Transparency – including Complaints, Freedom of Information (FOI), and Environmental Information Requests (EIR).

In this section you will find all our legal notices, our terms and conditions and related policies on the content and use of the website.

For Whistleblowing matters such as fraud, please raise any external issues as directed in the Whistleblowing section below.

You can find Our Mission, Vision, Governance, Organisational Values and Performance Reporting within the Publications, Policies and Guides section of the website.

You can find our Accessibility Statement at https://www.nlb.org.uk/accessibility-statement/

 

What is a complaint?

An External Complaint is an expression of dissatisfaction, whether written or verbal, by a member of the public or organisation,  in respect of  actions or proposed actions by NLB or its agents.

A complaint can be made using any form of communication whether verbal, written, posted on social media or via our Contact Us web form on this website.  Where the complaint is verbal, contemporaneous written notes will be made by the NLB staff member, and subsequently may be recorded on an NLB Complaint Form.

Complaints Procedure

  1. Communication identified as an External Complaint
  2. Relevant Senior Manager or Data Protection Officer is notified
  3. Senior Manager to notify Director if appropriate
  4. Senior Manager selects Officer
  5. Officer investigates and produces a proposed resolution to the complaint
  6. Senior Manager reviews & approves the response and agrees the resolution (iterative)
  7. Officer issues approved response and closes the complaint
  8. Officer raises Corrective and Preventative actions resulting from the complaint

Response Target Timescales

Acknowledge Receipt – 2 Working Days
Due Date – 10 Working days
Requested Review – 10 Working days

Complaints Review Request

A complainant may ask for a review of how their complaint has been handled and/or the resolution, this can be using any form of communication – as above.  If they are still unhappy they should be directed to the complaints process for the relevant Ombudsman.

Purpose of this Policy

The Northern Lighthouse Board is required by law to explain how and why we use cookies, and to seek your express permission to store and retrieve data about your browsing. In order to fulfil this requirement we draw your attention to this, our cookie policy when you first visit our home page.

What is a Cookie?

A cookie is created at the request of the website a user is viewing. The website requests that the web browser create a ‘text file’ containing a small amount of information, which it can then access whilst you are viewing the website. The information is usually to provide some functionality such as a shopping cart or to enhance the users experience on the site. You can read these ’text files’ using the Notebook program on your own PC.

The information saved usually contains the name of the cookie, and a value (which can be numbers or text). Other information can also be includes such as the domain the cookie is for (e.g. Northern Lighthouse Board), the path/page and the cookie expiry date and time. Many however, contain only two pieces of information: a site name and unique user ID, although this does vary.

Purpose

These small text files, placed on your computer by websites that you visit and are widely used in order to make the websites work, or to work more efficiently, as well as to provide information to the owners of the site. When you request another page from the server, your browser sends the cookie back to the server. These files typically contain information about your visit to the web page, as well as any information you’ve volunteered, such as your name and interests.

Cookies may, as we do on our On-line Shop, be used to record any personal information you enter, as well as any items in your electronic shopping cart, so that you don’t need to re-enter this information each time you visit the site.

Security

Accepting a cookie does not give a server access to your computer or any of your personal information (except for any information that you may have purposely given, as with online shopping). Under normal circumstances, it is not possible to execute code from a cookie, or to use a cookie to deliver a virus. Cookies cannot transfer viruses or malware to your computer because the data in a cookie doesn’t change when it travels back and forth, it therefore has no way to affect how your computer runs. Additionally, web servers can use only information that you provide or choices that you make while visiting the website as content in cookies.

To find out more about Cookies, please visit the following websites:
aboutcookies.org.uk
allaboutcookies.org/ 

Managing cookies in order to protect your privacy online

You have the ability to manage the use of cookies on your PC and mobile devices, the instructions for how to do so vary depending upon the browser you are using.

If you use more than one browser on your device you will need to manage the settings for each individual browser. Instructions for accessing the settings for the 5 most popular browsers are as follows:

  1. Open your browser
    Cookies are stored in your web browser. Popular browsers include Firefox, Chrome, Edge, Safari, and Internet Explorer.
  2. Locate where cookies are stored
    Each browser manages cookies in a different location. For example, in Internet Explorer, you can find them by clicking “Tools” and then “Internet Options.” From there, select “General” and “Browsing history” and “Settings.” In Chrome, choose “Preferences” from the Chrome menu in the navigation bar, which will display your settings. Then expand the “Advanced” option to display “Privacy and security.” From there, open “Content settings” and “Cookies.”
  3. Manage your cookies
    Every browser provides a range of options for enabling or deleting cookies. Internet Explorer, for instance, allows you to manage cookies under “Privacy” and “Advanced.” In Chrome, find where cookies are stored as outlined above, then select your management options under “Cookies.” Banning all browser cookies could make some websites difficult to navigate. However, a setting that controls or limits third-party and tracking cookies can help protect your privacy while still making it possible to shop online and carry out similar activities.

Cookies we use on our website

Google Analytics

• __utma
• __utmb
• __utmc (expires end of session)
• __utmt
• __utmz

We use these cookies to collect information about how visitors use our site. We use the information to compile reports and to help us improve the site. The cookies collect information in an anonymous form, including the number of visitors to the site, where visitors have come to the site from and the pages they visited.

WordPress Cookies

wordpress_test_cookie

WordPress only uses cookies for registered users (people logging into admin, subscribed to posts etc.). This applies to NLB staff logging in to admin etc. but not the general public. This is a session cookie, deleted when you close your web browser. WordPress sets this cookie when you navigate to the login page. The cookie is used to check whether your web browser is set to allow, or reject cookies.

Google Maps

Please note that ‘Gmaps’ has changed and no longer requires cookies. We now use the non-cookie, newer version.

The information below explains the cookies and when we use on our website. Additional Cookies we use on our online shop:

Jetpack plugin

tk_or
tk_lr
These gather internal metrics for user activity used for analysis of user activity, used to improve user experience.

Woocommerce

wp_woocommerce_session_
This contains a unique code for each customer so that it knows where to find the cart data in the database for each customer. This will stay on your device for two days.

eucookielaw
This allows us to inform users that our WordPress website has cookies, to comply with european regulations and legislation.

redux_blast
This does not impact users, it is needed for the visual theme to correctly render the website.

 

Please contact us if you have any questions about this Cookie Policy:
E: enquiries@nlb.org.uk

“Northern Lighthouse Board (NLB)” and the NLB logo (and any of the foregoing used in any combination), product names and all page headers, footers and icons are trademarks or registered trademarks of the Northern Lighthouse Board. All other product names, Company names and logos mentioned are the trademarks of their respective owners.

Certain links in this website may lead to resources or information maintained by third parties over whom NLB has no control. NLB makes no representations or warranties as to the accuracy of, or any other aspect relating to those resources.

The contents of Our Website are protected by international copyright laws and other intellectual property rights. The owner of these rights is NLB, its affiliates or other third party licensors. All product and company names and logos mentioned in Our Website are the trade marks, service marks or trading names of their respective owners, including us.  You may download material from Our Website for the sole purpose of placing an order with NLB or using Our Website as a shopping resource. However, you may not modify, copy, reproduce, republish, upload, post, transmit or distribute, by any means or in any manner, any material or information on or downloaded from Our Website including but not limited to text, graphics, video, messages, code and/or software without our prior written consent, except where expressly invited to do so, for example in order to complete any test or questionnaire.

Requests for permission to use our trademarks or to make use of any copyright material should be directed to:

Communications Officer
Northern Lighthouse Board
84 George Street
Edinburgh
EH2 3DA
T: 0131 473 3100
E: enquiries@nlb.org.uk

The Freedom of Information (FOI) Act 2000 aims to make information held by public authorities more accessible to the public, and gives a general right of access to all types of recorded information. The FOI Act places two main duties on public authorities:

  • to adopt and maintain a publication scheme setting out the classes of information the authority publishes; and
  • to respond to individual requests for information

In addition, the Environmental Information Regulations 2014 provide access to environmental information. Both the FOI Act and the EIRs are enforced by the Information Commissioner.

The Freedom of Information Act 2000, Freedom of Information (Scotland) Act 2002, the Environmental Information Regulations 2014, Environmental Information Regulations (Scotland) 2014 , Re-use of Public Sector Information Regulations 2015 and the Data Protection Act 2018 all confer rights to see or receive information.  The Freedom of Information Act provides rights to see official recorded information held by public authorities.  The Data Protection Act provides the right to see your personal information held by organisations, and includes both the public and private sector.

Under legislation and regulations, which covers only public authorities, anybody, anywhere in the world, has a right to access official information and they do not have to indicate why they want the information. When individuals exercise this right under the Freedom of Information Act 2000 this is referred to as an FOI Request, under Environmental Information Regulations 2004 it is referred to as an EIR Our default position is that we should provide information requested, there are however exemptions.  An applicant is also entitled to be informed in writing as to whether the information is held and to have the information communicated to them or provided with an explanation why this is not being done.

Our default response should be Full Disclosure wherever possible with the data provided conforming to the principles within the Re-use of Public Sector Information Regulations 2015 as laid down it the ICO Guide to
https://ico.org.uk/for-organisations/eir-and-access-to-information/guide-to-rpsi/what-is-rpsi/

There are however exemptions with the legislation/regulation that must be considered before issuing a reply.

Our publication scheme as summarised below provides access to previously complete FOI and EIR requests.

Guide to the Northern Lighthouse Board Publication Scheme

The Freedom of Information Act 2000 requires the Northern Lighthouse Board to adopt, maintain, publish and review from time to time a publication scheme. Our publication scheme has been developed under the requirements of the Freedom of Information Act 2000 and has been agreed by the Information Commissioner. Please note we are currently reviewing our Publication Scheme. The required Information is grouped as follows and is also available to download as a PDF. NLB Publication Scheme (PDF)

Who we are and what we do

Financial Information, NLB Report & Accounts and our Suppliers details are contained within the Publications, policies and guides sections of this website.

What we spend and how we spend it

This section provides Financial Information, NLB Report & Accounts and our Suppliers details are contained within the Background, Funding and Supplying NLB sections of this website.

Our plans, priorities, policies and procedures

You can find our objectives, plans for our service provision for the future, our current policies within the Publications, policies and guides  sections of this website together with other reports we publish such as the performance of our Aids to Navigation.

Please contact us for copies of:

  • Organisation and Business System Manual
  • QHSE Policy

How we make decisions

Committee membership, dates of Committee meetings and minutes of meetings can be found within the Commissioners and Board Business section of this website.

Transparency Data published elsewhere

Some transparency data is published on the GOV.UK website on behalf of NLB, by the Department for Transport (DfT). You can access this data via the following links:

Explanations of our internal structures, referring to functions and how the structure relates to the roles and responsibilities (PDF)

Details of authority contracts and tenders worth over £10,000 (PDF)

Organogram of Staff Roles & Salaries – data.gov.uk

Registration Certificate

Data Protection Impact Assessments

NLB does not routinely publish Data Protection Impact Assessments (DPIA) on its website. However, we will consider any application for copies of individual DPIAs’ under the Freedom of Information Act 2000 on a case-by-case basis. If you wish to obtain a copy of a particular DPIA, please email: FOIenquiries@nlb.org.uk

Lists and registers

For information held in registers required by law, and other lists and registers relating to the functions of the authority please write to:

The Compliance Officer
Northern Lighthouse Board
84 George Street
Edinburgh
EH2 3DA

E: FOIenquiries@nlb.org.uk

The services we offer

Information on some of the services we provide can be found in the following section of the website.

Making a Freedom of Information (FOI) Request

If you are looking for information not contained in our publication scheme you can make a request to:

The Compliance Officer
Northern Lighthouse Board
84 George Street
Edinburgh
EH2 3DA

E: FOIenquiries@nlb.org.uk

Requests for information must be made in writing (for example, letter, fax or email). Please state your name and the address for correspondence, and describe clearly the information requested.

When responding to requests for information, there are procedural requirements set out in the FOI Act which public authorities must follow. There are also valid reasons for withholding information, which are known as exemptions. We aim to reply to you promptly and are obliged to provide a response within 20 working days.

Our responses to FOI requests

The Disclosure Log below contains a list of our FOI and EIR requests where some or all of the requested information was disclosed to the applicant.

FOI 2026 ACTIVE DISCLOSURE LOG September 2026

In line with Department for Transport arrangements, the Northern Lighthouse Board does not routinely publish FOI replies, instead we provide copies on request. This is due to:

  • the fact that copies of FOI responses are infrequently accessed and rarely requested (only once in the last two years)
  • the overhead cost in preparing the material for publication
  • the cost of maintaining the material on the website
  • FOI information requested and provided is frequently transitory and would only contain up to date information at the time the reply was provided

To request a copy of a specific response, please  email FOIenquiries@nlb.org.uk providing the FOI reference number from the published list.

If you ask for information available in our publication scheme to be provided in paper format it may be necessary to make a charge. Each case is considered separately. For example, if a large amount of photocopying is required or if the cost of posting a large volume of paperwork is high. You will be advised in advance of the reason for the charge and the cost itself.

Complaints and Escalations

Should you have any enquiries or are dissatisfied with the content of this page or our approach to Transparency please contact us, clearly marking the communication  FAO the  ‘Director of Business Services’, at:

Northern Lighthouse Board
84 George Street
Edinburgh
EH2 3DA

E: enquiries@nlb.org.uk

If following conclusion of the enquiry you are still dissatisfied and wish escalate your issue or make a complaint, you should write to the Information Commissioner, the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals. They can be contacted at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

www.ico.gov.uk

 

This Guide plays an essential part in the corporate governance of the Northern Lighthouse Board (NLB) and as such should be seen as a primary reference source for both those serving as Commissioners of Northern Lighthouses and NLB staff members.

Guide to Governance 2024

In the normal course of our work we do not routinely process data in respect of children.  We don’t provide or plan to provide services directly to children, or to proactively collect their personal information.

Children may visit NLB premises under the control of parents, guardians or teachers for special events such as Open Doors, Carol Services and Christmas Parties, or for educational purposes through work experience programmes or our outreach Programme.  NLB staff may also visit schools under the outreach programme.  Photographs are often taken at these events and subsequently used on the lawful basis of Legitimate Interest.

For outreach events, a Privacy Statement will be provided to the school. As long as the school has agreed, and the children and/or their guardians are made aware by the schools that photographs of those attending the events may appear in one of our publications, this will not breach current UK legislation. Where a school raises any objections photographs are not taken.

Where data is collected in relation to a schools competition, the Terms & Conditions will make clear that  photos and videos may be taken of some or all of the children involved, and explain the context in which the images will be used.  The schools involved are required to ensure that parents are also made aware.

Images recorded at special events may be used for journalistic purposes within NLB publications such as the Journal,  on our website or our social media platforms fairly and lawfully without causing unwarranted harm or intrusion to the data subjects. When we publish images of children as part of an article we won’t include personal details such as names unless explicit Consent has been given by a parent or a guardian. These images are processed under our legitimate interest of providing information and education on the role of the NLB.

Personal Data and Risk Assessment documentation in relation to work experience activities are stored within HR and governed by normal HR rules.  Privacy Statements are provided to the school or parent/guardian depending on the circumstances of set up of the work experience.

The policy is designed to ensure that the responsible adults are aware that photos and videos are being taken and the context in which the images may be used.

1.  NLB Privacy Notice

As the General Lighthouse Authority for Scotland and the Isle of Man, NLB has responsibility, subject to certain provisions, for the superintendence and management of “all lighthouses, buoys and beacons” throughout Scotland and the Isle of Man including “the adjacent seas and islands.” within and beyond territorial waters. Our head office is at 84 George Street, Edinburgh EH2 3DA.

Throughout this document we refer to Data Protection Legislation which means the Data Protection Act 2018 (DPA2018), United Kingdom General Data Protection Regulation (UK GDPR), the Privacy and Electronic Communications (EC Directive) Regulations 2003, all the foregoing as amended from time to time, and any legislation implemented in connection with the aforementioned legislation.

NLB is the controller for the personal information we process, unless otherwise stated.

We are registered with the Information Commissioner with registration number Z5564485.

Contact details
84 George Street,
Edinburgh EH2 3DA

Tel: +44(0) 131 473 3100
E: enquiries@nlb.org.uk

We take seriously our responsibilities in respect of the protection of your privacy and confidentiality, and hope that you will reciprocate. This Privacy Policy sets out the conditions under which we may process any personal information that we collect from you, about you, or that you provide to us. It covers both information that could identify you (“personal information”) and information that could not. In the context of the law and this notice, “process” means collect, store, transfer, use or otherwise act on information. It also covers what we ask of you, to help us keep information up to date.

We use personal information for a wide range of purposes, to enable us to carry out our functions as a government department. These include:

  • verifying your identity for security purposes
  • maintaining our accounts and records
  • selling of products to you through our website
  • consideration and investigation of complaints
  • answering queries, Freedom of Information Act 2000 and Environmental Information Regulations 2004 requests
  • undertaking research
  • provision of education or training
  • provision of The Journal or online articles through social media
  • property management
  • corporate administration
  • support and management of our staff
  • licensing, enforcement, and regulatory duties
  • crime prevention and prosecution of offenders

2.  What is personal data?

Personal data is any information relating to an identified or identifiable natural living person, otherwise known as a ‘data subject.’ A data subject is someone who can be recognised, directly or indirectly, by information such as a name, an identification number, location data, an online identifier, or data relating to their physical, physiological, genetic, mental, economic, cultural, or social identity. These types of identifying information are known as ‘personal data’. Data protection law applies to the processing of personal data, including its collection, use and storage.

3. Your privacy

We know how important it is to protect your privacy and comply with data protection law. If we need to collect, store or otherwise use your personal information, we will:

  • have a lawful basis for doing so and only ask for what we need
  • do so in a fair and transparent way, letting you know why we need your information and how we will use it
  • use it in the way we said we would and not in any way you wouldn’t expect without consulting you
  • ensure that we do not keep personal information for more than we need, or longer than we need
  • make sure it is accurate and up to date where appropriate
  • make sure nobody has access to it who shouldn’t
  • ensure that it is kept safe and secure

4.  What allows NLB to process your personal data

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. To process personal data, we need to meet one of the following conditions (or lawful bases):

  • Consent – freely given consent where it is explicit, as to what you are consenting to and clear how you can withdraw your consent. Sometimes however you might give your consent implicitly, such as when you send us a message by e-mail to which you would expect us to reply.  All of your data protection rights may apply, except the right to object. You do have the right to withdraw your consent at any time.
  • Contract – processing is necessary for a contract you have entered or intend to enter into. All of your data protection rights may apply except the right to object.
  • Legal obligation – processing is necessary to meet a Legal obligation (such as collecting income tax). All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
  • Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. All of your data protection rights may apply, except the right to object and the right to portability.
  • Public task – processing is necessary in respect of the exercise of our official authority Under Section 193 of the Merchant Shipping Act 1995 or to exercise powers set out in law. All of your data protection rights may apply, except the right to erasure and the right to portability.
  • Legitimate interests – The processing of other data not directly associated with the functions of the NLB but needed to enable to function within its obligations under wider legislation and its’ Duty of Care’ responsibilities. It also applies within NLB for such areas as managing the subscription list for the Journal. All of your data protection rights may apply, except the right to portability.
  • Recognised legitimate interests – NLB may rely on RLI where processing is necessary for purpose such as prevention, investigation, detection of crime, safeguarding or public security.

There are further requirements for processing more sensitive, or ‘special category’, personal data.

The lawful basis that we rely on to process your personal data will determine which rights are available to you. Much of the processing we do in NLB will be necessary to perform our duties under our public task or to meet our legal obligations. If we hold personal data about for different purposes, then the legal basis we rely on in each case may not be the same.

5. Your rights over your information

The UK General Data Protection Regulation (UK GDPR) sets out a number of rights which individuals have over their personal data, allowing you to request copies of your personal data or, in certain circumstances, to have it deleted or modified. NLB will ensure that we uphold your rights to the extent that they apply to the way in which we process your personal data. Below we have explained those rights that are most likely to be relevant to the ways in which NLB, as a public authority, process personal data.

  • The right to be informed

You have the right to be informed about the collection and use of your personal data. We ensure we do this by providing you with this Privacy Notice. This Notice is regularly reviewed and updated to ensure it accurately reflects our data processing activities.

Please note, NLB does not undertake any Automated Decision Making (ADM) that requires disclosure in line with UK Algorithmic Transparency Recording Standard (ATRS) requirements as required by the UK Cabinet Office.

  • Right of access

You can request copies of the personal data that we hold about you in many circumstances, by making a written subject access request (SAR). Before we can act on your request, you may need to supply proof of your identity. Please be as specific as you can about the information you want and, if it isn’t obvious, explain why you expect us to hold your personal data.

If we agree that we are obliged to provide personal information to you (or someone else on your behalf), we will provide it to you or them free of charge and we will respond without delay and within one calendar month of receipt of your request; but may take up to 2 months in the case of complex and/or numerous requests. We will let you know when you can expect to receive a response, or if we will be unable to provide you with one. We will advise you of your right to complain to the Information Commission or to seek a judicial remedy.

We may ask for proof of identity and sufficient information about your interactions with us so that we can locate your personal information. Please note that the time limit for fulfilling your request does not start until we have been able to verify your identity.

If you would like to exercise this right, please email enquiries@nlb.org.uk

Staff or former staff should email HRConfidential@nlb.org.uk

  • Right to object

You have the right to object to us processing your personal information for particular purposes, to have your information deleted if we are keeping it too long, or have its processing restricted in certain circumstances.

If you would like to exercise this right, please contact us as set out below.

Your personal data will not be shared with organisations other than Police and /or Security Services where the information is required by law, and with National Records Scotland where much of our archive material is stored. In such circumstances, the appropriate lawful basis under Article 6 of the UK GDPR will be defined.

  • Other rights

Other rights you may have are a right to rectification if your personal data is inaccurate, a right to erasure, a right to restrict processing, a right to data portability, and rights in relation to automated decision making.

Whilst these rights are unlikely to apply to the kind of processing that NLB routinely carries out. Any request you make to us to exercise these rights will receive appropriate consideration, within the timescales required by data protection law.

The Information Commission (IC) regulates data protection and privacy matters in the UK. They make a lot of information accessible to consumers on their website, and they ensure that the registered details of all data controllers such as us are available publicly. You can access them here https://ico.org.uk/for-the-public.

6.  Children’s information

In the normal course of our work, we do not routinely process data in respect of children.  We don’t provide or plan to provide services directly to children, or to proactively collect their personal information.

Children may visit NLB premises under the control of parents, guardians or teachers for special events such as Open Doors, Carol Services and Christmas Parties, or for educational purposes through work experience programmes or our outreach Programme.  NLB staff may also visit schools under the outreach programme.  Photographs are often taken at these events and subsequently used on the lawful basis of legitimate interests.

For outreach events, a Privacy Statement will be provided to the school. As long as the school has agreed, and the children and/or their guardians are made aware by the schools that photographs of those attending the events may appear in one of our publications, this will not breach current UK legislation. Where a school raises any objections, photographs are not taken.

Where data is collected in relation to a schools competition, the Terms & Conditions will make clear that photos and videos may be taken of some or all of the children involved and explain the context in which the images will be used.  The schools involved are required to ensure that parents are also made aware.

Images recorded at special events may be used for journalistic purposes within NLB publications such as the Journal, on our website or our social media platforms fairly and lawfully without causing unwarranted harm or intrusion to the data subjects. When we publish images of children as part of an article, we won’t include personal details such as names unless explicit Consent has been given by a parent or a guardian. These images are processed under our legitimate interest of providing information and education on the role of the NLB.

Personal Data and Risk Assessment documentation in relation to work experience activities are stored within HR and governed by normal HR rules.  Privacy Statements are provided to the school or parent/guardian depending on the circumstances of set up of the work experience.

The policy is designed to ensure that the responsible adults are aware that photos and videos are being taken and the context in which the images may be used.

7.  Visitors

We only collect personal information that we know will genuinely use and in accordance with the Data Protection Legislation. The type of personal information that we will collect and process about you, may include the following:

  • names
  • contact details provided
  • host name
  • visitor’s organisation
  • visits (date & time)
  • static photographic images
  • moving imagery via CCTV or other video devices
  • vehicle details (if applicable

8. How do we use your data

We use personal information for a wide range of purposes, to enable us to carry out our functions as a government Arm’s Length Body (ALB) of a department. These include:

  • verifying your identity for security purposes
  • maintaining our accounts and records
  • selling of products to you through our website
  • consideration and investigation of complaints
  • answering queries, including Freedom of Information Act 2000 and Environmental Information Regulations 2004 requests
  • undertaking research
  • provision of education or training
  • provision of The Journal or on-line articles through social media
  • property management
  • corporate administration
  • support and management of our staff
  • licensing, enforcement and regulatory duties
  • crime prevention and prosecution of offenders

9. When we share information

We may share your personal data within our organisation or with other bodies where we are permitted to do so by law. There are some cases where we can pass on your data without telling you – for example, to prevent or detect crime, or in order to produce anonymised statistics. In all cases, whether data is shared internally or externally, we will be governed by data protection law.

We use data processors who are third parties to provide elements of services for us. We have Data Processing Agreements in place with our data processors. This means that they are only able to process your personal information under our strict instructions. They may only share your personal information with other organisations apart from us if we have provided them with prior written consent for this sharing. In addition, these other organisations must comply with our Data Processing Agreement. They will hold your personal data securely and retain it for the period we instruct.

A small proportion of our records are transferred to The National Records Scotland, in line with legal obligations for the collection, disposal and preservation of records in the public interest.

10. International Transfers

Most of our data is stored on servers within the UK. Where necessary, we will transfer personal information outside of the UK, either directly or through certain data processors. Every time we arrange for restricted (international) transfers of personal data outside of the UK we will ensure that appropriate safeguards are in place.

11. Distribution lists

NLB maintains a number of distribution lists to communicate with its stakeholders. In most cases this is to enable us to function efficiently as an ALB of a government department. In some cases, where the use of a distribution list does not relate to the performance of our tasks, we may use it as necessary for our legitimate interests. In such cases, we have had regard to the rights and freedoms of those whose names are included on the list. Each list will be used only for the purpose that the individuals on the list were informed about at the time their information was collected by us.

12.  CCTV

Closed-circuit television (CCTV) operates outside the building for security purposes of ensuring the integrity and safety of staff, visitors, and of buildings, contents and the facilities within them.

Please see our CCTV Policy 2026

13. Filming and Photography

Video and photographic records may be made, particularly at special events and used for journalistic purposes within NLB publications such as The Journal, and on our website fairly and lawfully without causing unwarranted harm or intrusion to the data subjects. These are processed under our legitimate interest of providing information and education on the role of the NLB.

NLB uses film and photographs to illustrate the work that we do, to support and promote policy in the public interest. We film individuals in non-intrusive ways where possible. If you have any concerns about appearing in any footage, please speak to a member of the film crew at the time or contact enquiries@nlb.org.uk.

We also take photographs to illustrate our work in our official publications and on our social media channels. We aim to avoid using images which could identify members of the public. If you are concerned about an image of you that we have used in one of our publications, contact us at enquiries@nlb.org.uk.

14. Privacy by design

Where we introduce new technologies, policies or processes, we will ensure that your privacy is considered from the outset, and where beneficial will carry out a Data Protection Impact Assessment (DPIA).

We will always carry out a DPIA where we use new technologies or consider there is a high risk to your rights and freedoms. Where an assessment identifies risks that cannot be satisfactorily reduced or avoided, our Data Protection Officer will seek advice from the Information Commissioner to help us find the best solution.

15. The steps we take to keep your data secure

We take information security seriously and will protect your personal data from unauthorised access, accidental loss, destruction and damage. We carry out regular reviews and audits to ensure that our methods of collecting, holding and processing personal data meet the government’s security standards and industry good practice. We will only transfer your personal data overseas where appropriate safeguards are in place to protect it. The cross-government security policy framework sets out the government’s approach to protective security.

16. The training and guidance we give to our staff

All of our staff are trained in the importance of protecting personal and other sensitive information. In line with government policy all those who routinely access personal data as part of their jobs are expected to undertake more in-depth training.

Managers who have formal responsibilities for large datasets, for example as information asset owners, will also receive additional training so that they have a clear understanding of what they need to do to keep the data under their control safe and secure.

17. Data breach notification

NLB does everything it can to keep your personal data secure. But if, despite this, a breach occurs which creates a risk to your rights and freedoms (for example, financial loss, breach of confidentiality, discrimination, reputational damage, or other significant social or economic damage), we will ensure that the Information Commission is informed without delay, and in any event within 72 hours after we have become aware of it.

Where we assess that there is a high risk to you, we will ensure that you are notified without undue delay.

18. How to make a complaint

If you are unhappy with the content of this notice, have any concerns about our use of your personal data, you can make a complaint to NLB using the contact details:

Director of Business Services
Northern Lighthouse Board
84 George Street
Edinburgh EH2 3DA

E: enquiries@nlb.org.uk

If your complaint means we need to contact another person, we may decide to give some of the information in your complaint to that other person. We do this as infrequently as possible, but it is ultimately our decision as to whether we give the information, and if we do, what that information is.

We aim to respond to complaints within NLB Corporate response times wherever possible, as listed in Complaints section of this website. If it is not possible to give you a full reply within this time (for example, if your complaint requires more detailed investigation), we will tell you what is being done and when you can expect a full response.

If following the complaint resolution by NLB you remain unhappy with how we have used your data after raising complaint with us, you can also complain to the IC.

The IC’s address:

Information Commission
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

19. How to contact us

If you would like to exercise any of your rights as set out above, or have a question or a complaint about this policy, the way your personal information is processed, please contact us by one of the following means:

Data Protection Officer
Northern Lighthouse Board
84 George Street,
Edinburgh EH2 3DA

Tel: +44(0) 131 473 3100
E: enquiries@nlb.org.uk

20. Changes to this privacy notice

We may change this Privacy Notice from time to time (for example if the law changes).

 

Our website is designed to be used for non-commercial purposes only. In particular, this limited licence does not permit you to incorporate any material from this web site in any other work, publications or web site either of your own or belonging to any third party without the prior consent of the Northern Lighthouse Board (NLB).

The site is intended to provide general information on a particular subject or subjects and is not an exhaustive treatment of such subject(s). Accordingly, the information in this Website is not intended to constitute any legal, consultative or other professional advice, service or contract in any way.

The website and the information contained herein is provided “as is”, and NLB makes no express or implied representations or warranties regarding this website or the information in it. Without limiting the foregoing, NLB does not warrant that the website or information in it will be error-free or will meet any particular criteria of performance or quality. NLB expressly disclaims all implied warranties, including, without limitation, warranties of merchantability, title, fitness for a particular purpose, non-infringement, compatibility, security and accuracy.

Your use of this website and information in it is at your own risk. You assume full responsibility and risk of loss resulting from the use of this website or information in it. None of NLB or its affiliates, or any partners, principals, stockholders or employees of any thereof will be liable for any special, indirect, incidental, consequential or punitive damages or any other damages whatsoever, whether in an action of contract, statute, tort (including, without limitation, negligence) or otherwise, relating to the use of this website or information contained in it.

We have used all reasonable endeavours to ensure that our Website complies with UK laws. However, we make no representations that the materials on our Website are appropriate or available for use in locations outside the UK. Those who visit our Website from other locations do so on their own initiative and are responsible for compliance with all applicable laws. If use of our Website and/or viewing of it, or use of any material or content on Our Website or services, or products offered through Our Website are contrary to or infringe any applicable law in your jurisdiction(s), you are not authorised to view or use Our Website and you must exit immediately.

If any of the foregoing is not fully enforceable for any reason, the remainder shall nonetheless continue to apply.

Workforce Management Information  – This link takes you to an external website.