Privacy Notice


issued by

The Association for the Relief of Infirmity

in the West of Scotland (ARI)


The Data Protection Act 2018 (“DP2018”) and the General Data Protection Regulation (“GDPR”) enforce certain obligations in connection with the processing of personal data. The ARI is a data controller within the meaning of the GDPR and our Secretaries process personal data. The ARI’s contact details are as follows:-

Secretaries to the ARI

Wright, Johnston & Mackenzie LLP, 319 St. Vincent Street, Glasgow, G2 5RZ

Telephone Number – 0141 248 3434

Fax Number – 0141 221 1226

Email Address –

Data Protection Officer (“DPO”) – Billy Kemmett (email –

The ARI may amend this Privacy Notice from time to time. If we do so, we will make available to you a copy of the amended Privacy Notice.

The Purposes for which we intend to Process Personal Data

We intend to process personal data for the following purposes:-

  • Process any application made by you to the ARI.

  • To better understand you and your needs with a view to the ARI reaching a decision on your application.

  • To manage to ARI’s relationship with you.

  • To maintain the ARI’s files and internal administrative records.

  • To process any payments awarded to you by payment to your nominated bank account or by other means nominated by you.

  • To fulfil our obligations under relevant laws in force from time to time.

  • To comply with our professional, regulatory or ethical obligations to which we are subject to as a Charity.

  • To use in the investigation process and/or defence of potential or actual complaints, formal proceeding, and legal proceedings.

The Legal Basis is for our intended Processing of Personal Data

Our intended processing of personal data has the following legal basis:-

  • At the time you submitted an application to the ARI, you gave consent to the processing of personal data for the purposes listed above.

  • Processing is necessary to make payment to you of any monies awarded to you.

  • The Processing is necessary for compliance with legal obligations to which we are subject including but not limited to OSCR Regulations

  • Is a requirement of any applicant to the ARI that they provide personal data that is requested by completing the application form. If you fail to provide the information requested the ARI may be unable to process your application.

The information we hold about you

We collect information that you provide by filling in an application form for financial assistance from the ARI.

We will collect, store, and use the following categories of personal information provided by you and about you:-

  • Personal contact details such as name, title, address, telephone number and personal email address.

  • Date of Birth.

  • Gender.

  • Marital Status and Dependents.

  • Next of Kin.

  • Contact Information.

  • Bank Account details.

  • Income and Expenditure information.

  • Medical History.

  • Employment/Unemployment/Information.

Information about your Health including any medical condition, health and sickness records is a special category of sensitive personal information which requires a higher level of protection. By supplying this information on your application form you have consented to processing sensitive personal data.

Persons/Organisations to whom we may give personal data

We will only share your information with GDPR compliant third parties when deemed appropriate and of benefit to you. We may share your personal data with GDPR compliant third parties when legally instructed or where the ARI has a justified legitimate interest (such as for audit purposes).

Transfers of Personal Data outside the UK

It is not envisaged that your personal data will be processed outside of the UK.

Retention of Personal Data

We will retain your personal data for as long as necessary to fulfil all purposes we collected it for.

Your Duty to Inform us of Changes

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes.

Your Rights in connection with Personal Data

Under certain circumstances, by law you have the right to:

  • Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

  • Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.

  • Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing.

  • Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.

  • Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.

  • Request the transfer of your personal data to another party.

If you want to review, verify, correct or request erasure of your personal data, object to the processing of your personal data, or request that we transfer a copy of your personal data to another party, please contact our DPO in writing.

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

Withdrawal of consent

Where you have consented to our processing of your personal data, you have the right to withdraw that consent at any time. Please inform us immediately if you wish to withdraw your consent.

Please note:

  • the withdrawal of consent does not affect the lawfulness of earlier processing

  • if you withdraw your consent, we may not be able to continue to provide services to you

  • even if you withdraw your consent, it may remain lawful for us to process your data on another legal basis (e.g. because we have a legal obligation to continue to process your data)


Data protection officer (DPO)

Our Secretaries Wright, Johnston & Mackenzie LLP have appointed a DPO to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal data, please contact the Data Protection Officer.

Changes to this privacy notice

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal data.


If you have requested details of the information we hold about you and you are not happy with our response, or you think we have not complied with the GDPR or DPA 2018 in some other way, you can complain to us.

Please send any complaints to ARI, Wright, Johnston & Mackenzie LLP, 319 St Vincent Street, Glasgow G2 5RZ or alternatively email us at If you are not happy with our response, you have a right to lodge a complaint with the ICO (

What Security Measures are in place

The ARI’s Secretaries firm, Wright, Johnston & Mackenzie LLP have appropriate security policies in place to safeguard your personal data.