1. Introduction

Turquoise Mountain is committed to protecting all personal data it obtains. This includes all personal information we obtain about you whether you are a supporter, employee, job applicant or beneficiary. The Data Protection and Privacy Policy sets out how and why we obtain, use and protect personal information, and has been formulated in accordance with the General Data Protection Regulation.

2. Who we are

Turquoise Mountain was founded in 2006 as a non-profit, non-governmental organisation dedicated to regenerating urban areas and promoting sustainable development in the crafts sector. Turquoise Mountain works in Afghanistan, Myanmar, the Kingdom of Saudi Arabia and Jordan.

Turquoise Mountain is registered in Scotland as a charity (charity number SC037343) and a company (company number SC299579). Turquoise Mountain’s registered address is Princes Exchange, 1 Earl Grey Street, Edinburgh, EH3 9EE.

The following Data Protection and Privacy Policy applies to both of the above entities and relates to information for which Turquoise Mountain is the data controller.

3. Definitions

The following list outlines the technical terms used in this policy and is intended to aid understanding:

Personal data: Data which relate to a living individual who can be identified – a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller – and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual.

Data subject: An individual who is the subject of personal data.

Data controller: A person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be, processed. Processing: In relation to information or data, this is obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information or data, including – a) organisation, adaptation or alteration of the information or data, b) retrieval, consultation or use of the information or data, c) disclosure of the information or data by transmission, dissemination or otherwise making available, or d) alignment, combination, blocking, erasure or destruction of the information or data.

Data Protection Officer: The person(s) responsible for ensuring that Turquoise Mountain follows its data protection policy and complies with the General Data Protection Regulation. This person is the Communications Manager.

4. Legal basis

Generally, our processing of personal data as described in the Data Protection and Privacy Policy is by your consent. Some processing may also be necessary because we have a legitimate need to carry out the processing for the purposes described below or because it is required by law.

5. Collecting your data

Turquoise Mountain may collect information about you directly whenever you interact with us. We may receive personal information about you when you contact us regarding our activities, register as a supporter, send or receive information, make a donation to us or submit a job application.

The information we collect from you will be relevant to the type of transaction you are entering into with Turquoise Mountain, such as your name, email address, postal address, telephone or mobile number, or bank account details to process donations. We do not collect sensitive personal data, such as health status, genetic data, political or religious views.

When collecting personal data from you, we will seek your consent to process your information and ensure that you are fully aware of why we need the information and what will be done with it. We will contact you at appropriate intervals to refresh this consent.

Your personal data will not be collected on our behalf by any other organisation and Turquoise Mountain will always be the data controller.

6. Processing your data

Turquoise Mountain may record and hold personal data for the following reasons:

  • To process donations we may receive from you;
  • For internal record keeping relating to donations, feedback, or complaints;
  • To send you marketing information about our projects and fundraising activities;
  • To ensure we do not send unwanted information to those who have informed us they do not wish to be contacted;
  • To assess your suitability for employment, including taking up references, for personnel administration or to perform appropriate security checks;
  • To carry out due diligence on potential or actual donors, in accordance with our legal and regulatory obligations and our internal policies and procedures;
  • Where we are required by law to disclose or otherwise use your information.

We will take appropriate physical, electronic and managerial measures to ensure that we keep your information secure, accurate and up to date.

When recruiting for a post based in another country, or when processing feedback or complaints, we may need to transfer your personal information to that country to progress the recruitment or act on feedback or complaints. It may be that that country does not provide the same level of data protection as in the European Economic Area, but we will not transfer your data internationally in cases where we believe there to be inadequate protection for your rights.

7. Sharing your data

Turquoise Mountain will only use your information within the organisation and for the purposes for which it was obtained with your consent. We will not share your personal data with any third party for their own marketing purposes, and you will not receive marketing from any other companies, charities or other organisations as a result of giving your details to us.

8. Requesting your data

Turquoise Mountain will provide you with a copy of the information we hold on you free of charge, unless the request is excessive or if it is for further copies of the same information, in which case we will charge a reasonable fee. If you wish to obtain a copy your data, please contact us using the details found in Section 13 below. We will respond to your request for access as soon as possible, and always within one month.

9. Updating your data

Turquoise Mountain will rectify information we hold on you that is inaccurate or incomplete at your request. If you wish to update your data, please contact us using the details found in Section 13 below. We will respond to your request for rectification as soon as possible, and always within one month.

10. Deleting your data

Turquoise Mountain will stop processing your data if you wish to withdraw your consent. You can update or withdraw your consent at any time, for a particular type of processing or for all types of processing.

If you have indicated that you do not wish your data to be processed in a certain way, for example if you have informed us that you do not wish to be contacted for marketing purposes, we may still need to maintain your details on a suppression list to help ensure that we comply with your request. We will inform you of this when we respond to your request.

If you wish to delete your data, please contact us using the details found in Section 13 below. We will act on withdrawals of consent as soon as possible, and always within one month.

11. Security

Turquoise Mountain will take reasonable and appropriate measures to protect your data, however the transmission of information over the internet is never completely safe and secure. We therefore cannot guarantee the security of any information you transmit to us, and you do so at your own risk. We will notify you as soon as possible in the event of a security breach and inform you of the action we took in response.

12. Updates to the Data Protection and Privacy Policy

This policy will be updated as necessary to reflect best practice in data management, security and control and to ensure compliance with the General Data Protection Regulation. The date of the most recent revisions will appear on this page.

13. Contacting us

If you would like more information, have questions about this policy, would like to change the ways in which we process your data or would like to make a formal complaint, please contact us by email at contact@turquoisemountain.org or write to us at:

Data Protection Officer
Turquoise Mountain Trust
Princes Exchange
1 Earl Grey Street
Edinburgh
EH3 9EE

You also have the right to make a complaint directly to the UK’s data protection authority, the Information Commissioner’s Office (ICO), at https://ico.org.uk/global/contact-us/.

Updated: 17 May 2018