Data Controller contact details
Name: Scottish Government
Address: 2 Regent Road, Edinburgh EH1 3DG
Privacy notice completed 22/10/20
The type of personal information we collect for the exemption card website
We currently collect and process the following information:
- First name
- Last name
- Email address
- Home telephone number
- Mobile number
- Confirmation that the person (or representative of the person) understands the guidance and that the exemption applies.
- Request permission for DES (on behalf of Scottish Government) to get back in touch with you about you experience of using the exemption card (optional).
How we get the personal information, why we have it and what we’ll use it for
- The personal information we process is provided by you. We will receive your information directly from you if you call the helpline and verbally request an exemption card. We will receive your information via a third party if you request an exemption card online at exempt.scot (Smart Survey).
- Disability Equality Scotland, acting as data processor on behalf of the Scottish Government, are able to deliver a face covering exemption card to you by postage or email. The route of delivery will be determined by the type of card you choose; postage if you choose a physical card and email if you choose a digital card.
- Providing personal data is obligatory in order to deliver the exemption card to you, either by postage or by email.
- You may agree for Disability Equality Scotland to contact you regarding your experience of using the card. Scottish Government will undertake a further data impact assessment before doing so.
- If you do not provide your personal data, Disability Equality Scotland, acting on behalf of the Scottish Government will not be able to deliver a face covering exemption card to you.
Your information might be shared with Smart Survey
- If requesting an exemption card via the online form on exempt.scot, your personal information will be shared with Smart Survey as the third party data collector. This data will be managed by Disability Equality Scotland to allow the exemption card to be delivered to you, either by postage or email.
- Scottish Government and Disability Equality Scotland will not process your information outside the EEA.
- Smart Survey: https://www.smartsurvey.co.uk/privacy-policy
- Disability Equality Scotland: https://disabilityequality.scot/data-privacy-policy/
- We are committed to doing everything we can to keep your data safe. Disability Equality Scotland will perform regular security tests to make sure our systems and processes are secure.
Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are.
We need it to perform a public task.
In order to distribute the card to you, this data is being processed under Article 6 (1)(e) as “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”. This is being done either under Scottish Ministers powers under section 1A of the NHS (Scotland) Act 1978.
Your consent. You are able to remove your consent at any time in relation to the (optional) data processed in order to get back in touch with you about your experience of using the exemption card. You can do this by contacting
Data Protection Officer
How we store your personal information
Your information is securely stored on password secure databases processed on Disability Equality Scotland’s server, accessed via VPN, Username and Password access.
We keep your details for 3 months from the date of collection. We will then dispose of your information by deleting it from the location it has been securely stored in by Disability Equality Scotland and, sub-processor, Survey Smart.
Your data protection rights
Under data protection law, you have rights including:
Your right of access – You have the right to ask us for copies of your personal information.
Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
Your right to object to processing – You have the the right to object to the processing of your personal information in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
To make a data request, please contact:
Data Protection Officer
How to complain
If you have any concerns about our use of your personal information, you can make a complaint to firstname.lastname@example.org or
Data Protection Officer
You can also complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we have used your data.The ICO’s address:
Information Commissioner’s Office
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk
You can also report any concerns