Privacy Policy

Introduction

This Privacy Notice describes how Scottish Organic Producers Association uses and takes care of the personal information that we collect. We take the privacy and security of your personal information very seriously. We will never sell your information to third parties and the sensitive business information you provide will be treated as ‘commercial in confidence’ by us. We commit to protect and respect any personal information you share with us, or that we legitimately get about you from other organisations. We will be clear when we collect your information and not to do anything you wouldn’t reasonably expect.

Scope
Who we are and how you can contact us
What we use personal information for
Our lawful bases for processing personal information
Where we collect information about you from
What personal information we collect
Sharing of your personal information to third parties
How we keep your personal information safe
How we keep your information up to date
How long we retain personal information
Your choices and your rights
Changes to this Privacy Notice
GDPR Summary Statement

1. Scope

This Privacy Policy only applies to SOPA’s activities and its website. Where links are provided from our website to third party websites or partnership websites, SOPA is not responsible for those websites and a link to them does not imply endorsement. This Privacy Policy shall be governed by the laws of Scotland. SOPA’s organic certification is carried out by OF&G (Scotland) and this policy should be read in conjunction with the OF&G (Scotland) Privacy Policy as published on their website www.ofgorganic.org and available from their offices The Old Estate Yard, Albrighton, Shrewsbury, Shropshire, SY4 3AG.

2. Who we are and how you contact us

SOPA is a membership co-operative registered under the Industrial and Provident Societies Act (no 2278R(S)). SOPA is the Scheme Owner for the OF&G (Scotland) organic certification body approved by Defra and UKAS. Our purpose is to offer, through OF&G (Scotland), Defra and UKAS Approved Scottish organic standards for our farming and food processing members, and to support our member businesses in the development of organic food and farming in Scotland and the UK. You can find out more about us at www.sopa.org.uk. Any queries regarding this policy should be directed in writing to info@sopa.org.uk or our correspondence address PO Box 5, Golspie, KW10 6AA. The independent supervisory authority in the UK to uphold information rights is the Information Commissioner’s Office (ico). Details on how to contact the ico can be found at www.ico.org.uk/global/contact-us/.

3. What we use personal information for

At SOPA we collect and use personal information for the purpose of supporting the organic food and farming industry, and in particular for the protection of our members’ interests.
‍
We use the personal information we collect for the following:

Members for certification and inspection purposes:

To enable OF&G (Scotland) to carry out its certification activities on behalf of Scheme Owners and
Defra;
To contact our members and stakeholders to inform them about changes to the SOPA organic certification scheme;
To contact our members and stakeholders to provide guidance and updates;
To collate data about organic production and food processing e.g. area, volume;
To collate data for research purposes
For business purposes to administer our contractual and legal obligations.
For statutory purposes as required by Scottish Government, Defra or EU.

Members and Potential Members for support and advisory services:

To contact members and stakeholders to provide guidance, events, industry news and updates
To provide advice that is specific and relevant to the members’ business enterprises
To act on behalf of members to facilitate trade;
To engage on behalf of members with relevant stakeholders
To offer training and skills development
For research purposes
To deliver and monitor Service Packages (for example the Sampling Service for soil, leaf and manures)

SOPA volunteers, employees and potential employees:

For recruitment purposes prior to entering into an employment contract
During employment for normal employment contract purposes including the provision of contracted pay and benefits, and to meet the requirement of tax and employment laws
or health and safety, holiday, sickness and absence records
To keep employees informed about what is going on in the organisation and the wider food and agricultural sectors.

4. Our lawful bases for processing personal information

"Certification’ - as a Scheme Owner processing personal information is necessary in order to carry out our duties as required by the European Organic Regulation (EC) 834/2007 and other non-regulatory services that we operate.

‘Contract’ - where we have contractual relationships with suppliers, customers and employees processing is necessary to administer the pre-contract and contractual obligations for the performance of a contract.

‘Legitimate Interest’ - where we use our members, employees or volunteers personal information in ways they would reasonably expect to keep them informed and to run the business.

‘Legal Obligation’ - we process and share some information because it is necessary to comply with laws and regulations to do with running a membership organisation and employing staff, such as health & safety legislation, tax laws, human rights and employment laws, etc.

‘Vital Interest’ - we process some sensitive information on health and disability provided to us by employees and members to enable us to respond in the most appropriate way in the event of a medical emergency.

‘Consent’ - the provision of information to others such as stakeholders or consumers, which may include direct marketing, will be done when the data subject has consented to the processing of his or her personal data for one or more specific purposes. Consent will also be used for photography and recording (video and audio).

5. Where we collect information about you from

We collect personal information in the following ways:

When you give it to us directly

You may give us your personal information as required by the certification schemes you are applying for, when you join SOPA as a member, when you provide feedback or sign up on- or off-line to receive information, or when you apply to work for SOPA, when you complete your employee contract pack, or when you attend one of our events, or when you sign up to volunteer for us, or when you join one of our committees, panels or boards.

From third party organisations

Your information may have been shared with us by third parties.
These third parties may be public sector organisations such as Scottish Government, and the Food Standards Agency (Scotland or otherwise) or other Control/Certification Bodies, where information has been shared to help enable SOPA to fulfil our statutory functions.
We may get data from third party organisations to whom you may have provided permission through your privacy settings or the responses you have given them.
We will be passed information from stakeholders and partners with whom we deliver Service Packages, such as the Sampling Service with Lancrop (Yara).
We will be passed personal information on potential volunteers, employees or temporary staff by
employment agencies.

When it is available publicly

We may supplement the information you provide with data from the public domain, such as Companies House, bioc.com and other public databases.

From social media

Depending on your settings for social media and messaging services like Facebook and Twitter, you might give us permission to access information from those accounts or services.

When you use our website

Like most websites, ours use ‘cookies’ to help us make our websites, and your user experience, better. Cookies mean that a website will remember you. They are small text files that sites transfer to your computer / tablet / smartphone and make interacting with a website faster and easier.

We may also track the Internet Protocol (IP) address used to connect your computer to the Internet; computer connection information such as browser type and version; and time zone setting, browser plug-in types and versions; operating system; download history, which we sometimes aggregate with similar information from other contacts to improve the navigation and services we provide. During some visits we may use software tools such as JavaScript to measure and collect session information, including page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page.

When you engage with our email newsletters

We will use online software platforms to distribute news, events, guidance, updates and technical developments to our members and stakeholders. These emails will be governed by the online newsletter programme privacy policies, such as MailChimp and EventBrite etc. You should refer to the Privacy and Cookie Policies for these online software platforms as relevant.

6. What personal information we collect

"Personal Information" is information that identifies you as an individual or relates to an identifiable individual. Personal Information we may collect through certification activities, membership applications, event booking and feedback forms, sign-up forms, surveys, websites, public databases and third parties includes:

Your title, first name, surname, business name, postal address and postcode, email address, telephone and mobile numbers
Your social media handles
Bank/direct debit details
Supplier bank details
Field locations, livestock details and ownership
Processing operations including locations and products
Volume of organic produce
Scientific metric data such as soil quality
Routes to market, supply chains and retail avenues
Information regarding your dealings with us including details of your attendance at events and engagement with our programmes and newsletters
Any preference you have in relation to our publications and services
Any information you may voluntarily submit to us by completing any paper or web-based form, or job application
Details of your visits to and usage of our websites and social media
Details of whether you have opened our emails, clicked on a link or watched our videos
Membership of panels, committees, bodies and organisations
In some instances we may also receive demographic information
As an employee or volunteer, we collect and process information to enable us to fulfil our contract with you and to meet legislative requirements; this includes your home address and contact details, bank account information, CV and references, driving licence details, some medical information where appropriate, date of birth, sex, ethnicity, pay, sickness, next of kin.

7. Sharing of your personal information to third parties

SOPA will never sell your personal information to third parties and we will not release your personal information to any company outside of SOPA for mailing or marketing purposes, unless you have positively opted in to allow this.

We may disclose your personal information to third parties for the following reasons:

As part of the certification service:

To provide information as required to Department for Environment, Food and Rural Affairs (Defra) or its equivalents in the Devolved Administrations as required by the European Organic Regulation
(834/2007)
To provide information to Scottish Government and Trading Standards as required by statute for organic certification, funding or subsidy contractual obligations.
To your appointed agents in order to facilitate organic certification, funding or subsidy contractual obligations
To bioc.com for the registration of certified businesses in the UK.

As part of the service delivery involving reputable suppliers:

To help deliver of our events, for example to facilitate registration or payment. If it is a joint event and delegate contact information is to be made available to the other organisation you will be asked to consent to the proposed uses at the time you register for that event
To provide information to Scottish Government as required by statute for funding or subsidy contractual obligations.
To your appointed agents in order to facilitate membership of SOPA, trade, funding or subsidy contractual obligations
To deliver SOPA member services such as the Sampling Package.
To deliver employee and volunteer services and benefits such as pensions, life insurance, private health schemes, occupational health schemes, vehicle leasing and insurance
SOPA requires all such third parties to treat your personal information as fully confidential

8. How we keep your personal information safe

We ensure that there are appropriate and proportionate controls in place to protect your personal information.

For example we use encryption, where appropriate, and we store data within SOPA and OF&G (Scotland)’s secure network and cloud environment. We also limit and control who has access to the personal information we hold.

Where we use third party suppliers or partners to process personal data, we put a contract in place that sets out our expectations and requirements, especially regarding how they manage and securely transfer the personal information and fully comply with all applicable UK Data Protection.

SOPA’s own systems and storage are within the European Economic Area (EEA). Some of our suppliers or partners may process personal information on our behalf outside the EEA, where a recognised data security protocol is in place between the EU/UK and the third country (e.g. the EU-US Privacy Shield).

9. How we keep your information up to date

We use information you provide to us through your various interactions with SOPA and OF&G (Scotland) to keep your personal information up to date. We also use sources such as postcode look-up to ensure we have the correct address for you, Companies House, and information provided to us by other organisations as describe in Section 5 to maintain and improve the information we hold. We really appreciate it if you let us know if your contact details change by emailing us at info@sopa.org.uk

10. How long we retain personal information

We will retain your personal information for no longer than necessary for the purpose it was obtained, unless a longer retention period is required or permitted by law.

11. Your choices and your rights

By law you have certain rights over your personal data that we hold about you and these are summarised below. Some of the rights are complex and not all the detail is included in our summaries, you should therefore read the relevant guidance on the Information Commissioner’s Office website: https://ico.
org.uk/for-organisations/guide-to-the-general-data-protectionregulation-gdpr/individual-rights/.
To enquire about exercising any of these rights please contact us using the details given in section 2. We may need to verify your identity before implementing your request. We will try to comply with your request as soon as reasonably practicable.

Access:
You (data subjects) have the right to ask for a copy of the personal information held about you - known as a Subject Access Request (SAR). Responses are usually made within 30 days, unless an extension is required.
Rectification: You have the right to ask us to correct any errors in the personal information held about you.

Objection:
You have the right to make an objection (based on your specific situation) to how we are processing or profiling your personal information.

Erasure:
Please note that the personal information we hold for ‘public task’ purposes is not eligible for erasure. Personal information obtained through consent is eligible and each request we receive will be treated on a case-by-case basis. It should be noted that we will retain enough information to ensure the individual is not contacted again. On occasion, some data may also have to be retained for legal record keeping purposes and we will always inform you when this is the case.
‍
Withdraw consent:
Where processing information is based on your consent, then that consent can be withdrawn at any time. However, SOPA and OF&G (Scotland) are required within certain regulatory frameworks to hold or provide information regarding its members.

Make a complaint:
You also have the right to lodge a complaint with the UK’s independent supervisory authority for upholding information rights - the Information Commissioner’s Office (ico). Details on how to contact the ico can be found at www.ico.org.uk/global/contact-us/.

12. Changes to this privacy policy

We may change this Privacy Notice from time to time. The effective date of this Privacy Notice, top right of the page, indicates the last time this Notice was revised. If we make any significant changes in the way we treat your personal information we will communicate this to you.

13. GDPR summary statement

SOPA will use the information you provide to be in touch with you and to include you in organic updates, news, market intelligence, financial accounts and regulatory information about your membership with us. We prefer to use email wherever possible so help us save the environment and time by agreeing to receive our communications to your email address.

We only hold your contact details for the duration of your active membership with us. Your details and information are closely guarded and treated with respect.

We only hold information provided by you. This includes contact details, business location, type and size, business operations and other legal requirements covered by EU Organic Regulation 834/2007 and 884/2008.
We do not share your details with any external company without your permission to do so. Government or legal requirements are excluded from this.

We are required by law to share information with OF&G (Scotland), and Scottish Government, Defra or Trading Standards can also demand to see regulatory information about your organic business.

This information includes details of your registered organic (and non-organic if applicable) business to ensure traceability, compliance to the organic standard as well as compliance to funding support arrangements.