This privacy notice applies to the Monument Monitor project run by Historic Environment Scotland, as described on the webpage www.hes.scot/monument-monitor.
Please see our main privacy notice for details of other ways in which we may collect and process your personal data and other important information regarding your personal data and your data protection rights.
1 General information
1.1 Controller
We are Historic Environment Scotland, an executive non-departmental public body, incorporated and established under the Historic Environment Scotland Act 2014, being a registered charity (Scottish Charity number SC045925) and having its principal office at Longmore House, Salisbury Place, Edinburgh, EH9 1SH (referred to as “HES”, “we”, “us” or “our” in this privacy notice).
We are a data controller and responsible for your personal data, in accordance with the Data Protection Act 2018 and related data protection legislation (including the UK General Data Protection Regulation).
Our registration number at the Information Commissioner's Office is ZA143443.
1.2 Data Protection Officer
We have appointed a data protection officer (“DPO”) who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact the DPO using the details set out below.
You have the right to make a complaint at any time to the Information Commissioner's Office (“ICO”), the UK regulator for data protection issues. We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.
1.3 Contact Details
By post
The Data Protection Officer
Historic Environment Scotland
Room G.50
Longmore House
Salisbury Place
Edinburgh, EH9 1SH
By email
dataprotection@hes.scot
By telephone
0131 668 8600
2 Changes to the privacy notice
We keep our privacy notice under regular review. This version was last updated on 29 March 2022.
3 Website information
3.1 Webpage
This webpage forms part of our website (www.hes.scot or www.historicenvironment.scot) (the "Website"). For more details about what personal data we may process when you use our Website, please see our main Privacy Notice. For more information regarding the cookies that we use on our Website, please see our separate Cookie Policy.
3.2 Children
This webpage is not intended for children and we do not knowingly collect any personal data relating to children via this webpage.
4 Submissions to the Monument Monitor project
If you submit a photograph (which for these purposes includes any form of photographic image) to our Monument
Monitor project:
| What we receive and process | Why | Legal Basis |
| Your email address | To enable us to receive a submission of a photograph to our Monument Monitor project* | This is necessary for the performance of a task carried out in the public interest |
| To enable us to send you a single acknowledgement email in response to your submission | This is necessary for the purposes of our legitimate interests (of responding to participation by members of the public and ensuring that all participants are aware of the terms of the Monument Monitor project) | |
| To enable us to contact you with questions about the HES Property in Care to which the photograph relates, in the event that your photograph shows that there may have been heritage crime committed at the site or there may have been serious degradation of the site | This is necessary for the performance of a task carried out in the public interest and it is a legal obligation | |
| Details of your submission(s), including location data | To enable us to identify the date of the photograph and the HES Property in Care to which the photograph relates | This is necessary for the performance of a task carried out in the public interest |
| To enable us to assess the conservation status of the HES Property in Care to which the photograph relates | This is necessary for the performance of a task carried out in the public interest | |
| Images of individuals or other data which may identify an individual** | To enable us to anonymise or delete any data contained in a submitted photograph which may identify an individual | This is necessary for the performance of a task carried out in the public interest |
* All submissions to the Monument Monitor project shall be made to our dedicated email address mm@hes.scot.
** We request that you do not submit images of individuals (including yourself) or other data which may identify an individual as part of your submission to the Monument Monitor project. Where we find that we have received such images or other data, we will delete any such photographs (subject to our automatic email back-up mentioned below) and remove them from the Monument Monitor project.
In accordance with the terms of use of our Monument Monitor project, we will anonymise your personal data collected in association with a submission of a photograph to the Monument Monitor project (so that it can no longer be associated with you). Once fully anonymised, we may use the submitted photograph and any anonymised or non-personal data relating to it indefinitely.
However, please note that emails (including attachments) are automatically backed up for 365 days, so whilst we will delete your submission email from our active system after it is sent in, it will be available from a recovery account for one year.
5 Enquiries
If you contact us with an enquiry about the Monument Monitor project:
| What we collect | Why | Legal Basis |
| Your name, contact details (contact address and/or personal email address and/or telephone number and/or social media identifier) and details of your enquiry | To enable us to respond to your enquiry about the Monument Monitor project | This is necessary for the purposes of our legitimate interests (to respond to enquiries and to manage our business effectively) |
| To enable you to report to us any problems or suspected problems at a Property in Care (whether or not as part of the Monument Monitor project) | This is necessary for the performance of a task carried out in the public interest and this is a legal requirement. | |
| To enable us to respond to requests made under freedom of information legislation | This is a legal requirement | |
| Your name, contact details (contact address and/or personal email address and/or telephone number and/or social media identifier), details of your enquiry and proof of identity documentation | To enable us to respond to requests made under data protection legislation | This is a legal requirement |
6 Sharing information
There may be circumstances in which we need to share your personal data with certain third parties who are also controllers under the applicable data protection legislation and/or with certain third-party service providers who are our data processors. Please see our main Privacy Notice for further details.
7 International transfers
We do not transfer your personal data outside the UK or the EEA. Personal data may be transferred between the UK and the EEA on the basis that the EEA has been deemed by the ICO to provide an adequate level of protection for personal data and vice versa.
8 Automated decision-making
We do not use any automated-decision making or profiling in respect of your personal data.
9 How long will we retain your personal data?
We will delete any emails received with submissions of photographs to the Monument Monitor project email address promptly, however all emails will be automatically backed up for 365 days in a recovery account before being permanently deleted. Any personal data contained in the photographs or other images will be anonymised (so that it can no longer be associated with you) and such anonymised data may be retained indefinitely.
Any other personal data that we may process in connection with the Monument Monitor project, such as if we need to follow up with you regarding any enquiry or a report of potential heritage crime, will be retained in accordance with our standard data retention policy.
10 Other important information
For more information regarding data security, your data protection rights and how to exercise your data protection rights, please see our main Privacy Notice.