Biodiversity Audit Project and Farm Biodiversity Scotland App - Privacy Statement

The Farm Biodiversity Scotland Audit App (“the app”) is owned by NatureScot. It has been developed under the Biodiversity Audit project (“the Project”) to encourage and help farmers and crofters to manage and monitor their contributions to biodiversity on their farms and crofts, and to align with and signpost to appropriate management measures under the future rural support framework being taken forward through the Scottish Government Agricultural Reform Programme. NatureScot contracts a company called Lumoscript for support and maintenance of the app. There is a Data Processing Agreement between NatureScot and Lumoscript that ensures personal and private data is subject to General Data Protection Regulation (GDPR) rules and only used for the purposes of the Biodiversity Audit project.

1. What information do we collect about you, and why?

Information	Why?
Your name and email address	To communicate with you and create an account in the app
Farm name and Business Reference Number (BRN) / Main Location Codes (MLCs)	For Lumoscript to retrieve your land parcel boundaries from Rural Payments & Inspections Division (RPID) for the app
Land Parcel Identification (LPID) numbers and polygons	To create your farm map in the app
Bank account details	For NatureScot to make a payment to you if applicable
Questionnaires and survey data	To receive and analyse feedback to help future design

2. What do we do with that information, and why?

Note: Information may also be shared with Scottish Government, with whom NatureScot are working on the biodiversity audit project.

Information	Sharing?	Why shared?
Your name and email address	NatureScot shares with Lumoscript	To create an account in the app
Farm name and Business Reference Number (BRN) / Main Location Codes (MLCs)	NatureScot shares with Lumoscript	For Lumoscript to retrieve your land parcel boundaries from Rural Payments & Inspections Division (RPID) for the app
Land Parcel Identification (LPID) numbers and polygons	Rural Payments & Inspections Division (RPID) shares with Lumoscript
Bank account details	Not shared
Questionnaires and survey data	NatureScot can share with third parties	Anonymised aggregated results may be used to demonstrate how the aims of the project are being delivered

3. How long may we keep your personal information for?

NatureScot will retain your personal information and the data in the app for as long as the Biodiversity Audit project is operational.

4. How are we keeping the data secure?

NatureScot aims to protect your personal information through a system of organisational and technical security measures. Lumoscript will ensure that:

all Land Parcel Identification, Farm, and Business data provided is transferred in a secure manner and only used for the purposes of the app.
all personal individual contact data is only used for the purposes of the app
the data supporting the platform is stored in a secure manner with the required safety tests carried out and is processed and stored in an accurate manner

Dedicated user accounts are created for each participant with their email. Additional access to a user account will be made if a request is made in writing/email by the original farmer/crofter, quoting their BRN. Farmers/crofters can only access their own farm/croft details and cannot view any others.

The database that houses the results of assessments, user data and user authentication is currently hosted in Google Firebase in the UK.

Information	Sharing?	Why shared?
Habitats and habitat condition assessments	NatureScot can share with third parties	Analysis of results may be shared with interested third parties at an aggregated level
Photos of habitats	NatureScot can share with third parties	Selected photos may be used e.g. through social media or project reports, in order to promote or demonstrate how the aims of the project are being delivered and the lessons being learned

6. My privacy and mobile technology?

Please see Appendix for further information on Application data and information collected if you use the Farm Biodiversity Scotland app.

7. What are your rights?

You have the right to know what information we hold about you and you have the right to ask us for copies of this information. You also have the right to ask us to rectify inaccurate data about you. You also have the right to ask us to stop processing your data until corrections are made or when you have concerns about our use of your data. You have the right to appeal to the UK Information Commissioner (https://ico.org.uk/) if you are not happy with our response following a request to access your information or for rectification of inaccuracies. For further details see your personal data rights.

NatureScot is a Scottish Public Authority and is subject to the provisions of the Freedom of Information (Scotland) Act 2002 and the Environmental Information (Scotland) Regulations 2004. We are therefore obliged to consider the release of any information held by us in response to a request. In providing any response to a request, we will fully consider our obligations under data protection legislation.

8. How can you contact us?

Please contact NatureScot’s Data Protection Officer (DPO) if you want to discuss any data related issues. The DPO can be contacted at: [email protected] Battleby, Redgorton, Perth, PH1 3EW, 01738 444177.

For any other project related query, please either contact your Project Officer or email [email protected].

Appendix - Further information on your privacy and the mobile technology

Application Data

If you use our application, we also may collect the following information if you choose to provide us with access or permission:

Geolocation Information. We may request access or permission to track location-based information from your mobile device, either continuously or while you are using our mobile application(s), to provide certain location-based services. If you wish to change our access or permissions, you may do so in your device's settings.
Mobile Device Access. We may request access or permission to certain features from your mobile device, including your mobile device's calendar, camera, reminders, and other features. If you wish to change our access or permissions, you may do so in your device's settings.
Mobile Device Data. We automatically collect device information (such as your mobile device ID, model, and manufacturer), operating system, version information and system configuration information, device and application identification numbers, browser type and version, hardware model Internet service provider and/or mobile carrier, and Internet Protocol (IP) address (or proxy server). If you are using our application(s), we may also collect information about the phone network associated with your mobile device, your mobile device’s operating system or platform, the type of mobile device you use, your mobile device’s unique device ID, and information about the features of our application(s) you accessed.

Push Notifications. We may request to send you push notifications regarding your account or certain features of the application(s). If you wish to opt out from receiving these types of communications, you may turn them off in your device's settings.

This information is primarily needed to maintain the security and operation of our application(s), for troubleshooting, and for our internal analytics and reporting purposes.

Information automatically collected

In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

Like many businesses, we also collect information through cookies and similar technologies.

The information we collect includes:

Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called "crash dumps"), and hardware settings).
Device Data. We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information.
Location Data. We collect location data such as information about your device's location, which can be either precise or imprecise. How much information we collect depends on the type and settings of the device you use to access the Services. For example, we may use GPS and other technologies to collect geolocation data that tells us your current location (based on your IP address). You can opt out of allowing us to collect this information either by refusing access to the information or by disabling your Location setting on your device. However, if you choose to opt out, you may not be able to use certain aspects of the Services.