Privacy & cookie policy

Privacy Statement

This is how we generally use information collected or obtained for various services (being updated on an ongoing basis).

This privacy statement is the privacy notice for all Park Authority services. We will use your details to provide you with the service(s) which you or someone else (with your CONSENT) have asked us to provide. We will also use your personal details for purposes of crime prevention and crime detection and/or when required by law and will share it with other public bodies for that purpose.

Privacy Statement in detail

The three core areas of business for the National Park Authority are Conservation, Visitor Experience and Rural Development. These activities are supported by the Corporate Services function.

The Park Authority is a Planning Authority, with planning powers to decide all planning and related applications within the boundary of Loch Lomond & The Trossachs National Park.

The Park Authority is an Access Authority, and upholds access rights in accordance with the Land Reform (Scotland) Act 2003.

Description of processing

The following is a broad description of the way we processes personal information. To understand how your own personal information is processed you may need to refer to any personal communications you have received, check any privacy notices we have  provided or contact us to ask about your personal circumstances.

Lawful basis for processing information

Planning – as a Planning Authority, personal information is processed for the consideration of planning applications, proposals for housing and tourism and for the enforcement and monitoring of planning developments.

Personal information is processed for the purposes of reporting byelaw infringements, in terms of the Camping Management Byelaws 2017: http://www.lochlomond-trossachs.org/rr-content/uploads/2017/02/Camping-Management-Byelaws-2017.pdf

This is in addition for the issuing of fixed penalty notices for litter or flytipping and the management of a camping booking system.

Personal information is processed for the purpose of compliance with the Loch Lomond Byelaws 2013 for all powered craft launched on Loch Lomond:http://www.lochlomond-trossachs.org/rr-content/uploads/2016/07/Loch-Lomond-Byelwas-2013.pdf

We process personal information to enable us to promote our goods and services, to maintain our accounts and records, to support and manage our staff and volunteers, and to guide and set the direction for the National Park.

In terms of data protection legislation, the Park Authority is the data controller of any personal information provided to or gathered by us.

This privacy statement describes what we will and will not do with the information we hold about you. It sets out the general approach we take, in each case with additional information relating to particular areas of our activity.

General Approach

The Park Authority does not sell or rent your personal details to any external organisations.

For most purposes, we will only process your information with your CONSENT. In most cases, we understand that by providing us with your details in order to obtain a service from the Park Authority you are consenting to us using those details in order to provide that service to you. Except as set out in this privacy statement, we will not use your personal details for any other purpose without first obtaining your CONSENT to that other purpose or purposes (you may have been asked to provide this additional CONSENT at the time when you originally contacted us, for example in an additional section on an application or other form).

We retain personal data relative to the purpose for which it was gathered in accordance with the time periods for retention set out in our record retention schedule. Our retention schedule is maintained in accordance with the Public Records Scotland Act 2011. Specific details on the use and retention of your personal data will be provided at the point we collect your data and you may contact us at any time if you have any queries about your rights as an individual in terms of how we are processing your data.

By law we are obliged to provide information to certain other public bodies such as the Department for Work and Pensions, HM Revenues and Customs, courts, tribunals, hearings and other formal bodies dealing with legal processes, and various external regulatory bodies. We also have an obligation to assist in the prevention of crime and we will therefore generally supply specific information which we are asked to provide to the police or other crime detection agencies, provided we are satisfied that the request is connected to an investigation and that disclosure would be lawful and proportionate.

External contractors who are appointed to process information on behalf of the Park Authority will do so under our instructions. All contractors which do this are appointed under written contracts requiring them to keep personal information safe and prohibiting them from doing anything with the personal data they process for us other than following the Park Authority’s instructions.

Use and Disclosure of Staff Information

Staff information is primarily held by the Park Authority in order to out its duties as an employer.  In connection with this we hold information on staff relating to ethnic background, disability etc. in order to comply with our obligations relating to monitoring equality of opportunities and discrimination legislation.  Where applicable we will hold information on trade union membership to allow for payment of union subscriptions deducted from pay and will share this information with the relevant unions to allow these subscriptions to be collected.  We also share information where applicable with other recipients of payroll deductions such as Glasgow Credit Union or suppliers of salary sacrifice schemes such as child care voucher providers.  Earnings information is supplied to HMRC as required by law to allow for deduction of PAYE and national insurance contributions.

Information will generally be released to the police and other criminal investigation agencies on request in relation to specific investigations; provided the Park Authority is satisfied that legitimate grounds exist for doing so.  It will also be released to government agencies able to compel disclosure such as the Child Support Agency if we receive an appropriate request.  Information will be released to courts and employment tribunals in relevant cases and may be shared with external legal advisers in these cases.  It will also be released in response to an order from a court with competent jurisdiction to make such an order.  It may also be released (without CONSENT) in response to investigations by external regulators such as Audit Scotland, the UK and Scottish Information Commissioners and Scottish Public Services Ombudsman.

If The Park Authority receives a freedom of information (“FOI”) request which includes information relating to staff, then as a general rule such requests will be refused (or the staff information removed/redacted from the response) unless it relates to more senior members of staff.

However, each request will be considered on its own merits and in line with guidance issued by the Information Commissioner and Scottish Information Commissioner.  Even for more senior staff, we will not release information which does not directly relate to that member of staff’s work activities, so information such as home address will not generally be released.  Staff will be consulted ahead of any decision to release their personal data in response to an FOI request.  The same principles apply to information relating to former members of staff (subject to the caveat that the Park Authority may be unable to readily contact such individuals to seek their views on disclosure and will generally reach a decision without making contact).

Media Enquiries

The Park Authority has a communications team which deals with queries from the press and media.

In responding to these queries, our communications team applies the same rules as all other officers of the Park Authority and will only release information about individuals in line with this privacy statement. In terms of this approach, personal information held by the Park Authority will only be released to the media if there are compelling reasons for doing so.

CCTV

The Park Authority’s properties are covered by a variety of CCTV (closed circuit television) systems. These systems are designed primarily to protect the buildings from theft or vandalism; some systems are also intended to help protect staff.

An individual has a right of access to their own personal data but does not have any rights to recordings of other individuals.

Police officers or the courts may request access to recordings for evidential purposes.  The courts are not required to complete a form demonstrating the right to request the footage although police officers are required to complete and submit the Park Authority’s standard Section 29 request for information form for approval before they will be given consent to view or remove recordings.  The relevant Park Authority staff member will determine whether or not they are satisfied that the justification provided by police officers is sufficient to allow access to the recordings.

All queries regarding public space CCTV should be directed to our business mailbox info@lochlomond-trossachs.org.

Marketing

What is ‘DIRECT marketing’? What is ‘DESTINATION marketing’?

Direct marketing is marketing which is directed at specific individuals as opposed to, for example, a newspaper advertisement which would be marketing but not direct marketing as it isn’t directed at you as a particular individual.

Controlling your personal information for direct marketing purposes:

You may choose to restrict the collection or use of your personal information for direct marketing purposes in the following ways:

• Whenever you are asked to fill in a form on the website or on an application or competition form or otherwise, look for the box that you can click to indicate that you do not want the information to be used by anyone for direct marketing purposes
• If you have previously agreed to us using your personal information for direct marketing purposes, you may change your mind at any time by writing to or emailing us. Every email we send gives you this option.

E-Mailing

When you send us an email, we use your email address to thank you for your comment and/or reply to your enquiry, and we will store your communication and our reply for any future correspondence in accordance with our data retention policy. Beyond our initial reply, we will never use your email address to send you any unsolicited message or information, nor will we share it with or sell it to anyone else for such use.

When you accept to receive information about our services, promotions, newsletters, press releases, and/or offers, we use your email address and any other information you give us to provide you with the information or other services, until you ask us to stop (using the ‘unsubscribe’ instructions provided with each email communication and/or on the site where you signed up, and/or as we otherwise provide), or until the information or service is no longer available.

Social Media

Some of our website(s) use the social plugin “like” button, widgets such as “share this” button, or Facebook Pixels, provided by the social network facebook.com, operated by Facebook Inc., 1601 S. California Avenue, Palo Alto, CA 94304, USA (“Facebook”). The plugin is identifiable by the bluish and white Facebook logo “f”.

By visiting our website(s) your browser (and in some cases your mobile device) establishes a connection to Facebook servers. Facebook directly transfers the plugin, widget or other similar technologies (like pixels) content from your browser (or mobile device), enabling Facebook to receive information about you having accessed the respective page of our website(s). We have no direct influence on the data gathered by these technologies.

If you are logged into Facebook, your visit can be assigned to your Facebook account. If you interact with the plugin by clicking “Like” the corresponding information is transmitted from your browser directly to Facebook and stored by it. Even if you are not logged into Facebook, there is possibility that the plugin transmits some data e.g. your IP-address to Facebook.

For the information on the purpose and scope of data collection and processing by Facebook, as well as your rights in this respect and settings options for protecting your privacy please visit Facebook’s privacy policy: http://www.facebook.com/policy.php or  https://www.facebook.com/about/privacy/advertising.

If you are a Facebook member and do not want Facebook to connect the data concerning your visit to our website with your member data already stored by Facebook, please log out of Facebook before entering our website(s).

The Park Authority does not intentionally upload any personal information to Facebook for the purposes of targeted marketing e.g. using Facebook services like Custom Audiences.

For more information about how online behavioural advertising works and what you can do to manage your privacy, please visit the pan European Interactive Digital Advertising Alliance (EDAA) website: Your Online Choices (www.youronlinechoices.eu).

Filming and Photography  

The Park Authority uses photographs and video footage of a wide range of people in all and any media to promote the services, mainstream activities and facilities that it provides. Such media include (but are not limited to) posters, leaflets, printed publications, display stands and banners, reports and pages on our website. None of the materials are produced for sale, and the photograph or video clip of you/your child will only be used in materials produced or commissioned by the Park Authority for the Specified Purposes and in accordance with data protection legislation from time to time in force.  The Park Authority shall only store copies of the photograph or video clip for the Specified Purposes.

Consent

If you agree that the Park Authority may use photograph/video footage of you or your child (and you confirm that you are the parent/carer of the child) for the Specified Purposes in our CONSENT form, we will store your contact details in restricted access files in case we need to contact you.  The contact details you provide will only be used in the event of a query regarding the photograph or video footage. Your details will not be used for any other purpose and will not be disclosed to anyone outside of the Park Authority except where you also signify agreement on our CONSENT form to us submitting photographs to local and national press to generate publicity for an event or service.

Your Rights under Data Protection Legislation

You have a number of Rights under data protection legislation in regards to how your data is processed. As a minimum you should be given ‘fair processing’ information which is sometimes referred to as a ‘privacy’ notice or statement. This online ‘privacy statement’ constitutes our general approach to how we process personal information in accordance with our approved Information Use and Privacy Policy. There may be other more specific privacy notices or statements you will have been given or made readily available for a service you are obtaining from us, e.g. in an online or offline form, public notice or orally, etc. You have the following fundamental rights in respect to how your data is being processed.

Subject Access Requests (Requests for copies of your personal data that we hold)

• The right to request (in writing) a copy of your personal data held by us, given to you in a permanent form. You are entitled to be given if requested:
  • A description of the personal data being processed
  • A description of the purposes for which it is being processed
  • A description of any likely recipients
  • Any information on the source of this data
  • Where any automated decisions have been taken, the ‘logic’ behind these decisions

Automated Decisions

• You have the right, by notice, to prevent any automated decisions.

Direct Marketing

• You have the right to request in writing to cease, or not begin, processing of your personal data, for the purpose of direct marketing.

Preventing Processing

• You have a right to request to cease processing personal data if you believe it would cause you ‘damage’ or ‘distress’.

Rectification, Blocking, Erasure & Destruction

• By order of a court, you have the right to have any inaccurate personal data or expression of opinion which appears to be based on that inaccurate data, to be rectified, erased, blocked or destroyed.

Complaints to the Commissioner

• You have the right to ask the Information Commissioner to carry out an ‘assessment’ of the processing of your personal data if you believe it directly affects you (causes ‘damage’ or ‘distress’) to determine whether the processing is undertaken in accordance with the law.

ICO Scotland contact details

The Information Commissioner’s Office – Scotland
45 Melville Street
Edinburgh
EH3 7HL

Telephone: 0303 123 1115

Email: Scotland@ico.org.uk

How do I make a Subject Access Request?

You must:

• supply information to prove who you are (to eliminate risk of unauthorised disclosure)
• supply appropriate information to help us to locate the information you require.
• Your request should include details and provide evidence of who you are (e.g. driving licence, passport, birth certificate, utility bills). You should also provide as much detail as possible regarding the information you wish to access (e.g. where and by whom information is believed to be held, specific details of information required).

This list is not exhaustive and other forms of identification may be acceptable.  At least one form of identification should contain the same signature that is on your application form or letter and one must include a photograph. Please note that the Park Authority will not be able to comply with any requests received unless satisfactory proof of identification is provided.

You are not required to state WHY you wish to access the information: the details we require are merely those that will aid the efficient location and retrieval of information.

Once we receive a Subject Access Request, you will receive all the information that has been located and can be released within one calendar month and an explanation for any information that cannot be provided at that time.

Upon receipt of a request, we must provide:

• information on whether or not the personal data are processed
• a description of the data, purposes and recipients
• a copy of the data
• an explanation of any codes/jargon contained within the data.

We must respond to Subject Access Requests within one calendar month.

Information Officer
National Park Authority
Carrochan
Carrochan Road
Balloch
G83 9EG

Website Privacy Policy

In terms of data protection legislation the Park Authority is the data controller of personal data (information relating to identifiable living individuals) collected or obtained by or through our websites.

The Park Authority is registered under the Data Protection Act 1998 and as a data controller (notification number Z6815521); the register entry can be inspected at https://ico.org.uk/about-the-ico/what-we-do/register-of-data-controllers/

Our websites do not automatically capture or store personal information, other than logging the user’s IP address and session info such as the duration of the visit and the type of browser used. This is recognised by the Web server and is only used for system administration and to provide statistics which the Park Authority uses to evaluate use of the site.

All marketing information will include an option for you to opt out of any future, similar correspondence. We do not contact children under 12 without the CONSENT of a legal parent or guardian.

Information Security

We believe that keeping personal information secure is one of our most important responsibilities.

We maintain all necessary physical, electronic and procedural security to help safeguard personal, sensitive and payment data against loss, misuse or alteration. Third parties that provide us with support or services may also receive personal, sensitive or payment information, and we require them to maintain security measures similar to ours with respect to such information.

In compliance with the Privacy and Electronic Communications Regulations 2003 (as amended) subscribers are given the opportunity to un-subscribe at any time. This process is detailed at the footer of each email campaign.

Social Media Platforms (Facebook, Twitter etc.)

Communication, engagement and actions taken through external social media platforms that we utilise, and users participate on, are bound to the terms and conditions, and the privacy policies held with each social media platform respectively.

Users are advised to use social media platforms wisely and communicate / engage upon them with due care and caution in regard to their own privacy and personal details. We will never ask for personal or sensitive information through social media platforms, and encourage users wishing to discuss sensitive details to contact us through our standard primary communication channels, such as by telephone or in writing.

Some of our websites use social plugins which help share web content directly from web pages to the social media platform in question. Users are advised before using such social plugins we utilise that they do so at their own discretion and note that the social media platform may track and save your request to share a web page respectively through your social media platform account.

Under 12

If you are aged 12 or under, please ask your parent or guardian’s permission before you provide personal information on any of our websites

Content Accuracy on our Websites

The information provided on our websites is believed to be accurate at the time of writing but The Park Authority accepts no liability for the contents and anyone relying on these contents does so at their own risk. Nothing on our websites is to be construed as binding the Park Authority or constituting an offer on behalf of the Park Authority.

Scope of Policies

This privacy policy only covers the Park Authority website at http://www.lochlomond-trossachs.org/ (and the other websites operated or managed by us where they link back to this privacy policy) Links within this site to other websites are not covered by this policy and individuals should check the terms of the privacy policy of those other sites for their terms. The Park Authority is not responsible for the content of external websites.

Changes to this Website Privacy Policy

Any changes to this Privacy Policy will be posted on our websites (at http://www.lochlomond-trossachs.org/).

Cookies

What is a Cookie?

Cookies are small data files which are placed on your computer, mobile or other handheld devices as you browse through our websites. On our websites, cookies are used to remember information about your browsing history, for example, the on-line resources you use, the pages you visit and how often you visit them.

Types of cookies

• ‘Session’ cookies remain in your browser during your browser session only, i.e. until you leave the website.
• ‘Persistent’ cookies remain in your browser after the session (unless deleted by you).
• ‘Performance’ cookies collect information about your use of the website, such as webpages visited and any error messages; they do not collect personally identifiable information, and the information collected is aggregated such that it is anonymous. Performance cookies are used to improve how a website works.
• ‘Functionality’ cookies allow the website to remember any choices you make about the website (such as changes to text size, customised pages) or enable services such as commenting on a blog.

How we Use Cookies on our Websites

Our websites uses cookies to help improve the users experience while visiting our websites. Where applicable our websites use a cookie control system allowing the user on their first visit to the website to allow or disallow the use of cookies on their computer / device. This complies with legislation requirements for websites to obtain explicit consent from users before leaving behind or reading files such as cookies on a user’s computer / device.

Our websites use cookies to collect anonymous information about how well the site is performing via Google Analytics.

Google Analytics

Please note – We do not collect personal information via Google Analytics.

Our websites use Google Analytics, a web analytics service provided by Google, Inc. 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”).

Google Analytics uses “cookies”, which are text files placed on your computer, to help the website analyse how users use the site. The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States.

Google will use this information for the purpose of evaluating your use of our websites, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf.

Google will not associate your IP address with any other data held by Google.

You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of our websites.

By using our websites, you consent to the processing of data about you by Google in the manner and for the purposes set out above.

Facebook

Our websites use Facebook plugins and pixels provided by Facebook Inc., 1601 S. California Avenue, Palo Alto, CA 94304, USA (“Facebook”).

We sometimes use Facebook plugins and pixels on our websites, however we do not store this information; it is stored by Facebook. The information is stored in such a way that information about individuals is not tracked, nor can individuals be targeted directly.

For the information on the purpose and scope of data collection and processing by Facebook, as well as your rights in this respect and settings options for protecting your privacy please visit Facebook’s privacy policy: http://www.facebook.com/policy.php or https://www.facebook.com/about/privacy/advertising.

Twitter

Please note – We do not collect personal information via Twitter.

Our websites use Twitter widgets, a social plugin service provided by Twitter, Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA (“Twitter”).

We sometimes use Twitter widgets on our websites, however we do not store this information; it is stored by Twitter. The information is processed in such a way that information about individuals is not tracked. The Twitter website widget is a social plugin that enables us to tailor content on our site(s), either by one or more of the following Twitter plugin features:

• showing recent tweets on our site(s)
• showing followers and counts
• showing interactive follow button
• help tailor content and suggestions

For the information on the purpose and scope of data collection and processing by Twitter, as well as your rights in this respect and settings options for protecting your privacy please read Twitter’s Privacy Policy: https://twitter.com/en/privacy

Disabling Cookies

If you would prefer to disable Cookies you need to change the browser settings on your computer to reject Cookies.

Microsoft Internet Explorer

1. Choose “Tools” from the menu at the top of your browser
2. Click on “Internet Options”
3. Click on the “Privacy tab”
4. Select the setting that best suits your needs

For Mozilla Firefox

1. Choose “Tools” from the menu at the top of your browser
2. Click on the “Privacy” icon
3. Select the setting that best suits your needs

Google Chrome

1. Click the spanner icon on the browser toolbar.
2. Select “Settings”
3. Select “Show advanced settings”
4. Select the setting that best suits your needs

Safari

1. Choose “Preferences” from your toolbar
2. Select “Privacy”
3. Select the setting that best suits your needs

Website Archiving

The Park Authority has given consent for the National Records of Scotland, the British Library and the National Library of Scotland to archive our website on an annual basis. These organisations may make our archived website available to their customers for research purposes.