WAVE ENERGY SCOTLAND LIMITED - PRIVACY STATEMENT

Last Updated: November 2024

Who we are

Wave Energy Scotland (WES) is a subsidiary of Highlands and Islands Enterprise. The aim of WES is to ensure that Scotland maintains a leading role in the development of wave energy.

Wave Energy Scotland (“WES”) is a Scottish registered company limited by guarantee (SC493764) having its registered office at An Lòchran, 10 Inverness Campus, Inverness, Scotland, IV2 5NA (“WES”, “we”, “us”). WES is registered with the Information Commissioner's Office (ICO) (registration number ZA198657).

Our Data Protection Officer can be contacted at: Data Protection Officer, An Lòchran, 10 Inverness Campus, Inverness, IV2 5NA, Scotland, info@waveenergyscotland.co.uk, 01463 245245.

How we use your information

This privacy statement explains how WES collects and uses personal information about you in order to provide its services to individuals and businesses. In general terms, WES collects and uses personal information about you to:

• Verify your identity where this is required
• Contact you by post, email or telephone
• Understand your needs and how they may be met
• Deliver its services and meet its legal responsibilities
• Provide joined up services to you
• Process financial and non financial transactions
• Maintain our records
• Carry out and provide research
• Prevent and detect crime, fraud or corruption
• Provide services to you 

WES may also share your personal information with its service delivery partners to enable them to do any of these things for WES and also with other public sector organisations such as the Highlands and Islands Enterprise, Scottish Government, Business Gateway, Scottish Enterprise and Skills Development Scotland to pursue their objectives.

Categories of information processed by WES:

• Information about your identity including first name, last name, title, date of birth and gender.
• Contact information including billing address, delivery address, email address and telephone numbers.
• Where you have applied for funding from WES, Financial information including bank account details, payment card details and financial statements.
• Transaction information includes details about payments to and from you and other details of services you have received from us.
• Technical information including internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website.
• Profile information includes your username and password for WES accounts, your interests, preferences, feedback and survey responses. 
• Usage information includes information about how you use our website and services.
• Marketing and Communications Data including your preferences in receiving marketing from us and our third parties and your communication preferences.
• Personal information including information about attending events and meetings including information about dietary or access requirements.

Source(s) of personal information, including whether it comes from publicly available resources.

You give us information about your identity, contact details and financial information when you contact us or make an enquiry, when you browse our website, when you attend a seminar, webinar or event or when you use our services.

We may also collect information from:

• Publicly accessible sources, for example, Companies House and the Electoral Roll;
• Other public sector organisations;
• Third parties who deliver services on our behalf;
• Social media channels;
• From a third parties with your consent;
• Your bank or building society, another financial institution or advisor;
• Consultants and other professionals we may engage in relation to your matter;
• Your employer and/or trade union, professional body or pension administrators;
• Via our website - we use cookies on our website (for more information on cookies, please see our cookies policy);
• Via our information technology (IT) and other systems;
• Case management, document management, data rooms and time recording systems;
• Door entry systems and reception logs;
• Automated monitoring of our websites and other technical systems, such as our computer networks and connections, CCTV and access control systems, communications systems, email and instant messaging systems.

The purposes of the processing

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contract we are about to enter into or have entered into with you, for example providing you with funding or information, research and analysis;
• Where we need to comply with a legal or regulatory obligation;
• For our legitimate interest or those of a third party;
• Where you have given us consent;
• If you make a complaint we use your personal information as part of dealing with that complaint; and
• When marketing our own services to you.

Generally, the information we collect is only used for any purpose for which you submitted it to us, for any purpose made clear to you at the point it was collected or here in this Privacy Policy. These purposes may include:

• When we assess your application for funding, the personal data you give us is used to process your application and to assess your eligibility. This information may be shared with third parties;
• Where we determine whether our programmes and interventions are reaching a representative proportion of the business population and the full range of individuals to whom they are of value;
• When we or third parties host events we will use your personal data to provide you with details, tickets and entry information and to provide the organisers with information to verify your attendance;
• When providing you with reports and research information we use your contact details;
• When you subscribe to receive communications and other updates from us, we use your personal data to provide communications and information about topics that you have expresses an interest in; and
• When you contact use through our website or contact your account manager/advisor, your information is used in order to respond to your enquiry.

Where you submit personal data to WES, you may also be given the option (through a tick box or otherwise) to have information used for an activity or service different from the ones that you received from us. If you choose to have your information used for another activity or service in this way, we will use your information to provide the services or the activities.

We may also use your email address to send you communications such as confirmation emails when you sign up for or unsubscribe from a specific registration or activity. We may also use if to update you about changes to this privacy statement.

We may also use your personal data for segmentation, analysis and demographic studies. This helps us to constantly improve, personalise, and customise the service we provide.

When you attend events we may also collect information about you. We use this information for the purpose of monitoring the equality and diversity of those attendees.

The legal basis for processing

There are a number of lawful reasons for us to process your personal data. These include:

• Where we require to process personal data in order to perform a contract with you, such as providing services and funding.
• Where we are required to comply with a legal or regulatory obligation such as reporting on European funding.
• Where we are processing data in accordance with our legitimate interests.

Legitimate Interests

In relation to a number of uses of Personal Data we refer to above we are doing this on the basis that it is in our legitimate interests – or those of a third party – for us to do so.   A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests. These interests cover a number of aspects of our business operations, namely:

• Information, system, network and cyber security purposes, including the monitoring and protection of our IT systems;
• System development and enhancement;
• Website analytics to determine web traffic and patterns of navigation;
• Internal analysis of companies for the purpose of planning strategy and growth;
• Defending legal claims;
• Anti-fraud purposes;
• “Know Your Customer” checks;
• Postal marketing;
• Analysing your personal data for the purpose of profiling or direct marketing;
• Ensuring that we are as efficient as we can be so we can deliver the best service for you at the best price;
• To allow us to provide bespoke services where requested by you;
• Protecting our commercially valuable information and also our intellectual property;
• Preventing and detecting fraud and/or criminal activity that could be damaging for us and for you;
• To maintain our accreditations so we can demonstrate we operate to the highest standards; and
• Ensuring we are able to keep up to date with the companies with which we work and contacts and developments in their organisations.

Consequences of not providing information where the information is required by statute or contractual requirement

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with services or support) or we may be unable to perform our public task. In this case, we may have to cancel a service you have with us but we will notify you if this is the case at the time.

The recipients of data/data sharing with named third parties, including named service delivery partners

We may have to share your personal data with the categories set out below for the purposes set out in this notice:

• External third parties including WES Contractors, Highlands and Islands Enterprise, the Scottish Government, Scottish Enterprise, Skills Development Scotland, Business Gateway and other Government Agencies;
• Third party product and service providers;
• Financial and non financial intermediaries, including auditors;
• Third sector support agencies;
• Educational institutes;
• Research organisations; and
• Funding bodies.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

We may also disclose your information to third parties:

• If WES ceases to operate the Website and an alternative operator for the Website is appointed, WES will be required to transfer the personal data held about its customers to the newly appointed operator.
• In the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets.
• If WES or substantially all of its assets are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets.

Is your personal data sent to recipients in other countries and why?

WES works with international partners and your personal data may be transferred across international borders. It may be transferred to countries that have different data protection laws to the country from where you submitted your personal data.

We will, however, ensure the transfer complies with data protection law both during transit and at the storage location and all personal data will be secure.

Data retention information

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Cookies

Code of Data Matching Practice

WES is required by law to protect the public funds it administers. It may share information provided to it with other bodies responsible for auditing or administering public funds, in order to prevent and detect fraud.

On behalf of the Auditor General for Scotland, Audit Scotland appoints the auditor to audit the accounts of this authority. It is also responsible for carrying out data matching exercises.

Data matching involves comparing computer records held by one body against other computer records held by the same or another body to see how far they match. This is usually personal information. Computerised data matching allows potentially fraudulent claims and payments to be identified. Where a match is found it indicates that there is an inconsistency that requires further investigation.

No assumption can be made as to whether there is fraud, error or other explanation until an investigation is carried out.

Audit Scotland currently requires us to participate in a data matching exercise to assist in the prevention and detection of fraud. We are required to provide particular sets of data to the Audit Scotland for matching for each exercise, and these are set out in the Audit Scotland's instructions, which can be found at www.audit-scotland.gov.uk/our-work/national-fraud-initiative.

The use of data by the Audit Scotland in a data matching exercise is carried out with statutory authority under its powers in Part 2A of the Public Finance and Accountability (Scotland) Act 2000. It does not require the consent of the individuals concerned under the General Data Protection Regulation.

Data matching by the Audit Scotland is subject to a Code of Practice. This may be found at: www.audit-scotland.gov.uk/our-work/national-fraud-initiative.

For further information on the Audit Scotland’s legal powers and the reasons why it matches particular information, see www.audit-scotland.gov.uk/our-work/national-fraud-initiative
For further information on data matching at this authority email customer.service@hient.co.uk

Your rights

Access to your information – You have the right to request a copy of the personal information about you that WES holds. 

Correcting your information – WES wants to make sure that your personal information is accurate, complete and up to date and you may ask WES to correct any personal information about you that you believe does not meet these standards.

Deletion of your information – You have the right to ask WES to delete personal information about you where:

• You consider that WES no longer requires the information for the purposes for which it was obtained
• WES is using that information with your consent and you have withdrawn your consent – see Withdrawing consent to using your information below
• You have validly objected to WES ' use of your personal information – see Objecting to how we may use your information below
• WES' use of your personal information is contrary to law or WES' other legal obligations.

Objecting to how we may use your information

You have the right at any time to require WES to stop using your personal information for direct marketing purposes. In addition, where WES uses your personal information to perform tasks carried out in the public interest or in exercising official authority vested in it then, if you ask it to, WES will stop using that personal information unless there are overriding legitimate grounds to continue.

Restricting how we may use your information

In some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to WES' use of your information. The right might also apply where WES no longer has a basis for using your personal information but you don't want WES to delete the data. Where this right to validly exercised, WES may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.

Automated processing

If WES uses your personal information on an automated basis to make decisions which significantly affect you, you have the right to ask that the decision be reviewed by an individual within WES to whom you may make representations and contest the decision. This right only applies where WES uses your information with your consent or as part of a contractual relationship with you.

Withdrawing consent using your information

Where WES uses your personal information with your consent you may withdraw that consent at any time and WES will stop using your personal information for the purpose(s) for which consent was given.

Please contact WES in any of the ways set out in the Contact information and further advice section if you wish to exercise any of these rights.

Changes to our privacy statement

WES keeps this privacy statement under regular review and will place any updates on this website.  Paper copies of the privacy statement may also be obtained using the contact details below. This privacy statement was last updated in November 2024

Contact information and further advice

If you have any questions, complaints or comments about this Privacy Policy or how we collect and manage your personal data, please contact us in the first instance by post, email or telephone at, WES, An Lòchran, 10 Inverness, Campus, Inverness, IV2 5NA, Scotland or sending an email to info@waveenergyscotland.co.uk, or phoning +44 (0) 1463 245 245.

Complaints

WES seeks to resolve directly all complaints about how it handles personal information.
You can complain in person at WES’ office, by phone, in writing, or by email. Our contact details are:

Wave Energy Scotland
An Lòchran
10 Inverness Campus
Inverness
IV2 5NA

e-mail: info@waveenergyscotland.co.uk
tel: +44 (0) 1463 245245

If you are not satisfied with the resolution proposed, you also have the right to lodge a complaint with WES’ initial response to your concerns through the Information Commissioner's Office whose contact details are as follows:

Scottish Information Commissioner
Kinburn Castle
Doubledykes Road
St Andrews
Fife
KY16 9DS

Telephone
01334 464610

Website - www.foi.scot