Privacy Policy

This page explains how and why NatureScot uses data about people, how we gather, use and share data, how long we keep it, the rights you have over the use of your data and how to get in touch with us to discuss our use of your data.

We will review this information regularly update it when changes are needed. We will also give you detailed information about each particular service that uses your information at the time we contact you or you pass your information to us.

We can be contacted at:

Great Glen House
Leachkin Road
Inverness
IV3 8NW
You can contact us by phone: 01463 725 000
Or email: [email protected]
The Data Protection Officer can be contacted at:

Data Protection Officer
Battleby
Redgorton
Perth
PH1 3EW
[email protected]

We use a variety of personal data depending on the task we are carrying out:

• To deliver most of our services, we need to use names, addresses, or other contact details.

• We sometimes use identifiers, such as business reference numbers.

• We will use other information about land management activities and some financial information to deliver functions such as Licensing and management of protected sites.

• If you write to us and include information about yourself we will hold that information for the length of time it takes to respond to you and for the management of those records.

• Where appropriate, we will ask for equalities information.

If you apply for a job with us, we’ll use and store the personal information you send to us. We may also look for other sources of information, such online sources, to assess your suitability.

When our partners work with us, we will keep contact details and other information sent to us. And we may make and keep audio and video recordings of meetings with partners where appropriate.

NatureScot are only allowed to use your personal data for the reasons described in the data protection laws. The main reasons we use personal data are:

• To fulfil our public tasks.

For example, when we are monitoring and managing protected sites we have to contact the people who manage the land where the site is. We also need the names and contact details of anyone applying for a licence.

• To fulfil a contract.

For example, when we are employing our staff or purchasing services from individuals

• Because we have your consent to use your personal data.

For example, you might have asked to be added to a newsletter or to find out about events. You can withdraw your consent any time, which means you will no longer receive that service from us.

NatureScot can only use data about people if we also protect people’s privacy and follow data protection law. The law sets out six principles organisations must follow to protect people’s privacy.

These are:

1. Use of data must be fair and comply with the law.
2. Data can only be used for a specific reason and, if it’s used again, the new use must be connected to the original reason.
3. The amount of data collected should only be enough as needed to do the job.
4. Information about people must be accurate and kept up-to-date if needed.
5. Information about people can only be kept for as long as needed to do the job and no longer.
6. Information must be kept safe and secure.

The law also states that NatureScot must be open, honest and transparent and help you understand why and how we are using your data. This guide forms part of that obligation.

NatureScot only processes data about people in line with these principles.

NatureScot is the Data Controller for the information covered by this notice. For some types of work we will be joint controllers with other organisations, or use a data processor. We will let the people whose personal data we are using know when NatureScot is not the only data controller or is using a data processor.

NatureScot’s Data Protection Officer (DPO) helps NatureScot to understand how to protect your personal data and comply with the law. They can also answer any questions you might have about how we use your data.

We obtain personal data:

• Directly from you, for example when you apply for a NatureScot service, write to us or phone us, or come to one of our events.
• From our partners, who help us deliver our services or when we help deliver another organisation’s services (for example the Scottish Government when we are helping deliver agri-environment subsidies).
• From neighbouring land managers when we need to contact the person responsible for a protected site.
• From cameras where we are using them for the security of our premises or for monitoring wildlife.

From audio or video recordings of meetings where appropriate.

From online sources when we don’t have your contact details or we need to verify information supplied in another way.

We will, for some types of work, share personal data with other organisations or receive data from them.

This includes:

• Scottish Government
• Private sector suppliers and contractors
• Third sector bodies such as charities and trusts
• Other Scottish public bodies
• Pension providers
• UK government departments such as HMRC
• Occupational health providers
• Trade unions
• Employee benefit schemes

We will keep our information about data protection up to date to include details about data sharing where relevant.

The laws give you rights over how data about you is used. NatureScot must tell you about these rights and help you use them.

The rights are:

a) To be given information by organisations about why and how we use your data;

NatureScot will give you as much information as we can at the time we collect your data. We will explain what categories of data we hold about you (e.g. name, address, email), and we will tell you how we are using this data.

b) To see, and be given a copy of, data we hold about you;

This means you have the right to ask us what data we hold about you and how we use it. If you ask NatureScot for access to your personal data we will:

• Confirm we are using your data;
• Give you a copy of the data we hold; and
• Explain what data is held about you, why we’re holding it and how we are keeping it safe.

To make a request please write to the Data Protection Officer giving us your name and contact details and a description of the data you want to see. We will respond as soon as we can and by 30 days after your request at the latest. We might ask you to provide some form of identification so we don’t give data about you to the wrong person by mistake.

We won’t charge you a fee for providing you with the data.

We can make data available in other formats. Please contact the Data Protection Officer if you would like to discuss this option.

c) To ask to have incorrect or incomplete data corrected or completed;

NatureScot will correct errors or add information that explains the error within 30 days of you contacting us. If we have shared your data with any third parties, we will tell them about the mistake and correction. We will let you know that we have done this. You can also ask us to complete some data about you where we hold only part of it. And you can also ask us to stop using your data while we look into your corrections.

d) To ask us to delete data we hold about you;

If you think we are using your data when there is no reason to do so you can ask us to delete your data. For example, you applied for a grant some years ago and the conditions have been discharged. If we shared your data with another organisation we will tell them about the deletion of your data. We might not be able to delete your data in some cases, for example if we have a contract with you.

e) To ask us to stop using your data in certain ways;

If you think we are using your data in a way that doesn’t follow the law, or if you have objected to your data is being used, you can tell us to stop using your data for certain tasks. We will consider your request and let you know if we can do this as soon as we can after your request. If we’ve shared your data with any other organisation, we will let them know you have asked us not to use your data in certain ways.

g) To object to your data is being used if there we have no grounds to use it;

If NatureScot is using your data to fulfil our public task you can object to us using it that way. Please write to us explaining your particular situation and how do you feel NatureScot use of your data is affecting you. We will tell you about this right when we collect your data. You can object to us sending marketing materials to you and we will stop as soon as possible.

Complaints

If you are not happy with how NatureScot is dealing with your rights, please write to the Data Protection Officer explaining your concerns.

If you are not happy with our response you can complain to the UK Information Commissioner (ICO). The Information Commissioner will carry out an investigation and let you know the outcome within a reasonable period. Contact www.ico.org.uk

We use your personal data to:

• Manage and monitor terrestrial and marine protected sites and species and give advice on the wider countryside
• Grant or restrict licences
• Give out funding
• Educate, inform and raise awareness of nature
• Provide advice about the natural heritage
• Help the Scottish Government distribute agri-environment subsidies
• Encourage participation
• Buy goods and services
• Run our administrative functions, such as Human Resources and Record Keeping
• Carry out the statutory duties of a non-departmental public body
• Carry out statutory duties for deer management
• Employ staff and engage contractors.

Our corporate policy is to dispose of information at the end of its lifecycle.

This means we will delete your personal data once we’ve finished the task we collected it for and any related audit or review period has passed.

In line with good records management practice, we have a business classification scheme and an information retention schedule.

Our Records Management Plan includes these schedules and describes our overall records management provision.

Our Records Management Plan has been approved by the Keep of the Records of Scotland.

We can provide a copy of our business classification scheme/Records Management Plan on request.