Privacy notice

Skyeline Marketing Scotland Limited is a face-to-face fundraising agency. For the information described here we are the data controller. You can reach us about anything in this notice at amy@skyelinemarketing.co.uk.

Skyeline Marketing Scotland Limited, registered in Scotland No. SC801704, registered office 14 Newton Place, Gallone and Co., Glasgow, G3 7PY.

When one of our fundraisers signs you up to support a charity, your details are collected on the charity's own platform, under the charity's privacy notice, and the charity is the controller of them. We do not keep a copy. Our own records hold the campaign, the fundraiser, the time, the amount, a reference number and, from the charity's platform, whether the gift is still running, why it stopped if it did, and an age band — so that we can pay the fundraiser correctly and report to the charity how the campaign went. Nothing in our records gives your name or how to contact you.

If you want to change or cancel your support, contact the charity directly. If you have a concern about how you were approached, see our complaints procedure.

On a door-to-door campaign the fundraiser's app holds the walk list the charity or the council area gives us: street addresses, and against each one whether it was knocked, the outcome (for example no answer, not interested, or do not knock again) and when. It holds no names. We use it so a household is not called at twice and a “do not knock” is always respected, under our legitimate interest in running the campaign properly. The record of a door is kept for twelve months after the campaign ends, except a “do not knock”, which we keep for as long as we fundraise in that area so it is never ignored.

The application form asks for your name, email address, phone number, the office nearest you and anything you choose to tell us. We use it to contact you about the job, to arrange an interview and, if you join, to start your onboarding. The legal basis is the steps needed before entering a contract with you.

If you are not hired we keep the application for six months in case a place opens, then delete it. If you join, it becomes part of your staff record.

A message sent through the site or by email is kept for as long as it takes to deal with it and for twelve months afterwards, so that a follow-up makes sense. The legal basis is our legitimate interest in answering you.

Staff records are covered by the staff privacy notice you receive when you join. In short: we hold what is needed to employ and pay you, to meet our legal duties (right to work, tax, safeguarding checks), and to run the work, including the record of your shifts, the conversations you log and the photographs taken when you clock in. Those records are also the evidence a charity is entitled to see on how its campaign was run.

The photographs taken at clock-in — the badge and the stand — and the location checked when you clock in and when you clock out are about our own staff, not about the public. They are processed to prove a shift was worked where and when it was booked, and are covered by the staff privacy notice. Nothing records where you are between those two moments.

Our fundraisers use an app on a company iPad and on their own phone. It is only for people who work for us; there is no public sign-up, and the office creates each login. This is what the app holds about the person signed in, and why.

• Your name, work email address and mobile number, so the office can reach you and so messages, invoices and rota changes are addressed to you.
• Your shifts, the conversations you log and the sign-ups you record. A sign-up is a campaign, a time, an amount and a reference number. Nothing that identifies the supporter is entered into the app.
• Your location when you clock in and when you clock out, checked against the site you are booked on, and saved with the shift. On a door-to-door shift the Doors map also reads your location when you open it, to show the nearest doors; that reading is not saved. The app does not track you between those moments, and you can refuse the permission — the clock-in is then recorded as unverified and the office is told why.
• Photographs you take in the app: your badge and the stand at clock-in, pink slips, receipts and any evidence you attach to your starter form. They are stored privately and can be seen by you and by the office.
• Your starter form: legal name, address, date of birth, emergency contact, right-to-work status and share code, a photograph or scan of your identity document, your tax reference (UTR) and the bank account we pay you into. These are needed to employ and pay you and to meet our legal duties, and they are visible to the office only.
• A notification token for each device you sign in on, stored against your name so the office's messages reach you. It is removed when you sign out, when the device stops accepting messages, or when you delete your account.
• A recording of a one-to-one review, only if you and your manager both agree to it on screen before it starts. It is stored privately, can be heard by you and the office, and is deleted after twelve months.
• Messages you write in a road-trip channel, seen by the others on that trip and the office. You can report a message or block somebody, and the office can take a message down.

The app uses no advertising identifier, no analytics service and no tracking. It asks for the camera, your location and, only during a review you have agreed to on screen, the microphone, each at the moment it is needed and each with an explanation. Nothing is shared with anyone outside the people and providers listed below. The app keeps what you have not yet sent, and any form you are part-way through, on the device so a shift works with no signal, until it is sent or you discard it; the rest of the day's working copy is cleared when you sign out.

How long we keep it. Your staff record for as long as you work for us. After you leave: pay and tax records for six years (HMRC), right-to-work records for two years (the Home Office), the record of your shifts, sign-ups and photographs for six years because your pay was calculated from them, and anything else for twelve months. One-to-one recordings are deleted twelve months after they were made.

Deleting your account. You can delete your account from the app (Hub → My account → Delete my account) or by email; deleting your account explains what goes at once, what goes within 30 days, and what the law makes us keep.

• The charity whose campaign you were working on, or applied for, where the record concerns that campaign.
• Supabase, through Lovable Cloud, for the hosting, the database and stored files, in the European Union (Ireland).
• Resend, for email we send.
• Twilio, for text messages we send.
• Google Firebase Cloud Messaging and, on iPhone and iPad, Apple Push Notification service, which carry notifications to the app. They receive the device's notification token and the message, nothing else.
• Google Maps and CARTO, which draw the maps in the app. They receive the area of the map being shown and your device's internet address, not who you are.
• Google Fonts, which serves the typefaces this website and the app use, and so sees your device's internet address.
• Evergiving, the charity's own sign-up platform, from which we read the outcome of each sign-up by its reference number.
• Regulators, where the law or the Code of Fundraising Practice requires it.
• Nobody else. We do not sell or rent personal information.

Each of those providers processes information on our instructions and under a written agreement. Where information leaves the United Kingdom it goes to the European Economic Area, which the UK government has found to provide an adequate level of protection, so no further safeguard is required.

You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, object to our use of it, ask us to restrict it, or ask us to send it to you or to somebody else in a portable form. Where we rely on your consent for something, you can withdraw that consent at any time, and withdrawing it does not affect anything done before you did. Write to amy@skyelinemarketing.co.uk and we will answer within one month. If you are not satisfied you can complain to the Information Commissioner's Office at ico.org.uk.