Privacy Policy

Spina Bifida Hydrocephalus Scotland (SBH Scotland) is committed to protecting your privacy. This policy explains what happens to any personal data that you provide to us or that we collect when you visit our site and how we use cookies on this website.

This Privacy Notice explains how and why we process personal information, the lawful bases we rely upon and the rights available to individuals under data protection law.

We will update this policy from time to time so please do review it regularly. This policy was last reviewed on 11^th August 2026.

1. Who we are?

Spina Bifida Hydrocephalus Scotland (SBH Scotland) provide a lifetime commitment of specialist support and information to all those with the life-long, complex disabilities of spina bifida and/or hydrocephalus, their family members, carers and a range of healthcare and educational professionals in Scotland. We raise money to make this extensive and vital service possible.

Access our ‘Why we need your help?’ page to find out more about what we do.

Spina Bifida Hydrocephalus Scotland is a trading name of the Scottish Spina Bifida Association. Registered as a charity in Scotland (number SC013328). We are also registered as a company limited by guarantee (number 213050).

2. The laws we follow

We process our data in line with duties and requirements set out in the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018. We take our data protection responsibilities very seriously and we ensure the personal information we obtain is held, used, transferred and otherwise processed in accordance with the regulation and all other applicable data protection laws and regulations including, but not limited to, the Privacy and Electronic Communication Regulations (PECR).

See section 12 on information about your rights.

3. What personal data do we collect?

The type and quantity of information we collect and how we use it depends on why you are providing it. Personal data is collected by SBH Scotland from service users, supporters, customers of the charity, employees, volunteers and job applicants.

Personal data is any information that can be used to identify you. It can include your name, date of birth, email address, postal address, telephone number, mobile telephone number, bank account details, credit/debit card details and whether you are a UK taxpayer so that we can claim Gift Aid (please rest assured we do not collect information about your actual tax payments, just whether you are a taxpayer).

Where there is legal basis under UK GDPR, and it is relevant to do so, SBH Scotland may store personal data relating to criminal convictions and offences.

Processing health and special category information

Special category data is defined as data consisting of racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data, data concerning health or data concerning a natural person’s sex life or sexual orientation.

We collect and use health and disability-related information where necessary to provide specialist support and information services. This allows us to give you the right advice, refer you to services and provide other support to you.

Where we rely on your consent, we will explain this clearly and you may withdraw that consent at any time. In other circumstances, we may process this information where permitted by UK data protection law for health, social care, safeguarding or other lawful purposes.

We only collect information that is relevant to the support and services we provide and limit access to those individuals who need it to carry out their role.

Supporters and Customers

If you have made a donation, taken part in a fundraising challenge, attended a fundraising event, signed up for email updates, registered for an online shop account, bought a product, volunteered with us or have contacted us for further information on SBH Scotland or fundraising for SBH Scotland we will collect relevant personal information about you.

We do not usually collect “sensitive personal information” about you unless there is a clear reason for doing so, such as participation in an event where we need health information to ensure we provide appropriate facilities for you (for example taking place in a high-risk event) or depending on the level of volunteering we may need to complete a PVG for you.

Although an answer is never mandatory, we may also ask your motivation for supporting or contacting us. We will always make it clear to you when collecting this information as to what information we are collecting and why.

Service users

Service users of the charity, in the context of this Privacy Policy, are classed as all those who benefit from our services: those with spina bifida and/or hydrocephalus or related conditions and, where applicable, their parents, siblings, family members and carers.

In order to provide the best possible information and support service to you, our members, we may collect both ‘personal’ and ‘sensitive personal’ information about you.

Many service users also choose to fundraise or volunteer for SBH Scotland. In those instances, the data you have provided to the fundraising team will be stored in a separate encrypted database. Data is not shared between the fundraising and member databases unless the information relates to a change of contact details or we are notified that communications are no longer required from us. At this stage you do not need to tell us the reason for this, but it would be helpful for the organisation in case there is any way we can improve further communications or services for others.

Employees, Volunteers, Trustees and Job Applicants

We also collect personal information necessary for recruitment, employment administration, volunteer management, governance and compliance purposes. This may include contact details, employment history, qualifications, payroll information, pension information, right-to-work documentation, performance management records, training records and health information where required for occupational health, equality monitoring or reasonable adjustments.

4. How do we collect information about you?

We collect information in the following ways:

When you give it to us directly as either a supporter, a customer or to register as a service user;
You may give us your information in order to sign up for one of our events, tell us your story, make a donation, purchase our product or communicate with us. Any forms you may fill in have clear marketing preference questions and we include information on how to request no contact (Opt-Out) from us. If you don’t want to hear from us, that’s absolutely fine, please get in touch to let us know and we will make sure your wishes are followed;
Your information may be shared with us by independent event organisers; for example, the London Marathon or fundraising sites like Just Giving or Virgin Money Giving. These independent third parties will only do so when you have indicated that you wish to support SBH Scotland and have given your consent. You should check their Privacy Policies when you provide your information to understand fully how they will process your data;
When you give permission to other organisations to share it. For service users, you may have given permission to the NHS, school authority or any other agency currently working with you permission to give us relevant information so we can continue to effectively support you.

You may have given permission to third party organisations to share your data with other third parties, including charities. You may do this when you buy a product or service, register with a website that runs competitions or register with a comparison site. The information we get from those services depends on your settings or the responses you give, so you should regularly check and update them.

When we collect it as you use our websites. Like most websites, the sbhscotland.org.uk and hydrocephalusscotland.org.uk sites use ‘cookies’ to help us make our sites, and the way you use them, better. Cookies mean that a website will remember you. They’re small text files that sites transfer to your computer (or other device such as phone or tablet). This can make interacting with a website faster and easier – for example by automatically filling your name and address in text fields. This information can also be used by SBH Scotland to record visitors to our sites, volumes of usage, support retargeted advertising or help to measure the effectiveness of any online advertising we may do. Some cookies and similar technologies may collect information that is considered personal data under data protection law, such as IP addresses and online identifiers.

Please read our Cookies Policy for more details on the cookies we use, how they work and how you can disable them should you wish to do so.

Our websites contain links to other websites belonging to third parties. All links to other websites are provided as a service to website visitors, but such linking does not constitute endorsement of those sites by Spina Bifida Hydrocephalus Scotland, and as such we are not responsible for the content of external websites. We encourage you to read each third-party site’s privacy policies carefully.

When you opt in to receiving updates. When you opt-in to receiving updates from SBH Scotland your email address and/or your first/second name are added into our private data list with a secure online service called Mailchimp. Mailchimp, for some of its processes uses cookies and it aids us in the design of our email newsletters, to send out bulk emails, share them on social networks and integrate with our other services.

Mailchimp automatically places single pixel gifs, also known as web beacons, in every email we send out using their system. These are tiny graphic files that contain unique identifiers that enable Mailchimp and SBH Scotland to recognise when our subscribers have opened an email or clicked certain links. These technologies record each subscriber’s email address, IP address, date, and time associated with each open and click for a campaign. Mailchimp use this data to create reports for us about how an email campaign performed and what actions subscribers took.

Every email we send through the Mailchimp system has a clear ‘unsubscribe’ option at the bottom. Read the full Mailchimp Privacy Policy for details.

When you interact with our social media channels. Depending on your settings, or the privacy policies, for social media and messaging services like Facebook, Instagram, Pinterest, or X (formerly Twitter), you might give us permission to access information from those accounts or services. We advise you to check all the privacy policies and settings of social media sites/apps that you use.

By submitting any content to any of Spina Bifida Hydrocephalus Scotland’s ‘public’ social media pages including, but not limited to, Facebook, X and Instagram, via posts, comments, photos, links, etc., you understand that this information is publicly available, and that Spina Bifida Hydrocephalus Scotland may use this information in internal and external publications and other communications.

Content posted in ‘closed’ or ‘private’ SBH Scotland Facebook groups will not normally be used without obtaining explicit permission from the individual concerned. Please note that it may be possible for other members of the closed groups to share or save your posted content.

5. What do we do with the collected information?

We process personal information using a range of lawful bases permitted under UK GDPR.

These may include consent, performance of a contract, compliance with a legal obligation, protection of vital interests and our legitimate interests as a charity. Where we process special category information, including health information, we rely on additional conditions provided under Article 9 of UK GDPR and Schedule 1 of the Data Protection Act 2018.

Whenever we process your Personal Information under the ‘legitimate interest’ lawful basis we make sure that we consider your rights and interests and we will not process your personal information in ways that you would not reasonably expect or where there is no justification for doing so.

This means we may write or call you occasionally for administrative purposes, with relevant direct marketing on a fundraising topic, event or service which we feel would benefit, or be of interest to you, or just to update you on the progress of the charity.

We will only contact you about our work and how you can support SBH Scotland by email or text message, if you have provided consent for us to contact you in this manner.

We do not sell or share personal details to third parties for the purposes of marketing. But if you attend an event run in partnership with another named organisation your details may need to be shared. We will be very clear what will happen to your data in those instances.

Supporters/Customers

SBH Scotland may collect your personal information for a range of reasons including:

to provide you with the fundraising products or information you have requested;
to process any donation(s) we may receive from you, including Gift Aid;
to ask you to help our charity with financial and non-financial support, but always in accordance with our supporter commitment;
to manage your marketing preferences and interests;
tailoring the information you receive to deliver you online targeted advertisements that are more tailored to you based on your browsing activities and inferred interests (“Interest Based Advertising”);
to provide you with information about our work or our activities funded with your support;
to send you any items you have ordered through our shop;
to invite you to participate in surveys or research;
to keep a record of your relationship with us;
for administration purposes or part of an existing fundraising conversation e.g. we may contact you about a donation you have made, or event you have taken part in or registered for;
for internal record keeping, such as the management of feedback or complaints;
to analyse and improve the services we offer;
to send you occasional email updates about our charity and fundraising activities;
the use of IP addresses to block disruptive use, to record website traffic or to personalise the way our information is presented to you to identify your approximate location

Where we rely on your consent, we will explain this clearly and you may withdraw that consent at any time.

Service users

We only collect information that is relevant to the support and services we provide and limit access to those individuals who need it to carry out their role.

SBH Scotland may collect your personal information for a range of reasons including:

to provide you with the information and support services you have requested;
to manage your preferences and interests; tailoring the support and services you receive;
to provide you with information about our work or our activities;
to invite you to participate in surveys or research;
for statistical research (anonymous data);
to keep a record of your relationship with us;
for internal record keeping, such as the management of feedback or complaints;
to analyse and improve the services we offer;
the use of IP addresses to block disruptive use, to record website traffic or to personalise the way our information is presented to you to identify your approximate location;
to update your SBH Scotland health and care records.

Please remember you can change your communications preferences at any time by contacting the Data Protection Lead on:

• Email: mail@sbhscotland.org.uk

• Telephone: 03455 211 811

• By post: The Dan Young Building, 6 Craighalbert Way, Cumbernauld G68 0LS

If you ask us not to use your information for future communications, we will respect that. However, we will retain your details on a suppression list to help ensure we do not continue to contact you.

Automated Decision Making

SBH Scotland does not carry out automated decision making or profiling that produces legal or similarly significant effects on individuals.

Sharing your story.

Some people choose to tell us about their experiences with spina bifida or hydrocephalus or their engagement with fundraising activities to help further our work. They may allow us to share their story in the press and media. This may include them sharing sensitive information related to their health and life, as well as their contact information.

If we have the explicit and informed consent of these individuals, or their parent/guardian if they are under 18, this information may be made public by us in materials promoting our campaigning and fundraising work, and in documents such as our Annual Report and in funding applications.

6. How we keep your data safe and who has access?

No electronic transmission or storage system can be guaranteed to be completely secure, but we work continuously to maintain appropriate safeguards.

We ensure that there are appropriate technical controls in place to protect your personal details.

If data transfer in necessary, it will only be done via encrypted services.

All our databases are on secure servers and are routinely monitored. All our third-party database providers have the relevant data security accreditation.

For all areas of our websites which collect personal information, we also use a secure server. Although we cannot 100 per cent guarantee the security of any information you transmit to us online, we enforce strict procedures and security features to protect your information and prevent unauthorised access.

We undertake regular reviews of who has access to information that we hold to ensure that your information is only accessible by appropriately trained staff, volunteers and contractors. Access to our databases also requires multi-factor authentication.

In some circumstances we use external companies to collect or process personal data on our behalf, for instance mailing houses used to post out our fundraising appeals or audience research companies to give us internal insights to help improve our work. We do comprehensive checks on these companies before we work with them and make sure they have appropriate licences and policies in place.

7. Information sharing and disclosure

We will not sell or swap your information with any third party.

There may be occasions when we enter into research with external organisations such as the NHS. If at any point, there is a reason why statistical information should be shared with these third parties the data will be provided in an anonymous form so that individuals cannot be identified.

We may need to disclose your details if required by law to the police, regulatory bodies or legal advisors.

We will only ever share your data in other circumstances if we have your explicit and informed consent.

Credit, Debit Card payment information

If you use your credit or debit card to donate to us, buy something or pay online or over the phone, we will ensure that this is done securely and in accordance with the Payment Card Industry Data Security Standard. Find out more information about PCI DSS standards by visiting their website

We do not store your credit or debit card details at all following the completion of your transaction. All card details and validation codes are securely destroyed once the payment or donation has been processed. Only those staff authorised to process payments will be able to see your card details. If we receive an e-mail containing any credit or debit card details, it will be immediately deleted, no payment will be taken and you will be notified about this.

8. Storing your information

Although most of the information we store and process stays within the UK, some information may be transferred to countries outside the UK.

This may occur if, for example, one of our trusted partner’s servers are located in a country outside the UK.

Where personal information is transferred outside the UK, we will ensure appropriate safeguards are in place in accordance with UK GDPR. These safeguards may include an adequacy decision, the UK International Data Transfer Agreement (IDTA) or other recognised transfer mechanisms.

We will keep your information for as long as required to enable us to operate our services, but we will not keep your information for any longer than is necessary. We will take into consideration our legal obligations and tax and accounting rules when determining how long we should retain your information.

When we no longer need to retain your information, we will ensure it is securely disposed of, at the appropriate time.

Data Breaches

SBH Scotland has procedures in place to identify, investigate and manage personal data breaches and will notify the ICO and affected individuals where required by law.

9. The accuracy of your information

We aim to ensure that all information we hold about you is accurate and, where necessary, kept up to date. If any of the information we hold about you is inaccurate and you advise us, we will ensure it is amended and updated as soon as possible.

10. Treating Supporters Fairly

We recognise the importance of treating all our supporters fairly and protecting those in vulnerable circumstances.

Our aim is to provide a foundation of awareness and knowledge which enables fundraisers to respond appropriately to people in vulnerable circumstances, putting the needs of the individual first, above and beyond securing a donation. We believe this helps to support our staff and fundraisers who come into contact with supporters in providing high quality customer care, ensuring anyone donating to the charity is in a position to make a free and informed decision.

Under 16’s. If you are aged 16 or under, and would like to participate in an event, make a donation or get involved with us, we will check with you that you have your parent/guardian’s permission before giving us your personal information. When we collect information about a child or young person, we will make it clear as to the reasons for collecting this information and how it will be used.

11. Changes to the policy

This policy replaces all previous versions and is correct as of August 2026. We will regularly review and update this Privacy and Data Protection Statement and will update, modify, add or remove sections at our discretion so we would ask you to regularly check back and make sure that you are in agreement with any changes made. We will always tell you in this section when the last changes were made.

Your continued use of our website, any of our services and/or the continued provision of personal information after we have made changes to these terms will be taken to mean you are in agreement with those changes.

12. Your rights

You have the right to:

request a copy of the information we hold about you in a clear format
update or amend the information we hold about you if it is wrong
change your communication preferences, or withdraw your consent at any time
ask us to remove your personal information from our records
restrict how your data is processed
object to the processing of your information; or raise a concern or complaint about the way in which your information is being used.
not to be subject to solely automated decision-making

If you wish to find out more about these rights, obtain a copy of the information we hold about you or change your communication preferences please contact the Data Protection Lead on:

Email: mail@sbhscotland.org.uk

Telephone: 03455 211 811

By post: The Dan Young Building, 6 Craighalbert Way, Cumbernauld G68 0LS

13. Privacy queries or complaints

If you have any questions or queries about this Privacy and Data Protection Statement, please contact our Data Protection Officer using the above address and contact details.

If you are unhappy with how we use your personal information, we would welcome the opportunity to address your concerns first.

Data Protection Lead Contact Details are:

Email address: mail@sbhscotland.org.uk
Telephone number: 03455 211 811
Postal address: The Dan Young Building, 6 Craighalbert Way, Cumbernauld G68 0LS

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s independent authority for data protection matters.

For further information, visit the ICO website at https://ico.org.uk

Support us

Because of you we provide a lifetime commitment of support. Please continue to support us or donate today. Thank you.

Make a donation

Privacy Policy

Support us

Want our newsletter?