Last Updated: 13th July 2019
- Introduction
- This privacy policy (the Member Privacy Policy) sets out how Edinburgh Community Solar Limited (“ECSC”/”us”/”we”/”our”) uses and protects the personal data of its shareholders, those applying become shareholders (“members”/”you”) and, if applicable, their nominated representatives. If you are not a member, please see the Non-Member Privacy Policy which is a simplified form of this policy due to the more limited amount of data we collect and process.
- Edinburgh Community Solar Co-operative and Edinburgh Community Solar Co-op are trading names of Edinburgh Community Solar Limited. We are a registered limited company with company number IP032277.
- We are a Registered Society under the Co-operative and Community Benefit Societies Act 2014 with registration number 32277R.
- Our registered address is:
Edinburgh Community Solar Limited
Friends of the Earth Scotland
Thorn House
5 Rose Street
Edinburgh
EH2 2PR - Our business address is:
Edinburgh Community Solar Co-operative
Unit 26
Trinity Enterprise Centre
Furness Business Park
Barrow-in-Furness
LA14 2PN - For matters relating to this privacy policy and data protection, please contact us by email at info@edinburghsolar.coop or by post to our business address above.
- Data We Collect
We may collect:- Name and title
- Job title
- Physical and electronic mail addresses
- Date of birth
- Telephone numbers
- Bank account name, number and sort code
- Contact preferences
- Number of shares held
- Proof of any changes to the details we hold about you (including any appointment of a power of attorney)
- Internet Protocol (IP) address
- Information automatically presented by your web browser such as browser version, operating system, preferred language, pages viewed, length of visit, referring website/page.
- Any other information you explicitly consent to give us (e.g. by sending us an email or submitting the information via an online form)
- How We Use Your Data
- We are legally obliged to record that you are an investor in one or more of our projects so that we can provide you your rights as a shareholder or lender.
- As a member of ECSC, we are required to notify you of general meetings where you have a right to vote such as the Annual General Meeting and any Extraordinary General Meetings that may occur. We will use the data we hold on file about you to determine the best way to notify you of these meetings and to verify your right to vote.
- Your data will be used to enable us to notify you of any dividends or interest payments you are due as well as to pay these to you at a time convenient to us.
- We are legally obliged to maintain a record of your investment in relation to anti-money-laundering and tax legislation and to share these details with HMRC where appropriate.
- If you are elected or appointed as a Director (also known as “Board Member”) of ECSC:
- As the director of a limited company, we are legally obliged to disclose certain details to Companies House.
- We may share your details or process your data in any other way so long as you either:
- Provide consent (which may be freely revoked at any time)
- Have an opportunity to vote at board meeting on your data being used in this way and, should ECSC decided to proceed under any lawful basis of data processing, you retain your right to resign your directorship in order to prevent your data being used in such a way.
- We may use your details to contact you about important operational affairs of the ECSC which do not require a vote but which we regard as important to communicate with members and being in either our or your legitimate interests. If this occurs, the legitimate interests will be explained in our communication to you.
- If you initiate communications with us, such as by email or a form on our website, we will use your information to allow us to provide an adequate response. This is considered to be a contractual obligation to process your data – i.e. you have asked us something and we need to respond.
- With your consent, we may use your details to send you news and updates about the activities of the ECSC. Consent will be considered to be given if you declared it when completing the application form to become a member, submitted an online form where it was clear you were providing consent for this purpose, or contacted us and asked for your data to be used in this way. If we process your data in this way, we will always give you the option to unsubscribe by contacting us using the details in 1.5 and 1.6 and, where the form of contact is email, usually via a link within the email as well.
- If you give us consent, we may use the information we hold about you to send you information relating to the activities of other organisations that ECSC or Energy4All Limited works with. Consent will be considered to be provided if you contact us and ask us to process your data in this way or if you submit an online form where it is clear that you are providing consent for your information to be used for this purpose. If we process your data in this way, we will always give you the option to unsubscribe by contacting us using the details in 1.5 and 1.6 and, where the form of contact is email, usually via a link within the email as well.
- The information you and your browser provide automatically in your use of the ECSC’s website (edinburghsolar.coop, edinburghsolar.org.uk and any subdomains thereof) may be used as follows:
- Analysed in our legitimate interests for the purposes of improving the website and ensuring it is not misused. If we find you are misusing the website we may use your information to takes steps against you to prevent such misuse.
- Anonymised or pseudo-anonymised and used in aggregate with other website users’ data to help guide the future activities of the ECSC in our legitimate interests.
- Should you bring legal proceedings against us or we bring such proceedings against you for any reason, we may process your personal data and/or disclose it to our representatives where necessary, in our legitimate interests.
- We may also use your data for any other purpose but only where:
- We reasonably believe that it is in your or some other natural person’s vital interests (i.e. to act to safeguard life)
- We are required to do so by law.
- We are legally obliged to record that you are an investor in one or more of our projects so that we can provide you your rights as a shareholder or lender.
- Information Storage, Sharing and Retention
- Your data will be shared with Energy4All Limited (“Energy4All”) who run the daily affairs of ECSC and who act as our data processor. Your data will be securely stored by Energy4All on our behalf at our business address listed in 1.5 and/or at any suitable substitute address as they determine which provides equal or greater safeguards to your data.
- Your data may be temporarily stored on paper at our business address listed in 1.5 as the ECSC’s and Energy4All’s employees and representatives make use of it. If this occurs it will be securely shredded immediately after work on the data is complete.
- ECSC has an appropriate contract in place with Energy4All to ensure that your data is treated in accordance with this privacy policy and the Data Protection Act 2018, and that appropriate physical, electronic and managerial procedures are in place to safeguard and secure the information they hold about you.
- Your contact data, but not financial data, may be transferred securely to subcontracted UK based data processors to enable us to communicate with you. Such data will be destroyed by the processor at the end of their delivery.
- Your financial data may be securely transferred to UK regulated financial institutions (such as banks) to enable us to make payments to you.
- Information collected automatically from your web browser as you view ECSC’s website will be collected by Google Inc. on our behalf as part of their Google Analytics service. This data will be stored on Google’s servers in accordance with their privacy policy which can be found at policies.google.com/privacy.
- As part of the ECSC and Energy4All’s use of your data, it may be securely transferred to servers in other countries including those outwith the European Economic Area. If this occurs the ECSC and Energy4All will ensure that appropriate safeguards (as determined by the Information Commissioner’s Office or European Commission) are in place to ensure your data is not accessed by unauthorised third parties.
- With the exception of data automatically collected through the use of the ECSC website, the information you provide to us may be retained in a personally identifiable form for the entire period that you remain a member of ECSC. This is to allow us to meet our legal obligations and to allow us to refer back to any previous correspondence or interactions that have existed between you and the ECSC.
- To allow us to carry out analysis of the use of our website, data provided automatically by your web browser may be kept in a personally identifiable form for a period of one year.
- If you cease to be a member of ECSC, your personal data will be retained for a period of six years to allow us to comply with our legal obligations. After this time, unless we are subject to a legal requirement to retain your data for longer, only anonymised information relating to any browsing activity of the website will be retained.
- Your Rights
- You have certain rights under the Data Protection Act 2018 such as the right to data access, right to rectify any errors in the data we hold, right to data erasure and right to object to data processing. If you would like to find out more about these and other rights under the Data Protection Act 2018, please see the Information Commissioners website or contact us and we will be happy to help with any enquiry.
- To exercise any of your rights under the Data Protection Act 2018, please contact us using the details in 1.5, 1.6 or on our Contact Us page.
- The ECSC’s use of your information is regulated by the UK’s Information Commissioner’s Office. If you feel we have or are failing to act in accordance with your rights and we have been unable to respond to your objection in a satisfactory manner, you have a right to make a complaint by contacting them using the details found on their website which is ico.org.uk.
- Other
- Please be aware, while ECSC and Energy4All will take all reasonable steps required to safeguard your data as per the Data Protection Act 2018, email is not a secure form of communication (it’s the electronic equivalent of a postcard) and there is a small chance the contents of any emails you send to us or any we send to you could be intercepted and read by someone else. The forms on our website also use email to transmit your data to Energy4All’s servers and so you should not enter anything onto those that you wouldn’t be comfortable with putting in an email. If you not comfortable with your data being transmitted in this way then you can send post to our business address shown in 1.5 or call us. The details for both are on our Contact Us page.
- Our website may contain links to other websites which are not under our control. If you choose to follow such a link, we cannot be responsible for the protection and privacy of any information you disclose to those sites as they are not governed by this or any other ECSC policy. We recommend that you exercise caution by reviewing the relevant privacy policies of the sites in question.
- Policy changes
- From time to time we may update this policy by updating this page or replacing it with a new policy that can be easily found from our website’s homepage.
- You should occasionally check back here for any updates to this policy.
- If we believe, in our sole opinion, that any changes to this policy represents a change that is materially disadvantageous to you or significantly different from this current policy, where possible, we may contact you by email to inform you of the changes. Where this is not possible, at our discretion, we may opt to contact you by post instead.
Google ReCAPTCHA
ECSC uses ReCAPTCHA on our website.
ReCAPTCHA is a Google service that collects the personal information of users to protect our site against spam and bots.
ReCAPTCHA works by implementing an algorithm to analyse a user’s activity by taking a screenshot of the user’s browser window. If the activity is deemed as mechanical or a made-up word is used, the activity is flagged by the system.
Activity and user information ReCAPTCHA collects and analyses include the following:
- Typing patterns of the user
- The amount of mouse clicks a user has done on the site or touches on an app
- What language the user’s browser is using
- Google cookies that have been placed on the site
- The answers to question fields on the site
- CSS information
- Plug-ins installed on the browser
The algorithm also recognises IP addresses that have been previously recognised as humans through cookies.
To learn more about what information Google collects please visit their Privacy Policy page here.