Last updated: July 2026
Who we are
Highland Group RDA is a Scottish charity providing therapeutic riding activities for disabled children and adults. We are the "data controller" for the personal information described in this policy, which means we are responsible for how it is collected and looked after.
- Website: www.highlandgrouprda.org.uk
- Email: info@highlandgrouprda.org.uk
- Registered charity number: SC007357
- Address: Sandycroft, Reelig, Kirkhill, IV5 7PP
We are committed to protecting your privacy and handling your personal data responsibly and transparently.
What information we collect
The information we collect depends on how you interact with us.
When you contact us or make an enquiry
- Your name
- Your email address and telephone number
- Anything you choose to tell us in your message
When you apply to take part in riding activities
Our participant application form collects more detailed information so we can support each rider safely. This can include:
- Contact and address details, date of birth and other personal details
- Where the participant is a child or supported adult, details of a parent, guardian or carer
- Health, disability, mobility and support needs — for example conditions, medications, allergies, communication needs, sensory needs, and mental-health considerations
- Emergency contact details
- Your choices about photographs and video, and whether you wish to receive our newsletter
Health and disability information is treated with particular care — see "Sensitive personal data" below.
When you apply to volunteer
- Contact and address details, date of birth and related personal details
- Availability, experience, skills and your reasons for volunteering
- Emergency contact details
- Details needed for safeguarding checks, including PVG (Protecting Vulnerable Groups) where required
- Referee details, so we can request references
If you provide a reference for a volunteer
If someone names you as a referee, we collect the contact details you provide and the assessment you give about the applicant. We use this only to help decide whether the applicant is suitable to volunteer with us, and we treat it confidentially.
When you make a donation
Donations and pony sponsorships are processed securely by Stripe, our payment provider. Your card details are entered directly into Stripe's secure systems and are not seen or stored by us. We receive confirmation of the donation and limited related details. Stripe's own privacy notice is available at stripe.com/privacy.
Information collected automatically
When you visit our website, basic technical information may be collected automatically, such as:
- IP address
- Device and browser type
- Pages visited
This information is used only to help us understand how the website is used and to keep it secure.
How we use your information
We use your information to:
- Respond to enquiries
- Manage applications and participation in our activities
- Carry out safeguarding checks and arrange references for volunteers
- Process donations and sponsorships
- Send newsletters and updates, where you have asked to receive them
- Communicate important information about sessions, events or safety
- Improve and maintain our website
- Meet our legal, regulatory and safeguarding obligations
We only use your data where we have a lawful basis to do so — usually your consent, our legitimate interests as a charity, the performance of an agreement with you, or a legal obligation.
Sensitive personal data
Some information we collect — particularly health, disability and mobility details — is classed as special category data under UK GDPR and is given extra protection.
- It is collected and used only to support participants safely and appropriately
- Access is restricted to the people who need it to run sessions safely
- It is never used for marketing
- We rely on your explicit consent, and on the basis that processing is necessary for reasons of substantial public interest, to handle this information
Photographs and video
We sometimes take photographs or video at sessions and events, which may be used in publicity, on our website, on social media, in newsletters and in training materials.
We only do this where you have given consent, and you can withdraw that consent at any time by contacting us.
Newsletters and updates
We only send newsletters and updates to people who have asked to receive them.
Every newsletter includes a way to unsubscribe, and you can ask us to stop at any time.
Cookies
Our website uses essential cookies needed to make it work properly and securely.
We do not use cookies for advertising or for tracking you across other websites.
Our website includes the UserWay accessibility widget, which may store your accessibility preferences (such as font size or contrast settings) in your browser so they are remembered on future visits. These preferences are saved locally for your convenience and are not used to identify or track you.
We use Google Analytics to understand how visitors use our site so we can improve it — but only if you accept this in the cookie banner shown when you first visit. If you decline, no analytics cookies are set and no data is sent to Google. You can change your choice at any time by clearing your browser's cookies for this site.
Hosting, storage and the providers we use
To run the charity and the website, we use a small number of trusted providers who process some information on our behalf, under data-protection agreements:
- Microsoft 365 — for email and for securely storing files and application records
- Stripe — for processing donations and sponsorships
- Microsoft Azure — for hosting and running the website
- UserWay— for providing the accessibility widget on the website; UserWay's privacy notice is available at userway.org/privacy
- Google Analytics— for understanding how visitors use our site, only if you accept this in the cookie banner; Google's privacy notice is available at policies.google.com/privacy
These providers act on our instructions and are not permitted to use your information for their own purposes.
How long we keep your data
We keep personal data only for as long as necessary:
- Enquiry data is kept only while it remains relevant
- Participant and volunteer records are retained in line with RDA UK guidance, safeguarding requirements and legal obligations
- Donation records are kept as required for financial and tax purposes
- Data is securely deleted when it is no longer required
Sharing your information
We do not sell or rent personal data.
Information may be shared only:
- With RDA UK where required
- With medical, safeguarding or emergency professionals where necessary for someone's safety
- With Disclosure Scotland for PVG checks, where relevant to a volunteer role
- With the providers listed above, acting on our behalf
- Where we are required to by law
Any sharing is done carefully and proportionately.
Your rights
Under UK data-protection law, you have the right to:
- Access the personal data we hold about you
- Ask for incorrect data to be corrected
- Ask for your data to be erased, where appropriate
- Object to or restrict certain types of processing
- Withdraw consent at any time, where we rely on your consent
To exercise any of these rights, contact us at info@highlandgrouprda.org.uk.
If you are unhappy with how we have handled your information, you can also complain to the Information Commissioner's Office (ICO) at ico.org.uk.
Keeping your data safe
We take appropriate technical and organisational steps to protect personal information from loss, misuse or unauthorised access.
Access to records is limited to the people who need it to carry out their role.
Changes to this policy
This policy may be updated occasionally to reflect changes in the law or in how the charity operates.
The latest version will always be published on our website, with the date it was last updated shown at the top.