Dunfermline Advocacy is committed to respecting the privacy rights of everyone who uses our website and our services. We comply with UK data protection law at all times, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025. This Privacy Notice explains what personal data we collect, why we collect it, how we protect it, and what your rights are.
Personal data we collect
On our website we collect the following data about you:
• your name, e-mail address, contact details and communication preferences when you complete the contact us form on our website;
• your online browsing activities, your IP address (computer internet address) and your approximate location (as determined by your IP address) in conjunction with Google Analytics (more details below).
Our website is not intended for use by children, and as such we do not knowingly collect data relating to children. Where our advocacy services are provided to a young person, we apply additional safeguards appropriate to their age and understanding, in line with the “children’s higher protection matters” recognised under the Data (Use and Access) Act 2025 and the Age Appropriate Design Code.
How we protect your data
We are committed to keeping your data secure. We use encryption for web traffic to and from our website and we store any data provided through our website in secure computer systems that only authorised staff and volunteers have access to. Our data is backed up and we have secure systems in place to prevent hackers, viruses and similar from accessing our systems and data. We also have a range of policies and procedures for our staff and volunteers, with ongoing training, to ensure your data is kept safe and only used in accordance with this Privacy Notice.
How we use your data
We use your data for four reasons:
• to provide information, support and advocacy services to you;
• to manage enquiries and service interactions with you;
• to subscribe you to our mailing list and send you relevant information by e-mail;
• to analyse how our website is used, so that we can improve it and report anonymised visitor numbers and analysis for performance reporting and to funders.
When and how we might share your data
We will never sell your personal data. We share limited data for limited purposes. There are three different sets of data sharing involving personal data collected through our website:
1. Cookie/visitor behaviour – we share this information with Google Analytics (see further details below).
2. Contact information you provide for our mailing list – we share this information with Mailchimp, the third-party mailing list software we use. Their privacy policy can be accessed here.
3. Contact information you provide to seek help, support or information, provide feedback, or make a complaint – we store this in computer systems provided by third parties for processing, storage and archive purposes. The agreement we have in place with them prevents them from using or sharing your personal data for any purpose other than providing that service to us.
We may also share your data with public bodies, such as social work, the police, or safeguarding partners, where this is necessary to safeguard a vulnerable individual or to help prevent or detect crime. Where we do this, we rely on the “recognised legitimate interest” lawful basis introduced by the Data (Use and Access) Act 2025 (see ‘Legal basis for using your data’ below).
How long we keep your data
We only keep your data for as long as we need to. More specifically:
• website visitor data (Google Analytics) – we will retain your data for 26 months;
• mailing list subscription – we will retain this data until you unsubscribe from our mailing list (every mailing list e-mail you receive from us will have a link allowing you to easily unsubscribe);
• enquiry and advocacy case information – we will retain this for not more than 2 years after you last contacted us; we only keep personal data for the current financial year and the previous financial year, unless a longer period is required by law or by our funders.
Transferring data outside the UK
Some of the third parties we use to provide our website and mailing list – including Google Analytics and Mailchimp – may process data on servers located outside the United Kingdom, including in the United States. Where this happens, we only permit the transfer where the destination country has a level of data protection that is not materially lower than that provided under UK law – the test introduced by the Data (Use and Access) Act 2025 – and, where required, appropriate legal safeguards are in place, such as Standard Contractual Clauses, the UK’s International Data Transfer Addendum, or the recipient’s participation in an approved certification scheme. You can ask us for more details of the safeguards we rely on for any particular transfer by contacting us using the details in ‘Your legal rights’ below.
Legal basis for using your data
We generally rely on your consent to use your personal data when monitoring website usage, sending you direct e-mails through our mailing list, or providing information or support after you contact us directly through our website.
We also process some data because it is in our legitimate interests, or a recognised legitimate interest, to do so, namely:
• collating website usage figures and analysis (which are anonymised) for performance reporting and reporting to our funders;
• understanding how visitors use our website so that we can improve it and the services we provide;
• safeguarding vulnerable individuals, and sharing information with public bodies such as social work or the police for that purpose, or to help prevent or detect crime – relying, where applicable, on the ‘recognised legitimate interest’ lawful basis introduced by the Data (Use and Access) Act 2025, which does not require the balancing exercise that applies to ordinary legitimate interests;
• protecting the organisation, our staff, volunteers, funders, partners and clients/service users by taking appropriate legal action against third parties who have committed criminal acts;
• fulfilling our duties to our clients/service users.
Where we rely on consent, you can withdraw that consent at any time – see ‘Your legal rights’ below.
Automated decision-making
We do not use automated decision-making or profiling to make decisions about you that have a legal or similarly significant effect. If this changes, we will update this notice to explain the safeguards that apply, including your right to obtain human intervention, to express your point of view, and to contest the decision, in line with the Data (Use and Access) Act 2025.
Cookies
We use cookies on our website to collect information from visitors. We collect information on pages viewed.
We use Google Analytics, so Google Inc. is a data processor – they process your personal data so that we can understand how visitors access and use our website. Click here for full details of Google’s Privacy Policy.
Strictly necessary cookies that are essential to the basic functioning of our website do not require your consent. All other cookies, including analytics cookies, still require your consent before they are placed, notwithstanding the limited new exemptions for low-risk cookies introduced by the Data (Use and Access) Act 2025.
Your legal rights
Under UK data protection law you have the following rights:
• the right to be informed about how your personal data is used;
• the right to ask what personal data we hold about you (right of access);
• the right to ask us to correct any out-of-date or incorrect personal data that we hold about you (right of rectification);
• the right to ask us to delete your personal data in certain circumstances (right of erasure);
• the right to ask us to restrict how we use your personal data in certain circumstances;
• the right to object to certain processing, including where we rely on legitimate interests or recognised legitimate interests, or to direct marketing;
• the right to receive a copy of certain personal data in a portable format, where we process it by automated means with your consent or under a contract;
• the right not to be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you, subject to the exceptions and safeguards set out in the UK GDPR;
• the right to withdraw consent at any time, where we rely on consent;
• the right to opt out of any marketing communications that we may send you.
To exercise any of the above rights, please write to our Chief Executive, Rachel Annand, by email to enquiries(@)dunfermlineadvocacy.org or by post to 14 Halbeath Road, Dunfermline, Fife, KY12 7QX.
We will normally respond within one month of receiving your request.
You also have the right to lodge a complaint with the Information Commissioner’s Office (the supervisory authority for data protection in the UK). To do that, please visit their website at
https://ico.org.uk/concerns/
How to raise a concern or make a complaint
We’ve endeavoured to make this Privacy Notice clear, informative and understandable, but if it is not, please contact us and we will provide further information. We will also look to improve the wording of this Privacy Notice based on feedback.
If you have a concern or complaint about how we collect or use your personal data, please contact us in the first instance so that we have the opportunity to put things right. You can do this by writing to our Chief Executive, Rachel Annand, by email to enquiries(@)dunfermlineadvocacy.org or by post to 14 Halbeath Road, Dunfermline, Fife, KY12 7QX. We will acknowledge your complaint promptly and respond as quickly as we can.
If you remain unhappy with our response, or do not wish to contact us directly, you can also complain to the Information Commissioner’s Office in the UK – please visit their website at
https://ico.org.uk/concerns/
Reviewing and changing how we use data
This Privacy Notice was last updated on 29 July 2026, to reflect changes made by the Data (Use and Access) Act 2025.
We regularly review our use of personal data to ensure that what we do continues to be fair, transparent, safe and legal. We sometimes change software, technologies or how we work, and this may result in us changing what data we collect and/or how we use it. We will only use your data for the purposes set out above. If we want to use your data for any other purpose, we will contact you and seek your express permission before doing so, unless the law allows us to proceed without it.
We will always seek to minimise the amount of data we collect and use, and to only keep it for as long as we need to.
Whenever we make a change to how we collect or use personal data, we will update this Privacy Notice and any other relevant policies.