Privacy notice

The personal information we gather will vary according to the task. 

Depending on service we are fulfilling it could include:

• personal details such as a person’s title, name or alias, and contact details including home address
• business information such as an address, Ordance Survey (OS) location, GPS reference, location code, business reference number, agent and/or legal representative, and business ownership details
• personal identifiers such as a person’s signature, visual images or filmed footage
• user information such as first name, last name, email address, profile picture and audio/video capture data
• financial information such as customer name, supplier name, account number and/or sort code, copies of invoices and bank
• statements, title deeds and/or tenancy agreements, and business accounts
• special category information may be collected in specific cases such as part of an investigation into unauthorised fellings

We’ll seek to keep your personal information accurate and up to date.

To ensure it's reliable, please inform us as soon as possible if there are any changes.

We must have a valid lawful basis to process your personal data. 

Mostly, we process personal data to perform a task in the public interest and to carry out our official functions, where the task or function has a clear basis in law. 

Scottish Forestry' Public Task statement

Sometimes, we may also have consent from an individual to process personal data for a specific purpose or to fulfil a contract.

The personal information we gather will only be kept and used for clear, limited purposes and it'll be adequate and relevant to the task.

We’ll use your data for a range of purposes. For example, to:

• pay grant claims
• consult on and process grant applications
• approve felling permission applications and forest management plans
• investigate unauthorised fellings
• undertake plant health surveillance and regulation duties
• co-ordinate the UK Land Carbon Registry
• map information to Geostore
• fulfil contractual obligations and to make payments
• respond to enquiries
• use images across internal and public facing platforms
• promote Scottish Forestry activities in the form of print and digital publications, marketing and advertising, exhibition displays, website and social media
• communicate remotely with staff, partners and stakeholders using Microsoft Teams to hold conference calls, online presentations or webinars

If you do not provide us with your personal information, we'll be unable to fulfil our statutory obligations and provide the services needed.

We may share our information internally across our organisation or Scottish Government.

If you choose to attend a meeting through Teams, be aware that your name and email address will be shared with other participants. 

Some of your personal data will be processed by Microsoft. 

Microsoft Privacy Statement (Microsoft website)

We may share your personal information with other public and regulatory bodies to ensure we are meeting our legal and statutory obligations. 

This may include:

• Animal and Plant Health Agency (APHA)
• appointed contractors
• Forestry and Land Scotland
• Forestry Commission
• Forest Research
• Health and Safety Executive (HSE)
• Historic Environment Scotland (HES)
• local authorities
• Nature Scot
• Police Scotland
• Rural Payments and Services Division (RPID)
• Science and Advice for Scottish Agriculture (SASA)
• Scottish Government
• Scottish Environment Protection Agency (SEPA)
• Scottish Government Planning and Environmental Appeals Division (DPEA)

We may also share your information with third parties to meet our business requirements, such as:

• undertaking surveys
• carrying out assessments

We may request other agencies or businesses to process personal information on our behalf, through service level agreements or contracts.

In order to consult with and inform stakeholder and community members about applications made and regulations implemented, we may share information submitted in connection to applications made and regulations implemented.  

This may include some personal information, such as:

• property names
• names of some individuals

In all these situations, UK GDPR requirements are adhered to.

Hard copies of personal information is kept in secure file storage at our local offices in filing cabinets with access limited to office staff as necessary.

Personal information stored electronically is on secure networks. These are accessible only through the use of an encrypted laptop. 

Some case management systems are used which are password protected. Sensitive information is stored in areas with restricted user access.

Personal information which is shared is done so in a variety of secure ways. This could include using systems which require password protection and two-factor authentication. 

Information is provided to named staff members and may be shared on a system which is accessible by invitation only or through an encrypted laptop.

Personal information is kept for a minimum period based on:

• business need
• statutory, regulatory and legal requisites

Once this period has passed, arrangements are made to securely delete or destroy it.

If your personal information is going to be processed outside the UK or European Economic Area (EEA), you’ll be informed of this and the safeguards that are in place.

Where we provide links to other websites, we're not responsible for the content of these websites.

Cookies are pieces of data that are often created when you visit a website. 

Cookies

We keep this privacy notice under regular review to make sure it's up to date and accurate.

This privacy notice was last updated on 1 October 2021.

Your rights in relation to your personal information:

• you have a right to request access to, and copies of, the personal information that we hold about you by making a 'subject access request'
• if you believe that any of the personal information that we hold about you is inaccurate or incomplete, you’ve a right to reques that we correct or complete your personal information
• you have a right to object to and/or request that we restrict the processing of your personal information for specific purposes
• where you’ve given consent to the processing of your personal information, you’ve the right to withdraw that consent

Any requests received by us will be considered under applicable data protection legislation.

You can email the Data Protection Officer to exercise any your rights.