Website survey

We want your feedback on the Scottish Parliament website. Take our 6 question survey now

Skip to main content

Language: English / GĂ idhlig

Loading…

Contact us: Live chat

This privacy statement explains how we collect and use personal information as a data controller for the following process: Website live chat.

Some of the language used in privacy notices can be specialised.  The Information Commissioner's website provides a useful introduction to key terms and concepts.


The purpose of the processing

This service allows enquirers to ask questions and receive answers in real time through the Scottish Parliament website.

The purpose of processing the personal information provided is in order to answer the enquiry.

Categories of information processed

For live chat, we process normal category data such as your name, if you chose to provide it. The system captures IP addresses, and contact details (telephone numbers, email or postal addresses) or postcodes may be provided as part of the enquiry exchange. Depending on the subject-matter of the enquiry, we may also process *special category data, for example, information about health, sexual orientation or religious or political beliefs.

*Special category data consists of information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purposes of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

Source of the information

Personal information is provided to us by individuals (known as “data subjects”) or by someone contacting us on their behalf.

Legal basis for processing

We must have a legal basis for processing personal data (including normal and special category data) in terms of Article 6 of the UK General Data Protection Regulation (UK GDPR). To process special category data, we also require a separate condition for processing in terms of Article 9 UK GDPR.

The legal basis for processing normal personal information for the purposes of the website live chat is that it is necessary for the performance of a task carried out in the public interest (Article 6 (1) (e) UK GDPR).

For special category data, processing relates to personal data which has been manifestly made public by the data subject (Article 9(2)(e) UK GDPR).

Personal information from the website live chat may be shared with the police and security forces if the chat contains threats, abusive language or indications of illegal activities. The legal basis for sharing information in these instances is that it is in the legitimate interest of the SPCB to do so, in accordance with Article 6(1)(f).

Data processing and data sharing

The Scottish Parliament uses the company WebsiteAlive to provide its live chat service. WebsiteAlive are a data processor for the SPCB and has access to the information about contacts made through live chat until these have been deleted from the system, but it will not access our records without our prior agreement and does not use any information within our account.

WebsiteAlive is based in the United States and services are hosted through Amazon Web Services in a cloud-based server. Information about its data security can be found on the WebsiteAlive website.

Criminal Offence Data:

Personal data may be shared by the Scottish Parliament with the police and security forces if the chat contains threats, abusive language or indications of illegal activities.

Retention of data

Information about contacts made through live chat is held on the WebsiteAlive system for no more than seven days. It is then deleted after statistics and transcripts have been extracted.

Some information is exported from the system, edited and held electronically by the Scottish Parliament as a record of enquiries for reference and statistical purposes.

The information exported is: Chat ID (the reference number); operator name (the member of staff answering the enquiry); the time the enquirer made their request, the time it was accepted and the time it ended; the chat length; the question; the browser used to access the site; the referrer (the website used to reach the live chat service); the Launch URL (the Scottish Parliament webpage from which the chat button was accessed); the number of Scottish Parliament webpages visited by the enquirer; time spent on the site by the enquirer; the chat content; who ended the chat (the operator or the enquirer).

The information exported includes names (where provided) within the transcripts of the enquiry exchanges, but all contact details and special category information are deleted. The edited transcripts are held for two years, then anonymised or deleted.

The IP address associated with an enquiry is held within the WebsiteAlive system until the information on the chat is deleted. IP addresses are not extracted for statistical purposes and will be deleted from the system within seven days, unless the content of a chat is offensive or raises concerns about security. In such cases, the full details of the chat, including the IP address, may be exported and may be

shared with the police or security forces. It will be deleted only when the matter has been concluded.

We do not hold information on enquiries that are not answered by – or are rejected by – a Scottish Parliament operator.

Children and young people safeguarding and child protection

In line with the principles underlying the National Guidance for Child Protection in Scotland (2014), published by the Scottish Government, our staff may report a concern to the relevant authorities if they come across an issue during their work which causes them to think that a child may be at risk of abuse or harm.

Your rights

Data protection legislation sets out the rights which individuals have in relation to personal data held about them by data controllers. Applicable rights are listed below.  You can exercise your data subject rights in particular circumstances depending on the purpose for which the data controller is processing the data and the legal basis upon which the processing takes place.

The following rights may apply:

Access to your information

You have the right to request a copy of the personal information about you that we hold.

Further information on how to make a data protection "subject access request"

Correcting your information

You have the right to ask us to correct the personal data we hold about you. We want to make sure that your personal information is accurate, complete and up to date and you may ask us to correct any personal information about you that you believe does not meet these standards.

Objecting to how we may use your information

You have the right at any time to require us to stop using your personal information for direct marketing purposes. In addition, where we use your personal information to perform tasks carried out in the public interest then, if you ask us to, we will stop using that personal information unless there are overriding legitimate grounds to continue.

  • please note that the right to object to the processing of personal data does not apply where the data subject has consented to the processing, subject to the right to withdraw consent 
  • the right to object to the processing of personal data for the purposes of a public interest task is restricted if there are legitimate grounds for the processing which override the interest of the data subject 
  • the right of erasure and the right to object to processing of personal data do not apply where personal data is processed for the performance of a legal obligation. This will be considered on a case by case basis and depends on what personal data is involved and the risks further processing of that data could pose to you 

Deletion of your information

You have the right to ask us to delete personal information about you where:

  • you consider that we no longer require the information for the purposes for which it was obtained
  • we are using that information with your consent and you have withdrawn your consent – see withdrawing consent to using your information below
  • you have validly objected to our use of your personal information – see objecting to how we may use your information above
  • our use of your personal information is contrary to law or our other legal obligations
  • please note that the right allowing for deletion or erasure of personal data (right to be forgotten) does not apply in cases where personal data is processed for the purposes of the performance of a task carried out in the public interest
  • the right of erasure and the right to object to processing of personal data do not apply where personal data is processed for the performance of a legal obligation. This will be considered on a case by case basis and depends on what personal data is involved and the risks further processing of that data could pose to you 

Restricting how we may use your information

In some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to our use of your information. The right might also apply where there is no longer a basis for using your personal information, but you don't want us to delete the data. Where this right is validly exercised, we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.

Withdrawing consent to using your information

Where we use your personal information with your consent, you may withdraw that consent at any time and we will stop using your personal information for the purposes for which consent was given.

Please contact us in any of the ways set out below if you wish to exercise any of these rights. 

Changes to our privacy statement

We keep this privacy statement under regular review and will place any updates on this website.  Paper copies of the privacy statement may also be obtained using the contact information below. 

This privacy statement was last updated on 24 March 2021.

Contact information and further advice 

If you have any further questions about the way in which we process personal data, or about how to exercise your rights, please contact the Head of Information Governance at:

The Scottish Parliament
Edinburgh
EH99 1SP

Telephone: 0131 348 6913

(Calls are welcome through the Text Relay service or in British Sign Language through contactSCOTLAND-BSL.)

Email: [email protected]

Please contact us if you require information in another language or format

Complaints

We seek to resolve directly all complaints about how we handle personal information but

You also have the right to lodge a complaint with the Information Commissioner's Office.

Or by phone at: 0303 123 1113

Share this page