Privacy

Contents

• Introduction
• Data Controllers
• Data Protection Officer's contact details
• Lawful basis for processing your information
• Websites and contact forms
• Social media
• When you contact us via phone, email or make a complaint
• When you use our services
• When you apply to work with NRS
• Your data protection rights
• Disclosure of personal information
• Complaints or queries about our use of personal information

Introduction

This privacy notice tells you what to expect when National Records of Scotland (NRS) collects and uses your personal information.

It explains what happens when you visit our websites, use our social media channels, contact us, use our services or apply to work with NRS. It also explains how to exercise your data subject rights and make a complaint.

Please use the table of contents to locate the information you want to find out more about.

Data Controllers

The data controllers for NRS are the Registrar General for Scotland and the Keeper of the Records of Scotland.

Data Protection Officer's contact details

Our Data Protection Officer can be contacted online by using our contact form here or by writing to:

Data Protection Officer

National Records of Scotland
HM General Register House
2 Princes Street
Edinburgh
EH1 3YY

Lawful basis for processing your information

We may process your personal information because:

• you have given us clear consent for us to process your personal information for a specific purpose
• you have entered into a contract with us
• processing is necessary for compliance with a legal obligation that applies to us
• it is necessary to protect someone in an emergency
• processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law

Websites and contact forms
This privacy notice covers this website (www.nrscotland.gov.uk) and the following websites which are managed by NRS:

• NRS Web Archive
• Scottish Archives for Schools (SAFS) 

Information collected by the NRS website

Information that is routinely collected by this website falls mainly into two categories: information submitted using our contact forms and website log files. 

Contact forms

The website provides a contact form to allow users to send us a message. You can use it to:

• Give general feedback about the site
• Make an enquiry relating to the different functions of NRS 
• Make a Freedom of Information request
• Make a data protection request
• Report technical problems with the site
• Request a business contact with NRS

The anniversary message request form can be used to make an application for the King to send a message of congratulations for wedding anniversaries. The information you provide is passed directly to the Anniversaries Office at Buckingham Palace.

The information collected using the contact forms will be stored and used by NRS chiefly for the purpose of fulfilling the stated service.

We will not share any personal information that we receive about individuals with other organisations for commercial purposes, or use it for any marketing purposes which individuals have not consented to.

We reserve, however, the right to use non-personal information for our business, research and marketing purposes. In these cases the use of the information will not identify or be associated in any way with the individual who provided it and will not contain any contact information relating to that individual or their company.

You do not need to include your name or contact details in order to provide us with general feedback or information about any technical problems you may encounter.

You will, however, need include an email address if you want us to reply to you. We will only use your email address to reply to you and not for any other purpose. For some enquiries contact details will be required. You will need to provide your name and contact information if you wish to make an enquiry about NRS functions, request a business contact with NRS or make a freedom of information or data protection request.

Information collected from the contact form is not stored on the website, and will only be accessible by authorised NRS staff. We use a relay service to scan emails for spam and malware before they reach the service desk system. 

Website log files

All websites produce log files that record the activity on that site. Log files record which pages on the site have been accessed and how many times. 

Log files typically record the IP address and/or hostname of all users accessing the website. This allows us to distinguish between different users and therefore estimate the number of unique visitors to our websites. IP addresses and hostnames are not linked to any individual's personally identifiable information.

Specific IP addresses and hostnames will not be made publicly available. They will only be used by website log file software to compile overall summary statistical reports on the performance of our websites.

Website log files are stored securely on the websites using good industry practice for safeguarding information and server functions.

Cookies and Google Analytics

To gather information about how people use this site (https://www.nrscotland.gov.uk) and the other websites covered by this privacy notice we use Google Analytics.

The information collected helps us investigate whether each website meets its users’ needs as well as to evaluate how each website can be improved.

Google Analytics stores information about what pages you visit, how long you are on the site, how you got here and what you clicked on. 

We do not collect or store your personal information (e.g. your name or address). The information collected cannot be used to identify who you are. 

We do not allow Google to use or share our analytics data. More information on the cookies used on this site can be found on our Cookies page.

Search engine

The NRS website uses a search engine which is part of our content management system. 

No user-specific data is collected or used by our website search facility.

IP addresses and hostnames

An IP address is the numeric address of a computer. The IP address recorded on website log files is the address provided by your internet service provider's equipment and not your own personal computer's address.

Hostnames are similar in appearance to the domain names you see in URLs and email addresses. The hostnames recorded on website log files are those of the internet service provider's equipment that you are using to access the internet, and not your own computer's name or location.

Your internet service provider will keep records of which customer is using any IP address or hostname at any given time, and so it is theoretically possible to trace back activity shown on any website log file to a specific individual. In practice, this can only be done with the explicit involvement of the internet service provider, and such a trace would therefore only take place in the event of serious criminal misuse of the internet and would be carried out by the police.

NRS will not attempt to associate IP addresses and hostnames with individuals. In the event of serious criminal misuse of the website, the matter would be referred to the police for investigation.

Security and performance

NRS uses a third party service to help maintain the security, performance and availability of our websites. IP addresses of visitors to the NRS website are processed to deliver this service. 

The IP addresses are not linked to any individual's personally identifiable information.

Social Media

Our blogging service

Our blog “Open Book” is run via a third party service which collects anonymous information about users' activity on the site, such as, for example, the number of users viewing pages on the site. In addition, the blog service requires visitors wishing to post a comment to provide a name and email address.

Our blogging service provider is run by Automattic Inc. For additional information about how our blogging service provider processes data, please see Automattic's privacy notice.

When you contact us via X/Twitter

NRS uses Hootsuite, a third party provider, to manage its social media interactions.

Hootsuite stores messages sent by you via social media for three months. These will not be shared with any other organisations.

When you contact us via phone, email or make a complaint

When you phone NRS

We do not collect caller line identification information when you call us.

We will only collect personal information that you consent to provide to us in order to deliver a service and we will not keep this information for longer than is necessary.

When you email NRS

When you contact us via email, we will retain your email and our response to it for business reasons usually for no longer than 5 years. Thereafter the information will be confidentially destroyed.

When you make a complaint to us

When you make a complaint to us, we ask for your full name and address as well as for as much detail about the complaint as possible. This information is stored in a file which is restricted to specific staff handling the complaint within NRS. We retain the material for 5 years and destroy it thereafter confidentially.

In most cases we will have to disclose the complainant’s identity to whoever the complaint is about in order to resolve the matter. If a person making a complaint would prefer to stay anonymous, we will do our best to ensure this, but it may not be possible to handle a complaint on an anonymous basis.

When you use our services

NHS Central Register (NHSCR)

NRS maintains the National Health Service Central Register (NHSCR). This is a confidential population database containing information about people who were born or died in Scotland and persons currently registered or persons who have previously been registered for NHS healthcare purposes with Scottish General Practitioners (GPs). 

The NHSCR privacy notice explains how we process personal information in the register.

Registration

NRS administers the registration of life events such as births, deaths, marriages, civil partnerships, divorces and adoptions. 

The Registration Privacy Notice tells you what happens to personal information when a life event is registered.

The Adopted Children Register Privacy Notice tells you what happens to information passed to NRS when a child is adopted.

Scotland’s Census

The information contained in Scotland's Census is vital to help shape Scotland's future by informing key decisions on how services such as transport, housing, schools and hospitals are planned.

You can find out more about how we protect the confidentiality of census data, and ensure transparency and confidence, in the privacy section on the Scotland’s Census website.

We have also published information explaining our use of Administrative Data for Scotland’s Census 2022 and beyond.

Scotland’s People 

Scotland’s People  is an official resource for searching Scottish records and archives  The web service is owned, operated and managed by NRS.

The Scotland's People Privacy Notice tells you what happens to personal information we collect and use.

The Scottish Register of Tartans

NRS is responsible for maintaining The Scottish Register of Tartans and registering of new tartan designs. 

The privacy statement on the Scottish Register of Tartans website tells you about the information we collect and how we use it.

Visiting our search rooms

More information on visiting our search rooms can be obtained on the Visit Us pages of our website pages. We only collect personal information which will help us to deliver a service. We keep this personal information for as long as necessary for the purpose it was collected.

When you apply to work for NRS

Information on how your personal information is processed when you apply to work for NRS is available in the privacy notice on the Scottish Government Jobs website.

Your data protection rights

Under data protection law, you have rights. The rights available to you depend on our reason for processing your information. 

Right to be informed

You have the right to be informed about the collection and use of your personal data in most circumstances. This information can usually be found in our privacy notices and elsewhere on our websites.

Right of access

You have a right to request a copy of personal information we hold about you, by making a subject access request. 

You can find out more about the process of requesting information on our dedicated website page.

We will not provide you with a copy of your personal information if we already make it available under a legal obligation. For example birth, death and marriage certificates can be ordered as official extracts.

Right to rectification

You have the right to ask us to update our records if you believe that the information we hold is inaccurate or incomplete. For some information we hold exemptions apply to the rights to rectification.

Right to erasure

You have the right to ask us to erase your personal information. For some information we hold exemptions apply to rights to erasure.

Right to restriction of processing

You have the right to ask that we stop or restrict the processing of your information in certain circumstances.

You can ask for content to be taken down from our websites or for a record to be withdrawn from public access. You will need to send us details and explain why you think it should be taken down or withdrawn.

When a valid request is received, the content or record will usually be temporarily taken down from public view or access pending the review process. For more information please read our Reclosure and Takedown Policy.

Right to object to processing

You have the right to object to the processing of your personal information if the process forms part of our public tasks.

Right to data portability

You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. This right only applies to information you have given us and we are processing information based on your consent or under contract, or are in talks about entering into a contract and the processing is automated.

If you want to find out more about how to exercise these rights please contact our Data Protection Officer.

Disclosure of personal information

We will not disclose personal information you provide to us without consent in most cases, but as highlighted above, we might need to do so when we investigate a complaint, or want to obtain a reference or a ‘disclosure’. We will inform you of this beforehand unless the disclosure is required by law, to prevent and detect crime or to produce anonymised statistics.

We may share information we collect for registration purposes to support the administration of vital public services. We may also share information we collect for registration and statistical purposes to enable research that delivers a clear public benefit, subject to appropriate safeguards. 

Complaints or queries about our use of personal information

NRS takes any complaints we receive about how we collect and use personal information very seriously, as we try to meet the highest standards. If you think that we collect or use information unfairly, misleadingly or inappropriately, please contact us and bring this to our attention. We also welcome any thoughts and suggestions for improving our procedures.

You can make a complaint or contact us about other concerns using the Data Protection Officer’s contact details provided above. 

When you make a complaint we will take appropriate steps to investigate and respond to your complaint and let you know the outcome without undue delay.

You also have the right to report your concerns to the Information Commissioner’s Office (ICO). The ICO recommend you contact us first, before you bring your complaint to them. For more information visit the ICO website.

Further information

This privacy notice does not provide details of every aspect of NRS’s collection and use of personal information. More details about how we may use personal information to carry out our functions are provided throughout this website. We are happy to provide any additional information or explanation needed. Any requests should be made using the Data Protection Officer’s contact details provided above. 

Links to other websites

When we link to other websites, we encourage you to read the privacy notices contained on those sites.

Changes to this privacy notice

We keep our privacy notice under regular review to make sure it is up to date and accurate. If there are any changes to how we collect, use and share personal information we will update this page.