to contact if you have any further queries about Data Protection, please see the information online using the following URL: https://staff.napier.ac.uk/services/governance[1]compliance/governance/DataProtection/Pages/accesspersonalinformation.aspx

Annex A – Capital City Partnership (CCP) funded services.

Collection and Storage of Data

  • Capital City Partnership collect and store data you have given us on paper files which are held securely within their offices.
  • In addition, your data will be stored on ‘HELIX’, a Management Information System developed by Hanlon software and managed by Capital City Partnership. This system allows Capital City Partnership, the Local Authority supporting your service and Equate to monitor services for people wishing to progress into volunteering, employment, training etc. or for people currently in work but may require some assistance to stay in work.
  • We may store information related to employability services you receive as well as your contact details, other personal data for example, your age, gender, National Insurance Number as well as sensitive personal data (for example, about your health, ethnicity and religion)
  • You can see and amend any of this information at any time, simply contact your caseworker to discuss what you will need to do.
  • This information will be retained on HELIX no longer than 7 years after your last support session or for some projects this will be 7 years after a particular project has finished. This is to allow the organisations who fund the project to Audit the records.
  • In most instances the recording on HELIX is mandatory and is a condition of funding for the project as it will allow us to evidence to our funders what we have done with public money.
  • The information is held securely on an ISO27001 and ISO9001 certified data hub accessed through a security vetted data transfer protocol.
  • On certain occasions, the data on HELIX will be collated, anonymised and used to provide reports on progress towards achieving strategic goals and help to better inform policy and future actions. • Data is stored within the UK. Sharing of Data
  • Whilst CCP are an independent organisation, they are part of the wider Joined up for Jobs network that provides support in Edinburgh and the Lothians. This is a group of services who help people into work, voluntary activities, training etc.
  • Personal information given to us will be used to check whether you already have a record on HELIX through working with another organisation.
  • If it is appropriate, we may share your data in order to match you to job and volunteering opportunities, training courses etc. and also to verify your outcomes for our funding partners. CCP may share your data with funding organisations such as Scottish Government to allow them to audit and check on where money has been spent. This could include third party evaluators acting on behalf of a funding organisation.
  • Each employability organisation is a separate data controller for the data that they hold about you and you are required to read and sign a privacy notice for each one