Privacy Policy

Scottish Business Pledge – Privacy Notice

This privacy notice tells you what to expect us to do with personal information held in relation to a Scottish Business Pledge.

Data Protection Legislation is Changing

From 25 May 2018, organisations must manage personal data in accordance with the Data Protection Act 2018 and the General Data Protection Regulation (GDPR). This legislation gives more rights to you as an individual and more obligations to organisations holding your personal data.

One of the rights is a right to be informed. Below is information about the way in which we use and share your personal data, the legal basis on which we process your personal data and information about the increased rights you have in relation to the data we hold on you.

Data Controller

The controller of your personal data is the Scottish Government. Their address is:

Scottish Government
Economic Development Directorate
3rd Floor
5 Atlantic Quay
150 Broomielaw
G2 8LU

If you want to request information, you can write to us at the above address or email us at

What Personal Data Do We Hold

Your name and business contact details.

What We Do With Your Personal Data

Your personal data will be used is in the production of statistical analysis or for the provision of business support. It will be managed in a secure manner and only Scottish Government employees or partner agencies working with Scottish Government with a need to see the information have access to it.

What Are Your Rights?

  • Access to Personal Data – You can request to see the personal data held about you.
  • Rectification of Personal Data – If you believe the personal data that Scottish Government hold in relation to the Scottish Business Pledge is incorrect or incomplete then you are entitled to request to have that data corrected.
  • Erasure of Personal Data or the Restriction of its Processing – You have the right to ask for your personal data to be erased or to restrict processing of that data.

Subject Access Request

You have the right to see a copy of the personal information held, subject to exemptions. This right is commonly referred to as a Subject Access Request (SAR). Subject Access Requests should not be confused with freedom of information requests.

Who can make a Subject Access Request?

An individual can request to see a copy of the personal information held about them. A request for personal data from people acting on behalf of someone else must be accompanied by their consent or authority to act on their behalf.

Making a Subject Access Request

Subject access requests must be made in writing and can be submitted to the Data Controller at the above address or by email to
In situations where a person making a request has some form of disability and finds it impossible or unreasonably difficult to make a subject access request in writing, Scottish Government will consider a verbal request which will be subject to a verification process.

How long will it take?

Your request will be processed in line with the timescales set out in the Act and following receipt of your completed request, proof of identity and such information as we may reasonably require:

  • to satisfy ourselves as to your identity and
  • to locate the information sought.

Complaint to the Information Commissioners Office (ICO)

If you wish to make a complaint about how the Scottish Government has or is processing your personal data you can do so by contacting:

Information Commissioner’s Office
Wycliffe House
Water Lane