General information

Introduction

This is the general privacy notice of Forestry and Land Scotland (FLS, “we”, “us”, “our”) established by the Forestry and Land Management (Scotland) Act 2018 and having our principal place of business at Great Glen House, Leachkin Road, Inverness, IV3 8NW.

This privacy notice explains your rights under the Data protection Act 2018 (DPA) and UK General Data Protection Regulation (UK GDPR). It describes how we gather, use and share your personal information that we may hold and includes any personal information we already hold. We are committed to protecting and respecting your privacy.

Forestry and Land Scotland is registered with the Information Commissioner (registration number Z4857137) under Scottish Ministers, to handle your data.

Our reasons for handling your data

We’ll use your personal information where:

• you have entered into a contract with us
• it is required by law (legal obligation)
• it is necessary to perform our statutory duties (public task)
• you, or your legal representative, have given us consent

Some of the information that we process is classed as ‘special category data’. Where we process this type of information, we rely on either your consent or on a condition set out in the DPA, such as medical or equality and diversity information, and will have safeguards in place.

There may be occasions where we ask for consent, for example, if you have signed up to a mailing list. You have the right to withdraw this consent at any time.

What data we collect from you

We may process several categories of personal information depending on the purpose, which may include:

• contact details, including name, address, telephone number(s), email address(es)
• information contained in correspondence with us
• visual images
• financial details

If we collect personal information from other sources we will inform you.

How we use your data

We process your data for a number of purposes:

• volunteer services
• developing policy and undertaking consultations
• providing advice and information and undertaking research
• the use of closed-circuit television (CCTV) and mobile systems for crime prevention
• car parking charges and control including the use of Automatic Number Plate Recognition (ANPR)
• investigation of complaints and accidents
• land management
• undertaking commercial activities
• carrying out our obligations arising from any contracts entered into by you and us
• notifying you of changes to our services
• sending you communications which you have requested and that may be of interest to you
• and all activities that we are required to carry out as a controller and as a public authority

When we share personal data

On occasion we may need to share your information with other organisations for statutory or regulatory reasons, or because it is in the public interest. Sharing will be carried out lawfully and securely and we will only disclose the personal information that is necessary for that particular purpose.

We will not sell or rent your information to third parties and we will not share your information with third parties for marketing purposes.

Will your data be transferred outside of the European Economic Area?

In most cases personal information is not transferred or stored outside of the UK or European Economic Area. If your personal information is processed outside the United Kingdom or European Economic Area, you will be informed of this and the safeguards that are in place.

How long we will keep your data and how we decide this

We will keep your personal information only for as long as it is needed based on business need, as well as statutory, regulatory and legal requisites. When we no longer need personal information, arrangements are made to securely delete or destroy it.

Choosing not to provide personal data

If you do not provide the requested personal information it is more than likely that the service you wish to use will not be available to you. We try to ensure that we only collect the minimum personal information that is necessary.

Your data and automated decision making

Your personal data may be subject to automated decision making. You will be informed where automated decision making applies including profiling, and the envisaged consequences of such processing.

Your rights

Under certain circumstances, you have the right to:

• request access to the personal information we hold about you (known as a ‘subject access request’)
• request that your personal information be corrected or updated if you believe it is inaccurate or incomplete
• request your personal information be deleted
• ask us to stop processing your personal information
• ask us to restrict the processing of your personal information
• ask us for the personal information that we hold about you to reuse it for your own purposes

How to contact us about your data

You have a right to access your personal data and ask us to see the data we hold about you. You will not have to pay to get your data. In some cases, however, we may refuse your request in line with the DPA.

You can contact our Data Protection Officer at:

Head of Records and Data Protection
Forestry and Land Scotland
Apex 1
99 Haymarket Terrace
Edinburgh
EH12 5HD

Email dataprotection@forestryandland.gov.scot

Your right to complain

If you have concerns about our compliance with data protection laws, please contact our Data Protection Officer in the first instance at dataprotection@forestryandland.gov.scot. They will look into the concerns you have raised and provide a response.

If you are not satisfied with the DPO’s response you have the right to lodge a complaint with the Information Commissioner's Office (ICO). The ICO are the supervisory authority responsible for data protection in the UK. You can contact the Information Commissioner at:

The Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 08456 30 60 60

More information is available at make a complaint on the Information Commissioner's site.  

Visiting our website and social media users

Why collect personal data?

We only collect information we need. We use this to:

• make site improvements
• respond to your queries
• improve our service

What's collected?

We collect different types of information for different reasons. This includes:

Website visits

We use Google Analytics, a third-party service, to understand how you use our website. We do this using cookies and page tagging using Google Tag Manager. No one is identified using the information we gather, and we hold onto it for 38 months. We only share this with essential users at the Scottish Government and the private company that helps us manage our website.

Data collected by Google Analytics may be transferred outside the UK and EEA for processing. Find out more here.

Videos and social media plugins

Our website displays some videos and social media tools that are managed by companies like YouTube and Vimeo. These platforms capture certain data about how they are used. As we don’t manage those platforms ourselves, your use is subject to their own privacy policies. These providers make certain data available to us, so that we understand how you use them on our website, but we don’t share that information with anyone outside of Forestry and Land Scotland.

Queries and feedback

If you contact us with a query or feedback, via email, social media or website, we collect your email address and other personal information contained in the message. We might pass this on to other authorised people within the organisation so we can help you.

Links to other websites

Some of our applications are provided by third parties. If you click on any links to third party websites from our website, we encourage you to read the privacy policy statements contained on those sites.

Data security

We work hard to ensure high standards of data security. Forestry and Land Scotland is Cyber Essentials Plus certified by accreditation body, IASME Consortium. Cyber Essentials is a Government backed scheme run by the National Cyber Security Centre, part of GCHQ.

 

Information management

Forestry and Land Scotland Digital Services hold an ISO 27001:2022 certification (certificate number 19644). This is one of the most widely recognised standards for Information Security Management Systems (ISMS). Complying with this standard shows our commitment to best practices in crucial areas:

• Data transmission
• Storage
• Access controls
• Management of third parties
• Incident management
• Tracking of threats

Do you need extra help?

If you would like this notice in another format (for example: audio, large print, braille) please contact us (see ‘How to contact us about your data’ above).

Changes to this policy

This policy was published on 1 April 2019 and last updated on 19 August 2024.

We may change this policy from time to time, when we do we will inform you via our website.