PRIVACY POLICY

This section explains how Native Scientist Ltd collects, uses and shares personal data, and your rights in relation to the personal data we hold. 

For these purposes Native Scientist is the Controller of your personal data under the General Data Protection Regulation and other UK data protection laws.

Native Scientist may change this Privacy Policy from time to time. 

This Privacy Policy is effective from 25th May 2018.

1. Data we collect from you

People who contact us via social media

People who send us a direct message via Twitter, Facebook, Linkedin or GPS will be stored for up to 2 years. We will use your contact details for opportunities and/or issues related to your enquiry.  Your contact details and data will not be shared with any other organisation or individuals.

People who access our website

When someone visits our website www.nativescientist.com, we use a third-party service, Google Analytics, to collect standard internet information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site.

This information is only processed in a way which does not identify anyone.

 

People who subscribe to our newsletter

Purpose of collection

People who sign up to receive our newsletter consent to receive our newsletter. We will use your contact details only to share our periodic newsletter. The newsletter includes Native Scientist and project updates, volunteer opportunities, news.

Your contact details and data will not be shared with any other organisation or individuals.

 

Data Held

We collect your name, email, occupation, location, language. If you explicitly opted in for a newsletter while signing up for another service, then this policy only applies to the data we have for our newsletters.

 

How we collect your data

This data is collected via Google online forms on our website. If you sign up for our newsletter via one of our online forms, then you are agreeing for your name and email address to be transferred to our marketing lists for the purpose you consented to.

 

How the data is stored

We use a third-party provider, MailChimp, to deliver our monthly e-newsletters. We gather statistics around email opening and clicks to help us monitor and improve our e-newsletter. We also store your data using a third-party provide G-suite.

 

Retention period

If you have signed up for a newsletter, your email address and name will be stored on MailChimp and G-suite for up to 5 years on an opt-out basis.

 

 

People who register as a volunteer scientist

Purpose of collection

People who sign up on our website to receive news on volunteer opportunities will receive from us regular updates on upcoming events and activities, which are segmented to your interests (e.g. language, country, city).

We will use your contact details only to share volunteer opportunities.

If you opted in for a newsletter while signing up, you will also receive our periodic newsletter, which includes Native Scientist and project updates, volunteer opportunities, news.

Your contact details and data will be used internally and by volunteer coordinators but not shared with any other organisation or third party.

 

Data Held

We collect your name, email, occupation, field of study, location, spoken languages.

 

How we collect your data

This data is collected via Google online form on our website.

 

How the data is stored

We use a third-party provider G-suite to store our data.

 

Retention period

If you have signed up to hear about volunteer opportunities, your data will be stored on G-suite on an opt-out basis.

 

 

Teachers who request a workshop

Purpose of collection

Teachers who register their interest in our website to host an activity in their school or classroom will be contacted by Native Scientist staff or volunteer coordinators to proceed with the scheduling and organisation of the event or project. At this stage, further data will be asked to you in order to assess the viability of such an event and its specifications.

If you opted in for a newsletter while signing up, you will also receive our periodic newsletter, which includes Native Scientist and project updates, volunteer opportunities, news.

Your contact details and data will be used internally and by volunteer coordinators and not shared with any other organisation or third party.

Data Held

We collect your name, email, phone, school address, event specifications.

How we collect your data

This data is usually collected in two steps:

1. Workshop request: Google online form on our website

2. Event scheduling and management: Google online form sent by email.

Occasionally Eventbrite may be used. 

 

How the data is stored

We use a third-party provider G-suite to store our data.

 

Retention period

If you have registered to request a workshop, your data will be stored on G-suite on an opt-out basis.

 

 

People who volunteer with us

Purpose of collection

1. Information and instructions: People who register with us to volunteer to one or more of our events and activities, will be contacted by Native Scientist staff or volunteer coordinators with further information, instructions and prior meetings (e.g. training) about the signed activity.

Your contact details and data will be used internally and by the coordinator and will not be shared with any other organisation or third party.

2. Expense claiming: People who volunteer to one or more workshops are able to claim travel and materials expenses incurred in the activity.

Your collected data will be only for the purpose of reimbursing the incurred expenses and contact you for further clarification.

Data Held

1. Information and instruction: We collect your name, email, phone, affiliation, job title.

2. Expense claiming: We collect your name, email and bank details.

 

How we collect your data

For both purposes, data is collected via a Google online form and occasionally via Eventbrite. 

 

How the data is stored

We use a third-party provider G-suite, Quickbooks to store our data and occasionally we may use a third-party provider Eventbrite.

 

Retention period

If you have volunteered to at least one of our events, your data will be stored on G-suite on an opt-out basis.

 

 

Employees, suppliers and customers

Purpose of collection

We will use your contact details to comply with our contractual and legal obligations.

Your contact details and data will be used internally and by our bookkeeper but not shared with any other organisation or third party.

 

Data Held

We may collect and process your contact, bank, pension, tax details, transaction history.

 

How we collect your data

This data is collected via email.

 

How the data is stored

We use third-party providers G-suite and Quickbooks to store our data.

 

Retention period

Your data will be stored on G-suite on an opt-out basis.

For employees, we will delete your data up to 3 years after your contract ceases.

 

2. Your rights
 

You also have the following rights:

-    To be informed what personal data we hold about you and access to it;

-    To require us not to send you direct marketing communications;

-    To require that we cease processing your personal data;

-    To require us to correct the personal data we hold about you if it is inaccurate;

-    To require us to erase your personal data;

-    To request that we restrict our data processing. When our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal;

-    To receive from us the personal data we hold about you, in a reasonable format specified by you;

-    To object, on grounds relating to your particular situation, to any of our particular processing activities where you feel this has a disproportionate impact on your rights.

 

Opt-out

•    To withdraw consent from our direct marketing communications, you can use an opt-out link to unsubscribe or restrict your personal data processing.

•    To request to cease processing, access, object, restrict, erase, correct your personal data, send us an email to info@nativescientist.com.

 

Access your data

To receive from us the personal data we hold about you, we will ask you for a valid receipt of evidence of your identity.

 

The requested information will be provided within one month of the request being made.

If requests are complex and numerous we may extend this period up to two months, which you will be notified.

 

3. The lawful basis for processing your data

 

Consent

 

We may process your data when we ask consent to process your personal data for a specific purpose.

For example: when you sign up to receive our newsletter using our online form on our website.

-    If we wish to use your name in our newsletter, website or marketing material, we will contact you by email and ask for your consent;

-    If we wish to put you in touch with our partners who you may be interested to hear from, we will contact you by email and ask for your consent.

If you have given your consent and you wish to withdraw it, you can contact us on info@nativescientist.com.

Legitimate interests

We may process your personal data when it is necessary for our and our third party’s legitimate interests.

We will always weigh it against your rights, interests and expectations.

Our legitimate interests entail the operation of Native Scientist, in accordance with our non-profit objectives.

 

See examples where we may process personal data in accordance with our legitimate interests:

-    to contact scientists you about our activities and outreach opportunities, including details of workshops, that you requested when signing up;

-    to contact coordinators to manage and support them in the organisation of their workshops and projects;

-    to process enquiries, complaints and analysis our non-profit activities;

-    to process expenses you may be claiming after attending our workshops;

-    to inform you of training opportunities, which you requested when registering as a volunteer for a specific event.

We may also provide your personal data to the following:

-    volunteer coordinators who will be the key person in the organisation of workshops you volunteer;

-    schools and teachers when asked your names for security reasons;

-    our bank, to whom payment details are provided in order to process a payment.

 

 

Legal obligations

 

We may process your personal data in accordance and compliance with our legal obligations. For example for tax legislation, safeguarding requirements, prevention and detection of crime, assist the police. If necessary to obtain advice or assistance, we may provide your personal data to our professional advisers.

 

Contract

We may process personal data in order to fulfil our contractual obligations to them or because they have asked you to do something before entering into a contract (e.g. provide a quote).

 

 

3. Procedure for data breach
 

Native Scientist has put the following procedure in place to follow on a potential breach under GDPR legislation:

- Notify Native Scientist directors (email: tatiana.correia@nativescientist.com or joana.moscoso@nativescientist.com)

- Native Scientist directors will investigate the potential breach to establish if is real

- The impact on individuals and organisation will be assessed

- Notify the Information Commissioners Office (ICO) within 72 hours.

- Notify any individuals concerned if there may be a risk to the rights and freedoms of those individuals

- Resolve breach

The following info will be provided to ICO:

           - The nature of the personal data breach

           - Type and number of individuals and personal data records concerned

           - The name and contact details of the Director

           - A description of the likely consequences of the data breach

           - What measures have been or proposed to be taken

           - What measures will be implemented to mitigate any potential adverse effects

 

This is only necessary if the breach could result in:

•    Discrimination

•    Damage to reputation

•    Financial loss

•    Loss of confidentiality

•    Economic disadvantage

•    Social disadvantage

4. Technical and organisational security measures 

 

​​General

  • Periodically check whether security measures are actually being adhered to and investigating security incidents. ​

Staff

  • Obtain appropriate references to confirm new staff reliability.

  • Apply standard contract of employment to set out what staff can and cannot do with the personal data they have access to.

  • Organise staff and data processor training on data protection procedures.

Physical and IT security

  • Ensure that information on laptop computers issued to staff is protected by encryption​.

  • Only allow staff, volunteers and consultants access to the information they need to do their job and don’t let them share passwords.

  • When sending an email to multiple recipients, use blind carbon copy (Bcc).

Data processors

  • Choose third-party data processor that provides sufficient guarantees about its security measures to protect the processing.​

5. Questions and concerns

 

If you have any questions or concerns about how we process your personal data, or you wish to exercise any of the rights set out above, you may contact us on info@nativescientist.com.

  • Twitter - Black Circle
  • Facebook - Black Circle
  • Instagram - Black Circle
  • YouTube - Black Circle

Copyright 2019 Native Scientist Ltd  |  Company Limited by Guarantee Registered in the UK (No. 08589240)  | Design by Margarida Rodrigues