Face Covering Exemption Card Scotland Website Privacy Policy

Data Controller contact details

Name: Scottish Government

Address: 2 Regent Road, Edinburgh EH1 3DG

E-mail: [email protected]

Privacy notice completed 22/10/20

The type of personal information we collect for the exemption card website

We currently collect and process the following information:

  • First name
  • Last name
  • Address
  • Email address
  • Home telephone number
  • Mobile number
  • Confirmation that the person (or representative of the person) understands the guidance and that the exemption applies.
  • Request permission for DES (on behalf of Scottish Government) to get back in touch with you about you experience of using the exemption card (optional).

How we get the personal information, why we have it and what we’ll use it for

  • The personal information we process is provided by you. We will receive your information directly from you if you call the helpline and verbally request an exemption card. We will receive your information via a third party if you request an exemption card online at exempt.scot (Smart Survey).
  • Disability Equality Scotland, acting as data processor on behalf of the Scottish Government, are able to deliver a face covering exemption card to you by postage or email. The route of delivery will be determined by the type of card you choose; postage if you choose a physical card and email if you choose a digital card.
  • Providing personal data is obligatory in order to deliver the exemption card to you, either by postage or by email.
  • You may agree for Disability Equality Scotland to contact you regarding your experience of using the card. Scottish Government will undertake a further data impact assessment before doing so.
  • If you do not provide your personal data, Disability Equality Scotland, acting on behalf of the Scottish Government will not be able to deliver a face covering exemption card to you.

Your information might be shared with Smart Survey

  • If requesting an exemption card via the online form on exempt.scot, your personal information will be shared with Smart Survey as the third party data collector. This data will be managed by Disability Equality Scotland to allow the exemption card to be delivered to you, either by postage or email.
  • Scottish Government and Disability Equality Scotland will not process your information outside the EEA.
  • This privacy policy is specific to the exemption cards project, you can review other privacy policies for the other organisations involved here:
  • We are committed to doing everything we can to keep your data safe. Disability Equality Scotland will perform regular security tests to make sure our systems and processes are secure.

Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are.

 We need it to perform a public task.

In order to distribute the card to you, this data is being processed under Article 6 (1)(e) as “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”. This is being done either under Scottish Ministers powers under section 1A of the NHS (Scotland) Act 1978. 

Your consent. You are able to remove your consent at any time in relation to the (optional) data processed in order to get back in touch with you about your experience of using the exemption card. You can do this by contacting

Data Protection Officer

Victoria Quay

Commercial Street

Edinburgh

EH6 6QQ

[email protected]

How we store your personal information

Your information is securely stored on password secure databases processed on Disability Equality Scotland’s server, accessed via VPN, Username and Password access.

We keep your details for 3 months from the date of collection. We will then dispose of your information by deleting it from the location it has been securely stored in by Disability Equality Scotland and, sub-processor, Survey Smart.

Your data protection rights

Under data protection law, you have rights including:

Your right of access – You have the right to ask us for copies of your personal information.

Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing – You have the the right to object to the processing of your personal information in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

To make a data request, please contact:

Data Protection Officer

Victoria Quay

Commercial Street

Edinburgh

EH6 6QQ

[email protected]

How to complain

If you have any concerns about our use of your personal information, you can make a complaint to [email protected] or

Data Protection Officer

Victoria Quay

Commercial Street

Edinburgh

EH6 6QQ

[email protected]

You can also complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we have used your data.The ICO’s address:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk

You can also report any concerns