Privacy Policy

The Spatial Hub services are provided by:

The Improvement Service
A company limited by guarantee and registered in Scotland (Company No. SC287978)

The Improvement Service
West Lothian Council Civic Centre,
Howden South Road,
Livingston,
EH54 6FF

You can read more about the Improvement Service and what we do on our website.

This notice (together with our Terms & Conditions) applies to your use of https://data.spatialhub.scot/.

Any reference to Data Protection Law we make in this document refers to the EU General Data Protection Regulation ((EU) 2016/679) and the UK Data Protection Bill 2018, which came into effect in the UK on 25th May 2018.

The Spatial Hub is a platform for hosting and publishing Scottish spatial data.

Developed and maintained by the Improvement Service (IS), the Spatial Hub collects datasets from local authorities and other partner organisations to form Scotland-wide national datasets before publishing these in various formats to maximise their use.

The Spatial Hub aims to improve data governance, whilst working towards greater availability of sustainable open data.

This notice sets out the basis on which any personal data we collect about you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.

Personal data can be anything that relates to a living person. It includes obvious things like your name and address and date of birth but also includes things you might not think about, like your car registration number, the languages you speak or your employee number.

Some information is deemed to be 'special' and needs more protection because of its sensitivity. This will generally be information that you wouldn't want to be widely known or that is very personal to you. It might include things such as your religious or political beliefs, your sexual orientation or your criminal history. We don't generally process information that comes into the 'special' category. We only process information that relates to who you are.

We are required by law to treat all of your personal information legally and fairly. We must also give you the means to correct it if it is wrong, allow you to object to our processing it and, in some instances, delete it from our systems if you ask us to do so.

Legitimate Interest

The legal basis for processing personal data in relation to setting up an account with https://data.spatialhub.scot/ is that it is in the Improvement Service's legitimate interest to develop products and services that support its business plan and its mission to promote efficiency and collaboration in Local Authority public services. For more information, please read the Improvement Service Business Plan.

The legal basis for processing personal data in relation to the services delivered by https://data.spatialhub.scot/ is that the Improvement Service, as Data Controllers, deem it necessary for the performance of a task carried out in the public interest or in the exercise of their official authority (Local Government Etc. (Scotland) Act 1994).

Furthermore, we need you to provide your personal data so that we can provide the Spatial Hub service. We need your personal data to ensure that your actions when you use the system are traceable to a named individual and/or a particular organisation. We have checked that this is the best way for us to provide a service to you or your organisation while fulfilling our own obligations and to protect the Spatial Hub from potentially malicious or fraudulent use.

For the purpose of Data Protection law, we are the Data Controller in relation to the processing of your personal data arising from your use of the Spatial Hub.

Other Data Processors

The Improvement Service has contracts with a managed service company (Tata Consultancy Services), a hosting company (brightsolid UK) and Yoti. All three companies are Data Processors for the Improvement Service. The contracts with these companies reflect the GDPR obligations of both the Improvement Service and the contractors.

The Spatial Hub platform is built using open-source data management software from ckan.org. Because of this, after registering a new account, a user’s name and email address are accessible to ckan.

Your personal information is not shared with the organisations who provide data to the Spatial Hub (except in the scenarios defined under the 'Disclosure of Personal Data' section).

We get information about you in a number of different ways. This information allows you to set up and manage your online account, use the Spatial Hub and raise with us any queries you might have. It also allows us to protect you and other service users from fraudulent or malicious use.

We get this information in one or more of the following ways:

• Collecting it directly from you when you register for an account
• Collecting it from your organisation
• Collecting it from the devices you use when you use our service

We will collect and process the following personal data about you:

Personal data you give us when you register for an account: This is personal data you give us when you register for an account on the Spatial Hub. Information you must provide to get an account comprises:

• Full name
• Email
• Organisation
• Sector (in which you work)

Personal data you give us when you raise a query with us: This is personal data you give us when you raise a support request in our system. If you want to contact us or report a problem, you can do so using our support request system. You can do this whether you have an account or not. To allow us to contact you and keep you up to date with your request you must give us a valid email address.

Data we receive about you when an organisation registers you for an account: Some organisations use the Spatial Hub by collecting your personal data themselves to create an account for you. The information we collect from organisations setting up an account on your behalf is the same as the information you would have provided yourself when setting up an account.

Personal data we collect about you when you use the service: When you use the Spatial Hub, we collect data that helps us understand how you are using the service so that we can improve it over time. The information collected includes:

• The type of device you use
• The unique device identifier that the manufacturer embeds into the device (e.g. the IMEI number of a mobile phone)
• Your operating system and browser versions
• The IP address used

Every device that connects to the internet has an IP address and we use it to identify the geographic locations from which people access the Spatial Hub service. We store this information securely in log files on our servers.

We also use this information to protect both you and us from potentially malicious or fraudulent use.

• Read this policy
• Make sure your data is kept up to date
• Keep your credentials safe and do not share them

The Spatial Hub uses cookies (small text files that we place on your device) to help provide our services to you and keep your account safe. For more information, please read our Cookie Policy.

We use personal data held about you in the following ways:

• To allow you to register an account and use it to access the Spatial Hub
• To ensure that you or your organisation is entitled to use the Spatial Hub – e.g. whether your organisation is a member of the Public Sector Geospatial Agreement (PSGA)
• To help you with any queries you may have in relation to the service
• Notifying you of any changes to our service, and/or solving issues (including any bug fixing) via our Help Centre or email notifications
• To develop and improve the services that we offer and to help the organisations with whom you may enrol do the same
• To protect both you and the Spatial Hub from possible fraudulent or malicious use
• To collect feedback on the Spatial Hub, with the aim of improving our service and the user experience, e.g., through our annual Stakeholder and User surveys

We will not sell your information or disclose it for direct marketing purposes.

We may disclose your personal data to third parties:

• If we are under a duty to disclose or share your personal data to comply with any legal or regulatory obligation or request
• To enforce or apply the Terms of Use (comprising the Terms & Conditions, Cookie Policy and this Privacy Notice), and other agreements you have agreed to with us, or to investigate potential breaches of those Terms
• To protect the rights, property or safety of our users or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection
• To enable ckan.org to provide appropriate technical support in the unlikely event that a user account experiences any issues that cannot be addressed by either IS or TCS.

All personal data you provide to us is stored on secure servers in the UK. Your personal data will not be passed outside the EEA.

Where we have given you (or where you have chosen) a password or authentication key that enables you to access the Spatial Hub, you are responsible for keeping this password or authentication key confidential.

We ask you not to share a password or authentication key with anyone.

We will keep your data for as long as you keep your https://data.spatialhub.scot/ account active.

The following table shows the retention periods for personal data held within https://data.spatialhub.scot/ in the event an account becomes inactive or otherwise closed.

We work hard to protect your information and keep it safe from unauthorised disclosure, alteration or destruction. Some of the measures we use include:

• Using a reputable, accredited data centre in which to store your data
• Making sure our staff and the staff of any contractors we use are security-cleared and vetted
• Encrypting our services and data
• Reviewing our processes and activities regularly to make sure they are fit for purpose
• Enabling access to information only for those employees who need it
• Having our service checked regularly by an independent security company
• Applying formal risk management to all our activities

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data upon receipt, we cannot guarantee the security of your personal data whilst it is being transmitted to the Spatial Hub; any transmission is at your own risk.

Once we have received your personal data, we will use strict procedures and security features as outlined above to minimise the risk of unauthorised access to that data.

We cannot be held responsible for the security of your personal data held by a third party or Service Provider you consent to share data with. Such third parties shall have their own privacy notices.

• You can withdraw your consent, seek to restrict our processing of your personal data or object to us processing your personal data for use with the Spatial Hub at any time by contacting us at: spatialhub@improvementservice.org.uk. Please note that if you do this you may no longer be able to access the full range of Spatial Hub services.
• You have the right to lodge a complaint with the Information Commissioners Office (ICO) if you think that we have infringed your rights. You can find more information about reporting a matter to the ICO on their website at https://ico.org.uk/.
• You have the right to access personal data held by us about you. To access your personal data and correct, update or delete it at any time you can contact spatialhub@improvementservice.org.uk. In certain circumstances you have the right to ask us to provide you with your personal data in a structured, commonly used and machine-readable format to allow you (or us on your behalf) to transmit this information to another party. More information can be found at the ICO website.
• You have the right to be forgotten. Individuals can ask to revoke their accounts, and we will physically delete them, and associated personal data.

The Spatial Hub contains links to and from the websites of third parties such as Local Authorities and other external organisations.

Please note that these websites and any services that may be accessible through these links have their own privacy policies and/or notices.

We do not accept any responsibility or liability for these policies and/or notices or for any personal data that may be collected when using these websites or services.

Please check all privacy policies and/or notices before you submit any personal data to these websites or use their services.

Any changes we may make to our privacy policy and/or notice in the future will be posted on the Spatial Hub website and, where appropriate, notified to you when you next start the service. The new terms may be displayed on-screen, and you may be required to read and accept them to continue your use of the service.

Questions, comments and requests regarding this privacy notice are welcome and should be sent to: spatialhub@improvementservice.org.uk