Why do we need your data?
The Scottish Government collects personal information from you in order to:
- Deliver your Baby Box on time and to the correct address.
- Provide analysis of the data to support research, planning, and management of the Baby Box policy, for example, to review the contents of the Baby Box, evaluate the Baby Box Policy, and to fulfil other public functions.
What data is going to be collected?
The specific information from you that will be processed for the Scottish Government will be:
- Mother’s date of birth
- Expected due date
- Number of babies
- Health Board
- Preferred contact method
- Telephone Number
- Email address
We ask you separately if you agree to be contacted for further research, asking your opinion on the Baby Box and its contents. If we contact you it will not be more than once a year, and you will again be asked for your consent to participate in a given research study. You can withdraw your consent to be contacted for research at any time.
We also ask you if you wish to receive emails on hints and tips that might be useful to you as a parent from the Scottish Government’s Parent Club website which has information about the Baby Box and parenting. Your information is passed to a 3rd party agency acting on behalf of the Scottish Government to deliver this service. The Scottish Government remains the data controller and your data is not shared for any other purpose. You can unsubscribe from these emails at any time.
You do not need to provide your consent for these opt ins in order to receive your Baby Box – it is your choice to decide whether you wish to participate in either of them.
What happens to your information?
Your information is collected and processed by APS Group (Scotland) which administer the Baby Box on behalf of the Scottish Government. APS process your registration details, deliver your Baby Box and provide anonymised management statistics on a weekly basis for the Scottish Government.
The Scottish Government will also provide analysis of the data to support research, planning, and management of the Baby Box policy, for example, to review the contents of the Baby Box, evaluate the Baby Box Policy, and to fulfil other public functions.
If you receive a Baby Box and also apply for the Pregnancy and Baby Grant through Social Security, during the Best Start Grant application process you will be asked if Social Security Scotland can check your Baby Box registration information to confirm that you are or have been pregnant, which is part of the eligibility criteria for the Pregnancy and Baby Grant. This will allow your application form to be processed more quickly.
Who is processing the data for this project?
The data processor for this project is APS Group (Scotland), the contractor who acts for and delivers the Baby Box on behalf of the Scottish Government. APS can be contacted at firstname.lastname@example.org. The data collected will be held by APS before being transferred to the Scottish Government. The data will be held within Scotland at all stages.
How will my data be kept secure?
Baby Box registration data is held and managed by secure systems on secure servers by APS Group (Scotland). Where information is transferred (e.g. between APS and Scottish Government) this will be done securely and will not be transferred outside the EEA. At all times we will protect your personal information and ensure that nobody accesses your information who shouldn’t have access to it.
Your data will be anonymised and archived within a secure environment for 5 years following the end of the contract. This will be reviewed by the Scottish Government before any data is deleted to determine if it should be held for longer.
What are my individual rights?
You have a right of access to any personal data we hold about you, by making a Subject Access Request (SAR) to the address below. In addition, if you believe that the data we hold is inaccurate or incomplete you can ask us to update our records. This includes withdrawing your consent to be contacted for research and by Parent Club.
The Data Protection Officer
What if I have concerns?
If you feel we have been unable, or unwilling, to resolve your information rights concern, you have the right to lodge a complaint with the Information Commissioner's Office (ICO). The ICO are the supervisory authority responsible for data protection in the UK.
For further information, including independent data protection advice and information in relation to your rights, you can contact the Information Commissioner at:
The Information Commissioner
You can also report any concerns here: ico.org.uk/concerns/handling/.