Privacy

Introduction

This privacy notice tells you what to expect when National Records of Scotland (NRS) collects personal information. It applies to information we collect when you:

• visit our websites (including cookies, IP addresses, hostnames and search engine)
• use our social media channels (Facebook, X/Twitter and WordPress)
• phone, email or make a complaint to us
• use our services
• visit our search rooms
• apply for a job with NRS
• want to access your personal information

It also explains when and how we may disclose personal information.

This privacy notice covers this website (www.nrscotland.gov.uk) and the following websites which are managed by NRS:

• NRS Web Archive: https://webarchive.nrscotland.gov.uk/
• Scottish Documents: http://www.scottishdocuments.com/
• Scottish Archives for Schools (SAFS): http://www.scottisharchivesforschools.org/  
• Scottish Archives Network (SCAN): http://www.scan.org.uk/
  
  

Data Controllers

The data controllers for NRS are the Registrar General for Scotland and the Keeper of the Records of Scotland. They can be contacted via our Data Protection Officer  by writing to:

Data Protection Officer
National Records of Scotland
HM General Register House
2 Princes Street
Edinburgh
EH1 3YY

Alternatively you can contact us online by clicking here

Websites

Information collected by the NRS website

Information that is routinely collected by this website falls mainly into two categories: information submitted using our contact us form and website log files.

Contact form

The website provides a contact form to allow users to send us a message. You can use it to:

• Give general feedback about the site
• Make an enquiry relating to the different functions of NRS 
• Make a Freedom of Information request
• Report technical problems with the site
• Request a business contact with NRS

The information collected will be stored and used by NRS chiefly for the purpose of fulfilling the stated service.

We will not share any personal information that we receive about individuals with other organisations for commercial purposes, or use it for any marketing purposes which individuals have not consented to.

We reserve, however, the right to use non-personal information for our business, research and marketing purposes. In these cases the reuse of the information will not identify or be associated in any way with the individual who provided it and will not contain any contact information relating to that individual or their company.

You do not need to include your name or contact details in order to provide us with general feedback or information about any technical problems you may encounter. You will, however, need include an email address if you want us to reply to you. We will only use your email address to reply to you and not for any other purpose. For some enquiries contact details will be required. You will need to provide your name and contact information if you wish to make an enquiry about NRS functions, request a business contact with NRS or make a freedom of information request.

Information collected from the contact form is not stored on the website, and will only be accessible by authorised NRS staff. We use a relay service to scan emails for spam and malware before they reach the service desk system. 

Website log files

All websites produce log files that record the activity on that site. Log files record which pages on the site have been accessed and how many times.

Log files typically record the IP address and/or hostname of all users accessing the website. This allows us to distinguish between different users and therefore estimate the number of unique visitors to our websites. IP addresses and hostnames are not linked to any individual's personally identifiable information.

Specific IP addresses and hostnames will not be made publicly available. They will only be used by website log file software to compile overall summary statistical reports on the performance of our websites.

Website log files are stored securely on the websites using good industry practice for safeguarding information and server functions.

Cookies and Google Analytics

To gather information about how people use this site (https://www.nrscotland.gov.uk) and the other websites covered by this privacy notice we use Google Analytics. The information collected helps us investigate whether each website meets its users’ needs as well as to evaluate how each website can be improved. Google Analytics stores information about what pages you visit, how long you are on the site, how you got here and what you clicked on. We do not collect or store your personal information (e.g. your name or address) so this information cannot be used to identify who you are. We do not allow Google to use or share our analytics data. More information on the cookies used on this site can be found on our Cookies page.

Search engine

The NRS website uses a search engine which is part of our content management system. No user-specific data is collected or used by our website search facility.

IP addresses and hostnames

An IP address is the numeric address of a computer. The IP address recorded on website log files is the address provided by your internet service provider's equipment and not your own personal computer's address.

Hostnames are similar in appearance to the domain names you see in URLs and email addresses. The hostnames recorded on website log files are those of the internet service provider's equipment that you are using to access the internet, and not your own computer's name or location.

Your internet service provider will keep records of which customer is using any IP address or hostname at any given time, and so it is theoretically possible to trace back activity shown on any website log file to a specific individual. In practice, this can only be done with the explicit involvement of the internet service provider, and such a trace would therefore only take place in the event of serious criminal misuse of the internet and would be carried out by the police.

NRS will not attempt to associate IP addresses and hostnames with individuals. In the event of serious criminal misuse of the website, the matter would be referred to the police for investigation.

Security and performance

NRS uses a third party service to help maintain the security, performance and availability of our websites. IP addresses of visitors to the NRS website are processed to deliver this service. The IP addresses are not linked to any individual's personally identifiable information.

Social Media

Our blog “The Open Book” is run via a third party service which collects anonymous information about users' activity on the site, such as, for example, the number of users viewing pages on the site. In addition, the blog service requires visitors wishing to post a comment to provide a name and email address. Our blogging service provider is run by Automattic Inc. For additional information about how our blogging service provider processes data, please see Automattic's privacy notice.

When you contact us via X/Twitter

NRS uses Hootsuite, a third party provider, to manage its social media interactions. Hootsuite stores messages sent by you via social media for three months. These will not be shared with any other organisations.

When you contact us via phone, email or make a complaint

When you phone NRS

We do not collect caller line identification information when you call us. We will only collect personal information that you consent to provide to us in order to deliver a service.

When you email NRS

When you contact us via email, we will retain your email and our response to it for business reasons usually for no longer than 5 years. Thereafter the information will be confidentially destroyed.

When you make a complaint to us

When you make a complaint to us, we ask for your full name and address as well as for as much detail about the complaint as possible. This information is stored in a file which is restricted to specific staff handling the complaint within NRS. We retain the material for 5 years and destroy it thereafter confidentially.

In most cases we will have to disclose the complainant’s identity to whoever the complaint is about in order to resolve the matter. If a person making a complaint would prefer to stay anonymous, we will do our best to ensure this, but it may not be possible to handle a complaint on an anonymous basis.

When you use our services

NHS Central Register (NHSCR)

NRS maintains the National Health Service Central Register (NHSCR). This is a confidential population database containing information about people who were born or died in Scotland and persons currently registered or persons who have previously been registered for NHS healthcare purposes with Scottish General Practitioners (GPs). The NHSCR privacy notice explains tells how we process personal information in the register.

Registration

NRS administers the registration of life events such as births, deaths, marriages, civil partnerships, divorces and adoptions. The Registration Privacy Notice tells you what happens to personal information when a life event is registered.

Scotland’s Census

The information contained in Scotland's Census is vital to help shape Scotland's future by informing key decisions on how services such as transport, housing, schools and hospitals are planned. You can find out more about how we protect the confidentiality of census data, and ensure transparency and confidence, in the privacy section on the Scotland’s Census website. We have also published information explaining our use of Administrative Data for Scotland’s Census 2022 and beyond.

Scotland’s People 

Scotland’s People website is the official Scottish Government site for searching government records and archives and is owned, operated and managed by NRS. The Scotland's People Privacy Notice tells you what happens to personal information we collect and use. 

The Scottish Register of Tartans

NRS is responsible for maintaining The Scottish Register of Tartans and registering of new tartan designs. The privacy statement on the our Scottish Register of Tartans tells you about the information we collect and how we use it.

Visiting our search rooms

More information on visiting our search rooms can be obtained on the search room page our site. We only collect personal information which will help us to deliver a service. Once the business use has passed, we will destroy this data confidentially.

When you apply to work for NRS

Information on how your personal information is processed when you apply to work for NRS is available in the privacy notice on the Scottish Government Jobs website.

Further information

This privacy notice does not provide detail of all aspects of NRS’s collection and use of personal information. More details about how we may use personal information to carry out our functions is provided throughout this website. We are happy to provide any additional information or explanation needed. Any requests for this should be sent to the address below.

Your data protection rights

Under data protection law, you have rights The rights available to you depend on our reason for processing your information. If you want to find out how to exercise these rights please contact our Data Protection Officer. 

Access to personal information

You can find out if we hold any personal information on you by making a ‘subject access request’ under the UK General Data Protection Regulation. If we do hold information about you we will:

• provide you with a description of it;
• tell you why we are holding it and how long for;
• tell you who it could be disclosed to;
• tell you your rights concerning this data; and
• where possible let you have a copy of the information in an intelligible form.

A subject access request needs to be made in writing (either by email, letter or by using our form). You can find out more about the process of requesting information on our dedicated website page.

We will not provide you with a copy of your personal information if we already make it available under a legal obligation (for example birth, death and marriage certificates can be ordered as official extracts) or if a restriction on access applies (for example census records are closed for 100 years).

If you find that the information we hold about you is incorrect, you can make a request for this to be corrected. In addition, you can ask us to delete the information. For some information we hold, however, exemptions apply to rights to rectification and erasure.

Requests to take down content

You can ask for content to be taken down from our websites. We will only do this in certain cases, for example, if it breaches copyright laws, contains sensitive personal data, or material that may be considered defamatory or obscene. You will need to send us details of the content and explain why you think it should be removed. When a valid request is received, the content will usually be temporarily taken down from public view on the website pending the review process.

Takedown requests are assessed by an NRS Takedown panel composed of staff with relevant experience and chaired by a senior manager. All assessments will be completed within 30 days of the request being received and we will let you know the outcome.  Any decision to remove/take down content is at our discretion. This does not affect your statutory rights to request information under the Freedom of Information (Scotland) Act 2002 and the UK General Data Protection Regulation. For more information please read our Takedown and Reclosure Policy.

Disclosure of personal information

We will not disclose personal data you provide without consent in most cases, but as highlighted above, we might need to do so when we investigate a complaint, or want to obtain a reference or a ‘disclosure’. We will inform you of this beforehand unless the disclosure is required by law, to prevent and detect crime or to produce anonymised statistics.

Complaints or queries about our use of personal information

NRS takes any complaints we receive about how we collect and use personal information very seriously, as we try to meet the highest standards in this regard. If you think that we collect or use information unfairly, misleadingly or inappropriately, please contact us and bring this to our attention. We also welcome any thoughts and suggestions for improving our procedures.

You also have the right to report your concerns to the Information Commissioner’s Office (ICO). For more information visit the ICO website.

Links to other websites

When we link to other websites, we encourage you to read the privacy notices contained on those sites.