This is the Data Protection Policy of MAST-S, registered under Scottish Charity Number SC045259, having its Registered Office at 3 Castle Court, Carnegie Campus, Dunfermline, Scotland, KY11 8PB.
MAST-S is committed to a policy of protecting the confidentiality, rights and privacy of the individuals who provide Personal Data to them.
The Charity will comply with its obligations under UK data protection legislation, including maintaining any registration or payment of data protection fees required by the Information Commissioner’s Office.
This policy describes how Personal Data must be collected, handled and stored to meet MAST-S’s data protection standards – and to comply with the law.
All Trustees, employees and committees of MAST–S have a responsibility for ensuring that Personal Data is collected, stored and handled confidentially and appropriately and in line with this policy.
Its purpose is to protect the rights and privacy of individuals and to ensure that Personal Data is collected and used fairly, stored safely and not disclosed unlawfully.
Where the Charity undertakes electronic marketing, fundraising communications or uses cookies and similar technologies, it will also comply with the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), as amended.
The law relating to Data Protection is underpinned by 8 principles which state that Personal Data should be:
Personal Data is any information that relates to a living individual from which that individual can be identified.
In the course of its activities, MAST-S may collect and process personal data including names, postal addresses, telephone numbers, email addresses, IP addresses and other contact information.
Where MAST-S engages with donors or prospective donors, it may also process personal data relevant to the administration of donations and fundraising activities, including donation history, payment information, Gift Aid declarations and eligibility information, and such other information as is reasonably required to administer donations, maintain donor records and comply with legal and regulatory obligations.
Personal data will be processed only for legitimate purposes connected with the activities of the Charity, including the administration of donations, donor stewardship, Gift Aid administration, governance, regulatory compliance and the provision of charitable services.
Most personal data is ordinarily collected directly from individuals. In limited cases, personal data may be received from third parties such as professional referees, event partners, or publicly available sources, where lawful to do so.
The Charity may share personal data with professional advisers, investment managers, fundraising service providers, IT providers and other third parties where reasonably necessary for the administration of the Charity’s activities, provided that appropriate contractual, technical and organisational safeguards are in place and such sharing is carried out in accordance with applicable data protection legislation.
The Charity will take reasonable steps to ensure that any third party processing personal data on its behalf provides appropriate safeguards for the protection of that data and complies with applicable data protection legislation.
In terms of the law relating to Data Protection, MAST-S is the ‘data controller’, and as such is responsible for, and required to demonstrate compliance with the principles relating to the processing of Personal Data, as follows:
MAST-S aims to make individuals aware that their Personal Data is being processed and that they understand how that data is processed and how to exercise their rights.
MAST-S has a setting out this information which is available on the MAST–Scotland website at www.masts.ac.uk or on request. Individuals are notified of the existence of the Privacy Policy at the point of providing their Personal Data.
Personal Data is collected and processed only for the purposes for which it was given as set out in the MAST-S Privacy Statement, which is typically:
MAST–S will not use Personal Data for any other purpose than the purpose for which it was given, without the prior express consent of the individual, which consent shall be recorded, unless requested by law enforcement agencies or there is a serious risk of harm or abuse to the individual or someone else, in which instance the Personal Data may be passed to a third party.
A written agreement will exist between MAST-S and any third parties, as required, which process personal information on its behalf to address data protection responsibilities, including purpose and data security.
MAST-S will not appoint any third party to process Personal Data without ensuring the terms of engagement address data protection responsibilities, including purpose and data security.
MAST-S will monitor the Personal Data held for its purposes, ensuring that they hold neither too much nor too little Personal Data in respect of the individuals about whom the Personal Data is held. If Personal Data given or obtained is excessive for such purpose, it will be immediately deleted or destroyed.
It is the responsibility of individuals who provide Personal Data to ensure the information held by the MAST-S is accurate and up-to-date. Where an individual or organisation notifies MAST-S of any changes these should be acted upon without delay.
It is MAST–S’s policy to retain Personal Data both electronically and physically for no longer than necessary. MAST-S will continue to retain Personal Data where there is a legitimate ongoing requirement to do so, such as the provision of services, advice, administration of donations, donor stewardship activities, management of endowment and fundraising relationships, or subscription to the mailing list.
With respect to Personal Data provided in connection with payments for products, services, events or remittance of payments, including Gift Aid declarations and records relating to donations, records will be retained for seven years in order to comply with HMRC requirements and audit purposes for the Charity.
Minutes of Board Meetings etc. will be retained for a minimum of 10 years.
MAST-S will periodically delete or anonymize Personal Data where there is no ongoing legitimate reason to retain it.
MAST-S reserves the right to retain Personal Data for a longer period where in the opinion of MAST-S the personal data may be required or is required to defend a possible legal claim.
All individuals that MAST-S hold Personal Data have the right to:
If an individual contacts MAST-S in order to exercise any of other rights above then MAST-S will always verify the identity before disclosing any information.
MAST-S shall take such technical, digital and organisational security measures to ensure Personal Data is retained and processed securely both physically and electronically and stored in a secure manner to protect the Personal Data against unauthorised or unlawful processing and against accidental loss, destruction, damage, alteration or disclosure.
The following procedures apply, but are by no means exhaustive:
Personal Data will not be transferred to countries outside the European Economic Area unless otherwise such transfer is covered by an adequacy decision of the EU Commission or there is an appropriate alternate safeguard, otherwise the explicit consent of the individual will be required.
Where a breach occurs leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed, MAST-S must:
Adopted: Aug 2026
We’re working behind the scenes to bring you a suite of useful, and updateable, resources including:
If you would like to be updated when the resources section is live please let us know.
