Volunteer Privacy Notice

Version 3.0 Final 8 January 2026

sportscotland is committed to protecting the privacy and security of your personal information. This privacy notice describes how we collect and use personal information about you, in accordance with UK Data Protection legislation. This Privacy Notice contains important information about how we collect, manage, use, and protect your personal information.

This privacy notice is applicable to all sportscotland volunteers, including volunteers working as Young Ambassadors or taking part in the Young People’s Sport Panel, Board Members, Fit for Girls Tutors and any other volunteers who may be associated with sportscotland (“ Volunteers ”). This notice does not form part of any contract of employment or other contract to provide services.

The Scottish Sports Council, trading as ‘sportscotland’ of Doges, Templeton on the Green, 62 Templeton Street, Glasgow, G40 1DA is the “controller” of the personal information that you provide to us and is registered as a data controller with the Information Commissioner’s Office, registration number Z7177835.

Our contact details

Headquarters
Doges,
Templeton on the Green,
62 Templeton Street
Glasgow,
G40 1DA

Tel: 0141 534 6500

Deaf/BSL users can contact us using the Contact Scotland service

Web: sportscotland - sportscotland the national agency for sport in Scotland

Email: sportscotland.enquiries@sportscotland.org.uk

Data Protection Officer Contact Details:

Information Governance and Data Protection Officer
Doges, Templeton on the Green, 62 Templeton Street

Glasgow, G40 1DA

Email: DPO@sportscotland.org.uk

What type of information we have

We collect and use personal information about you as a volunteer, which may include:

• Contact details: Name, address, email, phone, date of birth, nationality, country of birth
• Payment details: Bank account, national insurance number, tax status (for reimbursing expenses)
• Qualifications and training: Degrees, certificates, professional memberships
• Photographic ID and images: For identification and promotional purposes (with your consent)
• Equality and health information: Disability, race, gender, marital status, medical and allergy information (for legal reporting and reasonable adjustments)
• Emergency contact details
• Other relevant information: PVG membership, driving licence, previous offences, passport/visa numbers, declaration of interest forms (where required for your role) Country of birth, place of work or study, and previous job history

We may ask for additional information during your engagement, always explaining why it is needed and how it will be used.

Our purposes for processing personal data

We process your personal information for specific purposes.  These include: -

• To manage your volunteer role and fulfil our agreement with you
• To comply with legal obligations (e.g., equality monitoring, health and safety)
• Where it is required in order for us to perform a task in the public interest.
• Where we need to protect your vital interests (or someone else’s interests) in a life-threatening emergency.
• Monitor use and compliance of IT systems and access to information (where access has been granted to the Volunteer);
• Maintain records of meetings;
• Comply with Health and Safety and Fire Safety obligations;
• To process expenses and payments;
• For promotional activities (with your consent);
• To monitor and improve our volunteer programmes

Who we share your personal information with

We may share your information with:

• Partners (e.g., Young Scot, Youth Sport Trust, Scottish Government, local authorities, and SGB’s) for programme delivery, awards, and promotion
• Statutory or regulatory bodies (e.g., HMRC, Disclosure Scotland, Equalities and Human Rights Commission, Police Scotland) as required by law
• Professional and legal advisors
• Third-party suppliers (e.g., IT, payroll, training providers) under strict contractual conditions

We only share what is necessary and ensure recipients protect your information

If your personal information is included in any images or videos taken by us at our events, we may share this with Young Scot, Youth Sport Trust, the Scottish Government, Scottish Governing Bodies, and local authorities, among others, for promotional and/or journalistic purposes.

Fit for Girls is a programme delivered by sportscotland in partnership with Youth Sport Trust.  We may share your personal information, consisting of your name, age and local authority area and any additional personal information gained through the application process to become a Fit for Girls tutor in a voluntary capacity with Youth Sport Trust.

We may be required to share personal information with statutory or regulatory authorities and organisations to comply with statutory obligations. Such organisations include the Scottish Government, including Companies House, HMRC, the Health & Safety Executive, Disclosure Scotland, Equalities and Human Rights Commission (for the purposes of equalities monitoring (such information being provided in an anonymised form)) and Police Scotland.

In the event that we do share personal information with external third parties, we will only share such personal information strictly required for the specific purposes and take reasonable steps to ensure that recipients shall only process the disclosed personal information in accordance with those purposes.

How we store and protect your personal information 

Security measures in place within sportscotland include physical security measures; strong passwords; password lock out policy; managed permissions; two factor authentication; encryption; antivirus software; anti-malware software; data loss prevention software; secure email gateway; software patch management and appropriate data backup arrangements.

Core systems are only accessible by sportscotland staff and a small number of contracts for service practitioners.

International Data Transfers:

If we transfer personal information outside the UK, we do so in line with the UK General Data Protection Regulations, Data Protection Act 2018 and the Data Usage and Access Act.  This means we only transfer data to countries or organisations where the level of protection for personal information is not materially lower than that required under UK law.

Your personal information may also be stored on third party, cloud-based solutions. Where this is the case, sportscotland will ensure that that third party complies with data protection legislation when processing your personal information.

Use of AI Tools: We use certain AI-enabled tools to support administration (e.g., drafting and summarising) and do not use AI to make decisions about individuals. Where AI tools may process personal information, we complete Data Protection Impact Assessments (DPIAs), apply appropriate safeguards, and follow our AI Policy. We will be transparent where AI is used and ensure human oversight.

Retention Periods

We retain personal information only for as long as necessary for the purposes described above, and in line with the sportscotland retention and destruction policy contained within the sportscotland Records Management Plan, which is a legal requirement under the Public Records Scotland Act (2011) You can download this at: sportscotland Records Management Plan

Legal Basis for processing your personal data

We will only collect and process personal information where we have a legal basis for doing so under Data Protection legislation. The legal basis may differ depending on the purpose for processing your data.

Data Type: Name, address, email, phone
Purpose of Processing: Account creation, service provision
Lawful Basis (GDPR/DUAA): Contract (Art. 6(1)(b))

Data Type: Date of birth, gender, age
Purpose of Processing: Eligibility checks, reporting, equality monitoring
Lawful Basis (GDPR/DUAA): Legal obligation (Art. 6(1)(c)); Public interest (Art. 6(1)(e))

Data Type: Payment details (bank, NI number)
Purpose of Processing: Payment for services, payroll
Lawful Basis (GDPR/DUAA): Contract (Art. 6(1)(b)); Legal obligation (Art. 6(1)(c))

Data Type: Medical & accessibility info
Purpose of Processing: Course provision, accommodation, health & safety
Lawful Basis (GDPR/DUAA): Consent (Art. 6(1)(a), Art. 9(2)(a)); Public interest (Art. 9(2)(g))

Data Type: Photos/videos (events)
Purpose of Processing: Promotion, media, publications
Lawful Basis (GDPR/DUAA): Consent (Art. 6(1)(a))

Data Type: Website usage data (cookies)
Purpose of Processing: Analytics (audience measurement), site improvement, preferences, advertising
Lawful Basis (GDPR/DUAA): Strictly necessary cookies: not consented; necessary for a service you request. Statistical measurement / appearance cookies: in limited cases may be set without consent under DUAA’s PECR exemptions, with clear info and an easy opt-out. Advertising/targeting cookies: Consent (Art. 6(1)(a))

Data Type: Award nominations
Purpose of Processing: Processing nominations, event invitations
Lawful Basis (GDPR/DUAA): Consent (Art. 6(1)(a)); Legitimate interests (Art. 6(1)(f))

Data Type: Correspondence (email, social)
Purpose of Processing: Responding to queries, customer service
Lawful Basis (GDPR/DUAA): Legitimate interests (Art. 6(1)(f)); Consent (Art. 6(1)(a))

Data Type: eLearning data
Purpose of Processing: Certification, progress tracking
Lawful Basis (GDPR/DUAA): Contract (Art. 6(1)(b)); Consent (Art. 6(1)(a))

Your Data Protection Rights (with Examples)

You have the following rights under UK data protection law. Here’s what each right means, with examples:

• Access:
  You can ask us for copies of your personal information.
  Example: “I’d like to see what personal data you hold about me as a volunteer.”
• Rectification:
  You can ask us to correct or complete your information if it’s inaccurate or incomplete.
  Example: “My address has changed—please update your records.”
• Erasure (“Right to be Forgotten”):
  You can ask us to delete your information in certain circumstances.
  Example: “I am no longer volunteering—please delete my personal data unless you need to keep it for legal reasons.”
• Restriction of Processing:
  You can ask us to limit how we use your information in certain situations.
  Example: “Please stop using my data for promotional purposes while I review your records.”
• Objection:
  You can object to our use of your information in certain cases, such as direct marketing or where we rely on legitimate interests.
  Example: “I do not want my photo used in any promotional materials.”
• Data Portability:
  You can ask us to transfer your information to another organisation or to you, in certain circumstances.
  Example: “Please send me a copy of my volunteer training records in a format I can give to another organisation.”
• Withdraw Consent:
  Where we rely on your consent, you can withdraw it at any time.
  Example: “I previously agreed to be contacted about events, but I’d now like to withdraw my consent.”

Automated Decision Making: sportscotland does not use automated decision-making processes to make decisions about individuals. All decisions involving your personal information are made by our staff.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please note the lawful basis used for processing your personal information can also affect which rights are available to you as there may be exemptions.  Our Data Protection Officer will advise on any exemptions on request.

How to make a request

You can exercise your data protection rights using the Data Protection Officer contact details below. Further information can be found in our Subject Access Request Policy . We may ask you to confirm your identity or clarify your request. Where clarification or ID is reasonably required, we will pause (“stop the clock”) until the information is provided. We will conduct reasonable and proportionate searches across our systems when responding.

How to complain

If you have any concerns or complaints about this privacy notice or how we handle your personal data, please contact our Data Protection Officer (DPO) in the first instance:

Information Governance and Data Protection Officer

sportscotland, Doges
Templeton on the Green
62 Templeton Street
Glasgow
G401DA
Email: DPO@sportscotland.org.uk

We will aim to acknowledge your complaint within five working days of receiving it. 

We will investigate your complaint thoroughly and may contact you for further information or clarification if needed.  We aim to provide a full response within one month. If your complaint is complex or requires more time, we will keep you informed of progress and let you know if we need additional time.

If you are not satisfied with our response, you have the right to contact the Information Commissioner’s Office (ICO) to raise your concerns.  Their contact details are noted below:

The Information Commissioner’s Office – Scotland
Queen Elizabeth House
Sibbald Walk
Edinburgh
EH8 8FT

Telephone: 0303 123 1115 Email:  Scotland@ico.org.uk